@dxos/plugin-client 0.14.0 → 0.16.0-next-60712ab191a99ba90316cc4be753e9e11b17100a

package/dist/lib/Account.mjs

@@ -1,42 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-import { getEnvString } from "@dxos/config";
-import * as GraphPath from "@dxos/app-toolkit/GraphPath";
-//#region src/types/Account.ts
-var Account_exports = /* @__PURE__ */ __exportAll({
-	Account: () => Account,
-	Contacts: () => Contacts,
-	Devices: () => Devices,
-	Invitations: () => Invitations,
-	Profile: () => Profile,
-	Security: () => Security,
-	Usage: () => Usage,
-	getHubUrl: () => getHubUrl,
-	id: () => id,
-	isAuthEnabled: () => isAuthEnabled,
-	path: () => path,
-	workspacePath: () => workspacePath
-});
-/** Pinned (non-space) workspace ID anchoring the account's graph subtree, and its URL workspace token. */
-var id = "dxos:account";
-/** Panel ids, relative to the account workspace they hang off. Each is also its own singleton URL key. */
-var Profile = "profile";
-var Devices = "devices";
-var Contacts = "contacts";
-var Security = "security";
-var Account = "account";
-var Invitations = "invitations";
-var Usage = "usage";
-/** The account's own workspace path. */
-var workspacePath = GraphPath.getSpacePath(id);
-/** A panel's qualified path, which its surface matches on. */
-var path = (panel) => GraphPath.getSpacePath(id, panel);
-/**
-* The hub backing accounts, or `undefined` where none is configured.
-*/
-var getHubUrl = (config) => getEnvString(config, "DX_HUB_URL");
-/** Whether this profile has an account service to authenticate against. */
-var isAuthEnabled = (config) => !!getHubUrl(config);
-//#endregion
-export { Account, Contacts, Devices, Invitations, Profile, Security, Usage, getHubUrl, id, isAuthEnabled, path, Account_exports as t, workspacePath };
-
-//# sourceMappingURL=Account.mjs.map
+export { t as Account, r as Contacts, i as Devices, a as Invitations, o as Profile, s as Security, c as Usage, l as getHubUrl, u as id, d as isAuthEnabled, f as path, p as workspacePath } from "./chunk-Account.mjs";

package/dist/lib/AccountCache.mjs

@@ -1,30 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-import * as Schema from "effect/Schema";
-//#region src/types/AccountCache.ts
-var AccountCache_exports = /* @__PURE__ */ __exportAll({ AccountCache: () => AccountCache });
-var AccountCacheValue = Schema.Struct({
-	identityDid: Schema.String,
-	email: Schema.String,
-	emailVerified: Schema.Boolean,
-	/** ISO timestamp. */
-	createdAt: Schema.String,
-	invitationsRemaining: Schema.Number
-});
-var AccountCacheInvitation = Schema.Struct({
-	code: Schema.String,
-	/** ISO timestamp. */
-	createdAt: Schema.String,
-	redeemedByIdentityDid: Schema.optional(Schema.String),
-	/** ISO timestamp. */
-	redeemedAt: Schema.optional(Schema.String)
-});
-var AccountCache = Schema.Struct({
-	account: Schema.optional(AccountCacheValue),
-	invitations: Schema.optional(Schema.Array(AccountCacheInvitation)),
-	/** Epoch ms when the cache was last refreshed. */
-	fetchedAt: Schema.optional(Schema.Number)
-});
-//#endregion
-export { AccountCache, AccountCache_exports as t };
-
-//# sourceMappingURL=AccountCache.mjs.map
+export { t as AccountCache } from "./chunk-AccountCache.mjs";

package/dist/lib/CliLogin.mjs

@@ -1,78 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-//#region src/types/CliLogin.ts
-var CliLogin_exports = /* @__PURE__ */ __exportAll({
-	CALLBACK_PARAM: () => CALLBACK_PARAM,
-	CALLBACK_PATH: () => CALLBACK_PATH,
-	INVITATION_CODE_PARAM: () => INVITATION_CODE_PARAM,
-	RESPONSE_STATE_PARAM: () => RESPONSE_STATE_PARAM,
-	STATE_PARAM: () => STATE_PARAM,
-	createAuthorizeUrl: () => createAuthorizeUrl,
-	createCallbackUrl: () => createCallbackUrl,
-	createState: () => createState,
-	isValidState: () => isValidState,
-	parseCallback: () => parseCallback
-});
-/**
-* Contract between `dx account login --method composer` and the Composer page that approves it.
-*
-* The CLI opens `<composer>/?cliLogin=<callback>&cliLoginState=<state>`; once the user approves,
-* Composer creates a device invitation and hands its code to `<callback>?invitationCode=…&state=…`.
-* Both sides import this module so the parameter names cannot drift apart.
-*/
-/** Query param carrying the CLI's loopback callback URL. */
-var CALLBACK_PARAM = "cliLogin";
-/** Query param carrying the CLI's one-time state, shown on both sides so the user can match them. */
-var STATE_PARAM = "cliLoginState";
-/** Callback query params written by Composer. */
-var INVITATION_CODE_PARAM = "invitationCode";
-var RESPONSE_STATE_PARAM = "state";
-/** Path the CLI's loopback server answers on. */
-var CALLBACK_PATH = "/cli-login";
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]"
-]);
-/**
-* Parses a callback URL, accepting only plain-HTTP loopback targets.
-*
-* The invitation code is a bearer credential for the identity, so it may only ever be delivered to
-* this machine: a link crafted by someone else then admits nothing, because the victim's own
-* loopback port has nobody listening for it (the same rule the hub applies to passkey callbacks).
-*/
-var parseCallback = (value) => {
-	if (!value) return;
-	try {
-		const url = new URL(value);
-		return url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname) && url.pathname === "/cli-login" ? url : void 0;
-	} catch {
-		return;
-	}
-};
-/** The state is short and human-comparable, so it doubles as the code the user matches by eye. */
-var isValidState = (value) => !!value && /^[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(value);
-var STATE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-/** Generates a state token in the `XXXX-XXXX` form {@link isValidState} accepts. */
-var createState = () => {
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(8));
-	const chars = Array.from(bytes, (byte) => STATE_ALPHABET[byte % 32]);
-	return `${chars.slice(0, 4).join("")}-${chars.slice(4).join("")}`;
-};
-/** URL the CLI opens: Composer's origin with the callback and state attached. */
-var createAuthorizeUrl = (composerUrl, callback, state) => {
-	const url = new URL(composerUrl);
-	url.searchParams.set(CALLBACK_PARAM, callback);
-	url.searchParams.set(STATE_PARAM, state);
-	return url;
-};
-/** URL Composer calls back on, carrying the invitation code and echoing the state. */
-var createCallbackUrl = (callback, invitationCode, state) => {
-	const url = new URL(callback);
-	url.searchParams.set(INVITATION_CODE_PARAM, invitationCode);
-	url.searchParams.set(RESPONSE_STATE_PARAM, state);
-	return url;
-};
-//#endregion
-export { CALLBACK_PARAM, CALLBACK_PATH, INVITATION_CODE_PARAM, RESPONSE_STATE_PARAM, STATE_PARAM, createAuthorizeUrl, createCallbackUrl, createState, isValidState, parseCallback, CliLogin_exports as t };
-
-//# sourceMappingURL=CliLogin.mjs.map
+export { t as CALLBACK_PARAM, n as CALLBACK_PATH, i as INVITATION_CODE_PARAM, a as RESPONSE_STATE_PARAM, o as STATE_PARAM, s as createAuthorizeUrl, c as createCallbackUrl, l as createState, u as isValidState, d as parseCallback } from "./chunk-CliLogin.mjs";

package/dist/lib/ClientAction.mjs

@@ -1,75 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-import { meta } from "#meta";
-import * as Schema from "effect/Schema";
-import { IdentityDid, SpaceId } from "@dxos/keys";
-//#region src/types/ClientAction.ts
-var ClientAction_exports = /* @__PURE__ */ __exportAll({
-	CreateAgent: () => CreateAgent,
-	CreateIdentity: () => CreateIdentity,
-	CreatePasskey: () => CreatePasskey,
-	CreateRecoveryCode: () => CreateRecoveryCode,
-	JoinIdentity: () => JoinIdentity,
-	RecoverIdentity: () => RecoverIdentity,
-	RedeemPasskey: () => RedeemPasskey,
-	RedeemToken: () => RedeemToken,
-	ResetStorage: () => ResetStorage,
-	ShareIdentity: () => ShareIdentity
-});
-var IdentitySchema = Schema.Struct({
-	identityDid: IdentityDid,
-	spaceId: Schema.optional(SpaceId),
-	profile: Schema.optional(Schema.Struct({
-		displayName: Schema.optional(Schema.String),
-		avatarCid: Schema.optional(Schema.String),
-		data: Schema.optional(Schema.Record(Schema.String, Schema.Any))
-	}))
-});
-var ProfileSchema = Schema.Struct({
-	displayName: Schema.optional(Schema.String),
-	avatarCid: Schema.optional(Schema.String),
-	data: Schema.optional(Schema.Record(Schema.String, Schema.Any))
-});
-var CreateIdentity = class extends Schema.TaggedClass()(`${meta.profile.key}.action.create-identity`, {
-	input: ProfileSchema,
-	output: IdentitySchema
-}) {};
-var JoinIdentity = class extends Schema.TaggedClass()(`${meta.profile.key}.action.join-identity`, {
-	input: Schema.Struct({ invitationCode: Schema.optional(Schema.String) }),
-	output: Schema.Void
-}) {};
-var ShareIdentity = class extends Schema.TaggedClass()(`${meta.profile.key}.action.share-identity`, {
-	input: Schema.Void,
-	output: Schema.Void
-}) {};
-var RecoverIdentity = class extends Schema.TaggedClass()(`${meta.profile.key}.action.recover-identity`, {
-	input: Schema.Void,
-	output: Schema.Void
-}) {};
-var ResetStorage = class extends Schema.TaggedClass()(`${meta.profile.key}.action.reset-storage`, {
-	input: Schema.Struct({ mode: Schema.optional(Schema.String) }),
-	output: Schema.Void
-}) {};
-var CreateAgent = class extends Schema.TaggedClass()(`${meta.profile.key}.action.create-agent`, {
-	input: Schema.Void,
-	output: Schema.Void
-}) {};
-var CreateRecoveryCode = class extends Schema.TaggedClass()(`${meta.profile.key}.action.create-recovery-code`, {
-	input: Schema.Void,
-	output: Schema.Void
-}) {};
-var CreatePasskey = class extends Schema.TaggedClass()(`${meta.profile.key}.action.create-passkey`, {
-	input: Schema.Void,
-	output: Schema.Void
-}) {};
-var RedeemPasskey = class extends Schema.TaggedClass()(`${meta.profile.key}.action.redeem-passkey`, {
-	input: Schema.Void,
-	output: Schema.Void
-}) {};
-var RedeemToken = class extends Schema.TaggedClass()(`${meta.profile.key}.action.redeem-token`, {
-	input: Schema.Struct({ token: Schema.String }),
-	output: Schema.Void
-}) {};
-//#endregion
-export { CreateAgent, CreateIdentity, CreatePasskey, CreateRecoveryCode, JoinIdentity, RecoverIdentity, RedeemPasskey, RedeemToken, ResetStorage, ShareIdentity, ClientAction_exports as t };
-
-//# sourceMappingURL=ClientAction.mjs.map
+export { n as CreateAgent, r as CreateIdentity, i as CreatePasskey, a as CreateRecoveryCode, o as JoinIdentity, s as RecoverIdentity, c as RedeemPasskey, l as RedeemToken, u as ResetStorage, d as ShareIdentity } from "./chunk-ClientAction.mjs";

package/dist/lib/ClientCapabilities.mjs

@@ -1,60 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-import * as Capability from "@dxos/app-framework/Capability";
-import { meta } from "#meta";
-//#region src/types/ClientCapabilities.ts
-var ClientCapabilities_exports = /* @__PURE__ */ __exportAll({
-	AccountCache: () => AccountCache,
-	Client: () => Client,
-	Config: () => Config,
-	EdgeHttpClient: () => EdgeHttpClient,
-	HubHttpClient: () => HubHttpClient,
-	Hypergraph: () => Hypergraph,
-	IdentityService: () => IdentityService,
-	InitializeTimeout: () => InitializeTimeout,
-	Migration: () => Migration,
-	OnIdentityDeleted: () => OnIdentityDeleted,
-	Schema: () => Schema,
-	SchemaRegistered: () => SchemaRegistered,
-	SpaceService: () => SpaceService
-});
-var Client = Capability.makeSingleton()(`${meta.profile.key}.capability.client`);
-var Schema = Capability.make()(`${meta.profile.key}.capability.schema`);
-/**
-* The effective `initializeTimeout` the client capability resolved. Consumers that wait on
-* `client.waitUntilInitialized()` bound themselves by this rather than the default, so a host that
-* widens the client's initialization budget does not have its layers time out underneath it.
-*/
-var InitializeTimeout = Capability.makeSingleton()(`${meta.profile.key}.capability.initializeTimeout`);
-/**
-* Ordering marker for modules that create typed objects: requiring `Schema` only orders after the
-* schema PROVIDERS, which says nothing about `SchemaDefs`, the fellow consumer that registers them.
-* `true` rather than `void` — the loader reads an `undefined` implementation as not contributed.
-*/
-var SchemaRegistered = Capability.makeSingleton()(`${meta.profile.key}.capability.schemaRegistered`);
-var Migration = Capability.make()(`${meta.profile.key}.capability.migration`);
-var AccountCache = Capability.makeSingleton()(`${meta.profile.key}.capability.accountCache`);
-var OnIdentityDeleted = Capability.make()(`${meta.profile.key}.capability.onIdentityDeleted`);
-var HubHttpClient = Capability.makeSingleton()(`${meta.profile.key}.capability.hubHttpClient`);
-/**
-* The client's runtime configuration, for consumers that need a config value (e.g. the EDGE URL)
-* without depending on `@dxos/client`. Contributed once the client has initialized.
-*/
-var Config = Capability.makeSingleton()(`${meta.profile.key}.capability.config`);
-/**
-* The EDGE HTTP client, for consumers that call EDGE endpoints without depending on `@dxos/client`.
-* Absent when the config names no EDGE URL.
-*/
-var EdgeHttpClient = Capability.makeSingleton()(`${meta.profile.key}.capability.edgeHttpClient`);
-/** The cross-space ECHO graph, for imperative consumers that must find a space's database by id. */
-var Hypergraph = Capability.makeSingleton()(`${meta.profile.key}.capability.hypergraph`);
-/**
-* The HALO Identity service instance, for imperative (non-React, non-Effect-layer) consumers
-* that need identity access without depending on `@dxos/client`.
-*/
-var IdentityService = Capability.makeSingleton()(`${meta.profile.key}.capability.identityService`);
-/** The HALO Space service instance, for imperative consumers. */
-var SpaceService = Capability.makeSingleton()(`${meta.profile.key}.capability.spaceService`);
-//#endregion
-export { AccountCache, Client, Config, EdgeHttpClient, HubHttpClient, Hypergraph, IdentityService, InitializeTimeout, Migration, OnIdentityDeleted, Schema, SchemaRegistered, SpaceService, ClientCapabilities_exports as t };
-
-//# sourceMappingURL=ClientCapabilities.mjs.map
+export { t as AccountCache, n as Client, i as Config, a as EdgeHttpClient, o as HubHttpClient, s as Hypergraph, c as IdentityService, l as InitializeTimeout, u as Migration, d as OnIdentityDeleted, f as Schema, p as SchemaRegistered, m as SpaceService } from "./chunk-ClientCapabilities.mjs";

package/dist/lib/ClientEvents.mjs

@@ -1,25 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-import { meta } from "#meta";
-import * as ActivationEvent from "@dxos/app-framework/ActivationEvent";
-//#region src/types/ClientEvents.ts
-var ClientEvents_exports = /* @__PURE__ */ __exportAll({
-	IdentityCreated: () => IdentityCreated,
-	Initialized: () => Initialized,
-	SpacesAvailable: () => SpacesAvailable
-});
-/**
-* Runtime event: `client.initialize()` (forked off the startup pass) has completed. Modules
-* whose activation bodies need an initialized client (sync `halo`/`spaces` reads) ride this
-* instead of the startup dependency pass, which no longer implies initialization.
-*/
-var Initialized = ActivationEvent.make(`${meta.profile.key}.event.initialized`);
-var IdentityCreated = ActivationEvent.make(`${meta.profile.key}.event.identityCreated`);
-/**
-* Runtime event: the space list is observable. The spaces themselves may still be opening, so a
-* module that reads a space's properties waits for that space rather than for this.
-*/
-var SpacesAvailable = ActivationEvent.make(`${meta.profile.key}.event.spacesAvailable`);
-//#endregion
-export { IdentityCreated, Initialized, SpacesAvailable, ClientEvents_exports as t };
-
-//# sourceMappingURL=ClientEvents.mjs.map
+export { n as IdentityCreated, r as Initialized, i as SpacesAvailable } from "./chunk-ClientEvents.mjs";

package/dist/lib/ClientOperation.mjs

@@ -1,196 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-import * as Capability from "@dxos/app-framework/Capability";
-import { Identity } from "@dxos/halo";
-import * as Schema from "effect/Schema";
-import * as Operation from "@dxos/compute/Operation";
-import { DXN, IdentityDid, SpaceId } from "@dxos/keys";
-//#region src/types/ClientOperation.ts
-var ClientOperation_exports = /* @__PURE__ */ __exportAll({
-	CreateAgent: () => CreateAgent,
-	CreateIdentity: () => CreateIdentity,
-	CreatePasskey: () => CreatePasskey,
-	CreateRecoveryCode: () => CreateRecoveryCode,
-	GrantServiceAccess: () => GrantServiceAccess,
-	JoinIdentity: () => JoinIdentity,
-	OpenUsage: () => OpenUsage,
-	RecoverIdentity: () => RecoverIdentity,
-	RedeemPasskey: () => RedeemPasskey,
-	RedeemToken: () => RedeemToken,
-	ResetStorage: () => ResetStorage,
-	RevokeRecoveryCredential: () => RevokeRecoveryCredential,
-	ShareIdentity: () => ShareIdentity,
-	UpdateProfile: () => UpdateProfile
-});
-var IdentitySchema = Schema.Struct({
-	identityDid: IdentityDid,
-	spaceId: Schema.optional(SpaceId),
-	profile: Schema.optional(Schema.Struct({
-		displayName: Schema.optional(Schema.String),
-		avatarCid: Schema.optional(Schema.String),
-		data: Schema.optional(Schema.Record(Schema.String, Schema.Any))
-	}))
-});
-var ProfileSchema = Schema.Struct({
-	displayName: Schema.optional(Schema.String),
-	avatarCid: Schema.optional(Schema.String),
-	data: Schema.optional(Schema.Record(Schema.String, Schema.Any))
-});
-var CreateIdentity = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.createIdentity"),
-		name: "Create Identity",
-		icon: "ph--user--regular"
-	},
-	services: [Capability.Service, Identity.Service],
-	input: ProfileSchema,
-	output: IdentitySchema
-});
-var UpdateProfile = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.updateProfile"),
-		name: "Update Profile",
-		icon: "ph--user--regular"
-	},
-	services: [Identity.Service],
-	input: ProfileSchema,
-	output: Schema.Void
-});
-var JoinIdentity = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.joinIdentity"),
-		name: "Join Identity",
-		icon: "ph--sign-in--regular"
-	},
-	services: [Capability.Service],
-	input: Schema.Struct({ invitationCode: Schema.optional(Schema.String) }),
-	output: Schema.Void
-});
-var ShareIdentity = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.shareIdentity"),
-		name: "Share Identity",
-		icon: "ph--share-network--regular"
-	},
-	services: [Capability.Service],
-	input: Schema.Void,
-	output: Schema.Void
-});
-var OpenUsage = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.openUsage"),
-		name: "Open Usage",
-		icon: "ph--chart-bar--regular"
-	},
-	services: [Capability.Service],
-	input: Schema.Void,
-	output: Schema.Void
-});
-var RecoverIdentity = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.recoverIdentity"),
-		name: "Recover Identity",
-		icon: "ph--key--regular"
-	},
-	services: [Capability.Service],
-	input: Schema.Void,
-	output: Schema.Void
-});
-var ResetStorage = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.resetStorage"),
-		name: "Reset Storage",
-		icon: "ph--warning--regular"
-	},
-	services: [Capability.Service],
-	input: Schema.Struct({
-		mode: Schema.optional(Schema.String),
-		/** Device invitation to accept once the identity is deleted (`join-new-identity` only). */
-		invitationCode: Schema.optional(Schema.String)
-	}),
-	output: Schema.Void
-});
-var CreateAgent = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.createAgent"),
-		name: "Create Agent",
-		icon: "ph--brain--regular"
-	},
-	services: [Capability.Service],
-	input: Schema.Void,
-	output: Schema.Void
-});
-var GrantServiceAccess = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.grantServiceAccess"),
-		name: "Grant Service Access",
-		icon: "ph--key--regular"
-	},
-	services: [Identity.Service],
-	input: Schema.Struct({
-		/** Target server name (e.g. `hub.dxos.network`). */
-		serverName: Schema.String,
-		/** Capabilities to grant (e.g. `['composer:beta']`). */
-		capabilities: Schema.Array(Schema.String)
-	}),
-	output: Schema.Void
-});
-var CreateRecoveryCode = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.createRecoveryCode"),
-		name: "Create Recovery Code",
-		icon: "ph--key--regular"
-	},
-	services: [Capability.Service, Identity.Service],
-	input: Schema.Void,
-	output: Schema.Void
-});
-var CreatePasskey = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.createPasskey"),
-		name: "Create Passkey",
-		icon: "ph--key--regular"
-	},
-	services: [Capability.Service, Identity.Service],
-	input: Schema.Void,
-	output: Schema.Void
-});
-var RevokeRecoveryCredential = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.revokeRecoveryCredential"),
-		name: "Revoke Recovery Credential",
-		icon: "ph--key--regular"
-	},
-	services: [Capability.Service, Identity.Service],
-	input: Schema.Struct({ 
-	/**
-	* Lookup key of the credential to revoke, as hex. Constrained to a full key because
-	* `PublicKey.from` silently drops non-hex characters rather than rejecting them, so an
-	* unvalidated string would decode to some other key instead of failing.
-	*/
-lookupKey: Schema.String.check(Schema.isPattern(/^[0-9a-fA-F]{64}$/u)) }),
-	output: Schema.Void
-});
-var RedeemPasskey = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.redeemPasskey"),
-		name: "Redeem Passkey",
-		icon: "ph--key--regular"
-	},
-	services: [Capability.Service, Identity.Service],
-	input: Schema.Void,
-	output: Schema.Void
-});
-var RedeemToken = Operation.make({
-	meta: {
-		key: DXN.make("org.dxos.operation.client.redeemToken"),
-		name: "Redeem Token",
-		icon: "ph--lock--regular"
-	},
-	services: [Capability.Service, Identity.Service],
-	input: Schema.Struct({ token: Schema.String }),
-	output: Schema.Void
-});
-//#endregion
-export { CreateAgent, CreateIdentity, CreatePasskey, CreateRecoveryCode, GrantServiceAccess, JoinIdentity, OpenUsage, RecoverIdentity, RedeemPasskey, RedeemToken, ResetStorage, RevokeRecoveryCredential, ShareIdentity, UpdateProfile, ClientOperation_exports as t };
-
-//# sourceMappingURL=ClientOperation.mjs.map
+export { n as CreateAgent, r as CreateIdentity, i as CreatePasskey, a as CreateRecoveryCode, o as GrantServiceAccess, s as JoinIdentity, c as OpenUsage, l as RecoverIdentity, u as RedeemPasskey, d as RedeemToken, f as ResetStorage, p as RevokeRecoveryCredential, m as ShareIdentity, h as UpdateProfile } from "./chunk-ClientOperation.mjs";

package/dist/lib/ClientOptions.mjs

@@ -1,7 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-//#region src/types/ClientOptions.ts
-var ClientOptions_exports = /* @__PURE__ */ __exportAll({});
-//#endregion
-export { ClientOptions_exports as t };
-
-//# sourceMappingURL=ClientOptions.mjs.map
+import "./chunk-ClientOptions.mjs";

package/dist/lib/ClientPlugin.mjs

@@ -1,16 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-import * as Plugin from "@dxos/app-framework/Plugin";
-import { meta as meta$1 } from "#meta";
-//#region src/ClientPlugin.ts
-var ClientPlugin_exports = /* @__PURE__ */ __exportAll({
-	make: () => make,
-	meta: () => meta
-});
-/** Plugin metadata, available without loading the plugin body. */
-var meta = meta$1;
-/** Constructs the plugin; the body loads on first enable. */
-var make = Plugin.lazy(meta, () => import("#plugin"));
-//#endregion
-export { make, meta, ClientPlugin_exports as t };
-
-//# sourceMappingURL=ClientPlugin.mjs.map
+export { n as make, r as meta } from "./chunk-ClientPlugin.mjs";

package/dist/lib/PasskeyError.mjs

@@ -1,99 +1 @@
-import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-import * as Effect from "effect/Effect";
-import { BaseError, isCancellation } from "@dxos/errors";
-import * as Duration from "effect/Duration";
-import { log } from "@dxos/log";
-import * as NativePasskey from "@dxos/app-toolkit/NativePasskey";
-//#region src/types/PasskeyError.ts
-var PasskeyError_exports = /* @__PURE__ */ __exportAll({
-	Dismissed: () => Dismissed,
-	LoginFailed: () => LoginFailed,
-	NATIVE_PROMPT_TIMEOUT: () => NATIVE_PROMPT_TIMEOUT,
-	RegistrationFailed: () => RegistrationFailed,
-	Rejected: () => Rejected,
-	TimedOut: () => TimedOut,
-	Unavailable: () => Unavailable,
-	classify: () => classify,
-	fromAssertion: () => fromAssertion,
-	fromRegistration: () => fromRegistration,
-	report: () => report,
-	timeoutNativePrompt: () => timeoutNativePrompt
-});
-var __dxlog_file = "/__w/dxos/dxos/packages/plugins/plugin-client/src/types/PasskeyError.ts";
-/**
-* The platform prompt produced no assertion. WebAuthn reports a dismissed prompt and
-* "this device has no passkey for this site" identically, so the two cannot be told apart.
-*/
-var Dismissed = class extends BaseError.extend("PasskeyDismissedError", "No passkey was presented") {
-	/** Marks a dismissal as a cancellation so a generic reporter (the process runtime) can see it too. */
-	cancellation = true;
-};
-/** The assertion was refused: the passkey is not registered as a recovery credential for any identity. */
-var Rejected = class extends BaseError.extend("PasskeyRejectedError", "Passkey was not accepted") {};
-/** Passkey login failed before an assertion could be checked (service unreachable, unusable authenticator response). */
-var LoginFailed = class extends BaseError.extend("PasskeyLoginError", "Passkey login failed") {};
-/** Creating a passkey failed for a reason other than the user dismissing the prompt. */
-var RegistrationFailed = class extends BaseError.extend("PasskeyRegistrationError", "Passkey could not be created") {};
-/** The native prompt never answered. The bridge cannot cancel it, so its sheet may still be on screen. */
-var TimedOut = class extends BaseError.extend("PasskeyTimedOutError", "The passkey prompt did not respond") {};
-/** This host cannot complete a passkey request, so none was started. */
-var Unavailable = class extends BaseError.extend("PasskeyUnavailableError", "Passkeys are not available in this build") {};
-/** Longest a native prompt may stay unanswered; the WebAuthn ceremony ceiling. */
-var NATIVE_PROMPT_TIMEOUT = Duration.minutes(5);
-/** Abandon a native passkey call that never answers. */
-var timeoutNativePrompt = (effect, duration = NATIVE_PROMPT_TIMEOUT) => Effect.timeoutOrElse(effect, {
-	duration,
-	orElse: () => Effect.fail(new TimedOut())
-});
-/**
-* What the macOS bridge rejects with for every `ASAuthorizationError`, a cancel included: it collapses
-* each into one plain string per ceremony, so a cancel cannot be told apart from a failure.
-*/
-var NATIVE_BRIDGE_REJECTIONS = ["Registration failed", "Login failed"];
-/**
-* Whether the authenticator rejected because the prompt was dismissed. WebAuthn reports a dismissed
-* prompt and "no credential for this site" as the same `NotAllowedError`; the macOS bridge's generic
-* rejections are just as ambiguous, so both read as dismissals.
-*/
-var isDismissal = (error) => {
-	if (NativePasskey.isNativePasskeyError(error)) return error.cancelled;
-	const name = error instanceof DOMException ? error.name : void 0;
-	return name === "NotAllowedError" || name === "AbortError" || NATIVE_BRIDGE_REJECTIONS.includes(String(error)) || /cancell?ed/i.test(String(error));
-};
-/** Classify a rejection from the authenticator while logging in. */
-var fromAssertion = (error) => isDismissal(error) ? new Dismissed({ cause: error }) : new LoginFailed({ cause: error });
-/** Classify a rejection from the authenticator while creating a passkey. */
-var fromRegistration = (error) => isDismissal(error) ? new Dismissed({ cause: error }) : new RegistrationFailed({ cause: error });
-/**
-* Classify an error returned by the `RedeemPasskey` or `CreatePasskey` operation.
-* Anything unrecognized is reported as a generic failure rather than swallowed.
-*/
-var classify = (error) => {
-	if (Dismissed.is(error) || isCancellation(error)) return "dismissed";
-	if (Rejected.is(error)) return "rejected";
-	return "failed";
-};
-/**
-* Report a failed redemption and classify it for the UI. A dismissed prompt is the user closing a
-* dialog, so it reports at `info` — at `error` it swamps the production error stream (DX-1281).
-*/
-var report = (error) => {
-	const failure = classify(error);
-	if (failure === "dismissed") log.info("passkey prompt dismissed", { error }, {
-		"~LogMeta": "~LogMeta",
-		F: __dxlog_file,
-		L: 116,
-		S: void 0
-	});
-	else log.catch(error, void 0, {
-		"~LogMeta": "~LogMeta",
-		F: __dxlog_file,
-		L: 118,
-		S: void 0
-	});
-	return failure;
-};
-//#endregion
-export { Dismissed, LoginFailed, NATIVE_PROMPT_TIMEOUT, RegistrationFailed, Rejected, TimedOut, Unavailable, classify, fromAssertion, fromRegistration, report, PasskeyError_exports as t, timeoutNativePrompt };
-
-//# sourceMappingURL=PasskeyError.mjs.map
+export { t as Dismissed, n as LoginFailed, r as NATIVE_PROMPT_TIMEOUT, a as RegistrationFailed, o as Rejected, s as TimedOut, c as Unavailable, l as classify, u as fromAssertion, d as fromRegistration, f as report, p as timeoutNativePrompt } from "./chunk-PasskeyError.mjs";

package/dist/lib/capabilities.browser.mjs

@@ -30,7 +30,8 @@ var Client = Capability.lazyModule("Client", {
 		ClientCapabilities.InitializeTimeout,
 		Capabilities.Layer,
 		ClientCapabilities.IdentityService,
-		ClientCapabilities.SpaceService
+		ClientCapabilities.SpaceService,
+		AppCapabilities.UnsavedChanges
 	],
 	environments: [
 		"browser",