@dxos/plugin-client 0.12.0-next-73daef452f1464b62efdbca75fb0067c1066f264 → 0.13.0

package/src/operations/reset-storage.ts

@@ -7,10 +7,10 @@ import * as Effect from 'effect/Effect';
 import * as LayoutOperation from '@dxos/app-toolkit/LayoutOperation';
 import * as Operation from '@dxos/compute/Operation';
 
-import { RESET_DIALOG } from '../constants';
-import { ResetStorage } from './definitions';
+import { RESET_DIALOG } from '../constants.ts';
+import * as ClientOperation from '../types/ClientOperation.ts';
 
-const handler: Operation.WithHandler<typeof ResetStorage> = ResetStorage.pipe(
+const handler: Operation.WithHandler<typeof ClientOperation.ResetStorage> = ClientOperation.ResetStorage.pipe(
   Operation.withHandler(
     Effect.fnUntraced(function* (data) {
       yield* Operation.invoke(LayoutOperation.UpdateDialog, {
@@ -18,6 +18,7 @@ const handler: Operation.WithHandler<typeof ResetStorage> = ResetStorage.pipe(
         blockAlign: 'start',
         props: {
           mode: data.mode ?? 'reset-storage',
+          invitationCode: data.invitationCode,
         },
       });
     }),

package/src/operations/resolve-navigation-targets.ts

@@ -10,7 +10,7 @@ import * as AppSpace from '@dxos/app-toolkit/AppSpace';
 import * as NavigationOperation from '@dxos/app-toolkit/NavigationOperation';
 import * as Operation from '@dxos/compute/Operation';
 import { Database, EID } from '@dxos/echo';
-import { Position } from '@dxos/util';
+import * as Position from '@dxos/util/Position';
 
 import { ClientCapabilities } from '#types';
 

package/src/operations/revoke-recovery-credential.ts

@@ -7,7 +7,7 @@ import * as Effect from 'effect/Effect';
 import * as Operation from '@dxos/compute/Operation';
 import { Identity } from '@dxos/halo';
 
-import { RevokeRecoveryCredential } from './definitions';
+import * as ClientOperation from '../types/ClientOperation.ts';
 
 /**
  * Revoke one recovery credential.
@@ -16,12 +16,13 @@ import { RevokeRecoveryCredential } from './definitions';
  * identity key is the authorization and no identity can be passed in from the UI. Client services
  * refuse the last un-revoked credential.
  */
-const handler: Operation.WithHandler<typeof RevokeRecoveryCredential> = RevokeRecoveryCredential.pipe(
-  Operation.withHandler(
-    Effect.fnUntraced(function* ({ lookupKey }) {
-      yield* Identity.revokeRecoveryCredential(lookupKey);
-    }),
-  ),
-);
+const handler: Operation.WithHandler<typeof ClientOperation.RevokeRecoveryCredential> =
+  ClientOperation.RevokeRecoveryCredential.pipe(
+    Operation.withHandler(
+      Effect.fnUntraced(function* ({ lookupKey }) {
+        yield* Identity.revokeRecoveryCredential(lookupKey);
+      }),
+    ),
+  );
 
 export default handler;

package/src/operations/share-identity.ts

@@ -11,9 +11,9 @@ import * as ObservabilityOperation from '@dxos/plugin-observability/Observabilit
 
 import { Account } from '#types';
 
-import { ShareIdentity } from './definitions';
+import * as ClientOperation from '../types/ClientOperation.ts';
 
-const handler: Operation.WithHandler<typeof ShareIdentity> = ShareIdentity.pipe(
+const handler: Operation.WithHandler<typeof ClientOperation.ShareIdentity> = ClientOperation.ShareIdentity.pipe(
   Operation.withHandler(
     Effect.fnUntraced(function* () {
       yield* Operation.invoke(LayoutOperation.SwitchWorkspace, { subject: GraphPath.getSpacePath(Account.id) });

package/src/operations/update-profile.ts

@@ -7,9 +7,9 @@ import * as Effect from 'effect/Effect';
 import * as Operation from '@dxos/compute/Operation';
 import { Identity } from '@dxos/halo';
 
-import { UpdateProfile } from './definitions';
+import * as ClientOperation from '../types/ClientOperation.ts';
 
-const handler: Operation.WithHandler<typeof UpdateProfile> = UpdateProfile.pipe(
+const handler: Operation.WithHandler<typeof ClientOperation.UpdateProfile> = ClientOperation.UpdateProfile.pipe(
   Operation.withHandler(
     Effect.fnUntraced(function* (profile) {
       yield* Identity.updateProfile({ displayName: profile.displayName, data: profile.data });

package/src/plugin.test.ts

@@ -6,7 +6,7 @@ import { describe, test } from 'vitest';
 
 // #plugin resolves to ClientPlugin.node.ts under the source condition used by vitest.
 import * as ClientPlugin from '@dxos/plugin-client/ClientPlugin';
-import { createComposerTestApp } from '@dxos/plugin-testing/harness';
+import * as Harness from '@dxos/plugin-testing/Harness';
 
 import { meta } from '#meta';
 
@@ -14,7 +14,7 @@ const moduleId = (name: string) => `${meta.profile.key}.module.${name}`;
 
 describe('ClientPlugin', () => {
   test('modules activate on the expected events', async ({ expect }) => {
-    await using harness = await createComposerTestApp({
+    await using harness = await Harness.createComposerTestApp({
       plugins: [ClientPlugin.make({})],
     });
 

package/src/plugin.ts

@@ -8,8 +8,10 @@ import {
   AccountCache,
   AppGraphBuilder,
   Client,
+  ClientServices,
   Commands,
   HubHttpClient,
+  IdentityLifecycle,
   LayerSpecs,
   Migrations,
   NavigationHandler,
@@ -26,30 +28,33 @@ import {
 import { meta } from '#meta';
 import { ClientOptions } from '#types';
 
-export const ClientPlugin = Plugin.define<ClientOptions.ClientPluginOptions>(meta).pipe(
-  Plugin.addModule(AccountCache),
-  Plugin.addModule(AppGraphBuilder),
-  Plugin.addModule(Client),
-  Plugin.addModule(Commands),
-  Plugin.addModule(HubHttpClient),
-  Plugin.addModule(LayerSpecs),
-  Plugin.addModule(Migrations),
-  Plugin.addModule(NavigationHandler),
-  Plugin.addModule(NavigationTargetLoader),
-  Plugin.addModule(OperationHandler),
-  Plugin.addModule(ReactContext),
-  Plugin.addModule(ReactSurface),
-  // Swarm-backed remote trace source (DX-1125). Collected when the process-manager runtime is built.
-  Plugin.addModule(RemoteTraceMonitor),
-  Plugin.addModule(SchemaDefs),
-  // Runtime event: spaces become ready when the client observes them, not at startup — see the
-  // SpaceReplicationProgress module definition.
-  Plugin.addModule(SpaceReplicationProgress),
-  // Project remote (edge) trace progress into the registry (DX-1125) — see the TraceProgress
-  // module definition for its activation gating.
-  Plugin.addModule(TraceProgress),
-  Plugin.addModule(Translations),
-  Plugin.make,
-);
+export const ClientPlugin = Plugin.define<ClientOptions.ClientPluginOptions>(meta)
+  .pipe(
+    Plugin.addModule(AccountCache),
+    Plugin.addModule(AppGraphBuilder),
+    Plugin.addModule(Client),
+    Plugin.addModule(ClientServices),
+    Plugin.addModule(Commands),
+    Plugin.addModule(HubHttpClient),
+    Plugin.addModule(IdentityLifecycle),
+    Plugin.addModule(LayerSpecs),
+    Plugin.addModule(Migrations),
+    Plugin.addModule(NavigationHandler),
+    Plugin.addModule(NavigationTargetLoader),
+    Plugin.addModule(OperationHandler),
+    Plugin.addModule(ReactContext),
+    Plugin.addModule(ReactSurface),
+    // Swarm-backed remote trace source (DX-1125). Collected when the process-manager runtime is built.
+    Plugin.addModule(RemoteTraceMonitor),
+    Plugin.addModule(SchemaDefs),
+    // Runtime event: spaces become ready when the client observes them, not at startup — see the
+    // SpaceReplicationProgress module definition.
+    Plugin.addModule(SpaceReplicationProgress),
+    // Project remote (EDGE) trace progress into the registry (DX-1125) — see the TraceProgress
+    // module definition for its activation gating.
+    Plugin.addModule(TraceProgress),
+  )
+  // `pipe` has overloads only up to 20 arguments, and this plugin has more modules than that.
+  .pipe(Plugin.addModule(Translations), Plugin.make);
 
 export default ClientPlugin;

package/src/progress/index.ts

@@ -2,5 +2,5 @@
 // Copyright 2026 DXOS.org
 //
 
-export * from './progress-keys';
-export * from './space-sync-progress';
+export * from './progress-keys.ts';
+export * from './space-sync-progress.ts';

package/src/progress/space-sync-progress.test.ts

@@ -2,18 +2,18 @@
 // Copyright 2026 DXOS.org
 //
 
-import { describe, expect, test } from 'vitest';
+import { describe, test } from 'vitest';
 
 import { type Database } from '@dxos/echo';
 
-import { toSpaceUpdate } from './space-sync-progress';
+import { toSpaceUpdate } from './space-sync-progress.ts';
 
 describe('toSpaceUpdate', () => {
-  test('caught up on both backlogs yields no monitor', () => {
+  test('caught up on both backlogs yields no monitor', ({ expect }) => {
     expect(toSpaceUpdate('Space', makeState({ totalDocumentCount: 10, totalBlocks: '100' }))).toBeUndefined();
   });
 
-  test('combines documents and feed blocks into one meter', () => {
+  test('a monitor opens at the start of its run, with the backlog as its total', ({ expect }) => {
     const update = toSpaceUpdate(
       'Notes',
       makeState({
@@ -26,26 +26,49 @@ describe('toSpaceUpdate', () => {
     );
     expect(update).toEqual({
       label: 'Syncing Notes',
-      current: 98,
-      total: 110,
-      note: '4 CRDTs · ↓6 ↑2',
+      current: 0,
+      total: 12,
+      synced: 98,
+      note: '4 objects · ↓6 ↑2',
+    });
+  });
+
+  test('against its baseline, a monitor counts what the run has synced', ({ expect }) => {
+    const update = toSpaceUpdate(
+      'Notes',
+      makeState({ totalDocumentCount: 10, unsyncedDocumentCount: 1, totalBlocks: '100', blocksToPull: '3' }),
+      98,
+    );
+    expect(update).toEqual({
+      label: 'Syncing Notes',
+      current: 8,
+      total: 12,
+      synced: 106,
+      note: '1 objects · ↓3 ↑0',
     });
   });
 
-  test('unsynced documents alone keep the meter up', () => {
+  test('a backlog that grows extends the total without moving the count backwards', ({ expect }) => {
+    const update = toSpaceUpdate('Notes', makeState({ totalDocumentCount: 20, unsyncedDocumentCount: 8 }), 10);
+    expect(update).toMatchObject({ current: 2, total: 10, synced: 12 });
+  });
+
+  test('unsynced documents alone keep the meter up', ({ expect }) => {
     expect(toSpaceUpdate(undefined, makeState({ unsyncedDocumentCount: 3 }))).toEqual({
-      label: 'Syncing space',
+      label: 'Syncing Space',
       current: 0,
       total: 3,
-      note: '3 CRDTs',
+      synced: 0,
+      note: '3 objects',
     });
   });
 
-  test('feed blocks alone keep the meter up', () => {
+  test('feed blocks alone keep the meter up', ({ expect }) => {
     expect(toSpaceUpdate('Notes', makeState({ totalBlocks: '10', blocksToPush: '2' }))).toEqual({
       label: 'Syncing Notes',
-      current: 8,
-      total: 10,
+      current: 0,
+      total: 2,
+      synced: 8,
       note: '↓0 ↑2',
     });
   });

package/src/progress/space-sync-progress.ts

@@ -7,8 +7,12 @@ import { type Database } from '@dxos/echo';
 /** Registry update for a space's replication monitor. */
 export type MonitorUpdate = {
   readonly label: string;
+  /** Items synced since the run's baseline. */
   readonly current: number;
+  /** Items synced since the baseline plus the backlog still pending. */
   readonly total: number;
+  /** Items synced in absolute terms, which the caller keeps as the baseline of the run it opens. */
+  readonly synced: number;
   readonly note?: string;
 };
 
@@ -16,10 +20,19 @@ export type MonitorUpdate = {
  * Derives the combined (documents + feed blocks) monitor state for a space, or `undefined` when it
  * is fully caught up. Both backlogs share one meter so the UI shows one row per space.
  *
+ * The meter counts the run, not the space: `current` is what has synced since `baseline` (the
+ * absolute synced count when the monitor opened) and `total` adds the backlog still pending. Counting
+ * the whole space instead put a monitor that opened at 5,020 of 5,021 at the end of its bar with an
+ * ETA of zero, since the ETA divides the run's elapsed time by everything synced before it began.
+ *
  * The label leads with the phase, matching the mail sync meter — a name-only label never said that
  * the meter was tracking sync.
  */
-export const toSpaceUpdate = (name: string | undefined, state: Database.SyncState): MonitorUpdate | undefined => {
+export const toSpaceUpdate = (
+  name: string | undefined,
+  state: Database.SyncState,
+  baseline?: number,
+): MonitorUpdate | undefined => {
   const unsyncedDocuments = state.unsyncedDocumentCount;
   const blocksToPull = Number(state.blocksToPull);
   const blocksToPush = Number(state.blocksToPush);
@@ -31,20 +44,22 @@ export const toSpaceUpdate = (name: string | undefined, state: Database.SyncStat
 
   const totalDocuments = state.totalDocumentCount > 0 ? state.totalDocumentCount : unsyncedDocuments;
   const totalBlocks = Number(state.totalBlocks) > 0 ? Number(state.totalBlocks) : unsyncedBlocks;
-  const total = totalDocuments + totalBlocks;
+  const synced = Math.max(0, totalDocuments + totalBlocks - pending);
+  const current = Math.max(0, synced - (baseline ?? synced));
 
   const notes: string[] = [];
   if (unsyncedDocuments > 0) {
-    notes.push(`${unsyncedDocuments} CRDTs`);
+    notes.push(`${unsyncedDocuments} objects`);
   }
   if (unsyncedBlocks > 0) {
     notes.push(`↓${blocksToPull} ↑${blocksToPush}`);
   }
 
   return {
-    label: `Syncing ${name ?? 'space'}`,
-    current: Math.max(0, total - pending),
-    total,
+    label: `Syncing ${name ?? 'Space'}`,
+    current,
+    total: current + pending,
+    synced,
     note: notes.join(' · '),
   };
 };

package/src/schema-defs.test.ts

@@ -13,7 +13,7 @@ import * as AppCapabilities from '@dxos/app-toolkit/AppCapabilities';
 import { DXN, Type } from '@dxos/echo';
 // ClientPlugin's `#plugin` loader resolves to `plugin.node.ts` under the source condition vitest uses.
 import * as ClientPlugin from '@dxos/plugin-client/ClientPlugin';
-import { createComposerTestApp } from '@dxos/plugin-testing/harness';
+import * as Harness from '@dxos/plugin-testing/Harness';
 
 import { ClientCapabilities, ClientEvents } from '#types';
 
@@ -56,7 +56,7 @@ const makeSeedPlugin = (result: { registered?: boolean }) =>
 describe('SchemaDefs', () => {
   test('registers contributed schema before an IdentityCreated consumer runs', async ({ expect }) => {
     const result: { registered?: boolean } = {};
-    await using harness = await createComposerTestApp({
+    await using harness = await Harness.createComposerTestApp({
       plugins: [ClientPlugin.make({}), NotePlugin(), makeSeedPlugin(result)()],
       // A cold boot creates the identity seconds before the host goes idle, so the wave
       // `SchemaDefs` normally rides in on has not run: `autoStart: false` skips the harness's

package/src/testing/ClientPluginManager.tsx

@@ -0,0 +1,44 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import React, { type PropsWithChildren, useMemo } from 'react';
+
+import type * as Plugin from '@dxos/app-framework/Plugin';
+import { PluginManagerHost } from '@dxos/app-framework/testing';
+import { useClient } from '@dxos/react-client';
+
+import { ClientPlugin } from '#plugin';
+import { type ClientOptions } from '#types';
+
+export type ClientPluginManagerProps = PropsWithChildren<{
+  /** Distinguishes this client's manager from the others in the story. */
+  id: string;
+  /** Plugins beside `ClientPlugin`, built per client since plugin instances hold state. */
+  plugins: () => Plugin.Plugin[];
+  /** Options for the `ClientPlugin` that adopts the client. */
+  clientOptions?: Omit<ClientOptions.ClientPluginOptions, 'client'>;
+}>;
+
+/**
+ * Hosts `children` in a plugin app whose `ClientPlugin` adopts the enclosing `ClientProvider`'s
+ * client, so a multi-client story runs the real plugins once per client. Use it as
+ * `withMultiClientProvider({ wrapper })`.
+ */
+export const ClientPluginManager = ({ id, plugins, clientOptions, children }: ClientPluginManagerProps) => {
+  const client = useClient();
+  const options = useMemo(
+    () => ({ plugins: [ClientPlugin({ ...clientOptions, client }), ...plugins()] }),
+    // The plugins are rebuilt only with the client: a new manager per render would never settle.
+    [client],
+  );
+
+  return (
+    // Story layouts are `fixed inset-0`; layout containment confines each client's app to its own cell.
+    <div className='relative overflow-hidden contain-layout'>
+      <PluginManagerHost id={id} options={options}>
+        {children}
+      </PluginManagerHost>
+    </div>
+  );
+};

package/src/testing/createFakeContacts.ts

@@ -0,0 +1,57 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import { create } from '@bufbuild/protobuf';
+import * as Effect from 'effect/Effect';
+
+import { type Client } from '@dxos/client';
+import { type Space, SpaceMember_Role } from '@dxos/client/echo';
+import { Obj } from '@dxos/echo';
+import { PublicKey } from '@dxos/keys';
+import { fromPublicKey } from '@dxos/protocols/buf';
+import { ContactSchema } from '@dxos/protocols/buf/dxos/client/services_pb';
+import { ProfileDocumentSchema } from '@dxos/protocols/buf/dxos/halo/credentials_pb';
+
+export type CreateFakeContactsOptions = {
+  /** Names of the spaces to create; contacts are spread across them. */
+  spaceNames?: string[];
+  /** Display names of the contacts to admit. */
+  contactNames?: string[];
+};
+
+/**
+ * Populate the contact book with fake people by admitting random identities to new named spaces.
+ * The contact book is derived from space membership, so this exercises the real `useContacts` path.
+ * Contact `i` joins spaces `0..(i % spaceNames.length)`, so contacts share different numbers of spaces.
+ */
+export const createFakeContacts = (
+  client: Client,
+  {
+    spaceNames = ['Design', 'Engineering', 'Marketing'],
+    contactNames = ['Alice Adams', 'Bob Brown', 'Carol Chen', 'Dan Diaz', 'Eve Evans'],
+  }: CreateFakeContactsOptions = {},
+): Effect.Effect<Space[], never, never> =>
+  Effect.gen(function* () {
+    const spaces: Space[] = [];
+    for (const name of spaceNames) {
+      const space = yield* Effect.promise(() => client.spaces.create());
+      yield* Effect.promise(() => space.waitUntilReady());
+      Obj.update(space.properties, (properties) => {
+        properties.name = name;
+      });
+      spaces.push(space);
+    }
+
+    for (const [index, displayName] of contactNames.entries()) {
+      const contact = create(ContactSchema, {
+        identityKey: fromPublicKey(PublicKey.random()),
+        profile: create(ProfileDocumentSchema, { displayName }),
+      });
+      for (const space of spaces.slice(0, (index % spaces.length) + 1)) {
+        yield* Effect.promise(() => space.admitContact(contact, SpaceMember_Role.EDITOR));
+      }
+    }
+
+    return spaces;
+  });

package/src/testing/index.ts

@@ -2,5 +2,7 @@
 // Copyright 2025 DXOS.org
 //
 
-export * as ClientPlugin from '../ClientPlugin.testing';
-export { initializeIdentity } from './initializeIdentity';
+export * as ClientPlugin from '../ClientPlugin.testing.ts';
+export { createFakeContacts } from './createFakeContacts.ts';
+export { initializeIdentity } from './initializeIdentity.ts';
+export * from './ClientPluginManager.tsx';

package/src/testing/initializeIdentity.ts

@@ -2,12 +2,14 @@
 // Copyright 2025 DXOS.org
 //
 
+import { create } from '@bufbuild/protobuf';
 import * as Effect from 'effect/Effect';
 
 import * as AppSpace from '@dxos/app-toolkit/AppSpace';
 import { type Client } from '@dxos/client';
 import { type Space } from '@dxos/client-protocol';
-import { type Identity } from '@dxos/protocols/proto/dxos/client/services';
+import { type Identity } from '@dxos/protocols/buf/dxos/client/services_pb';
+import { ProfileDocumentSchema } from '@dxos/protocols/buf/dxos/halo/credentials_pb';
 
 export type InitializeIdentityResult = {
   identity: Identity;
@@ -37,7 +39,9 @@ export const initializeIdentity = (
     // The harness boots with client initialization forked off startup; `halo`/`spaces` are
     // unreadable until it completes.
     yield* Effect.promise(() => client.waitUntilInitialized());
-    const identity = yield* Effect.promise(() => client.halo.createIdentity(displayName ? { displayName } : {}));
+    const identity = yield* Effect.promise(() =>
+      client.halo.createIdentity(create(ProfileDocumentSchema, { displayName })),
+    );
     const spaces = yield* AppSpace.setupIdentitySpaces(client);
 
     return { identity, ...spaces };

package/src/translations.ts

@@ -2,7 +2,7 @@
 // Copyright 2023 DXOS.org
 //
 
-import { type Resource } from '@dxos/react-ui';
+import type * as Theme from '@dxos/react-ui/Theme';
 import { translations as shellTranslations } from '@dxos/shell/translations';
 
 import { meta } from '#meta';
@@ -24,9 +24,18 @@ const pluginTranslations = [
         'create-device-invitation.label': 'Create code',
         'qr-code.description':
           'Scan this QR code using the device you want to log in to, or copy the URL and share it with the new device.',
+        'contacts.label': 'Contacts',
+        'contacts.description': 'People you share at least one space with.',
+        'contacts-search.placeholder': 'Search contacts…',
+        'contact-picker-add.label': 'Add member',
+        'contact-picker-empty.message':
+          'You have no contacts yet — people appear here once you share a space with them.',
+        'role-editor.label': 'Editor',
+        'role-viewer.label': 'Viewer',
+        'role-admin.label': 'Admin',
         'security.label': 'Security',
         'account-panel.label': 'Account',
-        'invitations-panel.label': 'Invitations',
+        'invitations-panel.label': 'Account invitations',
         'usage-panel.label': 'Usage',
         'usage-section.title': 'Usage',
         'usage-section.description':
@@ -54,7 +63,7 @@ const pluginTranslations = [
         'account-section.title': 'Account',
         'account-section.description':
           'Your identity on this device is bound to a DXOS account that gates access to edge services like sync, agents, and AI.',
-        'invitations-section.title': 'Invitations',
+        'invitations-section.title': 'Account invitations',
         'invitations-section.description':
           'Share an invitation with someone you’d like to bring onto DXOS. Each code grants one-time access to create an account.',
         'no-edge-access.title': 'No edge access',
@@ -86,12 +95,11 @@ const pluginTranslations = [
         'generate-invitation.description_other': 'You have {{count}} invitations left to generate.',
         'available-invitations.title': 'Available invitations',
         'redeemed-invitations.title': 'Redeemed invitations',
-        'logout.description': 'Log out and erase all data on this device.',
+        'logout.description':
+          'Logging out erases all data on this device. Anything that has not synced to another device or to the cloud will be lost.',
         'join-new-identity.description': 'Erase this device and join an existing identity with a QR code or URL.',
         'recover-identity.description': 'Erase this device and log in with a passkey or recovery code.',
-        'logout-section.title': 'Log out',
-        'logout-section.description':
-          'Logging out erases all data on this device. Anything that has not synced to another device or to the cloud will be lost.',
+        'logout-section.title': 'Danger Zone',
         'identity-test-section.title': 'Testing',
         'identity-test-section.description':
           'Enabled for testing. These switch this device to a different identity, erasing all data on it first.',
@@ -132,6 +140,8 @@ const pluginTranslations = [
         //   Something like https://www.tomsguide.com/news/what-are-passkeys.
         'create-passkey.description':
           'A passkey is a secure and easy to use credential that can be used to recover your account.',
+        'create-passkey-failed.message':
+          'The passkey could not be created. Try again, or create a recovery code instead.',
         'create-recovery-code.label': 'Create Recovery Code',
         'create-recovery-code.description': 'A recovery code is 12 word phrase representing a private key.',
         'recovery-code-dialog.title': 'Recovery Code',
@@ -149,11 +159,25 @@ const pluginTranslations = [
         'qr.label': 'QR Code',
         'recover-identity.label': 'Use a recovery code',
         'logout.label': 'Log out',
+        'cli-login-dialog.title': 'Connect the dx CLI',
+        'cli-login-dialog.description':
+          'A dx command-line client on this computer is asking to join your identity as a new device, with full access to your spaces. Approve only if you just ran `dx account login` yourself.',
+        'cli-login-no-identity.message': 'Create or sign in to an identity first, then run the dx login command again.',
+        'cli-login-code.label': 'Approve only if your terminal shows this code:',
+        'cli-login-authorize.label': 'Authorize',
+        'cli-login-deny.label': 'Deny',
+        'cli-login-done.label': 'Done',
+        'cli-login-cancel.label': 'Cancel',
+        'cli-login-sending.message': 'Creating a device invitation…',
+        'cli-login-waiting.message': 'Invitation sent. Waiting for the CLI to join — keep this tab open.',
+        'cli-login-success.message': 'The CLI joined your identity. You can return to your terminal.',
+        'cli-login-cancelled.message': 'The invitation was cancelled.',
+        'cli-login-error.message': 'Could not connect the CLI: {{error}}',
         'navigation-failed-toast.title': 'Link could not be processed',
         'navigation-failed-toast.description': 'Something went wrong while handling this link. Please try again.',
       },
     },
   },
-] as const satisfies Resource[];
+] as const satisfies Theme.Resource[];
 
-export const translations: Resource[] = [...pluginTranslations, ...shellTranslations];
+export const translations: Theme.Resource[] = [...pluginTranslations, ...shellTranslations];

package/src/types/Account.ts

@@ -2,15 +2,31 @@
 // Copyright 2024 DXOS.org
 //
 
-// TODO(wittjosiah): Cannot use slashes in ids until we have a router which decouples ids from url paths.
-const _id = 'dxos.org.plugin.client.account';
-// TODO(wittjosiah): This is a hack to prevent the previous deck from being set for pinned items.
-//  Ideally this should be worked into the data model in a generic way.
-export const id = `!${_id}`;
+import * as GraphPath from '@dxos/app-toolkit/GraphPath';
+import { type Config, getEnvString } from '@dxos/config';
 
-export const Profile = `${_id}.profile`;
-export const Devices = `${_id}.devices`;
-export const Security = `${_id}.security`;
-export const Account = `${_id}.account`;
-export const Invitations = `${_id}.invitations`;
-export const Usage = `${_id}.usage`;
+/** Pinned (non-space) workspace ID anchoring the account's graph subtree, and its URL workspace token. */
+export const id = 'dxos:account';
+
+/** Panel ids, relative to the account workspace they hang off. Each is also its own singleton URL key. */
+export const Profile = 'profile';
+export const Devices = 'devices';
+export const Contacts = 'contacts';
+export const Security = 'security';
+export const Account = 'account';
+export const Invitations = 'invitations';
+export const Usage = 'usage';
+
+/** The account's own workspace path. */
+export const workspacePath = GraphPath.getSpacePath(id);
+
+/** A panel's qualified path, which its surface matches on. */
+export const path = (panel: string): string => GraphPath.getSpacePath(id, panel);
+
+/**
+ * The hub backing accounts, or `undefined` where none is configured.
+ */
+export const getHubUrl = (config?: Config): string | undefined => getEnvString(config, 'DX_HUB_URL');
+
+/** Whether this profile has an account service to authenticate against. */
+export const isAuthEnabled = (config?: Config): boolean => !!getHubUrl(config);