@dxos/plugin-client 0.8.4-main.c85a9c8dae → 0.8.4-main.d9fc60f731

package/src/operations/redeem-passkey.ts

@@ -0,0 +1,85 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+import * as Match from 'effect/Match';
+
+import { Capability } from '@dxos/app-framework';
+import { decodeUrlSafeBase64, supportsNativePasskeys, loginNativePasskey } from '@dxos/app-toolkit';
+import { PublicKey } from '@dxos/client';
+import { Operation } from '@dxos/compute';
+import { invariant } from '@dxos/invariant';
+
+import { ClientCapabilities } from '../types';
+import { RedeemPasskey } from './definitions';
+
+const handler: Operation.WithHandler<typeof RedeemPasskey> = RedeemPasskey.pipe(
+  Operation.withHandler(
+    Effect.fnUntraced(function* () {
+      const client = yield* Capability.get(ClientCapabilities.Client);
+      invariant(client.services.services.IdentityService, 'IdentityService not available');
+      const { deviceKey, controlFeedKey, challenge } = yield* Effect.promise(() =>
+        client.services.services.IdentityService!.requestRecoveryChallenge(),
+      );
+
+      const { lookupKey, signature, clientDataJson, authenticatorData } = yield* Match.value(
+        supportsNativePasskeys(),
+      ).pipe(
+        Match.when(true, () =>
+          Effect.gen(function* () {
+            const result = yield* Effect.promise(() =>
+              loginNativePasskey({ challenge: Uint8Array.from(Buffer.from(challenge, 'base64')) }),
+            );
+            invariant(result, 'Native passkey login returned no result');
+            return {
+              lookupKey: PublicKey.from(decodeUrlSafeBase64(result.user_handle)),
+              signature: Buffer.from(decodeUrlSafeBase64(result.signature)),
+              clientDataJson: Buffer.from(decodeUrlSafeBase64(result.client_data_json)),
+              authenticatorData: Buffer.from(decodeUrlSafeBase64(result.authenticator_data)),
+            };
+          }),
+        ),
+        Match.orElse(() =>
+          Effect.gen(function* () {
+            const credential = yield* Effect.promise(() =>
+              navigator.credentials.get({
+                publicKey: {
+                  challenge: Buffer.from(challenge, 'base64'),
+                  rpId: location.hostname,
+                  userVerification: 'required',
+                },
+              }),
+            );
+            return {
+              lookupKey: PublicKey.from(new Uint8Array((credential as any).response.userHandle)),
+              signature: Buffer.from((credential as any).response.signature),
+              clientDataJson: Buffer.from((credential as any).response.clientDataJSON),
+              authenticatorData: Buffer.from((credential as any).response.authenticatorData),
+            };
+          }),
+        ),
+      );
+
+      yield* Effect.promise(() =>
+        client.services.services.IdentityService!.recoverIdentity(
+          {
+            external: {
+              lookupKey,
+              deviceKey,
+              controlFeedKey,
+              signature,
+              clientDataJson,
+              authenticatorData,
+            },
+          },
+          { timeout: RECOVER_IDENTITY_RPC_TIMEOUT },
+        ),
+      );
+    }),
+  ),
+);
+
+export default handler;
+
+const RECOVER_IDENTITY_RPC_TIMEOUT = 20_000;

package/src/operations/redeem-token.ts

@@ -0,0 +1,31 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+
+import { Capability } from '@dxos/app-framework';
+import { Operation } from '@dxos/compute';
+import { invariant } from '@dxos/invariant';
+
+import { ClientCapabilities } from '../types';
+import { RedeemToken } from './definitions';
+
+const handler: Operation.WithHandler<typeof RedeemToken> = RedeemToken.pipe(
+  Operation.withHandler(
+    Effect.fnUntraced(function* (data) {
+      const client = yield* Capability.get(ClientCapabilities.Client);
+      invariant(client.services.services.IdentityService, 'IdentityService not available');
+      yield* Effect.promise(() =>
+        client.services.services.IdentityService!.recoverIdentity(
+          { token: data.token },
+          { timeout: RECOVER_IDENTITY_RPC_TIMEOUT },
+        ),
+      );
+    }),
+  ),
+);
+
+export default handler;
+
+const RECOVER_IDENTITY_RPC_TIMEOUT = 20_000;

package/src/operations/reset-storage.ts

@@ -0,0 +1,27 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+
+import { LayoutOperation } from '@dxos/app-toolkit';
+import { Operation } from '@dxos/compute';
+
+import { RESET_DIALOG } from '../constants';
+import { ResetStorage } from './definitions';
+
+const handler: Operation.WithHandler<typeof ResetStorage> = ResetStorage.pipe(
+  Operation.withHandler(
+    Effect.fnUntraced(function* (data) {
+      yield* Operation.invoke(LayoutOperation.UpdateDialog, {
+        subject: RESET_DIALOG,
+        blockAlign: 'start',
+        props: {
+          mode: data.mode ?? 'reset-storage',
+        },
+      });
+    }),
+  ),
+);
+
+export default handler;

package/src/operations/share-identity.ts

@@ -0,0 +1,26 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+
+import { LayoutOperation, getSpacePath } from '@dxos/app-toolkit';
+import { Operation } from '@dxos/compute';
+import { ObservabilityOperation } from '@dxos/plugin-observability';
+
+import { Account } from '../types';
+import { ShareIdentity } from './definitions';
+
+const handler: Operation.WithHandler<typeof ShareIdentity> = ShareIdentity.pipe(
+  Operation.withHandler(
+    Effect.fnUntraced(function* () {
+      yield* Operation.invoke(LayoutOperation.SwitchWorkspace, { subject: getSpacePath(Account.id) });
+      yield* Operation.invoke(LayoutOperation.Open, {
+        subject: [`${getSpacePath(Account.id)}/${Account.Profile}`],
+      });
+      yield* Operation.schedule(ObservabilityOperation.SendEvent, { name: 'identity.share' });
+    }),
+  ),
+);
+
+export default handler;

package/src/plugin.ts

@@ -0,0 +1,11 @@
+//
+// Copyright 2023 DXOS.org
+//
+
+import { Plugin } from '@dxos/app-framework';
+
+import { meta } from './meta';
+
+export const ClientPlugin = Plugin.lazy(meta, () => import('#plugin'));
+
+export { ClientOperationHandlerSet } from './operations';

package/src/state/account-cache.ts

@@ -0,0 +1,33 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Schema from 'effect/Schema';
+
+const AccountCacheValue = Schema.Struct({
+  identityDid: Schema.String,
+  email: Schema.String,
+  emailVerified: Schema.Boolean,
+  /** ISO timestamp. */
+  createdAt: Schema.String,
+  invitationsRemaining: Schema.Number,
+});
+export type AccountCacheValue = Schema.Schema.Type<typeof AccountCacheValue>;
+
+const AccountCacheInvitation = Schema.Struct({
+  code: Schema.String,
+  /** ISO timestamp. */
+  createdAt: Schema.String,
+  redeemedByIdentityDid: Schema.optional(Schema.String),
+  /** ISO timestamp. */
+  redeemedAt: Schema.optional(Schema.String),
+});
+export type AccountCacheInvitation = Schema.Schema.Type<typeof AccountCacheInvitation>;
+
+export const AccountCache = Schema.Struct({
+  account: Schema.optional(AccountCacheValue),
+  invitations: Schema.optional(Schema.Array(AccountCacheInvitation)),
+  /** Epoch ms when the cache was last refreshed. */
+  fetchedAt: Schema.optional(Schema.Number),
+});
+export type AccountCache = Schema.Schema.Type<typeof AccountCache>;

package/src/state/use-hub-http.ts

@@ -0,0 +1,32 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import { useEffect } from 'react';
+
+import { useCapabilities } from '@dxos/app-framework/ui';
+import { createEdgeIdentity } from '@dxos/client/edge';
+import { type HubHttpClient } from '@dxos/edge-client';
+import { useClient } from '@dxos/react-client';
+import { useIdentity } from '@dxos/react-client/halo';
+
+import { ClientCapabilities } from '#types';
+
+/**
+ * Returns the shared `HubHttpClient` singleton for hub-service API calls.
+ * Updates the VP-auth identity whenever the signed-in user changes.
+ * Returns `undefined` when the hub URL is unconfigured (no HubHttpClient capability).
+ */
+export const useHubHttpClient = (): HubHttpClient | undefined => {
+  const client = useClient();
+  const identity = useIdentity();
+  const [hubHttpClient] = useCapabilities(ClientCapabilities.HubHttpClient);
+
+  useEffect(() => {
+    if (hubHttpClient && identity) {
+      hubHttpClient.setIdentity(createEdgeIdentity(client));
+    }
+  }, [client, identity, hubHttpClient]);
+
+  return hubHttpClient ?? undefined;
+};

package/src/testing/index.ts

@@ -0,0 +1,6 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+export * from '#plugin';
+export { initializeIdentity } from './initializeIdentity';

package/src/testing/initializeIdentity.ts

@@ -0,0 +1,30 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+
+import { PERSONAL_SPACE_TAG } from '@dxos/app-toolkit';
+import { type Client } from '@dxos/client';
+import { type Space } from '@dxos/client-protocol';
+import { type Identity } from '@dxos/protocols/proto/dxos/client/services';
+
+export type InitializeIdentityResult = {
+  identity: Identity;
+  personalSpace: Space;
+};
+
+/**
+ * Create an identity and a personal space.
+ * Returns the identity and space for further setup.
+ */
+export const initializeIdentity = (client: Client): Effect.Effect<InitializeIdentityResult, never, never> =>
+  Effect.gen(function* () {
+    const identity = yield* Effect.promise(() => client.halo.createIdentity());
+    const personalSpace = yield* Effect.promise(() => client.spaces.create({}, { tags: [PERSONAL_SPACE_TAG] }));
+    yield* Effect.promise(() => personalSpace.waitUntilReady());
+    return {
+      identity,
+      personalSpace,
+    };
+  });

package/src/translations.ts

@@ -5,66 +5,108 @@
 import { type Resource } from '@dxos/react-ui';
 import { translations as shellTranslations } from '@dxos/shell/react';
 
-import { meta } from './meta';
+import { meta } from '#meta';
 
+// TODO(burdon): Disambiguate with sdk/shell
 const pluginTranslations = [
   {
     'en-US': {
       [meta.id]: {
-        'account label': 'User profile',
-        'profile label': 'Profile',
-        'profile description': 'You can adjust how your user settings here.',
-        'devices label': 'Devices',
-        'devices verbose label': 'Manage devices',
-        'add device description':
+        'account.label': 'User profile',
+        'profile.label': 'Profile',
+        'profile.description': 'User profile and account settings.',
+        'devices.label': 'Devices',
+        'add-device.label': 'Add device',
+        'devices-verbose.label': 'Manage devices',
+        'add-device.description':
           'Authenticating another device is a two-step process. To get started, create a code using the button below.',
-        'devices description':
-          'You can add and remove devices, configure your agent in the cloud, reset this device, or log in as a different identity here.',
-        'create device invitation label': 'Create code',
-        'qr code description':
+        'devices.description': 'Devices, cloud agents, and account access for this identity.',
+        'create-device-invitation.label': 'Create code',
+        'qr-code.description':
           'Scan this QR code using the device you want to log in to, or copy the URL and share it with the new device.',
-        'security label': 'Security',
-        'reset device description': 'Log out from this device, erasing all the data on this device.',
-        'join new identity description':
+        'security.label': 'Security',
+        'account-panel.label': 'Account',
+        'invitations-panel.label': 'Invitations',
+        'account-section.title': 'Account',
+        'account-section.description':
+          'Your identity on this device is bound to a DXOS account that gates access to edge services like sync, agents, and AI.',
+        'invitations-section.title': 'Invitations',
+        'invitations-section.description':
+          'Share an invitation with someone you’d like to bring onto DXOS. Each code grants one-time access to create an account.',
+        'no-edge-access.title': 'No edge access',
+        'no-edge-access.description':
+          'This identity is not bound to a DXOS account, so features that depend on edge services will not work. Request access below to be notified when an invitation is available.',
+        'access-request-email.placeholder': 'you@example.com',
+        'access-request-submitted.message': 'Thanks — we’ll be in touch.',
+        'request-access.label': 'Request access',
+        'request-access.description': 'Enter your email and we’ll add you to the waiting list.',
+        'account-offline.title': 'Couldn’t reach the server',
+        'account-offline.description':
+          'Account information could not be refreshed. Reconnect to update; cached values are shown until then.',
+        'email.label': 'Email',
+        'resend-verification.label': 'Resend verification email',
+        'verification-sent.message': 'Verification email sent.',
+        'verification-cooldown.message': 'Please wait {{seconds}}s before resending.',
+        'verification-failed.message': 'Could not send verification email.',
+        'delete-account.label': 'Delete account',
+        'delete-account.description':
+          'Permanently delete your account and all associated data. This will sign you out of this device.',
+        'generate-invitation.label': 'Generate invitation',
+        'generate-invitation.description_zero': 'You have no invitations left to generate.',
+        'generate-invitation.description_one': 'You have {{count}} invitation left to generate.',
+        'generate-invitation.description_other': 'You have {{count}} invitations left to generate.',
+        'available-invitations.title': 'Available invitations',
+        'redeemed-invitations.title': 'Redeemed invitations',
+        'reset-device.description': 'Log out from this device, erasing all the data on this device.',
+        'join-new-identity.description':
           'Log out from this device, erasing all the data currently on this device, and use a QR code or URL to log in.',
-        'recover identity description':
+        'recover-identity.description':
           'Log out from this device, erasing all the data currently on this device, and use a passkey or recovery code to log in.',
-        'danger zone title': 'Log out',
-        'danger zone description':
+        'danger-zone.title': 'Log out',
+        'danger-zone.description':
           'Because Composer is decentralized, logging out entails erasing all the data on this device. If you have any data on this device that you’d like to keep, you can log in on a separate device using a passkey or complete a peer-to-peer device invitation above.',
-        'display name label': 'Display name',
-        'display name description': 'Your name as it appears in the app.',
-        'display name input placeholder': 'Enter a name',
-        'icon label': 'Avatar',
-        'icon description': 'The emoji used to represent the user.',
-        'hue label': 'Color',
-        'hue description':
+        'display-name.label': 'Display name',
+        'display-name.description': 'Your name as it appears in the app.',
+        'display-name-input.placeholder': 'Enter a name',
+        'icon.label': 'Avatar',
+        'icon.description': 'The emoji used to represent the user.',
+        'hue.label': 'Color',
+        'hue.description':
           'The color used to represent you in the app, including as your avatar’s background, your cursor as it appears to others, and the messages you send in group threads.',
-        'did label': 'DID',
-        'did description': 'Your unique ID.',
-        'open user account label': 'Open user account',
-        'manage credentials dialog title': 'Manage Account Recovery',
-        'credentials list label': 'Recovery credentials',
-        'no credentials title': 'WARNING: There is currently no way to recover your account.',
-        'no credentials message': 'Create a recovery credential above to secure your account.',
-        'recovery setup dialog title': 'Account Security',
-        'recovery setup dialog description':
+        'did.label': 'DID',
+        'did.description': 'Your unique ID.',
+        'open-user-account.label': 'Open user account',
+        'manage-credentials-dialog.title': 'Manage Account Recovery',
+        'credentials-list.label': 'Recovery credentials',
+        'no-credentials.title': 'WARNING: There is currently no way to recover your account.',
+        'no-credentials.message': 'Create a recovery credential above to secure your account.',
+        'recovery-setup-dialog.title': 'Account Security',
+        'recovery-setup-dialog.description':
           'In order to maintain access to your account you need to register a recovery credential. Passkeys are the recommended way to do this, they can be stored in your browser or in a password manager.',
-        'create passkey label': 'Create Passkey',
+        'create-passkey.label': 'Create Passkey',
         // TODO(wittjosiah): At link to user-focused passkey information.
         //   Something like https://www.tomsguide.com/news/what-are-passkeys.
-        'create passkey description':
+        'create-passkey.description':
           'A passkey is a secure and easy to use credential that can be used to recover your account.',
-        'create recovery code label': 'Create Recovery Code',
-        'create recovery code description': 'A recovery code is 12 word phrase representing a private key.',
-        'recovery code dialog title': 'Recovery Code',
-        'recovery code dialog description':
+        'create-recovery-code.label': 'Create Recovery Code',
+        'create-recovery-code.description': 'A recovery code is 12 word phrase representing a private key.',
+        'recovery-code-dialog.title': 'Recovery Code',
+        'recovery-code-dialog.description':
           'This is your identity recovery code, store it in a safe place. You can use it to recover your identity if you ever lose access to your devices.',
-        'recovery code dialog warning 1': 'NOTE: This code will not be displayed again.',
-        'recovery code dialog warning 2':
+        'recovery-code-dialog-warning-1.message': 'NOTE: This code will not be displayed again.',
+        'recovery-code-dialog-warning-2.message':
           'It is your private key for recovering DXOS data. Anyone with this key will be able to gain access to your account.',
-        'recovery code confirmation label': 'Please confirm you have saved the code.',
-        'continue label': 'Continue',
+        'recovery-code-confirmation.label': 'Please confirm you have saved the code.',
+        'continue.label': 'Continue',
+        'auth-code.message': 'Authorization code',
+        'auth-other-device-emoji.message': 'Authorization icon',
+        'cancel.label': 'Cancel',
+        'join-new-identity.label': 'Join an existing identity',
+        'qr.label': 'QR Code',
+        'recover-identity.label': 'Use a recovery code',
+        'reset-device.label': 'Reset storage',
+        'reset-dialog.description': 'Reset storage',
+        'reset-dialog.title': 'Reset storage',
       },
     },
   },

package/src/types/capabilities.ts

@@ -2,15 +2,22 @@
 // Copyright 2025 DXOS.org
 //
 
+import { type Atom } from '@effect-atom/atom-react';
+
 import { Capability } from '@dxos/app-framework';
 import { type Client } from '@dxos/client';
 import { type ObjectMigration } from '@dxos/client/echo';
 import { type Type } from '@dxos/echo';
+import { type HubHttpClient } from '@dxos/edge-client';
+
+import { meta } from '#meta';
 
-import { meta } from '../meta';
+import { type AccountCache as AccountCacheType } from '../state/account-cache';
 
 export namespace ClientCapabilities {
-  export const Client = Capability.make<Client>(`${meta.id}/capability/client`);
-  export const Schema = Capability.make<Type.AnyEntity[]>(`${meta.id}/capability/schema`);
-  export const Migration = Capability.make<ObjectMigration[]>(`${meta.id}/capability/migration`);
+  export const Client = Capability.make<Client>(`${meta.id}.capability.client`);
+  export const Schema = Capability.make<Type.AnyEntity[]>(`${meta.id}.capability.schema`);
+  export const Migration = Capability.make<ObjectMigration[]>(`${meta.id}.capability.migration`);
+  export const AccountCache = Capability.make<Atom.Writable<AccountCacheType>>(`${meta.id}.capability.accountCache`);
+  export const HubHttpClient = Capability.make<HubHttpClient>(`${meta.id}.capability.hubHttpClient`);
 }

package/src/types/events.ts

@@ -4,12 +4,12 @@
 
 import { ActivationEvent } from '@dxos/app-framework';
 
-import { meta } from '../meta';
+import { meta } from '#meta';
 
 export namespace ClientEvents {
-  export const ClientReady = ActivationEvent.make(`${meta.id}/event/client-ready`);
-  export const SetupSchema = ActivationEvent.make(`${meta.id}/event/setup-schema`);
-  export const SetupMigration = ActivationEvent.make(`${meta.id}/event/setup-migration`);
-  export const IdentityCreated = ActivationEvent.make(`${meta.id}/event/identity-created`);
-  export const SpacesReady = ActivationEvent.make(`${meta.id}/event/spaces-ready`);
+  export const ClientReady = ActivationEvent.make(`${meta.id}.event.client-ready`);
+  export const SetupSchema = ActivationEvent.make(`${meta.id}.event.setup-schema`);
+  export const SetupMigration = ActivationEvent.make(`${meta.id}.event.setup-migration`);
+  export const IdentityCreated = ActivationEvent.make(`${meta.id}.event.identity-created`);
+  export const SpacesReady = ActivationEvent.make(`${meta.id}.event.spaces-ready`);
 }