@dxos/plugin-client 0.8.4-staging.60fe92afc8 → 0.9.1-main.c7dcc2e112

package/dx.config.ts

@@ -0,0 +1,19 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import { Config2 } from '@dxos/app-framework/config';
+import { trim } from '@dxos/util';
+
+export default Config2.make({
+  plugin: {
+    key: 'org.dxos.plugin.client',
+    name: 'Client',
+    author: 'DXOS',
+    description: trim`
+      Core client connectivity and peer-to-peer networking infrastructure.
+      Manages identity, authentication, and real-time synchronization across devices.
+    `,
+    tags: ['system'],
+  },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/plugin-client",
-  "version": "0.8.4-staging.60fe92afc8",
+  "version": "0.9.1-main.c7dcc2e112",
   "description": "DXOS Surface plugin for DXOS Client",
   "homepage": "https://dxos.org",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -99,6 +99,7 @@
   "types": "dist/types/src/index.d.ts",
   "files": [
     "dist",
+    "dx.config.ts",
     "src"
   ],
   "dependencies": {
@@ -107,34 +108,35 @@
     "effect": "3.21.3",
     "react-qr-rounded": "^1.0.0",
     "yaml": "^2.8.2",
-    "@dxos/app-framework": "0.8.4-staging.60fe92afc8",
-    "@dxos/async": "0.8.4-staging.60fe92afc8",
-    "@dxos/client": "0.8.4-staging.60fe92afc8",
-    "@dxos/client-services": "0.8.4-staging.60fe92afc8",
-    "@dxos/client-protocol": "0.8.4-staging.60fe92afc8",
-    "@dxos/compute": "0.8.4-staging.60fe92afc8",
-    "@dxos/config": "0.8.4-staging.60fe92afc8",
-    "@dxos/context": "0.8.4-staging.60fe92afc8",
-    "@dxos/credentials": "0.8.4-staging.60fe92afc8",
-    "@dxos/echo": "0.8.4-staging.60fe92afc8",
-    "@dxos/echo-client": "0.8.4-staging.60fe92afc8",
-    "@dxos/app-toolkit": "0.8.4-staging.60fe92afc8",
-    "@dxos/echo-protocol": "0.8.4-staging.60fe92afc8",
-    "@dxos/edge-client": "0.8.4-staging.60fe92afc8",
-    "@dxos/cli-util": "0.8.4-staging.60fe92afc8",
-    "@dxos/invariant": "0.8.4-staging.60fe92afc8",
-    "@dxos/effect": "0.8.4-staging.60fe92afc8",
-    "@dxos/keys": "0.8.4-staging.60fe92afc8",
-    "@dxos/functions": "0.8.4-staging.60fe92afc8",
-    "@dxos/plugin-observability": "0.8.4-staging.60fe92afc8",
-    "@dxos/log": "0.8.4-staging.60fe92afc8",
-    "@dxos/react-client": "0.8.4-staging.60fe92afc8",
-    "@dxos/protocols": "0.8.4-staging.60fe92afc8",
-    "@dxos/react-ui-form": "0.8.4-staging.60fe92afc8",
-    "@dxos/react-ui-pickers": "0.8.4-staging.60fe92afc8",
-    "@dxos/shell": "0.8.4-staging.60fe92afc8",
-    "@dxos/util": "0.8.4-staging.60fe92afc8",
-    "@dxos/plugin-graph": "0.8.4-staging.60fe92afc8"
+    "@dxos/async": "0.9.1-main.c7dcc2e112",
+    "@dxos/client": "0.9.1-main.c7dcc2e112",
+    "@dxos/cli-util": "0.9.1-main.c7dcc2e112",
+    "@dxos/client-protocol": "0.9.1-main.c7dcc2e112",
+    "@dxos/config": "0.9.1-main.c7dcc2e112",
+    "@dxos/client-services": "0.9.1-main.c7dcc2e112",
+    "@dxos/compute": "0.9.1-main.c7dcc2e112",
+    "@dxos/context": "0.9.1-main.c7dcc2e112",
+    "@dxos/credentials": "0.9.1-main.c7dcc2e112",
+    "@dxos/app-toolkit": "0.9.1-main.c7dcc2e112",
+    "@dxos/echo": "0.9.1-main.c7dcc2e112",
+    "@dxos/echo-protocol": "0.9.1-main.c7dcc2e112",
+    "@dxos/edge-client": "0.9.1-main.c7dcc2e112",
+    "@dxos/effect": "0.9.1-main.c7dcc2e112",
+    "@dxos/echo-client": "0.9.1-main.c7dcc2e112",
+    "@dxos/functions": "0.9.1-main.c7dcc2e112",
+    "@dxos/log": "0.9.1-main.c7dcc2e112",
+    "@dxos/app-framework": "0.9.1-main.c7dcc2e112",
+    "@dxos/keys": "0.9.1-main.c7dcc2e112",
+    "@dxos/invariant": "0.9.1-main.c7dcc2e112",
+    "@dxos/plugin-graph": "0.9.1-main.c7dcc2e112",
+    "@dxos/protocols": "0.9.1-main.c7dcc2e112",
+    "@dxos/plugin-observability": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-client": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-ui-form": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-ui-pickers": "0.9.1-main.c7dcc2e112",
+    "@dxos/shell": "0.9.1-main.c7dcc2e112",
+    "@dxos/util": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-ui-syntax-highlighter": "0.9.1-main.c7dcc2e112"
   },
   "devDependencies": {
     "@effect-atom/atom-react": "^0.5.0",
@@ -145,10 +147,10 @@
     "react": "~19.2.3",
     "react-dom": "~19.2.3",
     "vite": "^8.0.16",
-    "@dxos/plugin-testing": "0.8.4-staging.60fe92afc8",
-    "@dxos/react-ui": "0.8.4-staging.60fe92afc8",
-    "@dxos/ui-theme": "0.8.4-staging.60fe92afc8",
-    "@dxos/storybook-utils": "0.8.4-staging.60fe92afc8"
+    "@dxos/plugin-testing": "0.9.1-main.c7dcc2e112",
+    "@dxos/ui-theme": "0.9.1-main.c7dcc2e112",
+    "@dxos/storybook-utils": "0.9.1-main.c7dcc2e112",
+    "@dxos/react-ui": "0.9.1-main.c7dcc2e112"
   },
   "peerDependencies": {
     "@effect-atom/atom-react": "^0.5.0",
@@ -156,8 +158,8 @@
     "effect": "3.21.3",
     "react": "~19.2.3",
     "react-dom": "~19.2.3",
-    "@dxos/react-ui": "0.8.4-staging.60fe92afc8",
-    "@dxos/ui-theme": "0.8.4-staging.60fe92afc8"
+    "@dxos/react-ui": "0.9.1-main.c7dcc2e112",
+    "@dxos/ui-theme": "0.9.1-main.c7dcc2e112"
   },
   "publishConfig": {
     "access": "public"

package/src/ClientPlugin.node.ts

@@ -10,11 +10,11 @@ import { meta } from '#meta';
 import { ClientEvents } from '#types';
 import { type ClientPluginOptions } from '#types';
 
-import { config, device, edge, halo, profile } from './commands';
+import { account, config, device, edge, halo, profile } from './commands';
 
 export const ClientPlugin = Plugin.define<ClientPluginOptions>(meta).pipe(
   // TODO(wittjosiah): Could some of these commands make use of operations?
-  AppPlugin.addCommandModule({ commands: [config, device, edge, halo, profile] }),
+  AppPlugin.addCommandModule({ commands: [account, config, device, edge, halo, profile] }),
   AppPlugin.addOperationHandlerModule({ activate: OperationHandler }),
   Plugin.addModule((options) => ({
     id: Capability.getModuleTag(Client),

package/src/ClientPlugin.test.ts

@@ -11,7 +11,7 @@ import { createComposerTestApp } from '@dxos/plugin-testing/harness';
 
 import { meta } from './meta';
 
-const moduleId = (name: string) => `${meta.id}.module.${name}`;
+const moduleId = (name: string) => `${meta.profile.key}.module.${name}`;
 
 describe('ClientPlugin', () => {
   test('modules activate on the expected events', async ({ expect }) => {

package/src/capabilities/app-graph-builder.ts

@@ -25,7 +25,7 @@ export default Capability.makeModule(
             id: 'openUserAccount',
             data: () => Operation.invoke(ClientOperation.ShareIdentity),
             properties: {
-              label: ['open-user-account.label', { ns: meta.id }],
+              label: ['open-user-account.label', { ns: meta.profile.key }],
               icon: 'ph--user--regular',
               disposition: 'menu',
               keyBinding: {
@@ -45,9 +45,9 @@ export default Capability.makeModule(
         return [
           Node.make({
             id: Account.id,
-            type: meta.id,
+            type: meta.profile.key,
             properties: {
-              label: ['account.label', { ns: meta.id }],
+              label: ['account.label', { ns: meta.profile.key }],
               icon: 'ph--user--regular',
               disposition: 'user-account',
               testId: 'clientPlugin.account',
@@ -61,27 +61,27 @@ export default Capability.makeModule(
               Node.make({
                 id: Account.Profile,
                 data: Account.Profile,
-                type: meta.id,
+                type: meta.profile.key,
                 properties: {
-                  label: ['profile.label', { ns: meta.id }],
+                  label: ['profile.label', { ns: meta.profile.key }],
                   icon: 'ph--user--regular',
                 },
               }),
               Node.make({
                 id: Account.Account,
                 data: Account.Account,
-                type: meta.id,
+                type: meta.profile.key,
                 properties: {
-                  label: ['account-panel.label', { ns: meta.id }],
+                  label: ['account-panel.label', { ns: meta.profile.key }],
                   icon: 'ph--identification-card--regular',
                 },
               }),
               Node.make({
                 id: Account.Devices,
                 data: Account.Devices,
-                type: meta.id,
+                type: meta.profile.key,
                 properties: {
-                  label: ['devices.label', { ns: meta.id }],
+                  label: ['devices.label', { ns: meta.profile.key }],
                   icon: 'ph--devices--regular',
                   testId: 'clientPlugin.devices',
                 },
@@ -89,21 +89,30 @@ export default Capability.makeModule(
               Node.make({
                 id: Account.Security,
                 data: Account.Security,
-                type: meta.id,
+                type: meta.profile.key,
                 properties: {
-                  label: ['security.label', { ns: meta.id }],
+                  label: ['security.label', { ns: meta.profile.key }],
                   icon: 'ph--key--regular',
                 },
               }),
               Node.make({
                 id: Account.Invitations,
                 data: Account.Invitations,
-                type: meta.id,
+                type: meta.profile.key,
                 properties: {
-                  label: ['invitations-panel.label', { ns: meta.id }],
+                  label: ['invitations-panel.label', { ns: meta.profile.key }],
                   icon: 'ph--ticket--regular',
                 },
               }),
+              Node.make({
+                id: Account.Usage,
+                data: Account.Usage,
+                type: meta.profile.key,
+                properties: {
+                  label: ['usage-panel.label', { ns: meta.profile.key }],
+                  icon: 'ph--chart-bar--regular',
+                },
+              }),
             ],
           }),
         ];

package/src/capabilities/layer-specs.ts

@@ -69,7 +69,7 @@ const DatabaseLayerSpec = LayerSpec.make(
         const space = client.spaces.get(context.space);
         invariant(space, `space not found on client: ${context.space}`);
         yield* Effect.promise(() => space.waitUntilReady());
-        return Layer.mergeAll(Database.layer(space.db), createFeedServiceLayer(space.queues));
+        return Layer.mergeAll(Database.layer(space.db), createFeedServiceLayer(space.db));
       }),
     ),
 );

package/src/capabilities/react-context.tsx

@@ -15,7 +15,7 @@ import { ClientCapabilities } from '#types';
 export default Capability.makeModule(() =>
   Effect.succeed(
     Capability.contributes(Capabilities.ReactContext, {
-      id: meta.id,
+      id: meta.profile.key,
       context: ({ children }: { children?: ReactNode }) => {
         const client = useCapability(ClientCapabilities.Client);
         return <ClientProvider client={client}>{children}</ClientProvider>;

package/src/capabilities/react-surface.tsx

@@ -18,6 +18,7 @@ import {
   RecoveryCodeDialog,
   RecoveryCredentialsContainer,
   ResetDialog,
+  UsageContainer,
 } from '#containers';
 import { Account, type ClientPluginOptions } from '#types';
 
@@ -57,6 +58,11 @@ export default Capability.makeModule(
         filter: AppSurface.literal(AppSurface.Article, Account.Invitations),
         component: () => <InvitationsContainer />,
       }),
+      Surface.create({
+        id: Account.Usage,
+        filter: AppSurface.literal(AppSurface.Article, Account.Usage),
+        component: () => <UsageContainer />,
+      }),
       Surface.create({
         id: JOIN_DIALOG,
         filter: AppSurface.component<ComponentProps<typeof JoinDialog>>(AppSurface.Dialog, JOIN_DIALOG),

package/src/commands/account/index.ts

@@ -0,0 +1,13 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Command from '@effect/cli/Command';
+
+import { login } from './login';
+import { logout } from './logout';
+
+export const account: Command.Command<any, any, any, any> = Command.make('account').pipe(
+  Command.withDescription('Log in and out of a DXOS identity.'),
+  Command.withSubcommands([login, logout]),
+);

package/src/commands/account/login/index.ts

@@ -0,0 +1,5 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+export * from './login';

package/src/commands/account/login/login.ts

@@ -0,0 +1,147 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Args from '@effect/cli/Args';
+import * as Command from '@effect/cli/Command';
+import * as Options from '@effect/cli/Options';
+import * as Prompt from '@effect/cli/Prompt';
+import * as Console from 'effect/Console';
+import * as Effect from 'effect/Effect';
+import * as Match from 'effect/Match';
+import * as Option from 'effect/Option';
+
+import { CommandConfig, performRecoveryOAuthFlow, print } from '@dxos/cli-util';
+import { type Client, ClientService } from '@dxos/client';
+import { Invitation, InvitationEncoder } from '@dxos/client/invitations';
+import { Context as DxContext } from '@dxos/context';
+import { HubHttpClient } from '@dxos/edge-client';
+import { invariant } from '@dxos/invariant';
+import { ATPROTO_OAUTH_SCOPES, OAuthProvider } from '@dxos/protocols';
+
+import { printIdentity, waitForState } from '../../halo/util';
+
+type LoginMethod = 'email' | 'atproto' | 'device-invitation' | 'recovery-code';
+
+const LOGIN_METHODS: LoginMethod[] = ['email', 'atproto', 'device-invitation', 'recovery-code'];
+
+const METHOD_CHOICES = [
+  { title: 'Email', value: 'email' as const },
+  { title: 'AT Protocol', value: 'atproto' as const },
+  { title: 'Device invitation', value: 'device-invitation' as const },
+  { title: 'Recovery code', value: 'recovery-code' as const },
+];
+
+const INPUT_PROMPT: Record<LoginMethod, string> = {
+  email: 'Email address',
+  atproto: 'atproto handle or DID (e.g. alice.bsky.social)',
+  'device-invitation': 'Invitation code or URL',
+  'recovery-code': 'Recovery code (seed phrase)',
+};
+
+export const login = Command.make(
+  'login',
+  {
+    method: Options.choice('method', LOGIN_METHODS).pipe(
+      Options.withDescription(
+        'Login method (email | atproto | device-invitation | recovery-code). Prompted if omitted.',
+      ),
+      Options.optional,
+    ),
+    input: Args.text({ name: 'input' }).pipe(
+      Args.withDescription('Method input: email address / atproto handle / invitation code / recovery code.'),
+      Args.optional,
+    ),
+  },
+  Effect.fn(function* ({ method, input }) {
+    const { json } = yield* CommandConfig;
+    const client = yield* ClientService;
+    // TODO(wittjosiah): How to surface this error to the user cleanly?
+    invariant(!client.halo.identity.get(), 'Already logged in. Run `dx account logout` first.');
+
+    const resolvedMethod: LoginMethod = Option.isSome(method)
+      ? method.value
+      : yield* Prompt.select({ message: 'Choose a login method:', choices: METHOD_CHOICES }).pipe(Prompt.run);
+
+    const resolvedInput = Option.isSome(input)
+      ? input.value
+      : yield* Prompt.text({ message: `${INPUT_PROMPT[resolvedMethod]}:` }).pipe(Prompt.run);
+
+    const identity = yield* Match.value(resolvedMethod).pipe(
+      Match.when('atproto', () => loginWithAtproto(client, resolvedInput)),
+      Match.when('email', () => loginWithEmail(client, resolvedInput)),
+      Match.when('recovery-code', () => loginWithRecoveryCode(client, resolvedInput)),
+      Match.when('device-invitation', () => loginWithDeviceInvitation(client, resolvedInput)),
+      Match.exhaustive,
+    );
+
+    if (json) {
+      yield* Console.log(
+        JSON.stringify({ identityDid: identity.did, displayName: identity.profile?.displayName }, null, 2),
+      );
+    } else {
+      yield* Console.log('Logged in successfully');
+      yield* Console.log(print(printIdentity({ identityDid: identity.did, profile: identity.profile })));
+    }
+  }),
+).pipe(Command.withDescription('Log in to an existing DXOS identity (same methods as Composer).'));
+
+/**
+ * atproto / Bluesky OAuth login: runs the gate recovery flow (local server + browser) and redeems
+ * the resulting one-time `recoveryProof` to admit this device into the existing identity's HALO.
+ */
+const loginWithAtproto = (client: Client, handle: string) =>
+  Effect.gen(function* () {
+    const edgeBaseUrl = client.config.values.runtime?.services?.edge?.url;
+    invariant(edgeBaseUrl, 'Edge services not configured (runtime.services.edge.url).');
+    const { recoveryProof } = yield* performRecoveryOAuthFlow({
+      edgeBaseUrl,
+      provider: OAuthProvider.ATPROTO,
+      scopes: ATPROTO_OAUTH_SCOPES,
+      loginHint: handle,
+    });
+    return yield* Effect.tryPromise(() => client.halo.recoverIdentity({ recoveryProof }));
+  });
+
+/** Recovery-code (seed phrase) login. */
+const loginWithRecoveryCode = (client: Client, recoveryCode: string) =>
+  Effect.tryPromise(() => client.halo.recoverIdentity({ recoveryCode }));
+
+/**
+ * Email login: hub-service inlines a one-time `token` for test emails and emails it out-of-band
+ * otherwise. Redeems the token to admit this device into HALO.
+ */
+const loginWithEmail = (client: Client, email: string) =>
+  Effect.gen(function* () {
+    const hubUrl = client.config.values?.runtime?.app?.env?.DX_HUB_URL;
+    invariant(hubUrl, 'Hub URL not configured (runtime.app.env.DX_HUB_URL).');
+    const hub = new HubHttpClient(hubUrl);
+    const { token: inlineToken } = yield* Effect.tryPromise(() => hub.login(DxContext.default(), { email }));
+    let token = inlineToken;
+    if (!token) {
+      yield* Console.log(`A login link was sent to ${email}. Paste the token from the email below.`);
+      token = yield* Prompt.text({ message: 'Login token' }).pipe(Prompt.run);
+    }
+    return yield* Effect.tryPromise(() => client.halo.recoverIdentity({ token }));
+  });
+
+/**
+ * Device-invitation login: joins an existing identity from another authorized device.
+ *
+ * NOTE: p2p networking does not work in bun — this method will likely hang waiting for the peer.
+ */
+const loginWithDeviceInvitation = (client: Client, encoded: string) =>
+  Effect.gen(function* () {
+    let code = encoded;
+    if (code.startsWith('http') || code.startsWith('socket')) {
+      code = new URL(code).searchParams.get('deviceInvitationCode') ?? code;
+    }
+    const invitation = client.halo.join(InvitationEncoder.decode(code));
+    yield* waitForState(invitation, Invitation.State.READY_FOR_AUTHENTICATION);
+    const authCode = yield* Prompt.text({ message: 'Enter the authentication code' }).pipe(Prompt.run);
+    yield* Effect.tryPromise(() => invitation.authenticate(authCode));
+    yield* waitForState(invitation, Invitation.State.SUCCESS);
+    const identity = client.halo.identity.get();
+    invariant(identity, 'Device invitation completed but no identity is present.');
+    return identity;
+  });

package/src/commands/account/logout/index.ts

@@ -0,0 +1,5 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+export * from './logout';

package/src/commands/account/logout/logout.ts

@@ -0,0 +1,49 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Command from '@effect/cli/Command';
+import * as Options from '@effect/cli/Options';
+import * as Prompt from '@effect/cli/Prompt';
+import * as Error from '@effect/platform/Error';
+import * as FileSystem from '@effect/platform/FileSystem';
+import * as Console from 'effect/Console';
+import * as Effect from 'effect/Effect';
+
+import { CommandConfig } from '@dxos/cli-util';
+import { DX_DATA, getProfilePath } from '@dxos/client-protocol';
+import { ConfigService } from '@dxos/config';
+
+export const logout = Command.make(
+  'logout',
+  {
+    force: Options.boolean('force', { ifPresent: true }).pipe(Options.withDescription('Skip confirmation prompt.')),
+  },
+  Effect.fnUntraced(function* ({ force }) {
+    const fs = yield* FileSystem.FileSystem;
+    const config = yield* ConfigService;
+    const { json, profile } = yield* CommandConfig;
+    const path = config.values.runtime?.client?.storage?.dataRoot ?? getProfilePath(DX_DATA, profile);
+    if (!force) {
+      const confirmed = yield* Prompt.confirm({
+        message: `Log out of profile (${profile})? This removes the local identity and data; spaces re-sync on next login.`,
+        initial: false,
+      }).pipe(Prompt.run);
+      if (!confirmed) {
+        return;
+      }
+    }
+
+    yield* fs.remove(path, { recursive: true }).pipe(
+      Effect.catchIf(
+        (e): e is Error.SystemError => e._tag === 'SystemError' && e.reason === 'NotFound',
+        () => Effect.void,
+      ),
+    );
+    if (json) {
+      yield* Console.log(JSON.stringify({ profile, loggedOut: true }, null, 2));
+    } else {
+      yield* Console.log(`Logged out of profile (${profile}).`);
+    }
+  }),
+).pipe(Command.withDescription('Log out of the current profile (clears the local identity and data).'));

package/src/commands/halo/create/create.ts

@@ -9,7 +9,7 @@ import * as Effect from 'effect/Effect';
 import * as Option from 'effect/Option';
 
 import { Capabilities, Plugin } from '@dxos/app-framework';
-import { PERSONAL_SPACE_TAG } from '@dxos/app-toolkit';
+import { AppSpace } from '@dxos/app-toolkit';
 import { CommandConfig, flushAndSync, spaceLayer } from '@dxos/cli-util';
 import { print } from '@dxos/cli-util';
 import { ClientService } from '@dxos/client';
@@ -45,7 +45,7 @@ export const handler = Effect.fn(function* ({
 
   // Create personal space for the CLI identity.
   const space = yield* Effect.promise(() =>
-    client.spaces.create({}, { tags: [PERSONAL_SPACE_TAG], membershipPolicy: MembershipPolicy.LOCKED }),
+    client.spaces.create({}, { tags: [AppSpace.PERSONAL_SPACE_TAG], membershipPolicy: MembershipPolicy.LOCKED }),
   );
   yield* Effect.promise(() => space.waitUntilReady());
   yield* Effect.promise(() => space.internal.setEdgeReplicationPreference(EdgeReplicationSetting.ENABLED));

package/src/commands/halo/index.ts

@@ -4,18 +4,18 @@
 
 import * as Command from '@effect/cli/Command';
 
-import { create } from './create';
 import { credential } from './credential';
 import { identity } from './identity';
-// TODO(wittjosiah): Omitted currently due to p2p networking not working in bun.
-// import { join } from './join';
 import { keys } from './keys';
-import { recover } from './recover';
 import { seed } from './seed';
-// import { share } from './share';
 import { update } from './update';
 
+// `create`, `join`, and `recover` are superseded by `dx account login`, which logs in to an
+// existing identity via the same methods as Composer (email / atproto / device-invitation /
+// recovery-code). Note: `join` was omitted and the `device-invitation` login method may hang —
+// both rely on p2p networking which does not work in bun.
+
 export const halo: Command.Command<any, any, any, any> = Command.make('halo').pipe(
   Command.withDescription('Manage HALO identity.'),
-  Command.withSubcommands([create, credential, identity, keys, recover, seed, update]),
+  Command.withSubcommands([credential, identity, keys, seed, update]),
 );

package/src/commands/halo/join/join.ts

@@ -7,14 +7,13 @@ import * as Command from '@effect/cli/Command';
 import * as Prompt from '@effect/cli/Prompt';
 import * as Console from 'effect/Console';
 import * as Effect from 'effect/Effect';
-import * as Match from 'effect/Match';
 
 import { CommandConfig, print } from '@dxos/cli-util';
 import { type Client, ClientService } from '@dxos/client';
-import { type AuthenticatingInvitationObservable, Invitation, InvitationEncoder } from '@dxos/client/invitations';
+import { Invitation, InvitationEncoder } from '@dxos/client/invitations';
 import { invariant } from '@dxos/invariant';
 
-import { printIdentity } from '../util';
+import { printIdentity, waitForState } from '../util';
 
 export const join = Command.make(
   'join',
@@ -75,13 +74,3 @@ const sendInvitation = Effect.fn(function* ({
   yield* waitForState(invitation, Invitation.State.SUCCESS);
   return client.halo.identity.get();
 });
-
-const waitForState = (invitation: AuthenticatingInvitationObservable, state: Invitation.State) =>
-  Effect.gen(function* () {
-    const latch = yield* Effect.makeLatch();
-    const subscription = invitation.subscribe((invitation) => {
-      Match.value(invitation.state).pipe(Match.when(state, () => Effect.runSync(latch.open)));
-    });
-    yield* latch.await;
-    subscription.unsubscribe();
-  });

package/src/commands/halo/util.ts

@@ -2,7 +2,11 @@
 // Copyright 2025 DXOS.org
 //
 
+import * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+
 import { FormBuilder } from '@dxos/cli-util';
+import { type AuthenticatingInvitationObservable, Invitation } from '@dxos/client/invitations';
 
 /**
  * Pretty prints an identity with ANSI colors.
@@ -13,3 +17,23 @@ export const printIdentity = (identity: { identityDid: string; profile?: { displ
     FormBuilder.set('displayName', identity.profile?.displayName ?? '<none>'),
     FormBuilder.build,
   );
+
+const TERMINAL_FAILURE_STATES = new Set([
+  Invitation.State.CANCELLED,
+  Invitation.State.TIMEOUT,
+  Invitation.State.ERROR,
+  Invitation.State.EXPIRED,
+]);
+
+/** Await an authenticating invitation reaching the given state. */
+export const waitForState = (invitation: AuthenticatingInvitationObservable, state: Invitation.State) =>
+  Effect.async<void, Error>((resume) => {
+    const subscription = invitation.subscribe((inv) => {
+      if (inv.state === state) {
+        resume(Effect.void);
+      } else if (TERMINAL_FAILURE_STATES.has(inv.state!)) {
+        resume(Effect.fail(new Error(`Invitation failed with state: ${Invitation.State[inv.state!]}`)));
+      }
+    });
+    return Effect.sync(() => subscription.unsubscribe());
+  }).pipe(Effect.timeout(Duration.minutes(3)));

package/src/commands/index.ts

@@ -2,6 +2,7 @@
 // Copyright 2025 DXOS.org
 //
 
+export * from './account';
 export * from './config';
 export * from './device';
 export * from './edge';

package/src/constants.ts

@@ -6,6 +6,6 @@ import { DXN } from '@dxos/keys';
 
 import { meta } from '#meta';
 
-export const JOIN_DIALOG = DXN.make(`${meta.id}.joinDialog`);
-export const RECOVERY_CODE_DIALOG = DXN.make(`${meta.id}.recoveryCodeDialog`);
-export const RESET_DIALOG = DXN.make(`${meta.id}.resetDialog`);
+export const JOIN_DIALOG = DXN.make(`${meta.profile.key}.joinDialog`);
+export const RECOVERY_CODE_DIALOG = DXN.make(`${meta.profile.key}.recoveryCodeDialog`);
+export const RESET_DIALOG = DXN.make(`${meta.profile.key}.resetDialog`);

package/src/containers/AccountContainer/AccountContainer.tsx

@@ -22,7 +22,7 @@ import { useHubHttpClient } from '../../state/use-hub-http';
 type AccountState = 'loading' | 'present' | 'missing' | 'error';
 
 export const AccountContainer = () => {
-  const { t } = useTranslation(meta.id);
+  const { t } = useTranslation(meta.profile.key);
   const identity = useIdentity();
   const { invokePromise } = useOperationInvoker();
   const accountCacheAtom = useCapability(ClientCapabilities.AccountCache);