@dxos/plugin-client 0.9.0 → 0.9.1-staging.ee54ba693a

package/dx.config.ts

@@ -0,0 +1,19 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import { Config2 } from '@dxos/app-framework/config';
+import { trim } from '@dxos/util';
+
+export default Config2.make({
+  plugin: {
+    key: 'org.dxos.plugin.client',
+    name: 'Client',
+    author: 'DXOS',
+    description: trim`
+      Core client connectivity and peer-to-peer networking infrastructure.
+      Manages identity, authentication, and real-time synchronization across devices.
+    `,
+    tags: ['system'],
+  },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/plugin-client",
-  "version": "0.9.0",
+  "version": "0.9.1-staging.ee54ba693a",
   "description": "DXOS Surface plugin for DXOS Client",
   "homepage": "https://dxos.org",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -99,65 +99,68 @@
   "types": "dist/types/src/index.d.ts",
   "files": [
     "dist",
+    "dx.config.ts",
     "src"
   ],
   "dependencies": {
     "@effect/cli": "0.75.2",
-    "@effect/platform": "0.96.1",
-    "effect": "3.21.3",
+    "@effect/platform": "0.96.2",
+    "effect": "3.21.4",
     "react-qr-rounded": "^1.0.0",
     "yaml": "^2.8.2",
-    "@dxos/app-framework": "0.9.0",
-    "@dxos/app-toolkit": "0.9.0",
-    "@dxos/async": "0.9.0",
-    "@dxos/cli-util": "0.9.0",
-    "@dxos/client-protocol": "0.9.0",
-    "@dxos/compute": "0.9.0",
-    "@dxos/client": "0.9.0",
-    "@dxos/client-services": "0.9.0",
-    "@dxos/config": "0.9.0",
-    "@dxos/context": "0.9.0",
-    "@dxos/echo": "0.9.0",
-    "@dxos/echo-protocol": "0.9.0",
-    "@dxos/edge-client": "0.9.0",
-    "@dxos/credentials": "0.9.0",
-    "@dxos/effect": "0.9.0",
-    "@dxos/invariant": "0.9.0",
-    "@dxos/functions": "0.9.0",
-    "@dxos/keys": "0.9.0",
-    "@dxos/plugin-graph": "0.9.0",
-    "@dxos/log": "0.9.0",
-    "@dxos/plugin-observability": "0.9.0",
-    "@dxos/protocols": "0.9.0",
-    "@dxos/react-client": "0.9.0",
-    "@dxos/react-ui-form": "0.9.0",
-    "@dxos/echo-client": "0.9.0",
-    "@dxos/util": "0.9.0",
-    "@dxos/react-ui-pickers": "0.9.0",
-    "@dxos/shell": "0.9.0"
+    "@dxos/app-framework": "0.9.1-staging.ee54ba693a",
+    "@dxos/app-toolkit": "0.9.1-staging.ee54ba693a",
+    "@dxos/async": "0.9.1-staging.ee54ba693a",
+    "@dxos/cli-util": "0.9.1-staging.ee54ba693a",
+    "@dxos/client-protocol": "0.9.1-staging.ee54ba693a",
+    "@dxos/config": "0.9.1-staging.ee54ba693a",
+    "@dxos/client-services": "0.9.1-staging.ee54ba693a",
+    "@dxos/compute": "0.9.1-staging.ee54ba693a",
+    "@dxos/context": "0.9.1-staging.ee54ba693a",
+    "@dxos/credentials": "0.9.1-staging.ee54ba693a",
+    "@dxos/echo": "0.9.1-staging.ee54ba693a",
+    "@dxos/echo-client": "0.9.1-staging.ee54ba693a",
+    "@dxos/echo-protocol": "0.9.1-staging.ee54ba693a",
+    "@dxos/edge-client": "0.9.1-staging.ee54ba693a",
+    "@dxos/effect": "0.9.1-staging.ee54ba693a",
+    "@dxos/client": "0.9.1-staging.ee54ba693a",
+    "@dxos/invariant": "0.9.1-staging.ee54ba693a",
+    "@dxos/functions": "0.9.1-staging.ee54ba693a",
+    "@dxos/keys": "0.9.1-staging.ee54ba693a",
+    "@dxos/log": "0.9.1-staging.ee54ba693a",
+    "@dxos/plugin-graph": "0.9.1-staging.ee54ba693a",
+    "@dxos/plugin-observability": "0.9.1-staging.ee54ba693a",
+    "@dxos/protocols": "0.9.1-staging.ee54ba693a",
+    "@dxos/react-ui-form": "0.9.1-staging.ee54ba693a",
+    "@dxos/react-client": "0.9.1-staging.ee54ba693a",
+    "@dxos/react-ui-list": "0.9.1-staging.ee54ba693a",
+    "@dxos/react-ui-pickers": "0.9.1-staging.ee54ba693a",
+    "@dxos/react-ui-syntax-highlighter": "0.9.1-staging.ee54ba693a",
+    "@dxos/util": "0.9.1-staging.ee54ba693a",
+    "@dxos/shell": "0.9.1-staging.ee54ba693a"
   },
   "devDependencies": {
     "@effect-atom/atom-react": "^0.5.0",
     "@effect/printer": "0.49.0",
     "@effect/printer-ansi": "0.49.0",
-    "@types/react": "~19.2.7",
+    "@types/react": "~19.2.17",
     "@types/react-dom": "~19.2.3",
-    "react": "~19.2.3",
-    "react-dom": "~19.2.3",
+    "react": "~19.2.7",
+    "react-dom": "~19.2.7",
     "vite": "^8.0.16",
-    "@dxos/plugin-testing": "0.9.0",
-    "@dxos/react-ui": "0.9.0",
-    "@dxos/storybook-utils": "0.9.0",
-    "@dxos/ui-theme": "0.9.0"
+    "@dxos/plugin-testing": "0.9.1-staging.ee54ba693a",
+    "@dxos/react-ui": "0.9.1-staging.ee54ba693a",
+    "@dxos/storybook-utils": "0.9.1-staging.ee54ba693a",
+    "@dxos/ui-theme": "0.9.1-staging.ee54ba693a"
   },
   "peerDependencies": {
     "@effect-atom/atom-react": "^0.5.0",
-    "@effect/platform": "0.96.1",
-    "effect": "3.21.3",
-    "react": "~19.2.3",
-    "react-dom": "~19.2.3",
-    "@dxos/react-ui": "0.9.0",
-    "@dxos/ui-theme": "0.9.0"
+    "@effect/platform": "0.96.2",
+    "effect": "3.21.4",
+    "react": "~19.2.7",
+    "react-dom": "~19.2.7",
+    "@dxos/react-ui": "0.9.1-staging.ee54ba693a",
+    "@dxos/ui-theme": "0.9.1-staging.ee54ba693a"
   },
   "publishConfig": {
     "access": "public"

package/src/ClientPlugin.node.ts

@@ -10,11 +10,11 @@ import { meta } from '#meta';
 import { ClientEvents } from '#types';
 import { type ClientPluginOptions } from '#types';
 
-import { config, device, edge, halo, profile } from './commands';
+import { account, config, device, edge, halo, profile } from './commands';
 
 export const ClientPlugin = Plugin.define<ClientPluginOptions>(meta).pipe(
   // TODO(wittjosiah): Could some of these commands make use of operations?
-  AppPlugin.addCommandModule({ commands: [config, device, edge, halo, profile] }),
+  AppPlugin.addCommandModule({ commands: [account, config, device, edge, halo, profile] }),
   AppPlugin.addOperationHandlerModule({ activate: OperationHandler }),
   Plugin.addModule((options) => ({
     id: Capability.getModuleTag(Client),

package/src/ClientPlugin.test.ts

@@ -11,7 +11,7 @@ import { createComposerTestApp } from '@dxos/plugin-testing/harness';
 
 import { meta } from './meta';
 
-const moduleId = (name: string) => `${meta.id}.module.${name}`;
+const moduleId = (name: string) => `${meta.profile.key}.module.${name}`;
 
 describe('ClientPlugin', () => {
   test('modules activate on the expected events', async ({ expect }) => {

package/src/capabilities/account-cache.ts

@@ -7,9 +7,7 @@ import * as Effect from 'effect/Effect';
 import { Capability } from '@dxos/app-framework';
 import { createKvsStore } from '@dxos/effect';
 
-import { ClientCapabilities } from '#types';
-
-import { AccountCache } from '../state/account-cache';
+import { AccountCache, ClientCapabilities } from '#types';
 
 export default Capability.makeModule(() =>
   Effect.succeed(

package/src/capabilities/app-graph-builder.ts

@@ -25,7 +25,7 @@ export default Capability.makeModule(
             id: 'openUserAccount',
             data: () => Operation.invoke(ClientOperation.ShareIdentity),
             properties: {
-              label: ['open-user-account.label', { ns: meta.id }],
+              label: ['open-user-account.label', { ns: meta.profile.key }],
               icon: 'ph--user--regular',
               disposition: 'menu',
               keyBinding: {
@@ -37,77 +37,87 @@ export default Capability.makeModule(
             },
           },
         ]),
-      connector: Effect.fnUntraced(function* (node, get) {
-        const client = yield* Capability.get(ClientCapabilities.Client);
-        const identity = get(CreateAtom.fromObservable(client.halo.identity));
-        const status = get(CreateAtom.fromObservable(client.mesh.networkStatus));
+      connector: (node, get) =>
+        Effect.gen(function* () {
+          const client = yield* Capability.get(ClientCapabilities.Client);
+          const identity = get(CreateAtom.fromObservable(client.halo.identity));
+          const status = get(CreateAtom.fromObservable(client.mesh.networkStatus));
 
-        return [
-          Node.make({
-            id: Account.id,
-            type: meta.id,
-            properties: {
-              label: ['account.label', { ns: meta.id }],
-              icon: 'ph--user--regular',
-              disposition: 'user-account',
-              testId: 'clientPlugin.account',
-              // NOTE: This currently needs to be the identity key because the fallback is generated from hex.
-              userId: identity?.identityKey.toHex(),
-              hue: identity?.profile?.data?.hue,
-              emoji: identity?.profile?.data?.emoji,
-              status: status.swarm === ConnectionState.OFFLINE ? 'error' : 'active',
-            },
-            nodes: [
-              Node.make({
-                id: Account.Profile,
-                data: Account.Profile,
-                type: meta.id,
-                properties: {
-                  label: ['profile.label', { ns: meta.id }],
-                  icon: 'ph--user--regular',
-                },
-              }),
-              Node.make({
-                id: Account.Account,
-                data: Account.Account,
-                type: meta.id,
-                properties: {
-                  label: ['account-panel.label', { ns: meta.id }],
-                  icon: 'ph--identification-card--regular',
-                },
-              }),
-              Node.make({
-                id: Account.Devices,
-                data: Account.Devices,
-                type: meta.id,
-                properties: {
-                  label: ['devices.label', { ns: meta.id }],
-                  icon: 'ph--devices--regular',
-                  testId: 'clientPlugin.devices',
-                },
-              }),
-              Node.make({
-                id: Account.Security,
-                data: Account.Security,
-                type: meta.id,
-                properties: {
-                  label: ['security.label', { ns: meta.id }],
-                  icon: 'ph--key--regular',
-                },
-              }),
-              Node.make({
-                id: Account.Invitations,
-                data: Account.Invitations,
-                type: meta.id,
-                properties: {
-                  label: ['invitations-panel.label', { ns: meta.id }],
-                  icon: 'ph--ticket--regular',
-                },
-              }),
-            ],
-          }),
-        ];
-      }),
+          return [
+            Node.make({
+              id: Account.id,
+              type: meta.profile.key,
+              properties: {
+                label: ['account.label', { ns: meta.profile.key }],
+                icon: 'ph--user--regular',
+                disposition: 'user-account',
+                testId: 'clientPlugin.account',
+                // NOTE: This currently needs to be the identity key because the fallback is generated from hex.
+                userId: identity?.identityKey.toHex(),
+                hue: identity?.profile?.data?.hue,
+                emoji: identity?.profile?.data?.emoji,
+                status: status.swarm === ConnectionState.OFFLINE ? 'error' : 'active',
+              },
+              nodes: [
+                Node.make({
+                  id: Account.Profile,
+                  data: Account.Profile,
+                  type: meta.profile.key,
+                  properties: {
+                    label: ['profile.label', { ns: meta.profile.key }],
+                    icon: 'ph--user--regular',
+                  },
+                }),
+                Node.make({
+                  id: Account.Account,
+                  data: Account.Account,
+                  type: meta.profile.key,
+                  properties: {
+                    label: ['account-panel.label', { ns: meta.profile.key }],
+                    icon: 'ph--identification-card--regular',
+                  },
+                }),
+                Node.make({
+                  id: Account.Devices,
+                  data: Account.Devices,
+                  type: meta.profile.key,
+                  properties: {
+                    label: ['devices.label', { ns: meta.profile.key }],
+                    icon: 'ph--devices--regular',
+                    testId: 'clientPlugin.devices',
+                  },
+                }),
+                Node.make({
+                  id: Account.Security,
+                  data: Account.Security,
+                  type: meta.profile.key,
+                  properties: {
+                    label: ['security.label', { ns: meta.profile.key }],
+                    icon: 'ph--key--regular',
+                  },
+                }),
+                Node.make({
+                  id: Account.Invitations,
+                  data: Account.Invitations,
+                  type: meta.profile.key,
+                  properties: {
+                    label: ['invitations-panel.label', { ns: meta.profile.key }],
+                    icon: 'ph--ticket--regular',
+                  },
+                }),
+                Node.make({
+                  id: Account.Usage,
+                  data: Account.Usage,
+                  type: meta.profile.key,
+                  properties: {
+                    label: ['usage-panel.label', { ns: meta.profile.key }],
+                    icon: 'ph--chart-bar--regular',
+                  },
+                }),
+              ],
+            }),
+          ];
+        }).pipe(Effect.orDie),
     });
 
     return Capability.contributes(AppCapabilities.AppGraphBuilder, extensions);

package/src/capabilities/layer-specs.ts

@@ -8,8 +8,7 @@ import * as Layer from 'effect/Layer';
 import { Capabilities, Capability } from '@dxos/app-framework';
 import { ClientService } from '@dxos/client';
 import { Credential, LayerSpec } from '@dxos/compute';
-import { Database, Feed } from '@dxos/echo';
-import { createFeedServiceLayer } from '@dxos/echo-client';
+import { Database } from '@dxos/echo';
 import { credentialsLayerFromDatabase } from '@dxos/functions';
 import { invariant } from '@dxos/invariant';
 
@@ -20,8 +19,7 @@ import { ClientCapabilities } from '#types';
 //
 // Contributes the core client/space service layer specs:
 //   - {@link ClientService} (application affinity).
-//   - {@link Database.Service}, {@link Feed.FeedService},
-//     {@link Credential.CredentialsService} (space affinity).
+//   - {@link Database.Service}, {@link Credential.CredentialsService} (space affinity).
 //
 // Specs are declared at module level and resolve the underlying
 // {@link ClientCapabilities.Client} through the Effect layer graph (via
@@ -59,7 +57,7 @@ const DatabaseLayerSpec = LayerSpec.make(
   {
     affinity: 'space',
     requires: [ClientService],
-    provides: [Database.Service, Feed.FeedService],
+    provides: [Database.Service],
   },
   (context) =>
     Layer.unwrapEffect(
@@ -69,7 +67,7 @@ const DatabaseLayerSpec = LayerSpec.make(
         const space = client.spaces.get(context.space);
         invariant(space, `space not found on client: ${context.space}`);
         yield* Effect.promise(() => space.waitUntilReady());
-        return Layer.mergeAll(Database.layer(space.db), createFeedServiceLayer(space.queues));
+        return Database.layer(space.db);
       }),
     ),
 );

package/src/capabilities/react-context.tsx

@@ -15,7 +15,7 @@ import { ClientCapabilities } from '#types';
 export default Capability.makeModule(() =>
   Effect.succeed(
     Capability.contributes(Capabilities.ReactContext, {
-      id: meta.id,
+      id: meta.profile.key,
       context: ({ children }: { children?: ReactNode }) => {
         const client = useCapability(ClientCapabilities.Client);
         return <ClientProvider client={client}>{children}</ClientProvider>;

package/src/capabilities/react-surface.tsx

@@ -18,6 +18,7 @@ import {
   RecoveryCodeDialog,
   RecoveryCredentialsContainer,
   ResetDialog,
+  UsageContainer,
 } from '#containers';
 import { Account, type ClientPluginOptions } from '#types';
 
@@ -57,6 +58,11 @@ export default Capability.makeModule(
         filter: AppSurface.literal(AppSurface.Article, Account.Invitations),
         component: () => <InvitationsContainer />,
       }),
+      Surface.create({
+        id: Account.Usage,
+        filter: AppSurface.literal(AppSurface.Article, Account.Usage),
+        component: () => <UsageContainer />,
+      }),
       Surface.create({
         id: JOIN_DIALOG,
         filter: AppSurface.component<ComponentProps<typeof JoinDialog>>(AppSurface.Dialog, JOIN_DIALOG),

package/src/commands/account/index.ts

@@ -0,0 +1,13 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Command from '@effect/cli/Command';
+
+import { login } from './login';
+import { logout } from './logout';
+
+export const account: Command.Command<any, any, any, any> = Command.make('account').pipe(
+  Command.withDescription('Log in and out of a DXOS identity.'),
+  Command.withSubcommands([login, logout]),
+);

package/src/commands/account/login/index.ts

@@ -0,0 +1,5 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+export * from './login';

package/src/commands/account/login/login.ts

@@ -0,0 +1,147 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Args from '@effect/cli/Args';
+import * as Command from '@effect/cli/Command';
+import * as Options from '@effect/cli/Options';
+import * as Prompt from '@effect/cli/Prompt';
+import * as Console from 'effect/Console';
+import * as Effect from 'effect/Effect';
+import * as Match from 'effect/Match';
+import * as Option from 'effect/Option';
+
+import { CommandConfig, performRecoveryOAuthFlow, print } from '@dxos/cli-util';
+import { type Client, ClientService } from '@dxos/client';
+import { Invitation, InvitationEncoder } from '@dxos/client/invitations';
+import { Context as DxContext } from '@dxos/context';
+import { HubHttpClient } from '@dxos/edge-client';
+import { invariant } from '@dxos/invariant';
+import { ATPROTO_OAUTH_SCOPES, OAuthProvider } from '@dxos/protocols';
+
+import { printIdentity, waitForState } from '../../halo/util';
+
+type LoginMethod = 'email' | 'atproto' | 'device-invitation' | 'recovery-code';
+
+const LOGIN_METHODS: LoginMethod[] = ['email', 'atproto', 'device-invitation', 'recovery-code'];
+
+const METHOD_CHOICES = [
+  { title: 'Email', value: 'email' as const },
+  { title: 'AT Protocol', value: 'atproto' as const },
+  { title: 'Device invitation', value: 'device-invitation' as const },
+  { title: 'Recovery code', value: 'recovery-code' as const },
+];
+
+const INPUT_PROMPT: Record<LoginMethod, string> = {
+  'email': 'Email address',
+  'atproto': 'atproto handle or DID (e.g. alice.bsky.social)',
+  'device-invitation': 'Invitation code or URL',
+  'recovery-code': 'Recovery code (seed phrase)',
+};
+
+export const login = Command.make(
+  'login',
+  {
+    method: Options.choice('method', LOGIN_METHODS).pipe(
+      Options.withDescription(
+        'Login method (email | atproto | device-invitation | recovery-code). Prompted if omitted.',
+      ),
+      Options.optional,
+    ),
+    input: Args.text({ name: 'input' }).pipe(
+      Args.withDescription('Method input: email address / atproto handle / invitation code / recovery code.'),
+      Args.optional,
+    ),
+  },
+  Effect.fn(function* ({ method, input }) {
+    const { json } = yield* CommandConfig;
+    const client = yield* ClientService;
+    // TODO(wittjosiah): How to surface this error to the user cleanly?
+    invariant(!client.halo.identity.get(), 'Already logged in. Run `dx account logout` first.');
+
+    const resolvedMethod: LoginMethod = Option.isSome(method)
+      ? method.value
+      : yield* Prompt.select({ message: 'Choose a login method:', choices: METHOD_CHOICES }).pipe(Prompt.run);
+
+    const resolvedInput = Option.isSome(input)
+      ? input.value
+      : yield* Prompt.text({ message: `${INPUT_PROMPT[resolvedMethod]}:` }).pipe(Prompt.run);
+
+    const identity = yield* Match.value(resolvedMethod).pipe(
+      Match.when('atproto', () => loginWithAtproto(client, resolvedInput)),
+      Match.when('email', () => loginWithEmail(client, resolvedInput)),
+      Match.when('recovery-code', () => loginWithRecoveryCode(client, resolvedInput)),
+      Match.when('device-invitation', () => loginWithDeviceInvitation(client, resolvedInput)),
+      Match.exhaustive,
+    );
+
+    if (json) {
+      yield* Console.log(
+        JSON.stringify({ identityDid: identity.did, displayName: identity.profile?.displayName }, null, 2),
+      );
+    } else {
+      yield* Console.log('Logged in successfully');
+      yield* Console.log(print(printIdentity({ identityDid: identity.did, profile: identity.profile })));
+    }
+  }),
+).pipe(Command.withDescription('Log in to an existing DXOS identity (same methods as Composer).'));
+
+/**
+ * atproto / Bluesky OAuth login: runs the gate recovery flow (local server + browser) and redeems
+ * the resulting one-time `recoveryProof` to admit this device into the existing identity's HALO.
+ */
+const loginWithAtproto = (client: Client, handle: string) =>
+  Effect.gen(function* () {
+    const edgeBaseUrl = client.config.values.runtime?.services?.edge?.url;
+    invariant(edgeBaseUrl, 'Edge services not configured (runtime.services.edge.url).');
+    const { recoveryProof } = yield* performRecoveryOAuthFlow({
+      edgeBaseUrl,
+      provider: OAuthProvider.ATPROTO,
+      scopes: ATPROTO_OAUTH_SCOPES,
+      loginHint: handle,
+    });
+    return yield* Effect.tryPromise(() => client.halo.recoverIdentity({ recoveryProof }));
+  });
+
+/** Recovery-code (seed phrase) login. */
+const loginWithRecoveryCode = (client: Client, recoveryCode: string) =>
+  Effect.tryPromise(() => client.halo.recoverIdentity({ recoveryCode }));
+
+/**
+ * Email login: hub-service inlines a one-time `token` for test emails and emails it out-of-band
+ * otherwise. Redeems the token to admit this device into HALO.
+ */
+const loginWithEmail = (client: Client, email: string) =>
+  Effect.gen(function* () {
+    const hubUrl = client.config.values?.runtime?.app?.env?.DX_HUB_URL;
+    invariant(hubUrl, 'Hub URL not configured (runtime.app.env.DX_HUB_URL).');
+    const hub = new HubHttpClient(hubUrl);
+    const { token: inlineToken } = yield* Effect.tryPromise(() => hub.login(DxContext.default(), { email }));
+    let token = inlineToken;
+    if (!token) {
+      yield* Console.log(`A login link was sent to ${email}. Paste the token from the email below.`);
+      token = yield* Prompt.text({ message: 'Login token' }).pipe(Prompt.run);
+    }
+    return yield* Effect.tryPromise(() => client.halo.recoverIdentity({ token }));
+  });
+
+/**
+ * Device-invitation login: joins an existing identity from another authorized device.
+ *
+ * NOTE: p2p networking does not work in bun — this method will likely hang waiting for the peer.
+ */
+const loginWithDeviceInvitation = (client: Client, encoded: string) =>
+  Effect.gen(function* () {
+    let code = encoded;
+    if (code.startsWith('http') || code.startsWith('socket')) {
+      code = new URL(code).searchParams.get('deviceInvitationCode') ?? code;
+    }
+    const invitation = client.halo.join(InvitationEncoder.decode(code));
+    yield* waitForState(invitation, Invitation.State.READY_FOR_AUTHENTICATION);
+    const authCode = yield* Prompt.text({ message: 'Enter the authentication code' }).pipe(Prompt.run);
+    yield* Effect.tryPromise(() => invitation.authenticate(authCode));
+    yield* waitForState(invitation, Invitation.State.SUCCESS);
+    const identity = client.halo.identity.get();
+    invariant(identity, 'Device invitation completed but no identity is present.');
+    return identity;
+  });

package/src/commands/account/logout/index.ts

@@ -0,0 +1,5 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+export * from './logout';

package/src/commands/account/logout/logout.ts

@@ -0,0 +1,49 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Command from '@effect/cli/Command';
+import * as Options from '@effect/cli/Options';
+import * as Prompt from '@effect/cli/Prompt';
+import * as Error from '@effect/platform/Error';
+import * as FileSystem from '@effect/platform/FileSystem';
+import * as Console from 'effect/Console';
+import * as Effect from 'effect/Effect';
+
+import { CommandConfig } from '@dxos/cli-util';
+import { DX_DATA, getProfilePath } from '@dxos/client-protocol';
+import { ConfigService } from '@dxos/config';
+
+export const logout = Command.make(
+  'logout',
+  {
+    force: Options.boolean('force', { ifPresent: true }).pipe(Options.withDescription('Skip confirmation prompt.')),
+  },
+  Effect.fnUntraced(function* ({ force }) {
+    const fs = yield* FileSystem.FileSystem;
+    const config = yield* ConfigService;
+    const { json, profile } = yield* CommandConfig;
+    const path = config.values.runtime?.client?.storage?.dataRoot ?? getProfilePath(DX_DATA, profile);
+    if (!force) {
+      const confirmed = yield* Prompt.confirm({
+        message: `Log out of profile (${profile})? This removes the local identity and data; spaces re-sync on next login.`,
+        initial: false,
+      }).pipe(Prompt.run);
+      if (!confirmed) {
+        return;
+      }
+    }
+
+    yield* fs.remove(path, { recursive: true }).pipe(
+      Effect.catchIf(
+        (e): e is Error.SystemError => e._tag === 'SystemError' && e.reason === 'NotFound',
+        () => Effect.void,
+      ),
+    );
+    if (json) {
+      yield* Console.log(JSON.stringify({ profile, loggedOut: true }, null, 2));
+    } else {
+      yield* Console.log(`Logged out of profile (${profile}).`);
+    }
+  }),
+).pipe(Command.withDescription('Log out of the current profile (clears the local identity and data).'));