@dxos/client-services 0.4.10-main.3e35a2f → 0.4.10-main.403e461

package/dist/lib/node/{chunk-3T6D6GIB.cjs → chunk-KGGJXJON.cjs}

@@ -26,8 +26,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var chunk_3T6D6GIB_exports = {};
-__export(chunk_3T6D6GIB_exports, {
+var chunk_KGGJXJON_exports = {};
+__export(chunk_KGGJXJON_exports, {
   ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   ClientServicesProviderResource: () => ClientServicesProviderResource,
@@ -48,6 +48,7 @@ __export(chunk_3T6D6GIB_exports, {
   SpaceInvitationProtocol: () => SpaceInvitationProtocol,
   SpacesServiceImpl: () => SpacesServiceImpl,
   TrustedKeySetAuthVerifier: () => TrustedKeySetAuthVerifier,
+  createAdmissionKeypair: () => createAdmissionKeypair,
   createAuthProvider: () => createAuthProvider,
   createCollectDiagnosticsBroadcastHandler: () => createCollectDiagnosticsBroadcastHandler,
   createCollectDiagnosticsBroadcastSender: () => createCollectDiagnosticsBroadcastSender,
@@ -64,7 +65,7 @@ __export(chunk_3T6D6GIB_exports, {
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo
 });
-module.exports = __toCommonJS(chunk_3T6D6GIB_exports);
+module.exports = __toCommonJS(chunk_KGGJXJON_exports);
 var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_feed_store = require("@dxos/feed-store");
@@ -119,6 +120,7 @@ var import_async7 = require("@dxos/async");
 var import_client_protocol2 = require("@dxos/client-protocol");
 var import_context4 = require("@dxos/context");
 var import_credentials7 = require("@dxos/credentials");
+var import_crypto = require("@dxos/crypto");
 var import_invariant5 = require("@dxos/invariant");
 var import_keys5 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
@@ -128,6 +130,7 @@ var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_async8 = require("@dxos/async");
 var import_context5 = require("@dxos/context");
+var import_crypto2 = require("@dxos/crypto");
 var import_invariant6 = require("@dxos/invariant");
 var import_keys6 = require("@dxos/keys");
 var import_log5 = require("@dxos/log");
@@ -233,7 +236,7 @@ var import_async16 = require("@dxos/async");
 var import_client_protocol4 = require("@dxos/client-protocol");
 var import_context11 = require("@dxos/context");
 var import_echo_pipeline5 = require("@dxos/echo-pipeline");
-var E = __toESM(require("@dxos/echo-schema"));
+var import_echo_schema = require("@dxos/echo-schema");
 var import_indexing2 = require("@dxos/indexing");
 var import_invariant15 = require("@dxos/invariant");
 var import_keys11 = require("@dxos/keys");
@@ -1485,6 +1488,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
     this._callbacks = _callbacks;
     this._ctx = new import_context5.Context();
     this._remoteOptionsTrigger = new import_async8.Trigger();
+    this._challenge = void 0;
     this.invitation = void 0;
     this.guestProfile = void 0;
     this.authenticationPassed = false;
@@ -1499,7 +1503,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
         options: async (options) => {
           (0, import_invariant6.invariant)(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 87,
+            L: 90,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1516,7 +1520,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 96,
+            L: 99,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1526,7 +1530,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               invitationId
             }, {
               F: __dxlog_file6,
-              L: 100,
+              L: 103,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1540,7 +1544,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             guestProfile: profile
           }, {
             F: __dxlog_file6,
-            L: 109,
+            L: 112,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1549,25 +1553,27 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             ...this.invitation,
             state: import_services4.Invitation.State.READY_FOR_AUTHENTICATION
           });
+          this._challenge = this.invitation.authMethod === import_services4.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? (0, import_crypto2.randomBytes)(32) : void 0;
           import_log5.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols5.trace.end({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 116,
+            L: 122,
             S: this,
             C: (f, a) => f(...a)
           });
           return {
-            authMethod: this.invitation.authMethod
+            authMethod: this.invitation.authMethod,
+            challenge: this._challenge
           };
         },
-        authenticate: async ({ authCode: code }) => {
+        authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = import_keys6.PublicKey.random().toHex();
           import_log5.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols5.trace.begin({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 124,
+            L: 131,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1575,14 +1581,14 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             authCode: code
           }, {
             F: __dxlog_file6,
-            L: 125,
+            L: 132,
             S: this,
             C: (f, a) => f(...a)
           });
           let status = import_invitations2.AuthenticationResponse.Status.OK;
           (0, import_invariant6.invariant)(this.invitation, "Invitation is not set.", {
             F: __dxlog_file6,
-            L: 128,
+            L: 135,
             S: this,
             A: [
               "this.invitation",
@@ -1593,7 +1599,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             case import_services4.Invitation.AuthMethod.NONE: {
               (0, import_log5.log)("authentication not required", void 0, {
                 F: __dxlog_file6,
-                L: 131,
+                L: 138,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1613,12 +1619,25 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               }
               break;
             }
+            case import_services4.Invitation.AuthMethod.KNOWN_PUBLIC_KEY: {
+              if (!this.invitation.guestKeypair) {
+                status = import_invitations2.AuthenticationResponse.Status.INTERNAL_ERROR;
+                break;
+              }
+              const isSignatureValid = this._challenge && (0, import_crypto2.verify)(this._challenge, Buffer.from(signedChallenge ?? []), this.invitation.guestKeypair.publicKey.asBuffer());
+              if (isSignatureValid) {
+                this.authenticationPassed = true;
+              } else {
+                status = import_invitations2.AuthenticationResponse.Status.INVALID_SIGNATURE;
+              }
+              break;
+            }
             default: {
               import_log5.log.error("invalid authentication method", {
                 authMethod: this.invitation.authMethod
               }, {
                 F: __dxlog_file6,
-                L: 149,
+                L: 176,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1633,7 +1652,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             }
           }), {
             F: __dxlog_file6,
-            L: 155,
+            L: 182,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1647,14 +1666,14 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 161,
+            L: 188,
             S: this,
             C: (f, a) => f(...a)
           });
           try {
             (0, import_invariant6.invariant)(this.invitation, "Invitation is not set.", {
               F: __dxlog_file6,
-              L: 164,
+              L: 191,
               S: this,
               A: [
                 "this.invitation",
@@ -1669,7 +1688,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               id: traceId
             }), {
               F: __dxlog_file6,
-              L: 172,
+              L: 199,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1726,7 +1745,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
         options: async (options) => {
           (0, import_invariant6.invariant)(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 239,
+            L: 266,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1753,7 +1772,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     try {
       (0, import_log5.log)("begin options", void 0, {
         F: __dxlog_file6,
-        L: 260,
+        L: 287,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1765,7 +1784,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
       }));
       (0, import_log5.log)("end options", void 0, {
         F: __dxlog_file6,
-        L: 263,
+        L: 290,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1779,7 +1798,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     } catch (err) {
       (0, import_log5.log)("openError", err, {
         F: __dxlog_file6,
-        L: 273,
+        L: 300,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1789,7 +1808,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
   async onClose() {
     (0, import_log5.log)("onClose", void 0, {
       F: __dxlog_file6,
-      L: 279,
+      L: 306,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1806,11 +1825,11 @@ var InvitationsHandler = class {
     this._networkManager = _networkManager;
   }
   createInvitation(protocol, options) {
-    const { invitationId = import_keys5.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys5.PublicKey.random(), persistent = true, created = /* @__PURE__ */ new Date(), lifetime = 86400, multiUse = false } = options ?? {};
+    const { invitationId = import_keys5.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys5.PublicKey.random(), persistent = options?.authMethod !== import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
     const authCode = options?.authCode ?? (authMethod === import_services3.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials7.generatePasscode)(import_client_protocol2.AUTHENTICATION_CODE_LENGTH) : void 0);
     (0, import_invariant5.invariant)(protocol, void 0, {
       F: __dxlog_file7,
-      L: 85,
+      L: 87,
       S: this,
       A: [
         "protocol",
@@ -1825,7 +1844,8 @@ var InvitationsHandler = class {
       swarmKey,
       authCode,
       timeout,
-      persistent: persistent && type !== import_services3.Invitation.Type.OFFLINE,
+      persistent: persistent && type !== import_services3.Invitation.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
       created,
       lifetime,
       multiUse,
@@ -1843,7 +1863,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 111,
+        L: 115,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1868,7 +1888,7 @@ var InvitationsHandler = class {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             (0, import_invariant5.invariant)(deviceKey, void 0, {
               F: __dxlog_file7,
-              L: 132,
+              L: 136,
               S: this,
               A: [
                 "deviceKey",
@@ -1891,7 +1911,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 150,
+                L: 154,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1899,7 +1919,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 151,
+                L: 155,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1915,7 +1935,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 154,
+                L: 158,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1927,7 +1947,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 156,
+                L: 160,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1937,7 +1957,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 159,
+                  L: 163,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1948,7 +1968,7 @@ var InvitationsHandler = class {
               } else {
                 import_log4.log.error("failed", err, {
                   F: __dxlog_file7,
-                  L: 162,
+                  L: 166,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1959,7 +1979,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 165,
+                L: 169,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1980,7 +2000,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 180,
+              L: 184,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1991,7 +2011,7 @@ var InvitationsHandler = class {
           } else {
             import_log4.log.error("failed", err, {
               F: __dxlog_file7,
-              L: 183,
+              L: 187,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2005,7 +2025,7 @@ var InvitationsHandler = class {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
         import_log4.log.warn("invitation has already expired", void 0, {
           F: __dxlog_file7,
-          L: 194,
+          L: 198,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2056,7 +2076,7 @@ var InvitationsHandler = class {
     const { timeout = import_client_protocol2.INVITATION_TIMEOUT } = invitation;
     (0, import_invariant5.invariant)(protocol, void 0, {
       F: __dxlog_file7,
-      L: 248,
+      L: 252,
       S: this,
       A: [
         "protocol",
@@ -2066,7 +2086,7 @@ var InvitationsHandler = class {
     if (deviceProfile) {
       (0, import_invariant5.invariant)(invitation.kind === import_services3.Invitation.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
         F: __dxlog_file7,
-        L: 252,
+        L: 256,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -2081,7 +2101,7 @@ var InvitationsHandler = class {
     const setState = (newData) => {
       (0, import_invariant5.invariant)(newData.state !== void 0, void 0, {
         F: __dxlog_file7,
-        L: 263,
+        L: 267,
         S: this,
         A: [
           "newData.state !== undefined",
@@ -2101,7 +2121,7 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             F: __dxlog_file7,
-            L: 271,
+            L: 275,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2111,7 +2131,7 @@ var InvitationsHandler = class {
         } else {
           import_log4.log.warn("auth failed", err, {
             F: __dxlog_file7,
-            L: 274,
+            L: 278,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2125,7 +2145,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 282,
+        L: 286,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2140,7 +2160,7 @@ var InvitationsHandler = class {
               currentState
             }, {
               F: __dxlog_file7,
-              L: 292,
+              L: 296,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2155,7 +2175,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 301,
+                L: 305,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2167,7 +2187,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 309,
+                L: 313,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2178,7 +2198,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 313,
+                L: 317,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2188,62 +2208,28 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 F: __dxlog_file7,
-                L: 317,
+                L: 321,
                 S: this,
                 C: (f, a) => f(...a)
               });
               invitation.authMethod = introductionResponse.authMethod;
               if (isAuthenticationRequired(invitation)) {
-                for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  (0, import_log4.log)("guest waiting for authentication code...", void 0, {
-                    F: __dxlog_file7,
-                    L: 323,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
-                  });
-                  const authCode = await authenticated.wait({
-                    timeout
-                  });
-                  (0, import_log4.log)("sending authentication request", void 0, {
-                    F: __dxlog_file7,
-                    L: 327,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: import_services3.Invitation.State.AUTHENTICATING
-                  });
-                  const response = await extension.rpc.InvitationHostService.authenticate({
-                    authCode
-                  });
-                  if (response.status === void 0 || response.status === import_invitations.AuthenticationResponse.Status.OK) {
+                switch (invitation.authMethod) {
+                  case import_services3.Invitation.AuthMethod.SHARED_SECRET:
+                    await this._handleGuestOtpAuth(extension, setState, authenticated, {
+                      timeout
+                    });
+                    break;
+                  case import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY:
+                    await this._handleGuestKpkAuth(extension, setState, invitation, introductionResponse);
                     break;
-                  }
-                  if (response.status === import_invitations.AuthenticationResponse.Status.INVALID_OTP) {
-                    if (attempt === MAX_OTP_ATTEMPTS) {
-                      throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
-                    } else {
-                      (0, import_log4.log)("retrying invalid code", {
-                        attempt
-                      }, {
-                        F: __dxlog_file7,
-                        L: 338,
-                        S: this,
-                        C: (f, a) => f(...a)
-                      });
-                      authenticated.reset();
-                    }
-                  }
                 }
               }
               (0, import_log4.log)("request admission", {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 346,
+                L: 337,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2255,7 +2241,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 357,
+                L: 348,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2268,7 +2254,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 359,
+                L: 350,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2278,7 +2264,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 362,
+                  L: 353,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2288,7 +2274,7 @@ var InvitationsHandler = class {
               } else {
                 (0, import_log4.log)("auth failed", err, {
                   F: __dxlog_file7,
-                  L: 365,
+                  L: 356,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2299,7 +2285,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 368,
+                L: 359,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2317,7 +2303,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 379,
+              L: 370,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2327,7 +2313,7 @@ var InvitationsHandler = class {
           } else {
             (0, import_log4.log)("auth failed", err, {
               F: __dxlog_file7,
-              L: 382,
+              L: 373,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2344,7 +2330,7 @@ var InvitationsHandler = class {
       } else {
         (0, import_invariant5.invariant)(invitation.swarmKey, void 0, {
           F: __dxlog_file7,
-          L: 396,
+          L: 387,
           S: this,
           A: [
             "invitation.swarmKey",
@@ -2382,6 +2368,81 @@ var InvitationsHandler = class {
     });
     return observable;
   }
+  async _handleGuestOtpAuth(extension, setState, authenticated, options) {
+    for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
+      (0, import_log4.log)("guest waiting for authentication code...", void 0, {
+        F: __dxlog_file7,
+        L: 427,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
+      });
+      const authCode = await authenticated.wait(options);
+      (0, import_log4.log)("sending authentication request", void 0, {
+        F: __dxlog_file7,
+        L: 431,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: import_services3.Invitation.State.AUTHENTICATING
+      });
+      const response = await extension.rpc.InvitationHostService.authenticate({
+        authCode
+      });
+      if (response.status === void 0 || response.status === import_invitations.AuthenticationResponse.Status.OK) {
+        break;
+      }
+      if (response.status === import_invitations.AuthenticationResponse.Status.INVALID_OTP) {
+        if (attempt === MAX_OTP_ATTEMPTS) {
+          throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
+        } else {
+          (0, import_log4.log)("retrying invalid code", {
+            attempt
+          }, {
+            F: __dxlog_file7,
+            L: 442,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          authenticated.reset();
+        }
+      }
+    }
+  }
+  async _handleGuestKpkAuth(extension, setState, invitation, introductionResponse) {
+    if (invitation.guestKeypair?.privateKey == null) {
+      throw new Error("keypair missing in the invitation");
+    }
+    if (introductionResponse.challenge == null) {
+      throw new Error("challenge missing in the introduction");
+    }
+    (0, import_log4.log)("sending authentication request", void 0, {
+      F: __dxlog_file7,
+      L: 461,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    setState({
+      state: import_services3.Invitation.State.AUTHENTICATING
+    });
+    const signature = (0, import_crypto.sign)(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
+    const response = await extension.rpc.InvitationHostService.authenticate({
+      signedChallenge: signature
+    });
+    if (response.status !== import_invitations.AuthenticationResponse.Status.OK) {
+      throw new Error(`Authentication failed with code: ${response.status}`);
+    }
+  }
+};
+var createAdmissionKeypair = () => {
+  const keypair = (0, import_crypto.createKeyPair)();
+  return {
+    publicKey: import_keys5.PublicKey.from(keypair.publicKey),
+    privateKey: keypair.secretKey
+  };
 };
 var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts";
 var InvitationsServiceImpl = class {
@@ -4675,7 +4736,7 @@ var ServiceRegistry = class {
     delete this._handlers[name];
   }
 };
-var DXOS_VERSION = "0.4.10-main.3e35a2f";
+var DXOS_VERSION = "0.4.10-main.403e461";
 var getPlatform = () => {
   if (process.browser) {
     if (typeof window !== "undefined") {
@@ -5593,7 +5654,7 @@ var ClientServicesHost = class {
     await document.whenReady();
     const properties = {
       system: {
-        type: (0, import_echo_pipeline5.encodeReference)(E.getTypeReference(import_client_protocol4.Properties))
+        type: (0, import_echo_pipeline5.encodeReference)((0, import_echo_schema.getTypeReference)(import_client_protocol4.Properties))
       },
       data: {
         [import_client_protocol4.defaultKey]: identity.identityKey.toHex()
@@ -5684,6 +5745,7 @@ var findConfigs = () => {
   SpaceInvitationProtocol,
   SpacesServiceImpl,
   TrustedKeySetAuthVerifier,
+  createAdmissionKeypair,
   createAuthProvider,
   createCollectDiagnosticsBroadcastHandler,
   createCollectDiagnosticsBroadcastSender,
@@ -5700,4 +5762,4 @@ var findConfigs = () => {
   subscribeToSpaces,
   subscribeToSwarmInfo
 });
-//# sourceMappingURL=chunk-3T6D6GIB.cjs.map
+//# sourceMappingURL=chunk-KGGJXJON.cjs.map