@dxos/client-services 0.4.10-main.fa5a270 → 0.4.10-main.fe71b4c

package/dist/types/src/packlets/vault/worker-session.d.ts

@@ -21,6 +21,8 @@ export declare class WorkerSession {
     private readonly _serviceHost;
     readonly onClose: Callback<() => Promise<void>>;
     origin?: string;
+    observabilityGroup?: string;
+    signalTelemetryEnabled?: boolean;
     lockKey?: string;
     bridgeService?: BridgeService;
     constructor({ serviceHost, systemPort, appPort, shellPort, readySignal }: WorkerSessionParams);

package/dist/types/src/packlets/vault/worker-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-session.d.ts","sourceRoot":"","sources":["../../../../../src/packlets/vault/worker-session.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgB,OAAO,EAAE,MAAM,aAAa,CAAC;AASpD,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAyC,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAqB,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,KAAK,kBAAkB,EAA+C,MAAM,aAAa,CAAC;AAEnG,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,kBAAkB,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IAEjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAElD,SAAgB,OAAO,iBAAsB,QAAQ,IAAI,CAAC,EAAI;IAGvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,aAAa,CAAC,EAAE,aAAa,CAAC;gBAEzB,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,mBAAmB;IAkEvF,IAAI;IAeJ,KAAK;YAYG,eAAe;IAQ7B,OAAO,CAAC,kBAAkB;CAO3B"}
+{"version":3,"file":"worker-session.d.ts","sourceRoot":"","sources":["../../../../../src/packlets/vault/worker-session.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgB,OAAO,EAAE,MAAM,aAAa,CAAC;AASpD,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAyC,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAqB,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,KAAK,kBAAkB,EAA+C,MAAM,aAAa,CAAC;AAEnG,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,kBAAkB,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IAEjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAElD,SAAgB,OAAO,iBAAsB,QAAQ,IAAI,CAAC,EAAI;IAGvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAGjC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,aAAa,CAAC,EAAE,aAAa,CAAC;gBAEzB,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,mBAAmB;IAoEvF,IAAI;IAeJ,KAAK;YAYG,eAAe;IAQ7B,OAAO,CAAC,kBAAkB;CAO3B"}

package/dist/types/src/version.d.ts

@@ -1,2 +1,2 @@
-export declare const DXOS_VERSION = "0.4.10-main.fa5a270";
+export declare const DXOS_VERSION = "0.4.10-main.fe71b4c";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/client-services",
-  "version": "0.4.10-main.fa5a270",
+  "version": "0.4.10-main.fe71b4c",
   "description": "DXOS client services implementation",
   "homepage": "https://dxos.org",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -10,6 +10,7 @@
   "browser": {
     "jsondown": false,
     "./src/packlets/locks/node.ts": "./src/packlets/locks/browser.ts",
+    "./src/packlets/diagnostics/diagnostics-broadcast.ts": "./src/packlets/diagnostics/browser-diagnostics-broadcast.ts",
     "./dist/lib/node/index.cjs": "./dist/lib/browser/index.mjs",
     "./testing.js": "./dist/lib/browser/packlets/testing/index.mjs"
   },
@@ -21,44 +22,45 @@
     "src"
   ],
   "dependencies": {
+    "level": "^8.0.1",
     "platform": "^1.3.6",
-    "@dxos/async": "0.4.10-main.fa5a270",
-    "@dxos/client-protocol": "0.4.10-main.fa5a270",
-    "@dxos/automerge": "0.4.10-main.fa5a270",
-    "@dxos/config": "0.4.10-main.fa5a270",
-    "@dxos/codec-protobuf": "0.4.10-main.fa5a270",
-    "@dxos/context": "0.4.10-main.fa5a270",
-    "@dxos/credentials": "0.4.10-main.fa5a270",
-    "@dxos/crypto": "0.4.10-main.fa5a270",
-    "@dxos/debug": "0.4.10-main.fa5a270",
-    "@dxos/echo-db": "0.4.10-main.fa5a270",
-    "@dxos/echo-pipeline": "0.4.10-main.fa5a270",
-    "@dxos/echo-schema": "0.4.10-main.fa5a270",
-    "@dxos/feed-store": "0.4.10-main.fa5a270",
-    "@dxos/indexing": "0.4.10-main.fa5a270",
-    "@dxos/invariant": "0.4.10-main.fa5a270",
-    "@dxos/keyring": "0.4.10-main.fa5a270",
-    "@dxos/keys": "0.4.10-main.fa5a270",
-    "@dxos/lock-file": "0.4.10-main.fa5a270",
-    "@dxos/messaging": "0.4.10-main.fa5a270",
-    "@dxos/network-manager": "0.4.10-main.fa5a270",
-    "@dxos/log": "0.4.10-main.fa5a270",
-    "@dxos/node-std": "0.4.10-main.fa5a270",
-    "@dxos/random-access-storage": "0.4.10-main.fa5a270",
-    "@dxos/protocols": "0.4.10-main.fa5a270",
-    "@dxos/rpc": "0.4.10-main.fa5a270",
-    "@dxos/teleport": "0.4.10-main.fa5a270",
-    "@dxos/teleport-extension-gossip": "0.4.10-main.fa5a270",
-    "@dxos/teleport-extension-object-sync": "0.4.10-main.fa5a270",
-    "@dxos/tracing": "0.4.10-main.fa5a270",
-    "@dxos/websocket-rpc": "0.4.10-main.fa5a270",
-    "@dxos/timeframe": "0.4.10-main.fa5a270",
-    "@dxos/util": "0.4.10-main.fa5a270"
+    "@dxos/async": "0.4.10-main.fe71b4c",
+    "@dxos/client-protocol": "0.4.10-main.fe71b4c",
+    "@dxos/context": "0.4.10-main.fe71b4c",
+    "@dxos/automerge": "0.4.10-main.fe71b4c",
+    "@dxos/codec-protobuf": "0.4.10-main.fe71b4c",
+    "@dxos/config": "0.4.10-main.fe71b4c",
+    "@dxos/crypto": "0.4.10-main.fe71b4c",
+    "@dxos/credentials": "0.4.10-main.fe71b4c",
+    "@dxos/debug": "0.4.10-main.fe71b4c",
+    "@dxos/echo-db": "0.4.10-main.fe71b4c",
+    "@dxos/echo-schema": "0.4.10-main.fe71b4c",
+    "@dxos/echo-pipeline": "0.4.10-main.fe71b4c",
+    "@dxos/feed-store": "0.4.10-main.fe71b4c",
+    "@dxos/invariant": "0.4.10-main.fe71b4c",
+    "@dxos/indexing": "0.4.10-main.fe71b4c",
+    "@dxos/keys": "0.4.10-main.fe71b4c",
+    "@dxos/lock-file": "0.4.10-main.fe71b4c",
+    "@dxos/log": "0.4.10-main.fe71b4c",
+    "@dxos/messaging": "0.4.10-main.fe71b4c",
+    "@dxos/keyring": "0.4.10-main.fe71b4c",
+    "@dxos/network-manager": "0.4.10-main.fe71b4c",
+    "@dxos/node-std": "0.4.10-main.fe71b4c",
+    "@dxos/protocols": "0.4.10-main.fe71b4c",
+    "@dxos/teleport": "0.4.10-main.fe71b4c",
+    "@dxos/rpc": "0.4.10-main.fe71b4c",
+    "@dxos/random-access-storage": "0.4.10-main.fe71b4c",
+    "@dxos/teleport-extension-gossip": "0.4.10-main.fe71b4c",
+    "@dxos/teleport-extension-object-sync": "0.4.10-main.fe71b4c",
+    "@dxos/tracing": "0.4.10-main.fe71b4c",
+    "@dxos/util": "0.4.10-main.fe71b4c",
+    "@dxos/websocket-rpc": "0.4.10-main.fe71b4c",
+    "@dxos/timeframe": "0.4.10-main.fe71b4c"
   },
   "devDependencies": {
     "@types/platform": "^1.3.4",
     "@types/readable-stream": "^2.3.9",
-    "@dxos/signal": "0.4.10-main.fa5a270"
+    "@dxos/signal": "0.4.10-main.fe71b4c"
   },
   "publishConfig": {
     "access": "public"

package/src/index.ts

@@ -10,3 +10,4 @@ export * from './packlets/spaces';
 export * from './packlets/storage';
 export * from './packlets/vault';
 export * from './packlets/locks';
+export * from './packlets/diagnostics';

package/src/packlets/devices/devices-service.test.ts

@@ -19,7 +19,7 @@ describe('DevicesService', () => {
   let devicesService: DevicesService;
 
   beforeEach(async () => {
-    serviceContext = createServiceContext();
+    serviceContext = await createServiceContext();
     await serviceContext.open(new Context());
     devicesService = new DevicesServiceImpl(serviceContext.identityManager);
   });

package/src/packlets/diagnostics/browser-diagnostics-broadcast.ts

@@ -0,0 +1,94 @@
+//
+// Copyright 2024 DXOS.org
+//
+
+import { Trigger } from '@dxos/async';
+import { log } from '@dxos/log';
+import { type SystemService } from '@dxos/protocols/proto/dxos/client/services';
+
+import {
+  type CollectDiagnosticsBroadcastSender,
+  type CollectDiagnosticsBroadcastHandler,
+} from './diagnostics-collector';
+
+const CHANNEL_NAME = 'dxos.diagnostics.broadcast';
+
+enum MessageType {
+  PROBE = 'probe',
+  PROBE_ACK = 'probe-ack',
+  REQUEST_DIAGNOSTICS = 'request-diagnostics',
+  RECEIVE_DIAGNOSTICS = 'receive-diagnostics',
+}
+
+interface Message {
+  type: MessageType;
+  payload?: any;
+}
+
+export const createCollectDiagnosticsBroadcastSender = (): CollectDiagnosticsBroadcastSender => {
+  return {
+    broadcastDiagnosticsRequest: async () => {
+      let expectedResponse = MessageType.PROBE_ACK;
+      let channel: BroadcastChannel | undefined;
+      try {
+        const trigger = new Trigger<Message>();
+        channel = new BroadcastChannel(CHANNEL_NAME);
+        channel.onmessage = (msg) => {
+          if (expectedResponse === msg.data.type) {
+            trigger.wake(msg.data);
+          }
+        };
+        channel.postMessage({ type: MessageType.PROBE });
+        await trigger.wait({ timeout: 200 });
+        expectedResponse = MessageType.RECEIVE_DIAGNOSTICS;
+        trigger.reset();
+        channel.postMessage({ type: MessageType.REQUEST_DIAGNOSTICS });
+        const diagnostics = await trigger.wait({ timeout: 5000 });
+        return diagnostics.payload;
+      } catch (e) {
+        const errorDescription = e instanceof Error ? e.message : JSON.stringify(e);
+        return { expectedResponse, errorDescription };
+      } finally {
+        safeClose(channel);
+      }
+    },
+  };
+};
+
+export const createCollectDiagnosticsBroadcastHandler = (
+  systemService: SystemService,
+): CollectDiagnosticsBroadcastHandler => {
+  let channel: BroadcastChannel | undefined;
+  return {
+    start: () => {
+      channel = new BroadcastChannel(CHANNEL_NAME);
+      channel.onmessage = async (message) => {
+        try {
+          if (message.data.type === MessageType.PROBE) {
+            channel?.postMessage({ type: MessageType.PROBE_ACK });
+          } else if (message.data.type === MessageType.REQUEST_DIAGNOSTICS) {
+            const diagnostics = await systemService.getDiagnostics({});
+            channel?.postMessage({
+              type: MessageType.RECEIVE_DIAGNOSTICS,
+              payload: diagnostics,
+            });
+          }
+        } catch (error) {
+          log.catch(error);
+        }
+      };
+    },
+    stop: () => {
+      safeClose(channel);
+      channel = undefined;
+    },
+  };
+};
+
+const safeClose = (channel?: BroadcastChannel) => {
+  try {
+    channel?.close();
+  } catch (e) {
+    // ignored
+  }
+};

package/src/packlets/diagnostics/diagnostics-broadcast.ts

@@ -0,0 +1,20 @@
+//
+// Copyright 2024 DXOS.org
+//
+import { type SystemService } from '@dxos/protocols/proto/dxos/client/services';
+
+import {
+  type CollectDiagnosticsBroadcastSender,
+  type CollectDiagnosticsBroadcastHandler,
+} from './diagnostics-collector';
+
+export const createCollectDiagnosticsBroadcastSender = (): CollectDiagnosticsBroadcastSender => {
+  return { broadcastDiagnosticsRequest: async () => undefined };
+};
+
+export const createCollectDiagnosticsBroadcastHandler = (_: SystemService): CollectDiagnosticsBroadcastHandler => {
+  return {
+    start: () => {},
+    stop: () => {},
+  };
+};

package/src/packlets/diagnostics/diagnostics-collector.ts

@@ -0,0 +1,65 @@
+//
+// Copyright 2024 DXOS.org
+//
+
+import { type ClientServicesProvider } from '@dxos/client-protocol';
+import { type Config, ConfigResource } from '@dxos/config';
+import { GetDiagnosticsRequest } from '@dxos/protocols/proto/dxos/client/services';
+import { TRACE_PROCESSOR } from '@dxos/tracing';
+import { type JsonKeyOptions, jsonKeyReplacer, nonNullable } from '@dxos/util';
+
+import { createCollectDiagnosticsBroadcastSender } from './diagnostics-broadcast';
+import { ClientServicesProviderResource } from '../services';
+
+export interface CollectDiagnosticsBroadcastSender {
+  broadcastDiagnosticsRequest(): any;
+}
+
+export interface CollectDiagnosticsBroadcastHandler {
+  start(): void;
+  stop(): void;
+}
+
+export class DiagnosticsCollector {
+  private static broadcastSender = createCollectDiagnosticsBroadcastSender();
+
+  public static async collect(
+    config: Config | Config[] = findConfigs(),
+    services: ClientServicesProvider | null = findSystemServiceProvider(),
+    options: JsonKeyOptions = {},
+  ): Promise<any> {
+    const serviceDiagnostics = await services?.services?.SystemService?.getDiagnostics({
+      keys: options.humanize
+        ? GetDiagnosticsRequest.KEY_OPTION.HUMANIZE
+        : options.truncate
+          ? GetDiagnosticsRequest.KEY_OPTION.TRUNCATE
+          : undefined,
+    });
+
+    const clientDiagnostics = {
+      config,
+      trace: TRACE_PROCESSOR.getDiagnostics(),
+    };
+
+    const diagnostics =
+      serviceDiagnostics != null
+        ? { client: clientDiagnostics, services: serviceDiagnostics }
+        : {
+            client: clientDiagnostics,
+            broadcast: await this.broadcastSender.broadcastDiagnosticsRequest(),
+          };
+
+    return JSON.parse(JSON.stringify(diagnostics, jsonKeyReplacer(options)));
+  }
+}
+
+const findSystemServiceProvider = (): ClientServicesProvider | null => {
+  const serviceProviders = TRACE_PROCESSOR.findByAnnotation(ClientServicesProviderResource);
+  const providerResource = serviceProviders.find((r) => r.instance.deref()?.services?.SystemService != null);
+  return providerResource?.instance?.deref() ?? null;
+};
+
+const findConfigs = (): Config[] => {
+  const configs = TRACE_PROCESSOR.findByAnnotation(ConfigResource);
+  return configs.map((r) => r.instance.deref()).filter(nonNullable);
+};

package/src/packlets/{services → diagnostics}/diagnostics.ts

@@ -25,9 +25,9 @@ import { type Epoch } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type Resource, type Span } from '@dxos/protocols/proto/dxos/tracing';
 import { TRACE_PROCESSOR } from '@dxos/tracing';
 
-import { getPlatform } from './platform';
-import { type ServiceContext } from './service-context';
 import { DXOS_VERSION } from '../../version';
+import { type ServiceContext } from '../services';
+import { getPlatform } from '../services/platform';
 import { type DataSpace } from '../spaces';
 
 const DEFAULT_TIMEOUT = 1_000;

package/src/packlets/diagnostics/index.ts

@@ -0,0 +1,7 @@
+//
+// Copyright 2024 DXOS.org
+//
+
+export * from './diagnostics';
+export * from './diagnostics-collector';
+export * from './diagnostics-broadcast';

package/src/packlets/identity/identity-service.test.ts

@@ -22,7 +22,7 @@ describe('IdentityService', () => {
   let identityService: IdentityService;
 
   beforeEach(async () => {
-    serviceContext = createServiceContext();
+    serviceContext = await createServiceContext();
     await serviceContext.open(new Context());
     identityService = new IdentityServiceImpl(
       (options) => serviceContext.createIdentity(options),

package/src/packlets/indexing/util.ts

@@ -7,32 +7,32 @@ import { type DocHandle } from '@dxos/automerge/automerge-repo';
 import { warnAfterTimeout } from '@dxos/debug';
 import { type AutomergeHost } from '@dxos/echo-pipeline';
 import { type ObjectSnapshot } from '@dxos/indexing';
-import { idCodec } from '@dxos/protocols';
+import { type ObjectPointerEncoded, idCodec } from '@dxos/protocols';
 
 /**
  * Factory for `loadDocuments` iterator.
  */
-export const createLoadDocuments = (automergeHost: AutomergeHost) =>
+export const createSelectedDocumentsIterator = (automergeHost: AutomergeHost) =>
   /**
    * Get object data blobs from Automerge Repo by ids.
    * @param ids
    */
   // TODO(mykola): Unload automerge handles after usage.
-  async function* loadDocuments(ids: string[]) {
+  async function* loadDocuments(ids: ObjectPointerEncoded[]) {
     for (const id of ids) {
       const { documentId, objectId } = idCodec.decode(id);
       const handle = automergeHost.repo.find(documentId as any);
       await warnAfterTimeout(5000, 'to long to load doc', () => handle.whenReady());
       const doc = handle.docSync();
       const hash = getHeads(doc).join('');
-      yield [{ id, object: doc.objects[objectId], currentHash: hash }];
+      yield doc.objects?.[objectId] ? [{ id, object: doc.objects[objectId], currentHash: hash }] : [];
     }
   };
 
 /**
  * Factory for `getAllDocuments` iterator.
  */
-export const createGetAllDocuments = (automergeHost: AutomergeHost) =>
+export const createDocumentsIterator = (automergeHost: AutomergeHost) =>
   /**
    * Recursively get all object data blobs from Automerge Repo.
    * @param ids
@@ -57,7 +57,7 @@ export const createGetAllDocuments = (automergeHost: AutomergeHost) =>
           return {
             id: idCodec.encode({ documentId: handle.documentId, objectId }),
             object,
-            currentHash: heads.at(-1)!,
+            currentHash: heads.join(''),
           };
         });
       }

package/src/packlets/invitations/device-invitation-protocol.test.ts

@@ -20,7 +20,7 @@ const closeAfterTest = async (peer: ServiceContext) => {
 
 describe('services/device', () => {
   test('creates identity', async () => {
-    const peer = createServiceContext();
+    const peer = await createServiceContext();
     await peer.open(new Context());
     afterTest(() => peer.close());
 

package/src/packlets/invitations/invitation-extension.ts

@@ -4,6 +4,7 @@
 
 import { Trigger } from '@dxos/async';
 import { cancelWithContext, Context } from '@dxos/context';
+import { randomBytes, verify } from '@dxos/crypto';
 import { invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
@@ -51,6 +52,8 @@ export class InvitationHostExtension extends RpcExtension<
   private _remoteOptions?: Options;
   private _remoteOptionsTrigger = new Trigger();
 
+  private _challenge?: Buffer = undefined;
+
   public invitation?: Invitation = undefined;
 
   public guestProfile?: ProfileDocument = undefined;
@@ -113,13 +116,17 @@ export class InvitationHostExtension extends RpcExtension<
 
           this._callbacks.onStateUpdate({ ...this.invitation, state: Invitation.State.READY_FOR_AUTHENTICATION });
 
+          this._challenge =
+            this.invitation.authMethod === Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : undefined;
+
           log.trace('dxos.sdk.invitation-handler.host.introduce', trace.end({ id: traceId }));
           return {
             authMethod: this.invitation.authMethod,
+            challenge: this._challenge,
           };
         },
 
-        authenticate: async ({ authCode: code }) => {
+        authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = PublicKey.random().toHex();
           log.trace('dxos.sdk.invitation-handler.host.authenticate', trace.begin({ id: traceId }));
           log('received authentication request', { authCode: code });
@@ -145,6 +152,26 @@ export class InvitationHostExtension extends RpcExtension<
               break;
             }
 
+            case Invitation.AuthMethod.KNOWN_PUBLIC_KEY: {
+              if (!this.invitation.guestKeypair) {
+                status = AuthenticationResponse.Status.INTERNAL_ERROR;
+                break;
+              }
+              const isSignatureValid =
+                this._challenge &&
+                verify(
+                  this._challenge,
+                  Buffer.from(signedChallenge ?? []),
+                  this.invitation.guestKeypair.publicKey.asBuffer(),
+                );
+              if (isSignatureValid) {
+                this.authenticationPassed = true;
+              } else {
+                status = AuthenticationResponse.Status.INVALID_SIGNATURE;
+              }
+              break;
+            }
+
             default: {
               log.error('invalid authentication method', { authMethod: this.invitation.authMethod });
               status = AuthenticationResponse.Status.INTERNAL_ERROR;

package/src/packlets/invitations/invitations-handler.ts

@@ -11,6 +11,7 @@ import {
 } from '@dxos/client-protocol';
 import { Context } from '@dxos/context';
 import { generatePasscode } from '@dxos/credentials';
+import { createKeyPair, sign } from '@dxos/crypto';
 import { invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
@@ -21,9 +22,9 @@ import {
   type SwarmConnection,
 } from '@dxos/network-manager';
 import { InvalidInvitationExtensionRoleError, trace } from '@dxos/protocols';
-import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
+import { type AdmissionKeypair, Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import { type DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
-import { AuthenticationResponse } from '@dxos/protocols/proto/dxos/halo/invitations';
+import { AuthenticationResponse, type IntroductionResponse } from '@dxos/protocols/proto/dxos/halo/invitations';
 
 import {
   InvitationGuestExtension,
@@ -74,9 +75,11 @@ export class InvitationsHandler {
       state = Invitation.State.INIT,
       timeout = INVITATION_TIMEOUT,
       swarmKey = PublicKey.random(),
-      persistent = true,
+      persistent = options?.authMethod !== Invitation.AuthMethod.KNOWN_PUBLIC_KEY, // default no not storing keypairs
       created = new Date(),
-      lifetime = 86400, // 1 day
+      guestKeypair = undefined,
+      lifetime = 86400, // 1 day,
+      multiUse = false,
     } = options ?? {};
     const authCode =
       options?.authCode ??
@@ -91,9 +94,12 @@ export class InvitationsHandler {
       swarmKey,
       authCode,
       timeout,
-      persistent,
+      persistent: persistent && type !== Invitation.Type.DELEGATED, // delegated invitations are persisted in control feed
+      guestKeypair:
+        guestKeypair ?? (authMethod === Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : undefined),
       created,
       lifetime,
+      multiUse,
       ...protocol.getInvitationContext(),
     };
 
@@ -162,7 +168,7 @@ export class InvitationsHandler {
               }
               log.trace('dxos.sdk.invitations-handler.host.onOpen', trace.error({ id: traceId, error: err }));
             } finally {
-              if (type !== Invitation.Type.MULTIUSE) {
+              if (!multiUse) {
                 // Wait for graceful close before disposing.
                 await swarmConnection.close();
                 await ctx.dispose();
@@ -317,26 +323,13 @@ export class InvitationsHandler {
 
               // 2. Get authentication code.
               if (isAuthenticationRequired(invitation)) {
-                for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  log('guest waiting for authentication code...');
-                  setState({ state: Invitation.State.READY_FOR_AUTHENTICATION });
-                  const authCode = await authenticated.wait({ timeout });
-
-                  log('sending authentication request');
-                  setState({ state: Invitation.State.AUTHENTICATING });
-                  const response = await extension.rpc.InvitationHostService.authenticate({ authCode });
-                  if (response.status === undefined || response.status === AuthenticationResponse.Status.OK) {
+                switch (invitation.authMethod) {
+                  case Invitation.AuthMethod.SHARED_SECRET:
+                    await this._handleGuestOtpAuth(extension, setState, authenticated, { timeout });
+                    break;
+                  case Invitation.AuthMethod.KNOWN_PUBLIC_KEY:
+                    await this._handleGuestKpkAuth(extension, setState, invitation, introductionResponse);
                     break;
-                  }
-
-                  if (response.status === AuthenticationResponse.Status.INVALID_OTP) {
-                    if (attempt === MAX_OTP_ATTEMPTS) {
-                      throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
-                    } else {
-                      log('retrying invalid code', { attempt });
-                      authenticated.reset();
-                    }
-                  }
                 }
               }
 
@@ -423,13 +416,61 @@ export class InvitationsHandler {
 
     return observable;
   }
+
+  private async _handleGuestOtpAuth(
+    extension: InvitationGuestExtension,
+    setState: (newState: Partial<Invitation>) => void,
+    authenticated: Trigger<string>,
+    options: { timeout: number },
+  ) {
+    for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
+      log('guest waiting for authentication code...');
+      setState({ state: Invitation.State.READY_FOR_AUTHENTICATION });
+      const authCode = await authenticated.wait(options);
+
+      log('sending authentication request');
+      setState({ state: Invitation.State.AUTHENTICATING });
+      const response = await extension.rpc.InvitationHostService.authenticate({ authCode });
+      if (response.status === undefined || response.status === AuthenticationResponse.Status.OK) {
+        break;
+      }
+
+      if (response.status === AuthenticationResponse.Status.INVALID_OTP) {
+        if (attempt === MAX_OTP_ATTEMPTS) {
+          throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
+        } else {
+          log('retrying invalid code', { attempt });
+          authenticated.reset();
+        }
+      }
+    }
+  }
+
+  private async _handleGuestKpkAuth(
+    extension: InvitationGuestExtension,
+    setState: (newState: Partial<Invitation>) => void,
+    invitation: Invitation,
+    introductionResponse: IntroductionResponse,
+  ) {
+    if (invitation.guestKeypair?.privateKey == null) {
+      throw new Error('keypair missing in the invitation');
+    }
+    if (introductionResponse.challenge == null) {
+      throw new Error('challenge missing in the introduction');
+    }
+    log('sending authentication request');
+    setState({ state: Invitation.State.AUTHENTICATING });
+    const signature = sign(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
+    const response = await extension.rpc.InvitationHostService.authenticate({
+      signedChallenge: signature,
+    });
+    if (response.status !== AuthenticationResponse.Status.OK) {
+      throw new Error(`Authentication failed with code: ${response.status}`);
+    }
+  }
 }
 
-export const invitationExpired = (invitation: Invitation) => {
-  return (
-    invitation.created &&
-    invitation.lifetime &&
-    invitation.lifetime !== 0 &&
-    invitation.created.getTime() + invitation.lifetime * 1000 < Date.now()
-  );
+export const createAdmissionKeypair = (): AdmissionKeypair => {
+  const keypair = createKeyPair();
+  return { publicKey: PublicKey.from(keypair.publicKey), privateKey: keypair.secretKey };
 };