@dxos/client-services 0.6.13-main.548ca8d → 0.6.13-main.ed424a1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/client-services",
-  "version": "0.6.13-main.548ca8d",
+  "version": "0.6.13-main.ed424a1",
   "description": "DXOS client services implementation",
   "homepage": "https://dxos.org",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -47,48 +47,48 @@
   "dependencies": {
     "cbor-x": "^1.5.4",
     "platform": "^1.3.6",
-    "@dxos/async": "0.6.13-main.548ca8d",
-    "@dxos/automerge": "0.6.13-main.548ca8d",
-    "@dxos/client-protocol": "0.6.13-main.548ca8d",
-    "@dxos/codec-protobuf": "0.6.13-main.548ca8d",
-    "@dxos/config": "0.6.13-main.548ca8d",
-    "@dxos/credentials": "0.6.13-main.548ca8d",
-    "@dxos/crypto": "0.6.13-main.548ca8d",
-    "@dxos/context": "0.6.13-main.548ca8d",
-    "@dxos/debug": "0.6.13-main.548ca8d",
-    "@dxos/echo-db": "0.6.13-main.548ca8d",
-    "@dxos/echo-pipeline": "0.6.13-main.548ca8d",
-    "@dxos/echo-schema": "0.6.13-main.548ca8d",
-    "@dxos/edge-client": "0.6.13-main.548ca8d",
-    "@dxos/feed-store": "0.6.13-main.548ca8d",
-    "@dxos/echo-protocol": "0.6.13-main.548ca8d",
-    "@dxos/indexing": "0.6.13-main.548ca8d",
-    "@dxos/invariant": "0.6.13-main.548ca8d",
-    "@dxos/keys": "0.6.13-main.548ca8d",
-    "@dxos/keyring": "0.6.13-main.548ca8d",
-    "@dxos/kv-store": "0.6.13-main.548ca8d",
-    "@dxos/lock-file": "0.6.13-main.548ca8d",
-    "@dxos/log": "0.6.13-main.548ca8d",
-    "@dxos/messaging": "0.6.13-main.548ca8d",
-    "@dxos/node-std": "0.6.13-main.548ca8d",
-    "@dxos/network-manager": "0.6.13-main.548ca8d",
-    "@dxos/protocols": "0.6.13-main.548ca8d",
-    "@dxos/rpc": "0.6.13-main.548ca8d",
-    "@dxos/random-access-storage": "0.6.13-main.548ca8d",
-    "@dxos/teleport": "0.6.13-main.548ca8d",
-    "@dxos/teleport-extension-gossip": "0.6.13-main.548ca8d",
-    "@dxos/teleport-extension-object-sync": "0.6.13-main.548ca8d",
-    "@dxos/timeframe": "0.6.13-main.548ca8d",
-    "@dxos/tracing": "0.6.13-main.548ca8d",
-    "@dxos/util": "0.6.13-main.548ca8d",
-    "@dxos/websocket-rpc": "0.6.13-main.548ca8d"
+    "@dxos/async": "0.6.13-main.ed424a1",
+    "@dxos/automerge": "0.6.13-main.ed424a1",
+    "@dxos/codec-protobuf": "0.6.13-main.ed424a1",
+    "@dxos/config": "0.6.13-main.ed424a1",
+    "@dxos/context": "0.6.13-main.ed424a1",
+    "@dxos/client-protocol": "0.6.13-main.ed424a1",
+    "@dxos/credentials": "0.6.13-main.ed424a1",
+    "@dxos/crypto": "0.6.13-main.ed424a1",
+    "@dxos/debug": "0.6.13-main.ed424a1",
+    "@dxos/echo-pipeline": "0.6.13-main.ed424a1",
+    "@dxos/echo-protocol": "0.6.13-main.ed424a1",
+    "@dxos/echo-db": "0.6.13-main.ed424a1",
+    "@dxos/echo-schema": "0.6.13-main.ed424a1",
+    "@dxos/feed-store": "0.6.13-main.ed424a1",
+    "@dxos/edge-client": "0.6.13-main.ed424a1",
+    "@dxos/indexing": "0.6.13-main.ed424a1",
+    "@dxos/invariant": "0.6.13-main.ed424a1",
+    "@dxos/keyring": "0.6.13-main.ed424a1",
+    "@dxos/kv-store": "0.6.13-main.ed424a1",
+    "@dxos/keys": "0.6.13-main.ed424a1",
+    "@dxos/log": "0.6.13-main.ed424a1",
+    "@dxos/lock-file": "0.6.13-main.ed424a1",
+    "@dxos/messaging": "0.6.13-main.ed424a1",
+    "@dxos/network-manager": "0.6.13-main.ed424a1",
+    "@dxos/protocols": "0.6.13-main.ed424a1",
+    "@dxos/rpc": "0.6.13-main.ed424a1",
+    "@dxos/node-std": "0.6.13-main.ed424a1",
+    "@dxos/random-access-storage": "0.6.13-main.ed424a1",
+    "@dxos/teleport": "0.6.13-main.ed424a1",
+    "@dxos/teleport-extension-gossip": "0.6.13-main.ed424a1",
+    "@dxos/teleport-extension-object-sync": "0.6.13-main.ed424a1",
+    "@dxos/timeframe": "0.6.13-main.ed424a1",
+    "@dxos/websocket-rpc": "0.6.13-main.ed424a1",
+    "@dxos/util": "0.6.13-main.ed424a1",
+    "@dxos/tracing": "0.6.13-main.ed424a1"
   },
   "devDependencies": {
     "@types/platform": "^1.3.4",
     "@types/readable-stream": "^2.3.9",
     "get-port-please": "^3.1.1",
-    "@dxos/test-utils": "0.6.13-main.548ca8d",
-    "@dxos/signal": "0.6.13-main.548ca8d"
+    "@dxos/signal": "0.6.13-main.ed424a1",
+    "@dxos/test-utils": "0.6.13-main.ed424a1"
   },
   "publishConfig": {
     "access": "public"

package/src/index.ts

@@ -11,3 +11,4 @@ export * from './packlets/services';
 export * from './packlets/spaces';
 export * from './packlets/storage';
 export * from './packlets/worker';
+export * from './packlets/agents';

package/src/packlets/agents/edge-agent-manager.ts

@@ -0,0 +1,163 @@
+//
+// Copyright 2024 DXOS.org
+//
+
+import { DeferredTask, Event, scheduleTask, synchronized } from '@dxos/async';
+import { Resource } from '@dxos/context';
+import { type EdgeHttpClient } from '@dxos/edge-client';
+import { invariant } from '@dxos/invariant';
+import { PublicKey } from '@dxos/keys';
+import { log } from '@dxos/log';
+import { EdgeAgentStatus, EdgeCallFailedError } from '@dxos/protocols';
+import { SpaceState } from '@dxos/protocols/proto/dxos/client/services';
+import { type Runtime } from '@dxos/protocols/proto/dxos/config';
+
+import { type Identity } from '../identity';
+import { type DataSpaceManager } from '../spaces';
+
+const AGENT_STATUS_QUERY_RETRY_INTERVAL = 5000;
+const AGENT_STATUS_QUERY_RETRY_JITTER = 1000;
+
+export type EdgeAgentManagerConfig = {};
+
+export class EdgeAgentManager extends Resource {
+  public agentStatusChanged = new Event<EdgeAgentStatus>();
+
+  private _agentDeviceKey: PublicKey | undefined;
+  private _agentStatus: EdgeAgentStatus | undefined;
+
+  private _lastKnownDeviceCount = 0;
+
+  private _fetchAgentStatusTask: DeferredTask | undefined;
+
+  constructor(
+    private readonly _edgeFeatures: Runtime.Client.EdgeFeatures | undefined,
+    private readonly _edgeHttpClient: EdgeHttpClient | undefined,
+    private readonly _dataSpaceManager: DataSpaceManager,
+    private readonly _identity: Identity,
+  ) {
+    super();
+  }
+
+  public get agentStatus(): EdgeAgentStatus | undefined {
+    return this._agentStatus;
+  }
+
+  public get agentExists() {
+    return this._agentStatus && this._agentStatus !== EdgeAgentStatus.NOT_FOUND;
+  }
+
+  @synchronized
+  public async createAgent() {
+    invariant(this.isOpen);
+    invariant(this._edgeHttpClient);
+    invariant(this._edgeFeatures?.agents);
+
+    const response = await this._edgeHttpClient.createAgent({
+      identityKey: this._identity.identityKey.toHex(),
+      haloSpaceId: this._identity.haloSpaceId,
+      haloSpaceKey: this._identity.haloSpaceKey.toHex(),
+    });
+
+    const deviceKey = PublicKey.fromHex(response.deviceKey);
+
+    await this._identity.admitDevice({
+      deviceKey,
+      controlFeedKey: PublicKey.fromHex(response.feedKey),
+      // TODO: agents don't have data feed, should be removed
+      dataFeedKey: PublicKey.random(),
+    });
+
+    log('agent created', response);
+
+    this._updateStatus(EdgeAgentStatus.ACTIVE, deviceKey);
+  }
+
+  protected override async _open() {
+    const isEnabled = this._edgeHttpClient && this._edgeFeatures?.agents;
+
+    log('edge agent manager open', { isEnabled });
+
+    if (!isEnabled) {
+      return;
+    }
+
+    this._lastKnownDeviceCount = this._identity.authorizedDeviceKeys.size;
+    this._fetchAgentStatusTask = new DeferredTask(this._ctx, async () => {
+      await this._fetchAgentStatus();
+    });
+    this._fetchAgentStatusTask.schedule();
+
+    this._dataSpaceManager.updated.on(this._ctx, () => {
+      if (this._agentDeviceKey) {
+        this._ensureAgentIsInSpaces(this._agentDeviceKey);
+      }
+    });
+
+    this._identity.stateUpdate.on(this._ctx, () => {
+      const maybeAgentWasCreated = this._identity.authorizedDeviceKeys.size > this._lastKnownDeviceCount;
+      if (this.agentExists || !maybeAgentWasCreated) {
+        return;
+      }
+      this._lastKnownDeviceCount = this._identity.authorizedDeviceKeys.size;
+      this._fetchAgentStatusTask?.schedule();
+    });
+  }
+
+  protected override async _close() {
+    this._fetchAgentStatusTask = undefined;
+    this._lastKnownDeviceCount = 0;
+  }
+
+  protected async _fetchAgentStatus() {
+    invariant(this._edgeHttpClient);
+    try {
+      log('fetching agent status');
+      const { agent } = await this._edgeHttpClient.getAgentStatus({ ownerIdentityKey: this._identity.identityKey });
+      const wasAgentCreatedDuringQuery = this._agentStatus === EdgeAgentStatus.ACTIVE;
+      if (!wasAgentCreatedDuringQuery) {
+        const deviceKey = agent.deviceKey ? PublicKey.fromHex(agent.deviceKey) : undefined;
+        this._updateStatus(agent.status, deviceKey);
+      }
+    } catch (err) {
+      if (err instanceof EdgeCallFailedError) {
+        if (!err.isRetryable) {
+          log.warn('non retryable error on agent status fetch attempt', { err });
+          return;
+        }
+      }
+      const retryAfterMs = AGENT_STATUS_QUERY_RETRY_INTERVAL + Math.random() * AGENT_STATUS_QUERY_RETRY_JITTER;
+      log.info('agent status fetching failed', { err, retryAfterMs });
+      scheduleTask(this._ctx, () => this._fetchAgentStatusTask?.schedule(), retryAfterMs);
+    }
+  }
+
+  /**
+   * We don't want notarization plugin to always actively poll edge looking for credentials to notarize,
+   * because most of the time we'll be getting an empty response.
+   * Instead, we stay in active polling mode while there are spaces where we don't see our agent's feed.
+   */
+  protected _ensureAgentIsInSpaces(agentDeviceKey: PublicKey) {
+    for (const space of this._dataSpaceManager.spaces.values()) {
+      if ([SpaceState.SPACE_INACTIVE, SpaceState.SPACE_CLOSED].includes(space.state)) {
+        continue;
+      }
+      const agentFeedNeedsNotarization = !space.inner.spaceState.feeds
+        .values()
+        .some((feed) => feed.assertion.deviceKey.equals(agentDeviceKey));
+      space.notarizationPlugin.setActiveEdgePollingEnabled(agentFeedNeedsNotarization);
+
+      log.info('set active edge polling', { enabled: agentFeedNeedsNotarization, spaceId: space.id });
+    }
+  }
+
+  private _updateStatus(status: EdgeAgentStatus, deviceKey: PublicKey | undefined) {
+    this._agentStatus = status;
+    this._agentDeviceKey = deviceKey;
+    this.agentStatusChanged.emit(status);
+    if (deviceKey) {
+      this._ensureAgentIsInSpaces(deviceKey);
+    }
+    log.info('agent status update', { status });
+  }
+}

package/src/packlets/agents/edge-agent-service.ts

@@ -0,0 +1,42 @@
+//
+// Copyright 2024 DXOS.org
+//
+
+import { Stream } from '@dxos/codec-protobuf';
+import { EdgeAgentStatus } from '@dxos/protocols';
+import { QueryAgentStatusResponse, type EdgeAgentService } from '@dxos/protocols/proto/dxos/client/services';
+
+import { type EdgeAgentManager } from './edge-agent-manager';
+
+export class EdgeAgentServiceImpl implements EdgeAgentService {
+  constructor(private readonly _agentManagerProvider: () => Promise<EdgeAgentManager>) {}
+
+  public async createAgent(): Promise<void> {
+    return (await this._agentManagerProvider()).createAgent();
+  }
+
+  queryAgentStatus(): Stream<QueryAgentStatusResponse> {
+    return new Stream(({ ctx, next }) => {
+      next({ status: QueryAgentStatusResponse.AgentStatus.UNKNOWN });
+      void this._agentManagerProvider().then((agentManager) => {
+        next({ status: mapStatus(agentManager.agentStatus) });
+        agentManager.agentStatusChanged.on(ctx, (newStatus) => {
+          next({ status: mapStatus(newStatus) });
+        });
+      });
+    });
+  }
+}
+
+const mapStatus = (agentStatus: EdgeAgentStatus | undefined): QueryAgentStatusResponse.AgentStatus => {
+  switch (agentStatus) {
+    case EdgeAgentStatus.ACTIVE:
+      return QueryAgentStatusResponse.AgentStatus.ACTIVE;
+    case EdgeAgentStatus.INACTIVE:
+      return QueryAgentStatusResponse.AgentStatus.INACTIVE;
+    case EdgeAgentStatus.NOT_FOUND:
+      return QueryAgentStatusResponse.AgentStatus.NOT_FOUND;
+    case undefined:
+      return QueryAgentStatusResponse.AgentStatus.UNKNOWN;
+  }
+};

package/src/packlets/agents/index.ts

@@ -0,0 +1,6 @@
+//
+// Copyright 2024 DXOS.org
+//
+
+export * from './edge-agent-manager';
+export * from './edge-agent-service';

package/src/packlets/identity/identity-manager.test.ts

@@ -53,6 +53,7 @@ describe('identity/identity-manager', () => {
     const identityManager = new IdentityManager({ metadataStore, keyring, feedStore, spaceManager });
 
     return {
+      networkManager,
       metadataStore,
       identityManager,
       feedStore,
@@ -107,6 +108,11 @@ describe('identity/identity-manager', () => {
 
     const peer1 = await setupPeer({ signalContext });
     const identity1 = await peer1.identityManager.createIdentity();
+    peer1.networkManager.setPeerInfo({
+      peerKey: identity1.deviceKey.toHex(),
+      identityKey: identity1.identityKey.toHex(),
+    });
+    await identity1.joinNetwork();
 
     const peer2 = await setupPeer({ signalContext });
 
@@ -114,28 +120,38 @@ describe('identity/identity-manager', () => {
     const controlFeedKey = await peer2.keyring.createKey();
     const dataFeedKey = await peer2.keyring.createKey();
 
+    const credential = await identity1.getIdentityCredentialSigner().createCredential({
+      subject: deviceKey,
+      assertion: {
+        '@type': 'dxos.halo.credentials.AuthorizedDevice',
+        identityKey: identity1.identityKey,
+        deviceKey,
+      },
+    });
+
     await identity1.controlPipeline.writer.write({
       credential: {
-        credential: await identity1.getIdentityCredentialSigner().createCredential({
-          subject: deviceKey,
-          assertion: {
-            '@type': 'dxos.halo.credentials.AuthorizedDevice',
-            identityKey: identity1.identityKey,
-            deviceKey,
-          },
-        }),
+        credential,
       },
     });
 
-    // Identity2 is not yet ready at this point. Peer1 needs to admit peer2 device key and feed keys.
-    const identity2 = await peer2.identityManager.acceptIdentity({
+    const { identity: identity2, identityRecord } = await peer2.identityManager.prepareIdentity({
       identityKey: identity1.identityKey,
       deviceKey,
       haloSpaceKey: identity1.haloSpaceKey,
       haloGenesisFeedKey: identity1.haloGenesisFeedKey,
       controlFeedKey,
       dataFeedKey,
+      authorizedDeviceCredential: credential,
+    });
+    peer2.networkManager.setPeerInfo({
+      peerKey: identity2.deviceKey.toHex(),
+      identityKey: identity2.identityKey.toHex(),
     });
+    await identity2.joinNetwork();
+
+    // Identity2 is not yet ready at this point. Peer1 needs to admit peer2 device key and feed keys.
+    await peer2.identityManager.acceptIdentity(identity2, identityRecord);
 
     // TODO(dmaretskyi): We'd also need to admit device2's feeds otherwise messages from them won't be processed by the pipeline.
     // This would mean that peer2 has replicated it's device credential chain from peer1 and is ready to issue credentials.

package/src/packlets/identity/identity-manager.ts

@@ -23,6 +23,7 @@ import {
   type DeviceProfileDocument,
   DeviceType,
   type ProfileDocument,
+  type Credential,
 } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { Gossip, Presence } from '@dxos/teleport-extension-gossip';
 import { Timeframe } from '@dxos/timeframe';
@@ -49,6 +50,7 @@ export type JoinIdentityParams = {
   haloGenesisFeedKey: PublicKey;
   controlFeedKey: PublicKey;
   dataFeedKey: PublicKey;
+  authorizedDeviceCredential: Credential;
 
   /**
    * Latest known timeframe for the control pipeline.
@@ -65,10 +67,6 @@ export type CreateIdentityOptions = {
   deviceProfile?: DeviceProfileDocument;
 };
 
-export type IdentityManagerCallbacks = {
-  onIdentityConstruction?: (identity: Identity) => void;
-};
-
 export type IdentityManagerParams = {
   metadataStore: MetadataStore;
   keyring: Keyring;
@@ -78,7 +76,6 @@ export type IdentityManagerParams = {
   edgeFeatures?: Runtime.Client.EdgeFeatures;
   devicePresenceAnnounceInterval?: number;
   devicePresenceOfflineTimeout?: number;
-  callbacks?: IdentityManagerCallbacks;
 };
 
 // TODO(dmaretskyi): Rename: represents the peer's state machine.
@@ -94,7 +91,6 @@ export class IdentityManager {
   private readonly _devicePresenceOfflineTimeout: number;
   private readonly _edgeConnection: EdgeConnection | undefined;
   private readonly _edgeFeatures: Runtime.Client.EdgeFeatures | undefined;
-  private readonly _callbacks: IdentityManagerCallbacks | undefined;
 
   private _identity?: Identity;
 
@@ -108,7 +104,6 @@ export class IdentityManager {
     this._edgeFeatures = params.edgeFeatures;
     this._devicePresenceAnnounceInterval = params.devicePresenceAnnounceInterval ?? DEVICE_PRESENCE_ANNOUNCE_INTERVAL;
     this._devicePresenceOfflineTimeout = params.devicePresenceOfflineTimeout ?? DEVICE_PRESENCE_OFFLINE_TIMEOUT;
-    this._callbacks = params.callbacks;
   }
 
   get identity() {
@@ -198,10 +193,6 @@ export class IdentityManager {
       }
     }
 
-    // TODO(burdon): ???
-    // await this._keyring.deleteKey(identityRecord.identity_key);
-    // await this._keyring.deleteKey(identityRecord.halo_space.space_key);
-
     await this._metadataStore.setIdentityRecord(identityRecord);
     this._identity = identity;
     await this._identity.ready();
@@ -216,6 +207,7 @@ export class IdentityManager {
       deviceKey: identity.deviceKey,
       profile: identity.profileDocument,
     });
+
     return identity;
   }
 
@@ -246,9 +238,9 @@ export class IdentityManager {
   }
 
   /**
-   * Accept an existing identity. Expects its device key to be authorized (now or later).
+   * Prepare an identity object as the first step of acceptIdentity flow.
    */
-  async acceptIdentity(params: JoinIdentityParams) {
+  async prepareIdentity(params: JoinIdentityParams) {
     log('accepting identity', { params });
     invariant(!this._identity, 'Identity already exists.');
 
@@ -263,24 +255,33 @@ export class IdentityManager {
         controlTimeframe: params.controlTimeframe,
       },
     };
-
     const identity = await this._constructIdentity(identityRecord);
     await identity.open(new Context());
+    return { identity, identityRecord };
+  }
+
+  /**
+   * Accept an existing identity. Expects its device key to be authorized (now or later).
+   */
+  public async acceptIdentity(identity: Identity, identityRecord: IdentityRecord, profile?: DeviceProfileDocument) {
     this._identity = identity;
-    await this._metadataStore.setIdentityRecord(identityRecord);
+
+    // Identity becomes ready after device chain is replicated. Wait for it before storing the record.
     await this._identity.ready();
+    await this._metadataStore.setIdentityRecord(identityRecord);
+
     log.trace('dxos.halo.identity', {
-      identityKey: identityRecord.identityKey,
+      identityKey: this._identity!.identityKey,
       displayName: this._identity.profileDocument?.displayName,
     });
 
     await this.updateDeviceProfile({
       ...this.createDefaultDeviceProfile(),
-      ...params.deviceProfile,
+      ...profile,
     });
     this.stateUpdate.emit();
+
     log('accepted identity', { identityKey: identity.identityKey, deviceKey: identity.deviceKey });
-    return identity;
   }
 
   /**
@@ -378,7 +379,6 @@ export class IdentityManager {
       edgeFeatures: this._edgeFeatures,
     });
     log('done', { identityKey: identityRecord.identityKey });
-    this._callbacks?.onIdentityConstruction?.(identity);
 
     // TODO(mykola): Set new timeframe on a write to a feed.
     if (identityRecord.haloSpace.controlTimeframe) {

package/src/packlets/identity/identity.test.ts

@@ -173,6 +173,7 @@ describe('identity/identity', () => {
       networkManager: new SwarmNetworkManager({
         signalManager: new MemorySignalManager(args?.signalContext ?? new MemorySignalManagerContext()),
         transportFactory: MemoryTransportFactory,
+        peerInfo: { identityKey: identityKey.toHex(), peerKey: deviceKey.toHex() },
       }),
     });
 
@@ -202,6 +203,7 @@ describe('identity/identity', () => {
     });
 
     await identity.open(new Context());
+    await identity.joinNetwork();
     onTestFinished(() => identity.close(new Context()));
     return { identity, identityKey, keyring, deviceKey, controlFeed, spaceKey, dataFeed };
   };

package/src/packlets/identity/identity.ts

@@ -25,6 +25,7 @@ import {
   AdmittedFeed,
   type DeviceProfileDocument,
   type ProfileDocument,
+  type Credential,
 } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type DeviceAdmissionRequest } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { type Presence } from '@dxos/teleport-extension-gossip';
@@ -117,13 +118,14 @@ export class Identity {
     await this.space.spaceState.addCredentialProcessor(this._deviceStateMachine);
     await this.space.spaceState.addCredentialProcessor(this._profileStateMachine);
     await this.space.spaceState.addCredentialProcessor(this._defaultSpaceStateMachine);
+    await this.space.open(ctx);
+  }
 
+  public async joinNetwork() {
     if (this._edgeFeedReplicator) {
       this.space.protocol.feedAdded.append(this._onFeedAdded);
     }
-
-    await this.space.open(ctx);
-
+    await this.space.startProtocol();
     await this._edgeFeedReplicator?.open();
   }
 
@@ -161,6 +163,10 @@ export class Identity {
     return this.space.controlPipeline;
   }
 
+  get haloSpaceId() {
+    return this.space.id;
+  }
+
   get haloSpaceKey() {
     return this.space.key;
   }
@@ -210,7 +216,7 @@ export class Identity {
     await this.controlPipeline.state.waitUntilTimeframe(new Timeframe([[receipt.feedKey, receipt.seq]]));
   }
 
-  async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }: DeviceAdmissionRequest) {
+  async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }: DeviceAdmissionRequest): Promise<Credential> {
     log('Admitting device:', {
       identityKey: this.identityKey,
       hostDevice: this.deviceKey,
@@ -219,17 +225,18 @@ export class Identity {
       dataFeedKey,
     });
     const signer = this.getIdentityCredentialSigner();
+    const deviceCredential = await signer.createCredential({
+      subject: deviceKey,
+      assertion: {
+        '@type': 'dxos.halo.credentials.AuthorizedDevice',
+        identityKey: this.identityKey,
+        deviceKey,
+      },
+    });
     await writeMessages(
       this.controlPipeline.writer,
       [
-        await signer.createCredential({
-          subject: deviceKey,
-          assertion: {
-            '@type': 'dxos.halo.credentials.AuthorizedDevice',
-            identityKey: this.identityKey,
-            deviceKey,
-          },
-        }),
+        deviceCredential,
         await signer.createCredential({
           subject: controlFeedKey,
           assertion: {
@@ -252,6 +259,8 @@ export class Identity {
         }),
       ].map((credential): FeedMessage.Payload => ({ credential: { credential } })),
     );
+
+    return deviceCredential;
   }
 
   private _onFeedAdded = async (feed: FeedWrapper<any>) => {

package/src/packlets/invitations/device-invitation-protocol.ts

@@ -2,6 +2,7 @@
 // Copyright 2023 DXOS.org
 //
 
+import { getCredentialAssertion } from '@dxos/credentials';
 import { invariant } from '@dxos/invariant';
 import { type Keyring } from '@dxos/keyring';
 import { type PublicKey } from '@dxos/keys';
@@ -49,7 +50,8 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
   async admit(_: Invitation, request: AdmissionRequest): Promise<AdmissionResponse> {
     invariant(request.device);
     const identity = this._getIdentity();
-    await identity.admitDevice(request.device);
+    const credential = await identity.admitDevice(request.device);
+    invariant(getCredentialAssertion(credential)['@type'] === 'dxos.halo.credentials.AuthorizedDevice');
 
     return {
       device: {
@@ -57,6 +59,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
         haloSpaceKey: identity.haloSpaceKey,
         genesisFeedKey: identity.haloGenesisFeedKey,
         controlTimeframe: identity.controlPipeline.state.timeframe,
+        credential,
       },
     };
   }
@@ -109,6 +112,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
       dataFeedKey,
       controlTimeframe,
       deviceProfile: profile,
+      authorizedDeviceCredential: response.device.credential,
     });
 
     return { identityKey };

package/src/packlets/invitations/edge-invitation-handler.ts

@@ -4,7 +4,7 @@
 
 import { type MutexGuard, scheduleMicroTask, scheduleTask } from '@dxos/async';
 import { type Context } from '@dxos/context';
-import { ed25519Signature } from '@dxos/crypto';
+import { sign } from '@dxos/crypto';
 import { type EdgeHttpClient } from '@dxos/edge-client';
 import { invariant } from '@dxos/invariant';
 import { SpaceId } from '@dxos/keys';
@@ -159,15 +159,16 @@ export class EdgeInvitationHandler implements FlowLockHolder {
       return await this._client.joinSpaceByInvitation(spaceId, request);
     } catch (error: any) {
       if (error instanceof EdgeAuthChallengeError) {
-        guardedState.set(this, Invitation.State.AUTHENTICATING);
         const publicKey = guardedState.current.guestKeypair?.publicKey;
         const privateKey = guardedState.current.guestKeypair?.privateKey;
         if (!privateKey || !publicKey) {
           throw error;
         }
-        const signature = await ed25519Signature(privateKey, Buffer.from(error.challenge, 'base64'));
-        request.signature = Buffer.from(signature).toString('base64');
-        return this._client.joinSpaceByInvitation(spaceId, request);
+        const signature = sign(Buffer.from(error.challenge, 'base64'), privateKey);
+        return this._client.joinSpaceByInvitation(spaceId, {
+          ...request,
+          signature: Buffer.from(signature).toString('base64'),
+        });
       } else {
         throw error;
       }