@dxos/client-services 0.7.5-main.2567c87 → 0.7.5-main.5ae2ba8

package/dist/lib/node/{chunk-LKVY5GQC.cjs → chunk-F7R4IRLD.cjs}

@@ -26,8 +26,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var chunk_LKVY5GQC_exports = {};
-__export(chunk_LKVY5GQC_exports, {
+var chunk_F7R4IRLD_exports = {};
+__export(chunk_F7R4IRLD_exports, {
   ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   DataSpace: () => DataSpace,
@@ -72,24 +72,24 @@ __export(chunk_LKVY5GQC_exports, {
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo
 });
-module.exports = __toCommonJS(chunk_LKVY5GQC_exports);
+module.exports = __toCommonJS(chunk_F7R4IRLD_exports);
 var import_async = require("@dxos/async");
-var import_codec_protobuf = require("@dxos/codec-protobuf");
+var import_stream = require("@dxos/codec-protobuf/stream");
 var import_feed_store = require("@dxos/feed-store");
 var import_keys = require("@dxos/keys");
 var import_log = require("@dxos/log");
 var import_util = require("@dxos/util");
-var import_codec_protobuf2 = require("@dxos/codec-protobuf");
+var import_stream2 = require("@dxos/codec-protobuf/stream");
 var import_context = require("@dxos/context");
 var import_keys2 = require("@dxos/keys");
-var import_codec_protobuf3 = require("@dxos/codec-protobuf");
+var import_stream3 = require("@dxos/codec-protobuf/stream");
 var import_async2 = require("@dxos/async");
-var import_codec_protobuf4 = require("@dxos/codec-protobuf");
+var import_stream4 = require("@dxos/codec-protobuf/stream");
 var import_async3 = require("@dxos/async");
-var import_codec_protobuf5 = require("@dxos/codec-protobuf");
-var import_codec_protobuf6 = require("@dxos/codec-protobuf");
+var import_stream5 = require("@dxos/codec-protobuf/stream");
+var import_stream6 = require("@dxos/codec-protobuf/stream");
 var import_async4 = require("@dxos/async");
-var import_codec_protobuf7 = require("@dxos/codec-protobuf");
+var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_credentials = require("@dxos/credentials");
 var import_invariant = require("@dxos/invariant");
 var import_protocols = require("@dxos/protocols");
@@ -184,7 +184,7 @@ var import_debug2 = require("@dxos/debug");
 var import_credentials12 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe3 = require("@dxos/timeframe");
 var import_async12 = require("@dxos/async");
-var import_codec_protobuf8 = require("@dxos/codec-protobuf");
+var import_stream7 = require("@dxos/codec-protobuf/stream");
 var import_credentials13 = require("@dxos/credentials");
 var import_debug3 = require("@dxos/debug");
 var import_feed_store4 = require("@dxos/feed-store");
@@ -208,7 +208,7 @@ var import_timeframe4 = require("@dxos/timeframe");
 var import_tracing7 = require("@dxos/tracing");
 var import_util8 = require("@dxos/util");
 var import_async14 = require("@dxos/async");
-var import_codec_protobuf9 = require("@dxos/codec-protobuf");
+var import_stream8 = require("@dxos/codec-protobuf/stream");
 var import_context9 = require("@dxos/context");
 var import_credentials16 = require("@dxos/credentials");
 var import_invariant10 = require("@dxos/invariant");
@@ -270,7 +270,7 @@ var import_keys13 = require("@dxos/keys");
 var import_log17 = require("@dxos/log");
 var import_invitations5 = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_util11 = require("@dxos/util");
-var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_stream9 = require("@dxos/codec-protobuf/stream");
 var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
 var import_tracing9 = require("@dxos/tracing");
 var import_credentials18 = require("@dxos/credentials");
@@ -293,7 +293,7 @@ var import_credentials21 = require("@dxos/protocols/proto/dxos/halo/credentials"
 var import_invariant19 = require("@dxos/invariant");
 var import_lock_file = require("@dxos/lock-file");
 var import_log20 = require("@dxos/log");
-var import_codec_protobuf11 = require("@dxos/codec-protobuf");
+var import_codec_protobuf2 = require("@dxos/codec-protobuf");
 var import_debug4 = require("@dxos/debug");
 var import_rpc = require("@dxos/rpc");
 var import_tracing10 = require("@dxos/tracing");
@@ -305,7 +305,7 @@ var import_log21 = require("@dxos/log");
 var import_protocols14 = require("@dxos/protocols");
 var import_services19 = require("@dxos/protocols/proto/dxos/client/services");
 var import_metadata2 = require("@dxos/protocols/proto/dxos/echo/metadata");
-var import_codec_protobuf12 = require("@dxos/codec-protobuf");
+var import_stream10 = require("@dxos/codec-protobuf/stream");
 var import_protocols15 = require("@dxos/protocols");
 var import_services20 = require("@dxos/protocols/proto/dxos/client/services");
 var import_async22 = require("@dxos/async");
@@ -360,26 +360,26 @@ var import_services22 = require("@dxos/protocols/proto/dxos/client/services");
 var import_tracing12 = require("@dxos/tracing");
 var import_websocket_rpc = require("@dxos/websocket-rpc");
 var import_async24 = require("@dxos/async");
-var import_codec_protobuf13 = require("@dxos/codec-protobuf");
+var import_stream11 = require("@dxos/codec-protobuf/stream");
 var import_invariant25 = require("@dxos/invariant");
 var import_services23 = require("@dxos/protocols/proto/dxos/client/services");
 var import_async25 = require("@dxos/async");
-var import_codec_protobuf14 = require("@dxos/codec-protobuf");
+var import_stream12 = require("@dxos/codec-protobuf/stream");
 var import_keys20 = require("@dxos/keys");
 var import_util15 = require("@dxos/util");
 var import_async26 = require("@dxos/async");
-var import_codec_protobuf15 = require("@dxos/codec-protobuf");
+var import_stream13 = require("@dxos/codec-protobuf/stream");
 var import_keys21 = require("@dxos/keys");
 var import_log26 = require("@dxos/log");
 var import_services24 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util16 = require("@dxos/util");
-var import_codec_protobuf16 = require("@dxos/codec-protobuf");
-var import_codec_protobuf17 = require("@dxos/codec-protobuf");
+var import_stream14 = require("@dxos/codec-protobuf/stream");
+var import_stream15 = require("@dxos/codec-protobuf/stream");
 var import_services25 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util17 = require("@dxos/util");
 var __dxlog_file = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devtools/feeds.ts";
 var subscribeToFeeds = ({ feedStore, spaceManager }, { feedKeys }) => {
-  return new import_codec_protobuf.Stream(({ next }) => {
+  return new import_stream.Stream(({ next }) => {
     const subscriptions = new import_async.EventSubscriptions();
     const feedMap = new import_util.ComplexMap(import_keys.PublicKey.hash);
     const update = () => {
@@ -438,7 +438,7 @@ var findFeedOwner = (spaceManager, feedKey) => {
   };
 };
 var subscribeToFeedBlocks = ({ feedStore }, { feedKey, maxBlocks = 10 }) => {
-  return new import_codec_protobuf.Stream(({ next }) => {
+  return new import_stream.Stream(({ next }) => {
     if (!feedKey) {
       return;
     }
@@ -482,7 +482,7 @@ var subscribeToFeedBlocks = ({ feedStore }, { feedKey, maxBlocks = 10 }) => {
   });
 };
 var __dxlog_file2 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devtools/network.ts";
-var subscribeToNetworkStatus = ({ signalManager }) => new import_codec_protobuf2.Stream(({ next, close }) => {
+var subscribeToNetworkStatus = ({ signalManager }) => new import_stream2.Stream(({ next, close }) => {
   const update = () => {
     try {
       const status = signalManager.getStatus?.();
@@ -496,7 +496,7 @@ var subscribeToNetworkStatus = ({ signalManager }) => new import_codec_protobuf2
   signalManager.statusChanged?.on(() => update());
   update();
 });
-var subscribeToSignal = ({ signalManager }) => new import_codec_protobuf2.Stream(({ next }) => {
+var subscribeToSignal = ({ signalManager }) => new import_stream2.Stream(({ next }) => {
   const ctx = new import_context.Context(void 0, {
     F: __dxlog_file2,
     L: 36
@@ -531,7 +531,7 @@ var subscribeToSignal = ({ signalManager }) => new import_codec_protobuf2.Stream
     return ctx.dispose();
   };
 });
-var subscribeToNetworkTopics = ({ networkManager }) => new import_codec_protobuf2.Stream(({ next, close }) => {
+var subscribeToNetworkTopics = ({ networkManager }) => new import_stream2.Stream(({ next, close }) => {
   const update = () => {
     try {
       const topics = networkManager.topics;
@@ -549,7 +549,7 @@ var subscribeToNetworkTopics = ({ networkManager }) => new import_codec_protobuf
   networkManager.topicsUpdated.on(update);
   update();
 });
-var subscribeToSwarmInfo = ({ networkManager }) => new import_codec_protobuf2.Stream(({ next }) => {
+var subscribeToSwarmInfo = ({ networkManager }) => new import_stream2.Stream(({ next }) => {
   const update = () => {
     const info = networkManager.connectionLog?.swarms;
     if (info) {
@@ -574,7 +574,7 @@ var getNetworkPeers = ({ networkManager }, request) => {
   };
 };
 var subscribeToSpaces = (context, { spaceKeys = [] }) => {
-  return new import_codec_protobuf3.Stream(({ next }) => {
+  return new import_stream3.Stream(({ next }) => {
     let unsubscribe;
     const update = async () => {
       const spaces = [
@@ -606,7 +606,7 @@ var subscribeToSpaces = (context, { spaceKeys = [] }) => {
     };
   });
 };
-var subscribeToKeyringKeys = ({ keyring }) => new import_codec_protobuf5.Stream(({ next, ctx }) => {
+var subscribeToKeyringKeys = ({ keyring }) => new import_stream5.Stream(({ next, ctx }) => {
   const update = async () => {
     next({
       keys: await keyring.list()
@@ -615,7 +615,7 @@ var subscribeToKeyringKeys = ({ keyring }) => new import_codec_protobuf5.Stream(
   keyring.keysUpdate.on(ctx, update);
   (0, import_async3.scheduleTask)(ctx, update);
 });
-var subscribeToMetadata = ({ context }) => new import_codec_protobuf6.Stream(({ next, ctx }) => {
+var subscribeToMetadata = ({ context }) => new import_stream6.Stream(({ next, ctx }) => {
   context.metadataStore.update.on(ctx, (data) => next({
     metadata: data
   }));
@@ -633,7 +633,7 @@ var DevtoolsServiceImpl = class {
     this.params = params;
   }
   events(request) {
-    return new import_codec_protobuf4.Stream(({ next }) => {
+    return new import_stream4.Stream(({ next }) => {
       this.params.events.ready.on(() => {
         next({
           ready: {}
@@ -735,7 +735,7 @@ var DevtoolsServiceImpl = class {
     });
   }
 };
-var DXOS_VERSION = "0.7.5-main.2567c87";
+var DXOS_VERSION = "0.7.5-main.5ae2ba8";
 var getPlatform = () => {
   if (process.browser) {
     if (typeof window !== "undefined") {
@@ -788,7 +788,7 @@ var createDiagnostics = async (clientServices, serviceContext, config) => {
           "'SystemService is not available.'"
         ]
       });
-      diagnostics.metrics = await (0, import_codec_protobuf7.getFirstStreamValue)(clientServices.LoggingService.queryMetrics({}), {
+      diagnostics.metrics = await (0, import_codec_protobuf.getFirstStreamValue)(clientServices.LoggingService.queryMetrics({}), {
         timeout: DEFAULT_TIMEOUT
       }).catch(() => void 0);
     })(),
@@ -799,18 +799,19 @@ var createDiagnostics = async (clientServices, serviceContext, config) => {
       const identity = serviceContext.identityManager.identity;
       if (identity) {
         diagnostics.identity = {
+          did: identity.did,
           identityKey: identity.identityKey,
           spaceKey: identity.space.key,
           profile: identity.profileDocument
         };
-        const { devices } = await (0, import_codec_protobuf7.getFirstStreamValue)(clientServices.DevicesService.queryDevices(), {
+        const { devices } = await (0, import_codec_protobuf.getFirstStreamValue)(clientServices.DevicesService.queryDevices(), {
           timeout: DEFAULT_TIMEOUT
         }).catch(() => void 0) ?? {};
         diagnostics.devices = devices;
         if (serviceContext.dataSpaceManager) {
           diagnostics.spaces = await Promise.all(Array.from(serviceContext.dataSpaceManager.spaces.values()).map((space) => getSpaceStats(space)) ?? []);
         }
-        const { feeds = [] } = await (0, import_codec_protobuf7.getFirstStreamValue)(clientServices.DevtoolsHost.subscribeToFeeds({}), {
+        const { feeds = [] } = await (0, import_codec_protobuf.getFirstStreamValue)(clientServices.DevtoolsHost.subscribeToFeeds({}), {
           timeout: DEFAULT_TIMEOUT
         }).catch(() => void 0) ?? {};
         diagnostics.feeds = feeds.map(({ feedKey, bytes, length }) => ({
@@ -818,7 +819,7 @@ var createDiagnostics = async (clientServices, serviceContext, config) => {
           bytes,
           length
         }));
-        const status = await (0, import_codec_protobuf7.getFirstStreamValue)(clientServices.NetworkService.queryStatus(), {
+        const status = await (0, import_codec_protobuf.getFirstStreamValue)(clientServices.NetworkService.queryStatus(), {
           timeout: DEFAULT_TIMEOUT
         }).catch(() => void 0);
         diagnostics.networkStatus = status;
@@ -837,16 +838,17 @@ var getSpaceStats = async (space) => {
       ...credential.subject.assertion,
       id: credential.id
     })),
-    members: Array.from(space.inner.spaceState.members.values()).map((member) => ({
+    members: await Promise.all(Array.from(space.inner.spaceState.members.values()).map(async (member) => ({
       role: member.role,
       identity: {
+        did: await (0, import_credentials.createDidFromIdentityKey)(member.key),
         identityKey: member.key,
         profile: {
           displayName: member.assertion.profile?.displayName
         }
       },
       presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services.SpaceMember.PresenceState.ONLINE : import_services.SpaceMember.PresenceState.OFFLINE
-    })),
+    }))),
     pipeline: {
       // TODO(burdon): Pick properties from credentials if needed.
       currentEpoch: space.automergeSpaceState.lastEpoch,
@@ -926,7 +928,7 @@ var findSystemServiceProvider = () => {
 };
 var findConfigs = () => {
   const configs = import_tracing2.TRACE_PROCESSOR.findResourcesByAnnotation(import_config.ConfigResource);
-  return configs.map((r) => r.instance.deref()).filter(import_util2.nonNullable);
+  return configs.map((r) => r.instance.deref()).filter(import_util2.isNonNullable);
 };
 var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts";
 var Credential = import_proto.schema.getCodecForType("dxos.halo.credentials.Credential");
@@ -1211,7 +1213,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
     this._remoteLength.clear();
   }
   async addFeed(feed) {
-    import_log3.log.info("addFeed", {
+    (0, import_log3.log)("addFeed", {
       key: feed.key,
       connected: this._connected,
       hasConnectionCtx: !!this._connectionCtx
@@ -1248,7 +1250,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
   }
   async _sendMessage(message) {
     if (!this._connectionCtx) {
-      import_log3.log.info("message dropped because connection was disposed", void 0, {
+      (0, import_log3.log)("message dropped because connection was disposed", void 0, {
         F: __dxlog_file5,
         L: 146,
         S: this,
@@ -1257,7 +1259,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
       return;
     }
     if (message.type === "data") {
-      import_log3.log.info("sending blocks", {
+      (0, import_log3.log)("sending blocks", {
         feedKey: message.feedKey,
         blocks: message.blocks.map((b) => b.index)
       }, {
@@ -1332,7 +1334,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
               feedKey
             };
             if (message.length > feed.length) {
-              import_log3.log.info("requesting missing blocks", logMeta, {
+              (0, import_log3.log)("requesting missing blocks", logMeta, {
                 F: __dxlog_file5,
                 L: 194,
                 S: this,
@@ -1347,7 +1349,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
                 }
               });
             } else if (message.length < feed.length) {
-              import_log3.log.info("pushing blocks to remote", logMeta, {
+              (0, import_log3.log)("pushing blocks to remote", logMeta, {
                 F: __dxlog_file5,
                 L: 202,
                 S: this,
@@ -1363,7 +1365,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
           }
         }
         case "data": {
-          import_log3.log.info("received data", {
+          (0, import_log3.log)("received data", {
             feed: message.feedKey,
             blocks: message.blocks.map((b) => b.index)
           }, {
@@ -1402,7 +1404,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
     });
   }
   async _pushBlocks(feed, from, to) {
-    import_log3.log.info("pushing blocks", {
+    (0, import_log3.log)("pushing blocks", {
       feed: feed.key.toHex(),
       from,
       to
@@ -1441,7 +1443,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
     this._remoteLength.set(feed.key, to);
   }
   async _integrateBlocks(feed, blocks) {
-    import_log3.log.info("integrating blocks", {
+    (0, import_log3.log)("integrating blocks", {
       feed: feed.key.toHex(),
       blocks: blocks.length
     }, {
@@ -2664,7 +2666,7 @@ var DataSpaceManager = class extends import_context7.Resource {
     });
     dataSpace.postOpen.append(async () => {
       const setting = dataSpace.getEdgeReplicationSetting();
-      if (setting === import_metadata.EdgeReplicationSetting.ENABLED) {
+      if (!setting || setting === import_metadata.EdgeReplicationSetting.ENABLED) {
         await this._echoEdgeReplicator?.connectToSpace(dataSpace.id);
       } else if (this._echoEdgeReplicator) {
         (0, import_log8.log)("not connecting EchoEdgeReplicator because of EdgeReplicationSetting", {
@@ -2679,7 +2681,7 @@ var DataSpaceManager = class extends import_context7.Resource {
     });
     dataSpace.preClose.append(async () => {
       const setting = dataSpace.getEdgeReplicationSetting();
-      if (setting === import_metadata.EdgeReplicationSetting.ENABLED) {
+      if (!setting || setting === import_metadata.EdgeReplicationSetting.ENABLED) {
         await this._echoEdgeReplicator?.disconnectFromSpace(dataSpace.id);
       }
     });
@@ -2784,7 +2786,7 @@ var DataSpaceManager = class extends import_context7.Resource {
         guestKeypair: invitation.guestKey ? {
           publicKey: invitation.guestKey
         } : void 0,
-        lifetime: invitation.expiresOn ? invitation.expiresOn.getTime() - Date.now() : void 0,
+        lifetime: invitation.expiresOn ? (invitation.expiresOn.getTime() - Date.now()) / 1e3 : void 0,
         multiUse: invitation.multiUse,
         delegationCredentialId: credentialId,
         persistent: false
@@ -2856,7 +2858,7 @@ var SpacesServiceImpl = class {
     const credentials = await (0, import_credentials13.createAdmissionCredentials)(identity.getIdentityCredentialSigner(), request.memberKey, space.key, space.genesisFeedKey, request.newRole, space.spaceState.membershipChainHeads);
     (0, import_invariant8.invariant)(credentials[0].credential, void 0, {
       F: __dxlog_file10,
-      L: 106,
+      L: 111,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2866,7 +2868,7 @@ var SpacesServiceImpl = class {
     const spaceMemberCredential = credentials[0].credential.credential;
     (0, import_invariant8.invariant)((0, import_credentials13.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file10,
-      L: 108,
+      L: 113,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2876,15 +2878,15 @@ var SpacesServiceImpl = class {
     await (0, import_feed_store4.writeMessages)(space.controlPipeline.writer, credentials);
   }
   querySpaces() {
-    return new import_codec_protobuf8.Stream(({ next, ctx }) => {
+    return new import_stream7.Stream(({ next, ctx }) => {
       const scheduler = new import_async12.UpdateScheduler(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space));
+        const spaces = await Promise.all(Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space)));
         (0, import_log9.log)("update", () => ({
           ids: spaces.map((space) => space.id)
         }), {
           F: __dxlog_file10,
-          L: 119,
+          L: 126,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2936,7 +2938,7 @@ var SpacesServiceImpl = class {
     await space.postMessage(getChannelId(channel), message);
   }
   subscribeMessages({ spaceKey, channel }) {
-    return new import_codec_protobuf8.Stream(({ ctx, next }) => {
+    return new import_stream7.Stream(({ ctx, next }) => {
       (0, import_async12.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols6.SpaceNotFoundError(spaceKey));
@@ -2948,7 +2950,7 @@ var SpacesServiceImpl = class {
     });
   }
   queryCredentials({ spaceKey, noTail }) {
-    return new import_codec_protobuf8.Stream(({ ctx, next, close }) => {
+    return new import_stream7.Stream(({ ctx, next, close }) => {
       const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols6.SpaceNotFoundError(spaceKey));
       const processor = {
         processCredential: async (credential) => {
@@ -2976,7 +2978,7 @@ var SpacesServiceImpl = class {
       } else {
         (0, import_invariant8.invariant)(!credential.id, "Id on unsigned credentials is not allowed", {
           F: __dxlog_file10,
-          L: 217,
+          L: 224,
           S: this,
           A: [
             "!credential.id",
@@ -2985,7 +2987,7 @@ var SpacesServiceImpl = class {
         });
         (0, import_invariant8.invariant)(this._identityManager.identity, "Identity is not available", {
           F: __dxlog_file10,
-          L: 218,
+          L: 225,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -2995,7 +2997,7 @@ var SpacesServiceImpl = class {
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
         (0, import_invariant8.invariant)(credential.issuer.equals(signer.getIssuer()), void 0, {
           F: __dxlog_file10,
-          L: 220,
+          L: 227,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -3045,7 +3047,7 @@ var SpacesServiceImpl = class {
     const assertion = (0, import_credentials13.getCredentialAssertion)(credential);
     (0, import_invariant8.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file10,
-      L: 254,
+      L: 261,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -3055,7 +3057,7 @@ var SpacesServiceImpl = class {
     const myIdentity = this._identityManager.identity;
     (0, import_invariant8.invariant)(myIdentity && credential.subject.id.equals(myIdentity.identityKey), void 0, {
       F: __dxlog_file10,
-      L: 256,
+      L: 263,
       S: this,
       A: [
         "myIdentity && credential.subject.id.equals(myIdentity.identityKey)",
@@ -3076,10 +3078,10 @@ var SpacesServiceImpl = class {
       });
     }
     return {
-      space: this._serializeSpace(dataSpace)
+      space: await this._serializeSpace(dataSpace)
     };
   }
-  _serializeSpace(space) {
+  async _serializeSpace(space) {
     return {
       id: space.id,
       spaceKey: space.key,
@@ -3099,7 +3101,7 @@ var SpacesServiceImpl = class {
         totalDataTimeframe: void 0,
         spaceRootUrl: space.databaseRoot?.url
       },
-      members: Array.from(space.inner.spaceState.members.values()).map((member) => {
+      members: await Promise.all(Array.from(space.inner.spaceState.members.values()).map(async (member) => {
         const peers = space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key));
         const isMe = this._identityManager.identity?.identityKey.equals(member.key);
         if (isMe) {
@@ -3107,6 +3109,7 @@ var SpacesServiceImpl = class {
         }
         return {
           identity: {
+            did: await (0, import_credentials13.createDidFromIdentityKey)(member.key),
             identityKey: member.key,
             profile: member.profile ?? {}
           },
@@ -3114,7 +3117,7 @@ var SpacesServiceImpl = class {
           presence: peers.length > 0 ? import_services7.SpaceMember.PresenceState.ONLINE : import_services7.SpaceMember.PresenceState.OFFLINE,
           peerStates: peers
         };
-      }),
+      })),
       creator: space.inner.spaceState.creator?.key,
       cache: space.cache,
       metrics: space.metrics,
@@ -3157,13 +3160,14 @@ var Identity = class {
     this.space = params.space;
     this._signer = params.signer;
     this._presence = params.presence;
+    this.did = params.did;
     this.identityKey = params.identityKey;
     this.deviceKey = params.deviceKey;
     import_log6.log.trace("dxos.halo.device", {
       deviceKey: params.deviceKey
     }, {
       F: __dxlog_file11,
-      L: 79,
+      L: 82,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3265,7 +3269,7 @@ var Identity = class {
   getIdentityCredentialSigner() {
     (0, import_invariant6.invariant)(this._deviceStateMachine.deviceCredentialChain, "Device credential chain is not ready.", {
       F: __dxlog_file11,
-      L: 195,
+      L: 198,
       S: this,
       A: [
         "this._deviceStateMachine.deviceCredentialChain",
@@ -3309,7 +3313,7 @@ var Identity = class {
       dataFeedKey
     }, {
       F: __dxlog_file11,
-      L: 220,
+      L: 223,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3392,7 +3396,7 @@ var IdentityManager = class {
       id: traceId
     }), {
       F: __dxlog_file12,
-      L: 121,
+      L: 116,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3401,7 +3405,7 @@ var IdentityManager = class {
       identityRecord
     }, {
       F: __dxlog_file12,
-      L: 124,
+      L: 119,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3414,7 +3418,7 @@ var IdentityManager = class {
         displayName: this._identity.profileDocument?.displayName
       }, {
         F: __dxlog_file12,
-        L: 129,
+        L: 124,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3424,7 +3428,7 @@ var IdentityManager = class {
       id: traceId
     }), {
       F: __dxlog_file12,
-      L: 136,
+      L: 131,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3432,13 +3436,13 @@ var IdentityManager = class {
   async close() {
     await this._identity?.close(new import_context8.Context(void 0, {
       F: __dxlog_file12,
-      L: 140
+      L: 135
     }));
   }
   async createIdentity({ displayName, deviceProfile } = {}) {
     (0, import_invariant9.invariant)(!this._identity, "Identity already exists.", {
       F: __dxlog_file12,
-      L: 145,
+      L: 140,
       S: this,
       A: [
         "!this._identity",
@@ -3447,7 +3451,7 @@ var IdentityManager = class {
     });
     (0, import_log10.log)("creating identity...", void 0, {
       F: __dxlog_file12,
-      L: 146,
+      L: 141,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3465,13 +3469,13 @@ var IdentityManager = class {
     const identity = await this._constructIdentity(identityRecord);
     await identity.open(new import_context8.Context(void 0, {
       F: __dxlog_file12,
-      L: 161
+      L: 156
     }));
     {
       const generator = new import_credentials14.CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
       (0, import_invariant9.invariant)(identityRecord.haloSpace.genesisFeedKey, "Genesis feed key is required.", {
         F: __dxlog_file12,
-        L: 165,
+        L: 160,
         S: this,
         A: [
           "identityRecord.haloSpace.genesisFeedKey",
@@ -3480,7 +3484,7 @@ var IdentityManager = class {
       });
       (0, import_invariant9.invariant)(identityRecord.haloSpace.dataFeedKey, "Data feed key is required.", {
         F: __dxlog_file12,
-        L: 166,
+        L: 161,
         S: this,
         A: [
           "identityRecord.haloSpace.dataFeedKey",
@@ -3519,7 +3523,7 @@ var IdentityManager = class {
       displayName: this._identity.profileDocument?.displayName
     }, {
       F: __dxlog_file12,
-      L: 204,
+      L: 199,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3530,7 +3534,7 @@ var IdentityManager = class {
       profile: identity.profileDocument
     }, {
       F: __dxlog_file12,
-      L: 210,
+      L: 205,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3567,13 +3571,13 @@ var IdentityManager = class {
       params
     }, {
       F: __dxlog_file12,
-      L: 249,
+      L: 244,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant9.invariant)(!this._identity, "Identity already exists.", {
       F: __dxlog_file12,
-      L: 250,
+      L: 245,
       S: this,
       A: [
         "!this._identity",
@@ -3594,7 +3598,7 @@ var IdentityManager = class {
     const identity = await this._constructIdentity(identityRecord);
     await identity.open(new import_context8.Context(void 0, {
       F: __dxlog_file12,
-      L: 264
+      L: 259
     }));
     return {
       identity,
@@ -3613,7 +3617,7 @@ var IdentityManager = class {
       displayName: this._identity.profileDocument?.displayName
     }, {
       F: __dxlog_file12,
-      L: 278,
+      L: 273,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3627,7 +3631,7 @@ var IdentityManager = class {
       deviceKey: identity.deviceKey
     }, {
       F: __dxlog_file12,
-      L: 289,
+      L: 284,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3638,7 +3642,7 @@ var IdentityManager = class {
   async updateProfile(profile) {
     (0, import_invariant9.invariant)(this._identity, "Identity not initialized.", {
       F: __dxlog_file12,
-      L: 296,
+      L: 291,
       S: this,
       A: [
         "this._identity",
@@ -3669,7 +3673,7 @@ var IdentityManager = class {
   async updateDeviceProfile(profile) {
     (0, import_invariant9.invariant)(this._identity, "Identity not initialized.", {
       F: __dxlog_file12,
-      L: 313,
+      L: 308,
       S: this,
       A: [
         "this._identity",
@@ -3702,48 +3706,10 @@ var IdentityManager = class {
       profile
     };
   }
-  async createRecoveryPhrase() {
-    const identity = this._identity;
-    (0, import_invariant9.invariant)(identity, void 0, {
-      F: __dxlog_file12,
-      L: 340,
-      S: this,
-      A: [
-        "identity",
-        ""
-      ]
-    });
-    const seedphrase = (0, import_credentials14.generateSeedPhrase)();
-    const keypair = (0, import_credentials14.keyPairFromSeedPhrase)(seedphrase);
-    const recoveryKey = import_keys9.PublicKey.from(keypair.publicKey);
-    const identityKey = identity.identityKey;
-    const credential = await identity.getIdentityCredentialSigner().createCredential({
-      subject: identityKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.IdentityRecovery",
-        recoveryKey,
-        identityKey
-      }
-    });
-    const receipt = await identity.controlPipeline.writer.write({
-      credential: {
-        credential
-      }
-    });
-    await identity.controlPipeline.state.waitUntilTimeframe(new import_timeframe4.Timeframe([
-      [
-        receipt.feedKey,
-        receipt.seq
-      ]
-    ]));
-    return {
-      seedphrase
-    };
-  }
   async _constructIdentity(identityRecord) {
     (0, import_invariant9.invariant)(!this._identity, void 0, {
       F: __dxlog_file12,
-      L: 362,
+      L: 334,
       S: this,
       A: [
         "!this._identity",
@@ -3754,7 +3720,7 @@ var IdentityManager = class {
       identityRecord
     }, {
       F: __dxlog_file12,
-      L: 363,
+      L: 335,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3769,7 +3735,7 @@ var IdentityManager = class {
     });
     (0, import_invariant9.invariant)(identityRecord.haloSpace.controlFeedKey, void 0, {
       F: __dxlog_file12,
-      L: 376,
+      L: 348,
       S: this,
       A: [
         "identityRecord.haloSpace.controlFeedKey",
@@ -3781,7 +3747,7 @@ var IdentityManager = class {
     });
     (0, import_invariant9.invariant)(identityRecord.haloSpace.dataFeedKey, void 0, {
       F: __dxlog_file12,
-      L: 380,
+      L: 352,
       S: this,
       A: [
         "identityRecord.haloSpace.dataFeedKey",
@@ -3805,10 +3771,12 @@ var IdentityManager = class {
     });
     await space.setControlFeed(controlFeed);
     await space.setDataFeed(dataFeed);
+    const did = await (0, import_credentials14.createDidFromIdentityKey)(identityRecord.identityKey);
     const identity = new Identity({
       space,
       presence,
       signer: this._keyring,
+      did,
       identityKey: identityRecord.identityKey,
       deviceKey: identityRecord.deviceKey,
       edgeConnection: this._edgeConnection,
@@ -3818,7 +3786,7 @@ var IdentityManager = class {
       identityKey: identityRecord.identityKey
     }, {
       F: __dxlog_file12,
-      L: 409,
+      L: 383,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3843,7 +3811,7 @@ var IdentityManager = class {
       onAuthFailure: () => {
         import_log10.log.warn("auth failure", void 0, {
           F: __dxlog_file12,
-          L: 434,
+          L: 408,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3896,7 +3864,7 @@ var IdentityServiceImpl = class extends import_context9.Resource {
     const identity = this._identityManager.identity;
     (0, import_invariant10.invariant)(identity, void 0, {
       F: __dxlog_file13,
-      L: 60,
+      L: 61,
       S: this,
       A: [
         "identity",
@@ -3906,7 +3874,7 @@ var IdentityServiceImpl = class extends import_context9.Resource {
     await identity.updateDefaultSpace(space.id);
   }
   queryIdentity() {
-    return new import_codec_protobuf9.Stream(({ next }) => {
+    return new import_stream8.Stream(({ next }) => {
       const emitNext = () => next({
         identity: this._getIdentity()
       });
@@ -3919,6 +3887,7 @@ var IdentityServiceImpl = class extends import_context9.Resource {
       return void 0;
     }
     return {
+      did: this._identityManager.identity.did,
       identityKey: this._identityManager.identity.identityKey,
       spaceKey: this._identityManager.identity.space.key,
       profile: this._identityManager.identity.profileDocument
@@ -3927,7 +3896,7 @@ var IdentityServiceImpl = class extends import_context9.Resource {
   async updateProfile(profile) {
     (0, import_invariant10.invariant)(this._identityManager.identity, "Identity not initialized.", {
       F: __dxlog_file13,
-      L: 86,
+      L: 88,
       S: this,
       A: [
         "this._identityManager.identity",
@@ -3938,18 +3907,29 @@ var IdentityServiceImpl = class extends import_context9.Resource {
     await this._onProfileUpdate?.(this._identityManager.identity.profileDocument);
     return this._getIdentity();
   }
-  async createRecoveryPhrase() {
-    return this._recoveryManager.createRecoveryPhrase();
+  async createRecoveryCredential(request) {
+    return this._recoveryManager.createRecoveryCredential(request);
+  }
+  async requestRecoveryChallenge() {
+    return this._recoveryManager.requestRecoveryChallenge();
   }
   async recoverIdentity(request) {
-    await this._recoveryManager.recoverIdentity(request);
+    if (request.recoveryCode) {
+      await this._recoveryManager.recoverIdentity({
+        recoveryCode: request.recoveryCode
+      });
+    } else if (request.external) {
+      await this._recoveryManager.recoverIdentityWithExternalSignature(request.external);
+    } else {
+      throw new Error("Invalid request.");
+    }
     return this._getIdentity();
   }
   // TODO(burdon): Rename createPresentation?
   async signPresentation({ presentation, nonce }) {
     (0, import_invariant10.invariant)(this._identityManager.identity, "Identity not initialized.", {
       F: __dxlog_file13,
-      L: 103,
+      L: 116,
       S: this,
       A: [
         "this._identityManager.identity",
@@ -3968,7 +3948,7 @@ var IdentityServiceImpl = class extends import_context9.Resource {
     const identity = this._identityManager.identity;
     (0, import_invariant10.invariant)(identity, "Identity not initialized.", {
       F: __dxlog_file13,
-      L: 117,
+      L: 130,
       S: this,
       A: [
         "identity",
@@ -4006,7 +3986,7 @@ var IdentityServiceImpl = class extends import_context9.Resource {
             duplicate: space.id
           }, {
             F: __dxlog_file13,
-            L: 151,
+            L: 164,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4020,7 +4000,7 @@ var IdentityServiceImpl = class extends import_context9.Resource {
     }, (err) => {
       import_log11.log.catch(err, void 0, {
         F: __dxlog_file13,
-        L: 162,
+        L: 175,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -4789,6 +4769,12 @@ var DeviceInvitationProtocol = class {
 var stateToString = (state) => {
   return Object.entries(import_services13.Invitation.State).find(([key, val]) => val === state)?.[0] ?? "unknown";
 };
+var computeExpirationTime = (invitation) => {
+  if (!invitation.lifetime) {
+    return;
+  }
+  return new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime * 1e3);
+};
 var tryAcquireBeforeContextDisposed = async (ctx, mutex) => {
   let guard;
   return (0, import_context11.cancelWithContext)(ctx, (async () => {
@@ -5765,18 +5751,19 @@ var InvitationsHandler = class {
       });
       return extension;
     };
-    if (invitation.lifetime && invitation.created) {
-      if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
+    const expiresOn = (0, import_client_protocol5.getExpirationTime)(invitation);
+    if (expiresOn) {
+      if (expiresOn.getTime() < Date.now()) {
         import_log12.log.warn("invitation has already expired", void 0, {
           F: __dxlog_file21,
-          L: 193,
+          L: 194,
           S: this,
           C: (f, a) => f(...a)
         });
         guardedState.set(null, import_services11.Invitation.State.EXPIRED);
         void ctx.dispose().catch((err) => import_log12.log.catch(err, void 0, {
           F: __dxlog_file21,
-          L: 195,
+          L: 196,
           S: this,
           C: (f, a) => f(...a)
         }));
@@ -5787,7 +5774,7 @@ var InvitationsHandler = class {
         guardedState.set(null, import_services11.Invitation.State.EXPIRED);
         metrics.increment("dxos.invitation.expired");
         await ctx.dispose();
-      }, invitation.created.getTime() + invitation.lifetime * 1e3 - Date.now());
+      }, expiresOn.getTime() - Date.now());
     }
     let swarmConnection;
     (0, import_async15.scheduleTask)(ctx, async () => {
@@ -5803,7 +5790,7 @@ var InvitationsHandler = class {
       type: invitation.type
     }, {
       F: __dxlog_file21,
-      L: 226,
+      L: 227,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5811,7 +5798,7 @@ var InvitationsHandler = class {
     if (deviceProfile) {
       (0, import_invariant12.invariant)(invitation.kind === import_services11.Invitation.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
         F: __dxlog_file21,
-        L: 235,
+        L: 236,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -5829,7 +5816,7 @@ var InvitationsHandler = class {
         triedPeers: triedPeersIds.size
       }, {
         F: __dxlog_file21,
-        L: 243,
+        L: 244,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -5856,7 +5843,7 @@ var InvitationsHandler = class {
               currentState: guardedState.current.state
             }, {
               F: __dxlog_file21,
-              L: 271,
+              L: 272,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -5874,7 +5861,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file21,
-                L: 283,
+                L: 284,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5886,7 +5873,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file21,
-                L: 294,
+                L: 295,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5896,7 +5883,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file21,
-                L: 298,
+                L: 299,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5910,7 +5897,7 @@ var InvitationsHandler = class {
                 authMethod: introductionResponse.authMethod
               }, {
                 F: __dxlog_file21,
-                L: 306,
+                L: 307,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5932,7 +5919,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file21,
-                L: 336,
+                L: 337,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5945,7 +5932,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file21,
-                L: 350,
+                L: 351,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5958,7 +5945,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file21,
-                L: 359,
+                L: 360,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5968,7 +5955,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file21,
-                  L: 362,
+                  L: 363,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -5976,7 +5963,7 @@ var InvitationsHandler = class {
               } else {
                 import_log12.log.verbose("auth failed", err, {
                   F: __dxlog_file21,
-                  L: 365,
+                  L: 366,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -5988,7 +5975,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file21,
-                L: 369,
+                L: 370,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -6004,7 +5991,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file21,
-              L: 378,
+              L: 379,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -6012,7 +5999,7 @@ var InvitationsHandler = class {
           } else {
             import_log12.log.verbose("auth failed", err, {
               F: __dxlog_file21,
-              L: 381,
+              L: 382,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -6029,7 +6016,7 @@ var InvitationsHandler = class {
           ...protocol.toJSON()
         }, {
           F: __dxlog_file21,
-          L: 393,
+          L: 394,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -6042,14 +6029,14 @@ var InvitationsHandler = class {
     });
     edgeInvitationHandler.handle(ctx, guardedState, protocol, deviceProfile);
     (0, import_async15.scheduleTask)(ctx, async () => {
-      const error = protocol.checkInvitation(invitation);
+      const error = checkInvitation(protocol, invitation);
       if (error) {
         stream.error(error);
         await ctx.dispose();
       } else {
         (0, import_invariant12.invariant)(invitation.swarmKey, void 0, {
           F: __dxlog_file21,
-          L: 405,
+          L: 406,
           S: this,
           A: [
             "invitation.swarmKey",
@@ -6093,7 +6080,7 @@ var InvitationsHandler = class {
     for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
       (0, import_log12.log)("guest waiting for authentication code...", void 0, {
         F: __dxlog_file21,
-        L: 457,
+        L: 458,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -6101,7 +6088,7 @@ var InvitationsHandler = class {
       const authCode = await authenticated.wait(options);
       (0, import_log12.log)("sending authentication request", void 0, {
         F: __dxlog_file21,
-        L: 461,
+        L: 462,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -6120,7 +6107,7 @@ var InvitationsHandler = class {
             attempt
           }, {
             F: __dxlog_file21,
-            L: 472,
+            L: 473,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -6138,7 +6125,7 @@ var InvitationsHandler = class {
     }
     (0, import_log12.log)("sending authentication request", void 0, {
       F: __dxlog_file21,
-      L: 491,
+      L: 492,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6151,6 +6138,13 @@ var InvitationsHandler = class {
     }
   }
 };
+var checkInvitation = (protocol, invitation) => {
+  const expiresOn = (0, import_client_protocol5.getExpirationTime)(invitation);
+  if (expiresOn && expiresOn.getTime() < Date.now()) {
+    return new import_protocols9.InvalidInvitationError("Invitation already expired.");
+  }
+  return protocol.checkInvitation(invitation);
+};
 var createAdmissionKeypair = () => {
   const keypair = (0, import_crypto.createKeyPair)();
   return {
@@ -6167,7 +6161,7 @@ var InvitationsServiceImpl = class {
     return {};
   }
   createInvitation(options) {
-    return new import_codec_protobuf10.Stream(({ next, close }) => {
+    return new import_stream9.Stream(({ next, close }) => {
       void this._invitationsManager.createInvitation(options).then((invitation) => {
         import_tracing9.trace.metrics.increment("dxos.invitation.created");
         invitation.subscribe(next, close, close);
@@ -6176,7 +6170,7 @@ var InvitationsServiceImpl = class {
   }
   acceptInvitation(request) {
     const invitation = this._invitationsManager.acceptInvitation(request);
-    return new import_codec_protobuf10.Stream(({ next, close }) => {
+    return new import_stream9.Stream(({ next, close }) => {
       invitation.subscribe(next, close, close);
     });
   }
@@ -6187,7 +6181,7 @@ var InvitationsServiceImpl = class {
     return this._invitationsManager.cancelInvitation(request);
   }
   queryInvitations() {
-    return new import_codec_protobuf10.Stream(({ next, ctx }) => {
+    return new import_stream9.Stream(({ next, ctx }) => {
       this._invitationsManager.invitationCreated.on(ctx, (invitation) => {
         next({
           action: import_services16.QueryInvitationsResponse.Action.ADDED,
@@ -6285,7 +6279,7 @@ var SpaceInvitationProtocol = class {
   getInvitationContext() {
     (0, import_invariant17.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file22,
-      L: 64,
+      L: 65,
       S: this,
       A: [
         "this._spaceKey",
@@ -6295,7 +6289,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant17.invariant)(space, void 0, {
       F: __dxlog_file22,
-      L: 66,
+      L: 67,
       S: this,
       A: [
         "space",
@@ -6311,7 +6305,7 @@ var SpaceInvitationProtocol = class {
   async admit(invitation, request, guestProfile) {
     (0, import_invariant17.invariant)(this._spaceKey && request.space, void 0, {
       F: __dxlog_file22,
-      L: 79,
+      L: 80,
       S: this,
       A: [
         "this._spaceKey && request.space",
@@ -6323,7 +6317,7 @@ var SpaceInvitationProtocol = class {
       guest: request.space.deviceKey
     }, {
       F: __dxlog_file22,
-      L: 80,
+      L: 81,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6345,7 +6339,7 @@ var SpaceInvitationProtocol = class {
   async delegate(invitation) {
     (0, import_invariant17.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file22,
-      L: 100,
+      L: 101,
       S: this,
       A: [
         "this._spaceKey",
@@ -6355,7 +6349,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant17.invariant)(space, void 0, {
       F: __dxlog_file22,
-      L: 102,
+      L: 103,
       S: this,
       A: [
         "space",
@@ -6365,7 +6359,7 @@ var SpaceInvitationProtocol = class {
     if (invitation.authMethod === import_services17.Invitation.AuthMethod.KNOWN_PUBLIC_KEY) {
       (0, import_invariant17.invariant)(invitation.guestKeypair?.publicKey, void 0, {
         F: __dxlog_file22,
-        L: 104,
+        L: 105,
         S: this,
         A: [
           "invitation.guestKeypair?.publicKey",
@@ -6378,7 +6372,7 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file22,
-      L: 107,
+      L: 108,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6387,13 +6381,13 @@ var SpaceInvitationProtocol = class {
       authMethod: invitation.authMethod,
       swarmKey: invitation.swarmKey,
       role: invitation.role ?? import_credentials19.SpaceMember.Role.ADMIN,
-      expiresOn: invitation.lifetime ? new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime) : void 0,
+      expiresOn: computeExpirationTime(invitation),
       multiUse: invitation.multiUse ?? false,
       guestKey: invitation.authMethod === import_services17.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
     });
     (0, import_invariant17.invariant)(credential.credential, void 0, {
       F: __dxlog_file22,
-      L: 127,
+      L: 126,
       S: this,
       A: [
         "credential.credential",
@@ -6408,7 +6402,7 @@ var SpaceInvitationProtocol = class {
   async cancelDelegation(invitation) {
     (0, import_invariant17.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file22,
-      L: 133,
+      L: 132,
       S: this,
       A: [
         "this._spaceKey",
@@ -6417,7 +6411,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant17.invariant)(invitation.type === import_services17.Invitation.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
       F: __dxlog_file22,
-      L: 134,
+      L: 133,
       S: this,
       A: [
         "invitation.type === Invitation.Type.DELEGATED && invitation.delegationCredentialId",
@@ -6427,7 +6421,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant17.invariant)(space, void 0, {
       F: __dxlog_file22,
-      L: 136,
+      L: 135,
       S: this,
       A: [
         "space",
@@ -6439,14 +6433,14 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file22,
-      L: 138,
+      L: 137,
       S: this,
       C: (f, a) => f(...a)
     });
     const credential = await (0, import_credentials18.createCancelDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
     (0, import_invariant17.invariant)(credential.credential, void 0, {
       F: __dxlog_file22,
-      L: 145,
+      L: 144,
       S: this,
       A: [
         "credential.credential",
@@ -6485,7 +6479,7 @@ var SpaceInvitationProtocol = class {
   async accept(response) {
     (0, import_invariant17.invariant)(response.space, void 0, {
       F: __dxlog_file22,
-      L: 180,
+      L: 179,
       S: this,
       A: [
         "response.space",
@@ -6496,7 +6490,7 @@ var SpaceInvitationProtocol = class {
     const assertion = (0, import_credentials18.getCredentialAssertion)(credential);
     (0, import_invariant17.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file22,
-      L: 183,
+      L: 182,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -6505,7 +6499,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant17.invariant)(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
       F: __dxlog_file22,
-      L: 184,
+      L: 183,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -6729,7 +6723,7 @@ var InvitationsManager = class {
     }
   }
   _createInvitation(protocol, _options) {
-    const { invitationId = import_keys14.PublicKey.random().toHex(), type = import_services18.Invitation.Type.INTERACTIVE, authMethod = import_services18.Invitation.AuthMethod.SHARED_SECRET, state = import_services18.Invitation.State.INIT, timeout = import_client_protocol6.INVITATION_TIMEOUT, swarmKey = import_keys14.PublicKey.random(), persistent = _options?.authMethod !== import_services18.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, role = import_credentials21.SpaceMember.Role.ADMIN, lifetime = 86400, multiUse = false, ...options } = _options ?? {};
+    const { invitationId = import_keys14.PublicKey.random().toHex(), type = import_services18.Invitation.Type.INTERACTIVE, authMethod = import_services18.Invitation.AuthMethod.SHARED_SECRET, state = import_services18.Invitation.State.INIT, timeout = import_client_protocol6.INVITATION_TIMEOUT, swarmKey = import_keys14.PublicKey.random(), persistent = _options?.authMethod !== import_services18.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, role = import_credentials21.SpaceMember.Role.ADMIN, lifetime = 86400 * 7, multiUse = false, ...options } = _options ?? {};
     const authCode = options?.authCode ?? (authMethod === import_services18.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials20.generatePasscode)(import_client_protocol6.AUTHENTICATION_CODE_LENGTH) : void 0);
     return {
       invitationId,
@@ -6968,7 +6962,7 @@ var ClientRpcServer = class {
         const handler = (method2, params3) => this._getServiceHandler(serviceName).callStream(method2, params3);
         this._callMetrics.inc(`${serviceName}.${methodName} request stream`);
         if (this._handleStream) {
-          return import_codec_protobuf11.Stream.map(import_codec_protobuf11.Stream.unwrapPromise(this._handleStream(methodName, params2, handler)), (data) => {
+          return import_codec_protobuf2.Stream.map(import_codec_protobuf2.Stream.unwrapPromise(this._handleStream(methodName, params2, handler)), (data) => {
             this._callMetrics.inc(`${serviceName}.${methodName} response stream`);
             return data;
           });
@@ -7068,6 +7062,18 @@ var EdgeAgentManager = class extends import_context15.Resource {
       haloSpaceKey: this._identity.haloSpaceKey.toHex()
     });
     const deviceKey = import_keys15.PublicKey.fromHex(response.deviceKey);
+    if (await this._identity.authorizedDeviceKeys.has(deviceKey)) {
+      import_log21.log.info("agent was already added to HALO, ignoring response", {
+        response
+      }, {
+        F: __dxlog_file25,
+        L: 67,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      this._updateStatus(import_protocols14.EdgeAgentStatus.ACTIVE, deviceKey);
+      return;
+    }
     await this._identity.admitDevice({
       deviceKey,
       controlFeedKey: import_keys15.PublicKey.fromHex(response.feedKey),
@@ -7076,7 +7082,7 @@ var EdgeAgentManager = class extends import_context15.Resource {
     });
     (0, import_log21.log)("agent created", response, {
       F: __dxlog_file25,
-      L: 73,
+      L: 79,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7088,7 +7094,7 @@ var EdgeAgentManager = class extends import_context15.Resource {
       isEnabled
     }, {
       F: __dxlog_file25,
-      L: 81,
+      L: 87,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7121,7 +7127,7 @@ var EdgeAgentManager = class extends import_context15.Resource {
   async _fetchAgentStatus() {
     (0, import_invariant20.invariant)(this._edgeHttpClient, void 0, {
       F: __dxlog_file25,
-      L: 115,
+      L: 121,
       S: this,
       A: [
         "this._edgeHttpClient",
@@ -7131,7 +7137,7 @@ var EdgeAgentManager = class extends import_context15.Resource {
     try {
       (0, import_log21.log)("fetching agent status", void 0, {
         F: __dxlog_file25,
-        L: 117,
+        L: 123,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -7150,7 +7156,7 @@ var EdgeAgentManager = class extends import_context15.Resource {
             err
           }, {
             F: __dxlog_file25,
-            L: 127,
+            L: 133,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -7163,7 +7169,7 @@ var EdgeAgentManager = class extends import_context15.Resource {
         retryAfterMs
       }, {
         F: __dxlog_file25,
-        L: 132,
+        L: 138,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -7199,7 +7205,7 @@ var EdgeAgentManager = class extends import_context15.Resource {
         spaceId: space.id
       }, {
         F: __dxlog_file25,
-        L: 159,
+        L: 165,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -7219,7 +7225,7 @@ var EdgeAgentManager = class extends import_context15.Resource {
       status
     }, {
       F: __dxlog_file25,
-      L: 175,
+      L: 181,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7234,7 +7240,7 @@ var EdgeAgentServiceImpl = class {
     this._edgeConnection = _edgeConnection;
   }
   queryEdgeStatus() {
-    return new import_codec_protobuf12.Stream(({ ctx, next }) => {
+    return new import_stream10.Stream(({ ctx, next }) => {
       next({
         status: import_services20.QueryEdgeStatusResponse.EdgeStatus.NOT_CONNECTED
       });
@@ -7255,7 +7261,7 @@ var EdgeAgentServiceImpl = class {
     return (await this._agentManagerProvider()).createAgent();
   }
   queryAgentStatus() {
-    return new import_codec_protobuf12.Stream(({ ctx, next }) => {
+    return new import_stream10.Stream(({ ctx, next }) => {
       next({
         status: import_services20.QueryAgentStatusResponse.AgentStatus.UNKNOWN
       });
@@ -7292,27 +7298,41 @@ var EdgeIdentityRecoveryManager = class {
     this._identityProvider = _identityProvider;
     this._acceptRecoveredIdentity = _acceptRecoveredIdentity;
   }
-  async createRecoveryPhrase() {
+  async createRecoveryCredential({ recoveryKey, algorithm }) {
     const identity = this._identityProvider();
     (0, import_invariant22.invariant)(identity, void 0, {
       F: __dxlog_file26,
-      L: 29,
+      L: 37,
       S: this,
       A: [
         "identity",
         ""
       ]
     });
-    const seedphrase = (0, import_credentials23.generateSeedPhrase)();
-    const keypair = (0, import_credentials23.keyPairFromSeedPhrase)(seedphrase);
-    const recoveryKey = import_keys17.PublicKey.from(keypair.publicKey);
+    let recoveryCode;
+    if (!recoveryKey) {
+      recoveryCode = (0, import_credentials23.generateSeedPhrase)();
+      const keypair = (0, import_credentials23.keyPairFromSeedPhrase)(recoveryCode);
+      recoveryKey = import_keys17.PublicKey.from(keypair.publicKey);
+      algorithm = "ED25519";
+    }
+    (0, import_invariant22.invariant)(algorithm, "Algorithm is required.", {
+      F: __dxlog_file26,
+      L: 47,
+      S: this,
+      A: [
+        "algorithm",
+        "'Algorithm is required.'"
+      ]
+    });
     const identityKey = identity.identityKey;
     const credential = await identity.getIdentityCredentialSigner().createCredential({
       subject: identityKey,
       assertion: {
         "@type": "dxos.halo.credentials.IdentityRecovery",
         recoveryKey,
-        identityKey
+        identityKey,
+        algorithm
       }
     });
     const receipt = await identity.controlPipeline.writer.write({
@@ -7327,20 +7347,81 @@ var EdgeIdentityRecoveryManager = class {
       ]
     ]));
     return {
-      seedphrase
+      recoveryCode
     };
   }
-  async recoverIdentity(args) {
+  async requestRecoveryChallenge() {
     (0, import_invariant22.invariant)(this._edgeClient, "Not connected to EDGE.", {
       F: __dxlog_file26,
-      L: 51,
+      L: 66,
       S: this,
       A: [
         "this._edgeClient",
         "'Not connected to EDGE.'"
       ]
     });
-    const recoveryKeypair = (0, import_credentials23.keyPairFromSeedPhrase)(args.seedphrase);
+    const deviceKey = await this._keyring.createKey();
+    const controlFeedKey = await this._keyring.createKey();
+    const request = {
+      deviceKey: deviceKey.toHex(),
+      controlFeedKey: controlFeedKey.toHex()
+    };
+    try {
+      await this._edgeClient.recoverIdentity(request);
+      throw new Error("No challenge received.");
+    } catch (error) {
+      if (!(error instanceof import_protocols17.EdgeAuthChallengeError)) {
+        throw error;
+      }
+      return {
+        deviceKey,
+        controlFeedKey,
+        challenge: error.challenge
+      };
+    }
+  }
+  async recoverIdentityWithExternalSignature({ identityDid, deviceKey, controlFeedKey, signature, clientDataJson, authenticatorData }) {
+    (0, import_invariant22.invariant)(this._edgeClient, "Not connected to EDGE.", {
+      F: __dxlog_file26,
+      L: 98,
+      S: this,
+      A: [
+        "this._edgeClient",
+        "'Not connected to EDGE.'"
+      ]
+    });
+    const request = {
+      identityDid,
+      deviceKey: deviceKey.toHex(),
+      controlFeedKey: controlFeedKey.toHex(),
+      signature: clientDataJson && authenticatorData ? {
+        signature: Buffer.from(signature).toString("base64"),
+        clientDataJson: Buffer.from(clientDataJson).toString("base64"),
+        authenticatorData: Buffer.from(authenticatorData).toString("base64")
+      } : Buffer.from(signature).toString("base64")
+    };
+    const response = await this._edgeClient.recoverIdentity(request);
+    await this._acceptRecoveredIdentity({
+      authorizedDeviceCredential: decodeCredential(response.deviceAuthCredential),
+      haloGenesisFeedKey: import_keys17.PublicKey.fromHex(response.genesisFeedKey),
+      haloSpaceKey: import_keys17.PublicKey.fromHex(response.haloSpaceKey),
+      identityKey: import_keys17.PublicKey.fromHex(response.identityKey),
+      deviceKey,
+      controlFeedKey,
+      dataFeedKey: await this._keyring.createKey()
+    });
+  }
+  async recoverIdentity({ recoveryCode }) {
+    (0, import_invariant22.invariant)(this._edgeClient, "Not connected to EDGE.", {
+      F: __dxlog_file26,
+      L: 128,
+      S: this,
+      A: [
+        "this._edgeClient",
+        "'Not connected to EDGE.'"
+      ]
+    });
+    const recoveryKeypair = (0, import_credentials23.keyPairFromSeedPhrase)(recoveryCode);
     const recoveryKey = import_keys17.PublicKey.from(recoveryKeypair.publicKey);
     const deviceKey = await this._keyring.createKey();
     const controlFeedKey = await this._keyring.createKey();
@@ -7364,7 +7445,7 @@ var EdgeIdentityRecoveryManager = class {
     }
     import_log23.log.info("recovering identity", response, {
       F: __dxlog_file26,
-      L: 77,
+      L: 154,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -8068,7 +8149,7 @@ var DevicesServiceImpl = class {
     return this._identityManager.updateDeviceProfile(profile);
   }
   queryDevices() {
-    return new import_codec_protobuf13.Stream(({ next }) => {
+    return new import_stream11.Stream(({ next }) => {
       const update = () => {
         const deviceKeys = this._identityManager.identity?.authorizedDeviceKeys;
         if (!deviceKeys) {
@@ -8190,7 +8271,7 @@ var ContactsServiceImpl = class {
   }
   queryContacts() {
     const subscribedSpaceKeySet = new import_util15.ComplexSet(import_keys20.PublicKey.hash);
-    return new import_codec_protobuf14.Stream(({ next, ctx }) => {
+    return new import_stream12.Stream(({ next, ctx }) => {
       const pushUpdateTask = new import_async25.UpdateScheduler(ctx, async () => {
         const contacts = await this.getContacts();
         next(contacts);
@@ -8259,7 +8340,7 @@ var LoggingServiceImpl = class {
         stats: (0, import_util16.numericalValues)(events, "duration")
       };
     };
-    return new import_codec_protobuf15.Stream(({ next }) => {
+    return new import_stream13.Stream(({ next }) => {
       const update = () => {
         const metrics2 = {
           timestamp: /* @__PURE__ */ new Date(),
@@ -8281,7 +8362,7 @@ var LoggingServiceImpl = class {
     });
   }
   queryLogs(request) {
-    return new import_codec_protobuf15.Stream(({ ctx, next }) => {
+    return new import_stream13.Stream(({ ctx, next }) => {
       const handler = (entry2) => {
         if (LOG_PROCESSING > 0) {
           return;
@@ -8341,7 +8422,7 @@ var NetworkServiceImpl = class {
     this.signalManager = signalManager;
   }
   queryStatus() {
-    return new import_codec_protobuf16.Stream(({ next }) => {
+    return new import_stream14.Stream(({ next }) => {
       const update = () => {
         next({
           swarm: this.networkManager.connectionState,
@@ -8371,7 +8452,7 @@ var NetworkServiceImpl = class {
     return this.signalManager.leave(request);
   }
   subscribeSwarmState(request) {
-    return new import_codec_protobuf16.Stream(({ next }) => {
+    return new import_stream14.Stream(({ next }) => {
       const unsubscribe = this.signalManager.swarmState?.on((state) => {
         if (request.topic.equals(state.swarmKey)) {
           next(state);
@@ -8384,7 +8465,7 @@ var NetworkServiceImpl = class {
     return this.signalManager.sendMessage(message);
   }
   subscribeMessages(peer) {
-    return new import_codec_protobuf16.Stream(({ next }) => {
+    return new import_stream14.Stream(({ next }) => {
       const unsubscribe = this.signalManager.onMessage.on((message) => {
         if (message.recipient.peerKey === peer.peerKey) {
           next(message);
@@ -8427,7 +8508,7 @@ var SystemServiceImpl = class {
   }
   // TODO(burdon): Standardize interval option in stream request?
   queryStatus({ interval = 3e3 } = {}) {
-    return new import_codec_protobuf17.Stream(({ next }) => {
+    return new import_stream15.Stream(({ next }) => {
       const update = () => {
         next({
           status: this._getCurrentStatus()
@@ -8893,4 +8974,4 @@ ClientServicesHost = _ts_decorate11([
   subscribeToSpaces,
   subscribeToSwarmInfo
 });
-//# sourceMappingURL=chunk-LKVY5GQC.cjs.map
+//# sourceMappingURL=chunk-F7R4IRLD.cjs.map