@dxos/client-services 0.1.35 → 0.1.36-next.ef27157

package/dist/lib/browser/{chunk-H5IXSSI7.mjs → chunk-OINEQJWM.mjs}

@@ -861,696 +861,176 @@ var IdentityServiceImpl = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/device-invitations-handler.ts
+// packages/sdk/client-services/src/packlets/invitations/device-invitation-protocol.ts
 import assert4 from "@dxos/node-std/assert";
-import { scheduleTask, sleep, Trigger as Trigger2 } from "@dxos/async";
-import { AbstractInvitationsHandler, AuthenticatingInvitationProvider, AUTHENTICATION_CODE_LENGTH, InvitationObservableProvider, INVITATION_TIMEOUT, ON_CLOSE_DELAY } from "@dxos/client";
-import { Context as Context3 } from "@dxos/context";
-import { generatePasscode } from "@dxos/credentials";
-import { PublicKey as PublicKey4 } from "@dxos/keys";
-import { log as log4 } from "@dxos/log";
-import { createTeleportProtocolFactory, StarTopology } from "@dxos/network-manager";
-import { schema as schema2 } from "@dxos/protocols";
 import { Invitation } from "@dxos/protocols/proto/dxos/client/services";
-import { AuthenticationResponse } from "@dxos/protocols/proto/dxos/halo/invitations";
-import { RpcExtension } from "@dxos/teleport";
-var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
-  // prettier-ignore
-  constructor(_params) {
-    super(_params.networkManager);
-    this._params = _params;
+var DeviceInvitationProtocol = class {
+  constructor(_keyring, _getIdentity, _acceptIdentity) {
+    this._keyring = _keyring;
+    this._getIdentity = _getIdentity;
+    this._acceptIdentity = _acceptIdentity;
   }
-  /**
-  * Creates an invitation and listens for a join request from the invited (guest) peer.
-  */
-  createInvitation(context, options) {
-    const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    assert4(type !== Invitation.Type.OFFLINE);
-    const identity = this._params.getIdentity();
-    const invitation = {
-      type,
-      invitationId: PublicKey4.random().toHex(),
-      swarmKey: swarmKey != null ? swarmKey : PublicKey4.random(),
-      authenticationCode: generatePasscode(AUTHENTICATION_CODE_LENGTH)
-    };
-    const ctx = new Context3({
-      onError: (err) => {
-        void ctx.dispose();
-        observable.callback.onError(err);
-      }
-    });
-    const observable = new InvitationObservableProvider(async () => {
-      await ctx.dispose();
-    });
-    let authenticationCode;
-    const complete = new Trigger2();
-    const createExtension = () => new HostHaloInvitationExtension({
-      requestAdmission: async () => {
-        var _a, _b;
-        log4("responding with admission offer", {
-          host: identity.deviceKey
-        }, {
-          file: "device-invitations-handler.ts",
-          line: 92,
-          scope: this,
-          callSite: (f, a) => f(...a)
-        });
-        (_b = (_a = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a, invitation);
-        return {
-          identityKey: identity.identityKey,
-          haloSpaceKey: identity.haloSpaceKey,
-          genesisFeedKey: identity.haloGenesisFeedKey,
-          controlTimeframe: identity.controlPipeline.state.timeframe
-        };
-      },
-      authenticate: async ({ authenticationCode: code }) => {
-        log4("received authentication request", {
-          authenticationCode: code
-        }, {
-          file: "device-invitations-handler.ts",
-          line: 107,
-          scope: this,
-          callSite: (f, a) => f(...a)
-        });
-        authenticationCode = code;
-        return {
-          status: AuthenticationResponse.Status.OK
-        };
-      },
-      // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
-      presentAdmissionCredentials: async (credentials) => {
-        try {
-          if (invitation.type !== Invitation.Type.INTERACTIVE_TESTING) {
-            if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
-              throw new Error(`invalid authentication code: ${authenticationCode}`);
-            }
-          }
-          log4("writing guest credentials", {
-            host: identity.deviceKey,
-            guest: credentials.deviceKey
-          }, {
-            file: "device-invitations-handler.ts",
-            line: 122,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          await identity.admitDevice(credentials);
-          complete.wake(credentials.deviceKey);
-        } catch (err) {
-          observable.callback.onError(err);
-          throw err;
-        }
-      },
-      onOpen: () => {
-        scheduleTask(ctx, async () => {
-          var _a, _b;
-          try {
-            log4("connected", {
-              host: identity.deviceKey
-            }, {
-              file: "device-invitations-handler.ts",
-              line: 138,
-              scope: this,
-              callSite: (f, a) => f(...a)
-            });
-            (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
-            const deviceKey = await complete.wait({
-              timeout
-            });
-            log4("admitted guest", {
-              host: identity.deviceKey,
-              guest: deviceKey
-            }, {
-              file: "device-invitations-handler.ts",
-              line: 141,
-              scope: this,
-              callSite: (f, a) => f(...a)
-            });
-            observable.callback.onSuccess(invitation);
-          } catch (err) {
-            if (!observable.cancelled) {
-              log4.error("failed", err, {
-                file: "device-invitations-handler.ts",
-                line: 145,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              observable.callback.onError(err);
-            }
-          } finally {
-            await sleep(ON_CLOSE_DELAY);
-            await ctx.dispose();
-          }
-        });
-      }
-    });
-    scheduleTask(ctx, async () => {
-      var _a, _b;
-      const topic = invitation.swarmKey;
-      const swarmConnection = await this._networkManager.joinSwarm({
-        topic,
-        peerId: topic,
-        protocolProvider: createTeleportProtocolFactory(async (teleport) => {
-          teleport.addExtension("dxos.halo.invitations", createExtension());
-        }),
-        topology: new StarTopology(topic)
-      });
-      ctx.onDispose(() => swarmConnection.close());
-      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
-    });
-    return observable;
+  toJSON() {
+    return {};
   }
-  /**
-  * Waits for the host peer (inviter) to accept our join request.
-  * The local guest peer (invitee) then sends the local halo invitation to the host,
-  * which then writes the guest's credentials to the halo.
-  */
-  acceptInvitation(invitation, options) {
-    const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
-    const ctx = new Context3({
-      onError: (err) => {
-        void ctx.dispose();
-        observable.callback.onError(err);
-      }
-    });
-    const authenticated = new Trigger2();
-    const observable = new AuthenticatingInvitationProvider({
-      onCancel: async () => {
-        await ctx.dispose();
-      },
-      // TODO(burdon): Consider retry.
-      onAuthenticate: async (code) => {
-        authenticated.wake(code);
-      }
-    });
-    let connectionCount = 0;
-    const complete = new Trigger2();
-    const createExtension = () => {
-      const extension = new GuestHaloInvitationExtension({
-        onOpen: () => {
-          scheduleTask(ctx, async () => {
-            var _a, _b, _c, _d;
-            try {
-              if (++connectionCount > 1) {
-                throw new Error(`multiple connections detected: ${connectionCount}`);
-              }
-              log4("connected", {}, {
-                file: "device-invitations-handler.ts",
-                line: 216,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
-              log4("sending admission request", {}, {
-                file: "device-invitations-handler.ts",
-                line: 220,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = await extension.rpc.HaloHostService.requestAdmission();
-              if (invitation.type === void 0 || invitation.type === Invitation.Type.INTERACTIVE) {
-                log4("guest waiting for authentication code...", {}, {
-                  file: "device-invitations-handler.ts",
-                  line: 227,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
-                });
-                (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
-                const authenticationCode = await authenticated.wait({
-                  timeout
-                });
-                log4("sending authentication request", {}, {
-                  file: "device-invitations-handler.ts",
-                  line: 230,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
-                });
-                await extension.rpc.HaloHostService.authenticate({
-                  authenticationCode
-                });
-              }
-              const deviceKey = await this._params.keyring.createKey();
-              const controlFeedKey = await this._params.keyring.createKey();
-              const dataFeedKey = await this._params.keyring.createKey();
-              log4("presenting admission credentials", {
-                identityKey,
-                deviceKey,
-                controlFeedKey,
-                dataFeedKey
-              }, {
-                file: "device-invitations-handler.ts",
-                line: 239,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              await extension.rpc.HaloHostService.presentAdmissionCredentials({
-                deviceKey,
-                controlFeedKey,
-                dataFeedKey
-              });
-              const identity = await this._params.acceptIdentity({
-                identityKey,
-                deviceKey,
-                haloSpaceKey,
-                haloGenesisFeedKey: genesisFeedKey,
-                controlFeedKey,
-                dataFeedKey,
-                controlTimeframe
-              });
-              log4("admitted by host", {
-                guest: identity.deviceKey,
-                identityKey
-              }, {
-                file: "device-invitations-handler.ts",
-                line: 259,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              complete.wake(identityKey);
-            } catch (err) {
-              if (!observable.cancelled) {
-                log4.warn("auth failed", err, {
-                  file: "device-invitations-handler.ts",
-                  line: 263,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
-                });
-                observable.callback.onError(err);
-              }
-            } finally {
-              await ctx.dispose();
-            }
-          });
-        }
-      });
-      return extension;
+  getInvitationContext() {
+    return {
+      kind: Invitation.Kind.DEVICE
     };
-    scheduleTask(ctx, async () => {
-      var _a, _b;
-      assert4(invitation.swarmKey);
-      const topic = invitation.swarmKey;
-      const swarmConnection = await this._networkManager.joinSwarm({
-        topic,
-        peerId: PublicKey4.random(),
-        protocolProvider: createTeleportProtocolFactory(async (teleport) => {
-          teleport.addExtension("dxos.halo.invitations", createExtension());
-        }),
-        topology: new StarTopology(topic)
-      });
-      ctx.onDispose(() => swarmConnection.close());
-      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
-      invitation.identityKey = await complete.wait();
-      observable.callback.onSuccess(invitation);
-      await ctx.dispose();
-    });
-    return observable;
-  }
-};
-var HostHaloInvitationExtension = class extends RpcExtension {
-  constructor(_callbacks) {
-    super({
-      exposed: {
-        HaloHostService: schema2.getService("dxos.halo.invitations.HaloHostService")
-      }
-    });
-    this._callbacks = _callbacks;
   }
-  async getHandlers() {
+  async admit(request) {
+    assert4(request.device);
+    const identity = this._getIdentity();
+    await identity.admitDevice(request.device);
     return {
-      // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
-      // Perhaps in the future we will have more complex logic here.
-      HaloHostService: {
-        requestAdmission: async () => {
-          return this._callbacks.requestAdmission();
-        },
-        authenticate: async (credentials) => {
-          return this._callbacks.authenticate(credentials);
-        },
-        // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
-        presentAdmissionCredentials: async (credentials) => {
-          return this._callbacks.presentAdmissionCredentials(credentials);
-        }
+      device: {
+        identityKey: identity.identityKey,
+        haloSpaceKey: identity.haloSpaceKey,
+        genesisFeedKey: identity.haloGenesisFeedKey,
+        controlTimeframe: identity.controlPipeline.state.timeframe
       }
     };
   }
-  async onOpen(context) {
-    await super.onOpen(context);
-    this._callbacks.onOpen();
-  }
-};
-var GuestHaloInvitationExtension = class extends RpcExtension {
-  constructor(_callbacks) {
-    super({
-      requested: {
-        HaloHostService: schema2.getService("dxos.halo.invitations.HaloHostService")
-      }
-    });
-    this._callbacks = _callbacks;
-  }
-  async getHandlers() {
+  createIntroduction() {
     return {};
   }
-  async onOpen(context) {
-    await super.onOpen(context);
-    this._callbacks.onOpen();
-  }
-};
-
-// packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
-import assert5 from "@dxos/node-std/assert";
-import { Stream as Stream7 } from "@dxos/codec-protobuf";
-import { log as log5 } from "@dxos/log";
-import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
-var AbstractInvitationsService = class {
-  // prettier-ignore
-  constructor(_identityManager, _getInvitationsHandler) {
-    this._identityManager = _identityManager;
-    this._getInvitationsHandler = _getInvitationsHandler;
-    this._createInvitations = /* @__PURE__ */ new Map();
-    this._acceptInvitations = /* @__PURE__ */ new Map();
-  }
-  // TODO(burdon): Guest/host label.
-  getLoggingContext() {
-    var _a;
+  async createAdmissionRequest() {
+    const deviceKey = await this._keyring.createKey();
+    const controlFeedKey = await this._keyring.createKey();
+    const dataFeedKey = await this._keyring.createKey();
     return {
-      deviceKey: (_a = this._identityManager.identity) == null ? void 0 : _a.deviceKey
+      device: {
+        deviceKey,
+        controlFeedKey,
+        dataFeedKey
+      }
     };
   }
-  createInvitation(invitation) {
-    return new Stream7(({ next, close }) => {
-      const invitationsHandler = this._getInvitationsHandler();
-      const context = this.getContext(invitation);
-      log5("stream opened", this.getLoggingContext(), {
-        file: "invitations-service.ts",
-        line: 48,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      let invitationId;
-      const { type, swarmKey, authMethod } = invitation;
-      const observable = invitationsHandler.createInvitation(context, {
-        type,
-        swarmKey,
-        authMethod
-      });
-      observable.subscribe({
-        onConnecting: (invitation2) => {
-          assert5(invitation2.invitationId);
-          invitationId = invitation2.invitationId;
-          this._createInvitations.set(invitation2.invitationId, observable);
-          invitation2.state = Invitation2.State.CONNECTING;
-          next(invitation2);
-        },
-        onConnected: (invitation2) => {
-          assert5(invitation2.invitationId);
-          invitation2.state = Invitation2.State.CONNECTED;
-          next(invitation2);
-        },
-        onAuthenticating: (invitation2) => {
-          assert5(invitation2.invitationId);
-          invitation2.state = Invitation2.State.AUTHENTICATING;
-          next(invitation2);
-        },
-        onSuccess: (invitation2) => {
-          assert5(invitation2.invitationId);
-          invitation2.state = Invitation2.State.SUCCESS;
-          next(invitation2);
-          close();
-        },
-        onCancelled: () => {
-          assert5(invitationId);
-          invitation.invitationId = invitationId;
-          invitation.state = Invitation2.State.CANCELLED;
-          next(invitation);
-          close();
-        },
-        onTimeout: (err) => {
-          invitation.state = Invitation2.State.TIMEOUT;
-          close(err);
-        },
-        onError: (err) => {
-          invitation.state = Invitation2.State.ERROR;
-          close(err);
-        }
-      });
-      return (err) => {
-        const context2 = this.getLoggingContext();
-        if (err) {
-          log5.warn("stream closed", {
-            ...context2,
-            err
-          }, {
-            file: "invitations-service.ts",
-            line: 97,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        } else {
-          log5("stream closed", context2, {
-            file: "invitations-service.ts",
-            line: 99,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        }
-        this._createInvitations.delete(invitation.invitationId);
-      };
-    });
-  }
-  acceptInvitation(invitation, options) {
-    return new Stream7(({ next, close }) => {
-      log5("stream opened", this.getLoggingContext(), {
-        file: "invitations-service.ts",
-        line: 109,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      const invitationsHandler = this._getInvitationsHandler();
-      let invitationId;
-      const observable = invitationsHandler.acceptInvitation(invitation, options);
-      observable.subscribe({
-        onConnecting: (invitation2) => {
-          assert5(invitation2.invitationId);
-          invitationId = invitation2.invitationId;
-          this._acceptInvitations.set(invitation2.invitationId, observable);
-          invitation2.state = Invitation2.State.CONNECTING;
-          next(invitation2);
-        },
-        onConnected: (invitation2) => {
-          assert5(invitation2.invitationId);
-          invitation2.state = Invitation2.State.CONNECTED;
-          next(invitation2);
-        },
-        onAuthenticating: (invitation2) => {
-          assert5(invitation2.invitationId);
-          invitation2.state = Invitation2.State.AUTHENTICATING;
-          next(invitation2);
-        },
-        onSuccess: (invitation2) => {
-          invitation2.state = Invitation2.State.SUCCESS;
-          next(invitation2);
-          close();
-        },
-        onCancelled: () => {
-          assert5(invitationId);
-          invitation.invitationId = invitationId;
-          invitation.state = Invitation2.State.CANCELLED;
-          next(invitation);
-          close();
-        },
-        onTimeout: (err) => {
-          invitation.state = Invitation2.State.TIMEOUT;
-          close(err);
-        },
-        onError: (err) => {
-          invitation.state = Invitation2.State.ERROR;
-          close(err);
-        }
-      });
-      return (err) => {
-        const context = this.getLoggingContext();
-        if (err) {
-          log5.warn("stream closed", {
-            ...context,
-            err
-          }, {
-            file: "invitations-service.ts",
-            line: 157,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        } else {
-          log5("stream closed", context, {
-            file: "invitations-service.ts",
-            line: 159,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        }
-        this._acceptInvitations.delete(invitation.invitationId);
-      };
-    });
-  }
-  async authenticate({ invitationId, authenticationCode }) {
-    log5("authenticating...", {}, {
-      file: "invitations-service.ts",
-      line: 168,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    assert5(invitationId);
-    const observable = this._acceptInvitations.get(invitationId);
-    if (!observable) {
-      log5.warn("invalid invitation", {
-        invitationId
-      }, {
-        file: "invitations-service.ts",
-        line: 172,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    } else {
-      await observable.authenticate(authenticationCode);
-    }
-  }
-  async cancelInvitation(invitation) {
-    var _a;
-    log5("cancelling...", {}, {
-      file: "invitations-service.ts",
-      line: 179,
-      scope: this,
-      callSite: (f, a) => f(...a)
+  async accept(response, request) {
+    assert4(response.device);
+    const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
+    assert4(request.device);
+    const { deviceKey, controlFeedKey, dataFeedKey } = request.device;
+    await this._acceptIdentity({
+      identityKey,
+      deviceKey,
+      haloSpaceKey,
+      haloGenesisFeedKey: genesisFeedKey,
+      controlFeedKey,
+      dataFeedKey,
+      controlTimeframe
     });
-    assert5(invitation.invitationId);
-    const observable = (_a = this._createInvitations.get(invitation.invitationId)) != null ? _a : this._acceptInvitations.get(invitation.invitationId);
-    if (!observable) {
-      log5.warn("invalid invitation", {
-        invitationId: invitation.invitationId
-      }, {
-        file: "invitations-service.ts",
-        line: 184,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    } else {
-      await (observable == null ? void 0 : observable.cancel());
-    }
-  }
-};
-
-// packages/sdk/client-services/src/packlets/invitations/device-invitations-service.ts
-var DeviceInvitationsServiceImpl = class extends AbstractInvitationsService {
-  // prettier-ignore
-  constructor(identityManager, invitationsHandler) {
-    super(identityManager, () => invitationsHandler);
-    this.invitationsHandler = invitationsHandler;
-  }
-  getContext(invitation) {
+    return {
+      identityKey
+    };
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts
-import assert6 from "@dxos/node-std/assert";
-import { scheduleTask as scheduleTask2, sleep as sleep2, Trigger as Trigger3 } from "@dxos/async";
-import { AuthenticatingInvitationProvider as AuthenticatingInvitationProvider2, AUTHENTICATION_CODE_LENGTH as AUTHENTICATION_CODE_LENGTH2, InvitationObservableProvider as InvitationObservableProvider2, INVITATION_TIMEOUT as INVITATION_TIMEOUT2, ON_CLOSE_DELAY as ON_CLOSE_DELAY2, AbstractInvitationsHandler as AbstractInvitationsHandler2 } from "@dxos/client";
-import { Context as Context4 } from "@dxos/context";
-import { createAdmissionCredentials, generatePasscode as generatePasscode2, getCredentialAssertion } from "@dxos/credentials";
-import { writeMessages as writeMessages2 } from "@dxos/feed-store";
-import { PublicKey as PublicKey5 } from "@dxos/keys";
-import { log as log6 } from "@dxos/log";
-import { createTeleportProtocolFactory as createTeleportProtocolFactory2, StarTopology as StarTopology2 } from "@dxos/network-manager";
-import { schema as schema3 } from "@dxos/protocols";
-import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
-import { AuthenticationResponse as AuthenticationResponse2, AuthMethod } from "@dxos/protocols/proto/dxos/halo/invitations";
-import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
+// packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
+import assert5 from "@dxos/node-std/assert";
+import { PushStream, scheduleTask, sleep, TimeoutError, Trigger as Trigger2 } from "@dxos/async";
+import { AUTHENTICATION_CODE_LENGTH, CancellableInvitationObservable, INVITATION_TIMEOUT, ON_CLOSE_DELAY, AuthenticatingInvitationObservable } from "@dxos/client";
+import { Context as Context3 } from "@dxos/context";
+import { generatePasscode } from "@dxos/credentials";
+import { PublicKey as PublicKey4 } from "@dxos/keys";
+import { log as log4 } from "@dxos/log";
+import { createTeleportProtocolFactory, StarTopology } from "@dxos/network-manager";
+import { schema as schema2 } from "@dxos/protocols";
+import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
+import { AuthenticationResponse } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { RpcExtension } from "@dxos/teleport";
 var MAX_OTP_ATTEMPTS = 3;
-var SpaceInvitationsHandler = class extends AbstractInvitationsHandler2 {
-  constructor(networkManager, _spaceManager, _signingContext, _keyring) {
-    super(networkManager);
-    this._spaceManager = _spaceManager;
-    this._signingContext = _signingContext;
-    this._keyring = _keyring;
+var InvitationsHandler = class {
+  constructor(_networkManager) {
+    this._networkManager = _networkManager;
   }
-  /**
-  * Creates an invitation and listens for a join request from the invited (guest) peer.
-  */
-  createInvitation(space, options) {
+  createInvitation(protocol, options) {
     var _a;
-    let swarmConnection;
-    const { type, timeout = INVITATION_TIMEOUT2, swarmKey } = options != null ? options : {};
-    assert6(type !== Invitation3.Type.OFFLINE);
-    assert6(space);
+    const { invitationId = PublicKey4.random().toHex(), type = Invitation2.Type.INTERACTIVE, authMethod = Invitation2.AuthMethod.SHARED_SECRET, state = Invitation2.State.INIT, timeout = INVITATION_TIMEOUT, swarmKey = PublicKey4.random() } = options != null ? options : {};
+    const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === Invitation2.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0;
+    assert5(protocol);
     const invitation = {
+      invitationId,
       type,
-      invitationId: PublicKey5.random().toHex(),
-      swarmKey: swarmKey != null ? swarmKey : PublicKey5.random(),
-      spaceKey: space.key,
-      authMethod: (_a = options == null ? void 0 : options.authMethod) != null ? _a : AuthMethod.SHARED_SECRET,
-      authenticationCode: generatePasscode2(AUTHENTICATION_CODE_LENGTH2)
-      // TODO(dmaretskyi): Don't generate if authMethod === NONE .
+      authMethod,
+      state,
+      swarmKey,
+      authCode,
+      timeout,
+      ...protocol.getInvitationContext()
     };
-    const ctx = new Context4({
+    const stream = new PushStream();
+    const ctx = new Context3({
       onError: (err) => {
         void ctx.dispose();
-        observable.callback.onError(err);
+        stream.error(err);
       }
     });
-    const observable = new InvitationObservableProvider2(async () => {
-      await (swarmConnection == null ? void 0 : swarmConnection.close());
+    ctx.onDispose(() => {
+      log4("complete", {
+        ...protocol.toJSON()
+      }, {
+        file: "invitations-handler.ts",
+        line: 102,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      stream.complete();
     });
-    let authenticationPassed = false;
-    let authenticationRetry = 0;
     const createExtension = () => {
-      const complete = new Trigger3();
+      const success = new Trigger2();
       let guestProfile;
-      const hostInvitationExtension = new HostSpaceInvitationExtension({
+      let authenticationPassed = false;
+      let authenticationRetry = 0;
+      const extension = new InvitationHostExtension({
         introduce: async ({ profile }) => {
-          var _a2, _b;
-          log6("guest introduced itself", {
+          log4("guest introduced itself", {
             guestProfile: profile,
-            host: this._signingContext.deviceKey,
-            spaceKey: space.key
+            ...protocol.toJSON()
           }, {
-            file: "space-invitations-handler.ts",
-            line: 101,
+            file: "invitations-handler.ts",
+            line: 115,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           guestProfile = profile;
-          (_b = (_a2 = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a2, invitation);
+          stream.next({
+            ...invitation,
+            state: Invitation2.State.READY_FOR_AUTHENTICATION
+          });
           return {
-            spaceKey: type === Invitation3.Type.INTERACTIVE_TESTING || type === Invitation3.Type.MULTIUSE_TESTING ? space.key : void 0,
-            authMethod: invitation.authMethod
+            spaceKey: authMethod === Invitation2.AuthMethod.NONE ? protocol.getInvitationContext().spaceKey : void 0,
+            authMethod
           };
         },
-        authenticate: async ({ authenticationCode: code }) => {
-          log6("received authentication request", {
-            authenticationCode: code
+        authenticate: async ({ authCode: code }) => {
+          log4("received authentication request", {
+            authCode: code
           }, {
-            file: "space-invitations-handler.ts",
-            line: 123,
+            file: "invitations-handler.ts",
+            line: 134,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          let status = AuthenticationResponse2.Status.OK;
+          let status = AuthenticationResponse.Status.OK;
           switch (invitation.authMethod) {
-            case AuthMethod.NONE: {
-              log6("authentication not required", {}, {
-                file: "space-invitations-handler.ts",
-                line: 128,
+            case Invitation2.AuthMethod.NONE: {
+              log4("authentication not required", {}, {
+                file: "invitations-handler.ts",
+                line: 139,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               return {
-                status: AuthenticationResponse2.Status.OK
+                status: AuthenticationResponse.Status.OK
               };
             }
-            case AuthMethod.SHARED_SECRET: {
-              if (invitation.authenticationCode) {
+            case Invitation2.AuthMethod.SHARED_SECRET: {
+              if (invitation.authCode) {
                 if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
-                  status = AuthenticationResponse2.Status.INVALID_OPT_ATTEMPTS;
-                } else if (code !== invitation.authenticationCode) {
-                  status = AuthenticationResponse2.Status.INVALID_OTP;
+                  status = AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
+                } else if (code !== invitation.authCode) {
+                  status = AuthenticationResponse.Status.INVALID_OTP;
                 } else {
                   authenticationPassed = true;
                 }
@@ -1558,15 +1038,15 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler2 {
               break;
             }
             default: {
-              log6.error("invalid authentication method", {
+              log4.error("invalid authentication method", {
                 authMethod: invitation.authMethod
               }, {
-                file: "space-invitations-handler.ts",
-                line: 144,
+                file: "invitations-handler.ts",
+                line: 157,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              status = AuthenticationResponse2.Status.INTERNAL_ERROR;
+              status = AuthenticationResponse.Status.INTERNAL_ERROR;
               break;
             }
           }
@@ -1574,159 +1054,196 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler2 {
             status
           };
         },
-        requestAdmission: async ({ identityKey, deviceKey, controlFeedKey, dataFeedKey }) => {
-          var _a2;
+        admit: async (admissionRequest) => {
+          var _a2, _b, _c;
           try {
             if (isAuthenticationRequired(invitation) && !authenticationPassed) {
               throw new Error("Not authenticated");
             }
-            log6("writing guest credentials", {
-              host: this._signingContext.deviceKey,
-              guest: deviceKey
-            }, {
-              file: "space-invitations-handler.ts",
-              line: 160,
-              scope: this,
-              callSite: (f, a) => f(...a)
-            });
-            const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
-            assert6(credentials[0].credential);
-            const spaceMemberCredential = credentials[0].credential.credential;
-            assert6(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
-            await writeMessages2(space.inner.controlPipeline.writer, credentials);
-            complete.wake(deviceKey);
-            return {
-              credential: spaceMemberCredential,
-              controlTimeframe: space.inner.controlPipeline.state.timeframe,
-              dataTimeframe: (_a2 = space.dataPipeline.pipelineState) == null ? void 0 : _a2.timeframe
-            };
+            const deviceKey = (_c = (_a2 = admissionRequest.device) == null ? void 0 : _a2.deviceKey) != null ? _c : (_b = admissionRequest.space) == null ? void 0 : _b.deviceKey;
+            assert5(deviceKey);
+            const admissionResponse = await protocol.admit(admissionRequest, guestProfile);
+            success.wake(deviceKey);
+            return admissionResponse;
           } catch (err) {
-            observable.callback.onError(err);
+            stream.error(err);
             throw err;
           }
         },
         onOpen: () => {
-          scheduleTask2(ctx, async () => {
-            var _a2, _b;
+          scheduleTask(ctx, async () => {
             try {
-              log6("connected", {
-                host: this._signingContext.deviceKey
+              log4("connected", {
+                ...protocol.toJSON()
               }, {
-                file: "space-invitations-handler.ts",
-                line: 195,
+                file: "invitations-handler.ts",
+                line: 191,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              (_b = (_a2 = observable.callback).onConnected) == null ? void 0 : _b.call(_a2, invitation);
-              const deviceKey = await complete.wait({
+              stream.next({
+                ...invitation,
+                state: Invitation2.State.CONNECTED
+              });
+              const deviceKey = await success.wait({
                 timeout
               });
-              log6("admitted guest", {
-                host: this._signingContext.deviceKey,
-                guest: deviceKey
+              log4("admitted guest", {
+                guest: deviceKey,
+                ...protocol.toJSON()
               }, {
-                file: "space-invitations-handler.ts",
-                line: 198,
+                file: "invitations-handler.ts",
+                line: 194,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              observable.callback.onSuccess(invitation);
+              stream.next({
+                ...invitation,
+                state: Invitation2.State.SUCCESS
+              });
             } catch (err) {
-              if (!observable.cancelled) {
-                log6.error("failed", err, {
-                  file: "space-invitations-handler.ts",
-                  line: 202,
+              if (err instanceof TimeoutError) {
+                log4("timeout", {
+                  ...protocol.toJSON()
+                }, {
+                  file: "invitations-handler.ts",
+                  line: 198,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                stream.next({
+                  ...invitation,
+                  state: Invitation2.State.TIMEOUT
+                });
+              } else {
+                log4.error("failed", err, {
+                  file: "invitations-handler.ts",
+                  line: 201,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
-                observable.callback.onError(err);
+                stream.error(err);
               }
             } finally {
-              if (type !== Invitation3.Type.MULTIUSE_TESTING) {
-                await sleep2(ON_CLOSE_DELAY2);
+              if (type !== Invitation2.Type.MULTIUSE) {
+                await sleep(ON_CLOSE_DELAY);
                 await ctx.dispose();
               }
             }
           });
         }
       });
-      return hostInvitationExtension;
+      return extension;
     };
-    scheduleTask2(ctx, async () => {
-      var _a2, _b;
+    scheduleTask(ctx, async () => {
       const topic = invitation.swarmKey;
-      const swarmConnection2 = await this._networkManager.joinSwarm({
+      const swarmConnection = await this._networkManager.joinSwarm({
         topic,
         peerId: topic,
-        protocolProvider: createTeleportProtocolFactory2(async (teleport) => {
+        protocolProvider: createTeleportProtocolFactory(async (teleport) => {
           teleport.addExtension("dxos.halo.invitations", createExtension());
         }),
-        topology: new StarTopology2(topic)
+        topology: new StarTopology(topic)
+      });
+      ctx.onDispose(() => swarmConnection.close());
+      stream.next({
+        ...invitation,
+        state: Invitation2.State.CONNECTING
       });
-      ctx.onDispose(() => swarmConnection2.close());
-      (_b = (_a2 = observable.callback).onConnecting) == null ? void 0 : _b.call(_a2, invitation);
+    });
+    const observable = new CancellableInvitationObservable({
+      initialInvitation: invitation,
+      subscriber: stream.observable,
+      onCancel: async () => {
+        stream.next({
+          ...invitation,
+          state: Invitation2.State.CANCELLED
+        });
+        await ctx.dispose();
+      }
     });
     return observable;
   }
-  /**
-  * Waits for the host peer (inviter) to accept our join request.
-  * The local guest peer (invitee) then sends the local space invitation to the host,
-  * which then writes the guest's credentials to the space.
-  */
-  acceptInvitation(invitation, options) {
-    const { timeout = INVITATION_TIMEOUT2 } = options != null ? options : {};
-    const ctx = new Context4({
+  acceptInvitation(protocol, invitation) {
+    const { timeout = INVITATION_TIMEOUT } = invitation;
+    assert5(protocol);
+    const authenticated = new Trigger2();
+    const stream = new PushStream();
+    const ctx = new Context3({
       onError: (err) => {
-        void ctx.dispose();
-        observable.callback.onError(err);
-      }
-    });
-    const authenticated = new Trigger3();
-    const observable = new AuthenticatingInvitationProvider2({
-      onCancel: async () => {
-        await ctx.dispose();
-      },
-      onAuthenticate: async (code) => {
-        authenticated.wake(code);
+        if (err instanceof TimeoutError) {
+          log4("timeout", {
+            ...protocol.toJSON()
+          }, {
+            file: "invitations-handler.ts",
+            line: 255,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          stream.next({
+            ...invitation,
+            state: Invitation2.State.TIMEOUT
+          });
+        } else {
+          log4.warn("auth failed", err, {
+            file: "invitations-handler.ts",
+            line: 258,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          stream.error(err);
+        }
+        void ctx.dispose();
       }
     });
-    let connectionCount = 0;
-    const complete = new Trigger3();
+    ctx.onDispose(() => {
+      log4("complete", {
+        ...protocol.toJSON()
+      }, {
+        file: "invitations-handler.ts",
+        line: 266,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      stream.complete();
+    });
     const createExtension = () => {
-      const extension = new GuestSpaceInvitationExtension({
+      let connectionCount = 0;
+      const extension = new InvitationGuestExtension({
         onOpen: () => {
-          scheduleTask2(ctx, async () => {
-            var _a, _b, _c, _d, _e, _f;
+          scheduleTask(ctx, async () => {
             try {
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
               }
-              log6("connected", {
-                guest: this._signingContext.deviceKey
+              scheduleTask(ctx, () => ctx.raise(new TimeoutError(timeout)), timeout);
+              log4("connected", {
+                ...protocol.toJSON()
               }, {
-                file: "space-invitations-handler.ts",
-                line: 275,
+                file: "invitations-handler.ts",
+                line: 284,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
-              log6("introduce", {
-                guest: this._signingContext.deviceKey
+              stream.next({
+                ...invitation,
+                state: Invitation2.State.CONNECTED
+              });
+              log4("introduce", {
+                ...protocol.toJSON()
               }, {
-                file: "space-invitations-handler.ts",
-                line: 279,
+                file: "invitations-handler.ts",
+                line: 288,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              const introductionResponse = await extension.rpc.SpaceHostService.introduce({
-                profile: this._signingContext.profile
-              });
-              log6("introduce response", {
-                guest: this._signingContext.deviceKey,
+              const introductionResponse = await extension.rpc.InvitationHostService.introduce(protocol.createIntroduction());
+              log4("introduce response", {
+                ...protocol.toJSON(),
                 response: introductionResponse
               }, {
-                file: "space-invitations-handler.ts",
-                line: 283,
+                file: "invitations-handler.ts",
+                line: 292,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1735,39 +1252,45 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler2 {
                 invitation.spaceKey = introductionResponse.spaceKey;
               }
               if (isAuthenticationRequired(invitation)) {
-                (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  log6("guest waiting for authentication code...", {}, {
-                    file: "space-invitations-handler.ts",
-                    line: 297,
+                  log4("guest waiting for authentication code...", {}, {
+                    file: "invitations-handler.ts",
+                    line: 301,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
-                  (_f = (_e = observable.callback).onAuthenticating) == null ? void 0 : _f.call(_e, invitation);
-                  const authenticationCode = await authenticated.wait({
+                  stream.next({
+                    ...invitation,
+                    state: Invitation2.State.READY_FOR_AUTHENTICATION
+                  });
+                  const authCode = await authenticated.wait({
                     timeout
                   });
-                  log6("sending authentication request", {}, {
-                    file: "space-invitations-handler.ts",
-                    line: 301,
+                  log4("sending authentication request", {}, {
+                    file: "invitations-handler.ts",
+                    line: 305,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
-                  const response = await extension.rpc.SpaceHostService.authenticate({
-                    authenticationCode
+                  stream.next({
+                    ...invitation,
+                    state: Invitation2.State.AUTHENTICATING
+                  });
+                  const response = await extension.rpc.InvitationHostService.authenticate({
+                    authCode
                   });
-                  if (response.status === void 0 || response.status === AuthenticationResponse2.Status.OK) {
+                  if (response.status === void 0 || response.status === AuthenticationResponse.Status.OK) {
                     break;
                   }
-                  if (response.status === AuthenticationResponse2.Status.INVALID_OTP) {
+                  if (response.status === AuthenticationResponse.Status.INVALID_OTP) {
                     if (attempt === MAX_OTP_ATTEMPTS) {
                       throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
                     } else {
-                      log6("retrying invalid code", {
+                      log4("retrying invalid code", {
                         attempt
                       }, {
-                        file: "space-invitations-handler.ts",
-                        line: 311,
+                        file: "invitations-handler.ts",
+                        line: 316,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -1775,52 +1298,58 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler2 {
                     }
                   }
                 }
+              } else {
+                stream.next({
+                  ...invitation,
+                  state: Invitation2.State.READY_FOR_AUTHENTICATION
+                });
               }
-              const controlFeedKey = await this._keyring.createKey();
-              const dataFeedKey = await this._keyring.createKey();
-              log6("request admission", {
-                guest: this._signingContext.deviceKey
+              log4("request admission", {
+                ...protocol.toJSON()
               }, {
-                file: "space-invitations-handler.ts",
-                line: 322,
+                file: "invitations-handler.ts",
+                line: 327,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              const { credential, controlTimeframe, dataTimeframe } = await extension.rpc.SpaceHostService.requestAdmission({
-                identityKey: this._signingContext.identityKey,
-                deviceKey: this._signingContext.deviceKey,
-                controlFeedKey,
-                dataFeedKey
-              });
-              const assertion = getCredentialAssertion(credential);
-              assert6(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
-              assert6(credential.subject.id.equals(this._signingContext.identityKey));
-              const space = await this._spaceManager.acceptSpace({
-                spaceKey: assertion.spaceKey,
-                genesisFeedKey: assertion.genesisFeedKey,
-                controlTimeframe,
-                dataTimeframe
-              });
-              await this._signingContext.recordCredential(credential);
-              log6("admitted by host", {
-                guest: this._signingContext.deviceKey,
-                spaceKey: space.key
+              const admissionRequest = await protocol.createAdmissionRequest();
+              const admissionResponse = await extension.rpc.InvitationHostService.admit(admissionRequest);
+              const result = await protocol.accept(admissionResponse, admissionRequest);
+              log4("admitted by host", {
+                ...protocol.toJSON()
               }, {
-                file: "space-invitations-handler.ts",
-                line: 347,
+                file: "invitations-handler.ts",
+                line: 335,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              complete.wake();
+              stream.next({
+                ...invitation,
+                ...result,
+                state: Invitation2.State.SUCCESS
+              });
             } catch (err) {
-              if (!observable.cancelled) {
-                log6.warn("auth failed", err, {
-                  file: "space-invitations-handler.ts",
-                  line: 351,
+              if (err instanceof TimeoutError) {
+                log4("timeout", {
+                  ...protocol.toJSON()
+                }, {
+                  file: "invitations-handler.ts",
+                  line: 339,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                stream.next({
+                  ...invitation,
+                  state: Invitation2.State.TIMEOUT
+                });
+              } else {
+                log4.warn("auth failed", err, {
+                  file: "invitations-handler.ts",
+                  line: 342,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
-                observable.callback.onError(err);
+                stream.error(err);
               }
             } finally {
               await ctx.dispose();
@@ -1830,33 +1359,46 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler2 {
       });
       return extension;
     };
-    scheduleTask2(ctx, async () => {
-      var _a, _b;
-      assert6(invitation.swarmKey);
+    scheduleTask(ctx, async () => {
+      assert5(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
-        peerId: PublicKey5.random(),
-        protocolProvider: createTeleportProtocolFactory2(async (teleport) => {
+        peerId: PublicKey4.random(),
+        protocolProvider: createTeleportProtocolFactory(async (teleport) => {
           teleport.addExtension("dxos.halo.invitations", createExtension());
         }),
-        topology: new StarTopology2(topic)
+        topology: new StarTopology(topic)
       });
       ctx.onDispose(() => swarmConnection.close());
-      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
-      await complete.wait();
-      observable.callback.onSuccess(invitation);
-      await ctx.dispose();
+      stream.next({
+        ...invitation,
+        state: Invitation2.State.CONNECTING
+      });
+    });
+    const observable = new AuthenticatingInvitationObservable({
+      initialInvitation: invitation,
+      subscriber: stream.observable,
+      onCancel: async () => {
+        stream.next({
+          ...invitation,
+          state: Invitation2.State.CANCELLED
+        });
+        await ctx.dispose();
+      },
+      onAuthenticate: async (code) => {
+        authenticated.wake(code);
+      }
     });
     return observable;
   }
 };
-var isAuthenticationRequired = (invitation) => invitation.authMethod !== AuthMethod.NONE && invitation.type !== Invitation3.Type.INTERACTIVE_TESTING && invitation.type !== Invitation3.Type.MULTIUSE_TESTING;
-var HostSpaceInvitationExtension = class extends RpcExtension2 {
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== Invitation2.AuthMethod.NONE;
+var InvitationHostExtension = class extends RpcExtension {
   constructor(_callbacks) {
     super({
       exposed: {
-        SpaceHostService: schema3.getService("dxos.halo.invitations.SpaceHostService")
+        InvitationHostService: schema2.getService("dxos.halo.invitations.InvitationHostService")
       }
     });
     this._callbacks = _callbacks;
@@ -1865,15 +1407,15 @@ var HostSpaceInvitationExtension = class extends RpcExtension2 {
     return {
       // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
       // Perhaps in the future we will have more complex logic here.
-      SpaceHostService: {
-        introduce: async (params) => {
-          return this._callbacks.introduce(params);
+      InvitationHostService: {
+        introduce: async (request) => {
+          return this._callbacks.introduce(request);
         },
-        authenticate: async (credentials) => {
-          return this._callbacks.authenticate(credentials);
+        authenticate: async (request) => {
+          return this._callbacks.authenticate(request);
         },
-        requestAdmission: async (credentials) => {
-          return this._callbacks.requestAdmission(credentials);
+        admit: async (request) => {
+          return this._callbacks.admit(request);
         }
       }
     };
@@ -1883,11 +1425,11 @@ var HostSpaceInvitationExtension = class extends RpcExtension2 {
     this._callbacks.onOpen();
   }
 };
-var GuestSpaceInvitationExtension = class extends RpcExtension2 {
+var InvitationGuestExtension = class extends RpcExtension {
   constructor(_callbacks) {
     super({
       requested: {
-        SpaceHostService: schema3.getService("dxos.halo.invitations.SpaceHostService")
+        InvitationHostService: schema2.getService("dxos.halo.invitations.InvitationHostService")
       }
     });
     this._callbacks = _callbacks;
@@ -1901,21 +1443,333 @@ var GuestSpaceInvitationExtension = class extends RpcExtension2 {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/space-invitations-service.ts
+// packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
+import assert6 from "@dxos/node-std/assert";
+import { Stream as Stream7 } from "@dxos/codec-protobuf";
+import { log as log5 } from "@dxos/log";
+import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
+var InvitationsServiceImpl = class {
+  constructor(_invitationsHandler, _getHandler) {
+    this._invitationsHandler = _invitationsHandler;
+    this._getHandler = _getHandler;
+    this._createInvitations = /* @__PURE__ */ new Map();
+    this._acceptInvitations = /* @__PURE__ */ new Map();
+  }
+  // TODO(burdon): Guest/host label.
+  getLoggingContext() {
+    return {};
+  }
+  createInvitation(invitation) {
+    return new Stream7(({ next, close }) => {
+      const handler = this._getHandler(invitation);
+      log5("stream opened", this.getLoggingContext(), {
+        file: "invitations-service.ts",
+        line: 37,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      let invitationId;
+      const observable = this._invitationsHandler.createInvitation(handler, invitation);
+      observable.subscribe((invitation2) => {
+        switch (invitation2.state) {
+          case Invitation3.State.CONNECTING: {
+            assert6(invitation2.invitationId);
+            invitationId = invitation2.invitationId;
+            this._createInvitations.set(invitation2.invitationId, observable);
+            invitation2.state = Invitation3.State.CONNECTING;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.CONNECTED: {
+            assert6(invitation2.invitationId);
+            invitation2.state = Invitation3.State.CONNECTED;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.READY_FOR_AUTHENTICATION: {
+            assert6(invitation2.invitationId);
+            invitation2.state = Invitation3.State.READY_FOR_AUTHENTICATION;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.AUTHENTICATING: {
+            assert6(invitation2.invitationId);
+            invitation2.state = Invitation3.State.AUTHENTICATING;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.SUCCESS: {
+            assert6(invitation2.invitationId);
+            invitation2.state = Invitation3.State.SUCCESS;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.CANCELLED: {
+            assert6(invitationId);
+            invitation2.invitationId = invitationId;
+            invitation2.state = Invitation3.State.CANCELLED;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.TIMEOUT: {
+            assert6(invitationId);
+            invitation2.invitationId = invitationId;
+            invitation2.state = Invitation3.State.TIMEOUT;
+            next(invitation2);
+            break;
+          }
+        }
+      }, (err) => {
+        close(err);
+      }, () => {
+        close();
+      });
+      return (err) => {
+        const context = this.getLoggingContext();
+        if (err) {
+          log5.warn("stream closed", {
+            ...context,
+            err
+          }, {
+            file: "invitations-service.ts",
+            line: 103,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        } else {
+          log5("stream closed", context, {
+            file: "invitations-service.ts",
+            line: 105,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+        this._createInvitations.delete(invitation.invitationId);
+      };
+    });
+  }
+  acceptInvitation(invitation) {
+    return new Stream7(({ next, close }) => {
+      log5("stream opened", this.getLoggingContext(), {
+        file: "invitations-service.ts",
+        line: 115,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      const handler = this._getHandler(invitation);
+      let invitationId;
+      const observable = this._invitationsHandler.acceptInvitation(handler, invitation);
+      observable.subscribe((invitation2) => {
+        switch (invitation2.state) {
+          case Invitation3.State.CONNECTING: {
+            assert6(invitation2.invitationId);
+            invitationId = invitation2.invitationId;
+            this._acceptInvitations.set(invitation2.invitationId, observable);
+            invitation2.state = Invitation3.State.CONNECTING;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.CONNECTED: {
+            assert6(invitation2.invitationId);
+            invitation2.state = Invitation3.State.CONNECTED;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.READY_FOR_AUTHENTICATION: {
+            assert6(invitation2.invitationId);
+            invitation2.state = Invitation3.State.READY_FOR_AUTHENTICATION;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.AUTHENTICATING: {
+            assert6(invitation2.invitationId);
+            invitation2.state = Invitation3.State.AUTHENTICATING;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.SUCCESS: {
+            invitation2.state = Invitation3.State.SUCCESS;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.CANCELLED: {
+            assert6(invitationId);
+            invitation2.invitationId = invitationId;
+            invitation2.state = Invitation3.State.CANCELLED;
+            next(invitation2);
+            break;
+          }
+          case Invitation3.State.TIMEOUT: {
+            assert6(invitationId);
+            invitation2.invitationId = invitationId;
+            invitation2.state = Invitation3.State.TIMEOUT;
+            next(invitation2);
+            break;
+          }
+        }
+      }, (err) => {
+        close(err);
+      }, () => {
+        close();
+      });
+      return (err) => {
+        const context = this.getLoggingContext();
+        if (err) {
+          log5.warn("stream closed", {
+            ...context,
+            err
+          }, {
+            file: "invitations-service.ts",
+            line: 181,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        } else {
+          log5("stream closed", context, {
+            file: "invitations-service.ts",
+            line: 183,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+        this._acceptInvitations.delete(invitation.invitationId);
+      };
+    });
+  }
+  async authenticate({ invitationId, authCode }) {
+    log5("authenticating...", {}, {
+      file: "invitations-service.ts",
+      line: 192,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    assert6(invitationId);
+    const observable = this._acceptInvitations.get(invitationId);
+    if (!observable) {
+      log5.warn("invalid invitation", {
+        invitationId
+      }, {
+        file: "invitations-service.ts",
+        line: 196,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } else {
+      await observable.authenticate(authCode);
+    }
+  }
+  async cancelInvitation({ invitationId }) {
+    var _a;
+    log5("cancelling...", {}, {
+      file: "invitations-service.ts",
+      line: 203,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    assert6(invitationId);
+    const observable = (_a = this._createInvitations.get(invitationId)) != null ? _a : this._acceptInvitations.get(invitationId);
+    if (!observable) {
+      log5.warn("invalid invitation", {
+        invitationId
+      }, {
+        file: "invitations-service.ts",
+        line: 207,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } else {
+      await (observable == null ? void 0 : observable.cancel());
+    }
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts
 import assert7 from "@dxos/node-std/assert";
-var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
-  // prettier-ignore
-  constructor(identityManager, invitationsHandler, _getSpaceManager) {
-    super(identityManager, invitationsHandler);
-    this.invitationsHandler = invitationsHandler;
-    this._getSpaceManager = _getSpaceManager;
-  }
-  getContext(invitation) {
-    assert7(invitation.spaceKey);
-    const spaceManager = this._getSpaceManager();
-    const space = spaceManager.spaces.get(invitation.spaceKey);
+import { createAdmissionCredentials, getCredentialAssertion } from "@dxos/credentials";
+import { writeMessages as writeMessages2 } from "@dxos/feed-store";
+import { log as log6 } from "@dxos/log";
+import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
+var SpaceInvitationProtocol = class {
+  constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
+    this._spaceManager = _spaceManager;
+    this._signingContext = _signingContext;
+    this._keyring = _keyring;
+    this._spaceKey = _spaceKey;
+  }
+  toJSON() {
+    return {
+      deviceKey: this._signingContext.deviceKey,
+      spaceKey: this._spaceKey
+    };
+  }
+  getInvitationContext() {
+    return {
+      kind: Invitation4.Kind.SPACE,
+      spaceKey: this._spaceKey
+    };
+  }
+  async admit(request, guestProfile) {
+    var _a;
+    assert7(this._spaceKey);
+    const space = await this._spaceManager.spaces.get(this._spaceKey);
     assert7(space);
-    return space;
+    assert7(request.space);
+    const { identityKey, deviceKey } = request.space;
+    log6("writing guest credentials", {
+      host: this._signingContext.deviceKey,
+      guest: deviceKey
+    }, {
+      file: "space-invitation-protocol.ts",
+      line: 51,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
+    assert7(credentials[0].credential);
+    const spaceMemberCredential = credentials[0].credential.credential;
+    assert7(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    await writeMessages2(space.inner.controlPipeline.writer, credentials);
+    return {
+      space: {
+        credential: spaceMemberCredential,
+        controlTimeframe: space.inner.controlPipeline.state.timeframe,
+        dataTimeframe: (_a = space.dataPipeline.pipelineState) == null ? void 0 : _a.timeframe
+      }
+    };
+  }
+  createIntroduction() {
+    return {
+      profile: this._signingContext.profile
+    };
+  }
+  async createAdmissionRequest() {
+    const controlFeedKey = await this._keyring.createKey();
+    const dataFeedKey = await this._keyring.createKey();
+    return {
+      space: {
+        identityKey: this._signingContext.identityKey,
+        deviceKey: this._signingContext.deviceKey,
+        controlFeedKey,
+        dataFeedKey
+      }
+    };
+  }
+  async accept(response) {
+    assert7(response.space);
+    const { credential, controlTimeframe, dataTimeframe } = response.space;
+    const assertion = getCredentialAssertion(credential);
+    assert7(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
+    assert7(credential.subject.id.equals(this._signingContext.identityKey));
+    await this._spaceManager.acceptSpace({
+      spaceKey: assertion.spaceKey,
+      genesisFeedKey: assertion.genesisFeedKey,
+      controlTimeframe,
+      dataTimeframe
+    });
+    await this._signingContext.recordCredential(credential);
+    return {
+      spaceKey: assertion.spaceKey
+    };
   }
 };
 
@@ -2054,17 +1908,16 @@ var MemoryShellRuntime = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
-import { Trigger as Trigger9 } from "@dxos/async";
+import { Trigger as Trigger8 } from "@dxos/async";
 import { log as log17, logInfo as logInfo3 } from "@dxos/log";
 import { MemorySignalManager as MemorySignalManager3, MemorySignalManagerContext as MemorySignalManagerContext3, WebsocketSignalManager as WebsocketSignalManager3 } from "@dxos/messaging";
 import { createWebRTCTransportFactory as createWebRTCTransportFactory2, NetworkManager as NetworkManager3 } from "@dxos/network-manager";
 import { getAsyncValue } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-import assert12 from "@dxos/node-std/assert";
+import assert13 from "@dxos/node-std/assert";
 import { Event as Event7 } from "@dxos/async";
-import { clientServiceBundle, createDefaultModelFactory, PublicKey as PublicKey10 } from "@dxos/client";
-import { raise as raise3 } from "@dxos/debug";
+import { clientServiceBundle, createDefaultModelFactory, PublicKey as PublicKey9 } from "@dxos/client";
 import { DataServiceImpl } from "@dxos/echo-pipeline";
 import { log as log15 } from "@dxos/log";
 import { trace as trace3 } from "@dxos/protocols";
@@ -2156,45 +2009,45 @@ var NetworkServiceImpl = class {
 import assert10 from "@dxos/node-std/assert";
 import { Event as Event6, synchronized, trackLeaks as trackLeaks2 } from "@dxos/async";
 import { SpaceState as SpaceState2 } from "@dxos/client";
-import { cancelWithContext, Context as Context7 } from "@dxos/context";
+import { cancelWithContext, Context as Context6 } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
 import { SnapshotManager, spaceGenesis } from "@dxos/echo-pipeline";
-import { PublicKey as PublicKey8 } from "@dxos/keys";
+import { PublicKey as PublicKey7 } from "@dxos/keys";
 import { log as log9 } from "@dxos/log";
 import { Gossip, Presence } from "@dxos/teleport-extension-gossip";
 import { ComplexMap as ComplexMap3, deferFunction as deferFunction2 } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-import { Event as Event5, scheduleTask as scheduleTask4, trackLeaks } from "@dxos/async";
+import { Event as Event5, scheduleTask as scheduleTask3, trackLeaks } from "@dxos/async";
 import { SpaceState } from "@dxos/client";
-import { Context as Context6 } from "@dxos/context";
+import { Context as Context5 } from "@dxos/context";
 import { timed } from "@dxos/debug";
 import { createMappedFeedWriter, DataPipeline } from "@dxos/echo-pipeline";
 import { CancelledError, SystemError } from "@dxos/errors";
-import { PublicKey as PublicKey7 } from "@dxos/keys";
+import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { log as log8 } from "@dxos/log";
 import { AdmittedFeed as AdmittedFeed3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { ComplexSet as ComplexSet2 } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
 import assert9 from "@dxos/node-std/assert";
-import { DeferredTask, Event as Event4, scheduleTask as scheduleTask3, sleep as sleep3, TimeoutError, Trigger as Trigger4 } from "@dxos/async";
-import { Context as Context5, rejectOnDispose } from "@dxos/context";
-import { PublicKey as PublicKey6 } from "@dxos/keys";
+import { DeferredTask, Event as Event4, scheduleTask as scheduleTask2, sleep as sleep2, TimeoutError as TimeoutError2, Trigger as Trigger3 } from "@dxos/async";
+import { Context as Context4, rejectOnDispose } from "@dxos/context";
+import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log as log7 } from "@dxos/log";
-import { schema as schema4 } from "@dxos/protocols";
-import { RpcExtension as RpcExtension3 } from "@dxos/teleport";
+import { schema as schema3 } from "@dxos/protocols";
+import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
 import { ComplexMap as ComplexMap2, ComplexSet, entry } from "@dxos/util";
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
 var NotarizationPlugin = class {
   constructor() {
-    this._ctx = new Context5();
+    this._ctx = new Context4();
     this._extensionOpened = new Event4();
     this._extensions = /* @__PURE__ */ new Set();
-    this._processedCredentials = new ComplexSet(PublicKey6.hash);
-    this._processCredentialsTriggers = new ComplexMap2(PublicKey6.hash);
+    this._processedCredentials = new ComplexSet(PublicKey5.hash);
+    this._processCredentialsTriggers = new ComplexMap2(PublicKey5.hash);
   }
   async open() {
   }
@@ -2214,7 +2067,7 @@ var NotarizationPlugin = class {
       callSite: (f, a) => f(...a)
     });
     assert9(credentials.every((credential) => credential.id), "Credentials must have an id");
-    const errors = new Trigger4();
+    const errors = new Trigger3();
     const ctx = this._ctx.derive({
       onError: (err) => {
         log7.warn("Notarization error", {
@@ -2231,7 +2084,7 @@ var NotarizationPlugin = class {
     });
     opCtx == null ? void 0 : opCtx.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
-      scheduleTask3(ctx, () => {
+      scheduleTask2(ctx, () => {
         log7.warn("Notarization timeout", {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
@@ -2242,7 +2095,7 @@ var NotarizationPlugin = class {
           callSite: (f, a) => f(...a)
         });
         void ctx.dispose();
-        errors.throw(new TimeoutError(timeout, "Notarization timed out"));
+        errors.throw(new TimeoutError2(timeout, "Notarization timed out"));
       }, timeout);
     }
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
@@ -2265,7 +2118,7 @@ var NotarizationPlugin = class {
             callSite: (f, a) => f(...a)
           });
           peersTried.clear();
-          scheduleTask3(ctx, () => notarizeTask.schedule(), retryTimeout);
+          scheduleTask2(ctx, () => notarizeTask.schedule(), retryTimeout);
           return;
         }
         peersTried.add(peer);
@@ -2287,7 +2140,7 @@ var NotarizationPlugin = class {
           scope: this,
           callSite: (f, a) => f(...a)
         });
-        await sleep3(successDelay);
+        await sleep2(successDelay);
       } catch (err) {
         log7.warn("error notarizing (recoverable)", err, {
           file: "notarization-plugin.ts",
@@ -2336,7 +2189,7 @@ var NotarizationPlugin = class {
     if (this._processedCredentials.has(id)) {
       return;
     }
-    await entry(this._processCredentialsTriggers, id).orInsert(new Trigger4()).value.wait();
+    await entry(this._processCredentialsTriggers, id).orInsert(new Trigger3()).value.wait();
   }
   /**
   * Requests from other peers to notarize credentials.
@@ -2384,14 +2237,14 @@ var NotarizationPlugin = class {
     return extension;
   }
 };
-var NotarizationTeleportExtension = class extends RpcExtension3 {
+var NotarizationTeleportExtension = class extends RpcExtension2 {
   constructor(_params) {
     super({
       requested: {
-        NotarizationService: schema4.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: schema3.getService("dxos.mesh.teleport.notarization.NotarizationService")
       },
       exposed: {
-        NotarizationService: schema4.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: schema3.getService("dxos.mesh.teleport.notarization.NotarizationService")
       }
     });
     this._params = _params;
@@ -2429,7 +2282,7 @@ var __decorate = function(decorators, target, key, desc) {
 var AUTH_TIMEOUT2 = 3e4;
 var DataSpace = class DataSpace2 {
   constructor(params) {
-    this._ctx = new Context6();
+    this._ctx = new Context5();
     this._state = SpaceState.CLOSED;
     this.stateUpdate = new Event5();
     var _a;
@@ -2452,7 +2305,7 @@ var DataSpace = class DataSpace2 {
       snapshotId: params.snapshotId
     });
     this.authVerifier = new TrustedKeySetAuthVerifier({
-      trustedKeysProvider: () => new ComplexSet2(PublicKey7.hash, Array.from(this._inner.spaceState.members.keys())),
+      trustedKeysProvider: () => new ComplexSet2(PublicKey6.hash, Array.from(this._inner.spaceState.members.keys())),
       update: this._inner.stateUpdate,
       authTimeout: AUTH_TIMEOUT2
     });
@@ -2506,7 +2359,7 @@ var DataSpace = class DataSpace2 {
   * Initialize the data pipeline in a separate task.
   */
   initializeDataPipelineAsync() {
-    scheduleTask4(this._ctx, async () => {
+    scheduleTask3(this._ctx, async () => {
       try {
         await this.initializeDataPipeline();
       } catch (err) {
@@ -2653,9 +2506,9 @@ var DataSpaceManager = class DataSpaceManager2 {
     this._modelFactory = _modelFactory;
     this._feedStore = _feedStore;
     this._snapshotStore = _snapshotStore;
-    this._ctx = new Context7();
+    this._ctx = new Context6();
     this.updated = new Event6();
-    this._spaces = new ComplexMap3(PublicKey8.hash);
+    this._spaces = new ComplexMap3(PublicKey7.hash);
     this._isOpen = false;
   }
   // TODO(burdon): Remove.
@@ -2883,7 +2736,7 @@ DataSpaceManager = __decorate2([
 ], DataSpaceManager);
 
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
-import { EventSubscriptions as EventSubscriptions3, scheduleTask as scheduleTask5 } from "@dxos/async";
+import { EventSubscriptions as EventSubscriptions3, scheduleTask as scheduleTask4 } from "@dxos/async";
 import { Stream as Stream10 } from "@dxos/codec-protobuf";
 import { raise, todo as todo2 } from "@dxos/debug";
 import { SpaceNotFoundError } from "@dxos/echo-pipeline";
@@ -2926,7 +2779,7 @@ var SpacesServiceImpl = class {
           spaces
         });
       };
-      scheduleTask5(ctx, async () => {
+      scheduleTask4(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const subscriptions = new EventSubscriptions3();
         ctx.onDispose(() => subscriptions.clear());
@@ -2963,7 +2816,7 @@ var SpacesServiceImpl = class {
   }
   subscribeMessages({ spaceKey, channel }) {
     return new Stream10(({ ctx, next }) => {
-      scheduleTask5(ctx, async () => {
+      scheduleTask4(ctx, async () => {
         var _a;
         const dataSpaceManager = await this._getDataSpaceManager();
         const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : raise(new SpaceNotFoundError(spaceKey));
@@ -2984,7 +2837,7 @@ var SpacesServiceImpl = class {
         }
       });
       ctx.onDispose(() => processor.close());
-      scheduleTask5(ctx, () => processor.open());
+      scheduleTask4(ctx, () => processor.open());
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
@@ -2999,18 +2852,22 @@ var SpacesServiceImpl = class {
     }
   }
   _transformSpace(space) {
-    var _a, _b;
+    var _a, _b, _c, _d, _e;
     return {
       spaceKey: space.key,
       state: space.state,
       pipeline: {
-        targetControlTimeframe: space.inner.controlPipeline.state.targetTimeframe,
+        controlFeeds: space.inner.controlPipeline.state.feeds.map((feed) => feed.key),
         currentControlTimeframe: space.inner.controlPipeline.state.timeframe,
-        currentDataTimeframe: (_a = space.dataPipeline.pipelineState) == null ? void 0 : _a.timeframe,
-        targetDataTimeframe: (_b = space.dataPipeline.pipelineState) == null ? void 0 : _b.targetTimeframe
+        targetControlTimeframe: space.inner.controlPipeline.state.targetTimeframe,
+        totalControlTimeframe: space.inner.controlPipeline.state.endTimeframe,
+        dataFeeds: (_b = (_a = space.dataPipeline.pipelineState) == null ? void 0 : _a.feeds.map((feed) => feed.key)) != null ? _b : [],
+        currentDataTimeframe: (_c = space.dataPipeline.pipelineState) == null ? void 0 : _c.timeframe,
+        targetDataTimeframe: (_d = space.dataPipeline.pipelineState) == null ? void 0 : _d.targetTimeframe,
+        totalDataTimeframe: (_e = space.dataPipeline.pipelineState) == null ? void 0 : _e.endTimeframe
       },
       members: Array.from(space.inner.spaceState.members.values()).map((member) => {
-        var _a2, _b2, _c;
+        var _a2, _b2, _c2;
         return {
           identity: {
             identityKey: member.key,
@@ -3018,7 +2875,7 @@ var SpacesServiceImpl = class {
               displayName: (_b2 = (_a2 = member.assertion.profile) == null ? void 0 : _a2.displayName) != null ? _b2 : humanize(member.key)
             }
           },
-          presence: ((_c = this._identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember.PresenceState.ONLINE : SpaceMember.PresenceState.OFFLINE
+          presence: ((_c2 = this._identityManager.identity) == null ? void 0 : _c2.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember.PresenceState.ONLINE : SpaceMember.PresenceState.OFFLINE
         };
       })
     };
@@ -3114,7 +2971,7 @@ var IFrameProxyRuntime = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
-import { asyncTimeout, Trigger as Trigger5 } from "@dxos/async";
+import { asyncTimeout, Trigger as Trigger4 } from "@dxos/async";
 import { log as log11, logInfo } from "@dxos/log";
 var __decorate3 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3133,7 +2990,7 @@ var Message;
 var VaultResourceLock = class {
   constructor({ lockKey, onAcquire, onRelease }) {
     this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
-    this._releaseTrigger = new Trigger5();
+    this._releaseTrigger = new Trigger4();
     this._lockKey = lockKey;
     this._onAcquire = onAcquire;
     this._onRelease = onRelease;
@@ -3193,14 +3050,14 @@ var VaultResourceLock = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const acquired = new Trigger5();
+    const acquired = new Trigger4();
     void navigator.locks.request(this._lockKey, {
       steal
     }, async () => {
       var _a, _b;
       await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
       acquired.wake();
-      this._releaseTrigger = new Trigger5();
+      this._releaseTrigger = new Trigger4();
       await this._releaseTrigger.wait();
       log11("releasing lock...", {}, {
         file: "vault-resource-lock.ts",
@@ -3235,14 +3092,14 @@ __decorate3([
 ], VaultResourceLock.prototype, "lockKey", null);
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
-import { Trigger as Trigger7 } from "@dxos/async";
+import { Trigger as Trigger6 } from "@dxos/async";
 import { log as log13 } from "@dxos/log";
 import { MemorySignalManager, MemorySignalManagerContext, WebsocketSignalManager } from "@dxos/messaging";
 import { NetworkManager, WebRTCTransportProxyFactory } from "@dxos/network-manager";
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
 import assert11 from "@dxos/node-std/assert";
-import { asyncTimeout as asyncTimeout2, Trigger as Trigger6 } from "@dxos/async";
+import { asyncTimeout as asyncTimeout2, Trigger as Trigger5 } from "@dxos/async";
 import { iframeServiceBundle as iframeServiceBundle2, workerServiceBundle as workerServiceBundle2 } from "@dxos/client";
 import { log as log12, logInfo as logInfo2 } from "@dxos/log";
 import { createProtoRpcPeer as createProtoRpcPeer3 } from "@dxos/rpc";
@@ -3316,7 +3173,7 @@ var WorkerSession = class {
   constructor({ serviceHost, systemPort, appPort, shellPort, readySignal, options = {
     heartbeatInterval: 1e3
   } }) {
-    this._startTrigger = new Trigger6();
+    this._startTrigger = new Trigger5();
     this.onClose = new Callback();
     assert11(options);
     assert11(serviceHost);
@@ -3471,14 +3328,17 @@ var WorkerRuntime = class {
   constructor(_configProvider) {
     this._configProvider = _configProvider;
     this._transportFactory = new WebRTCTransportProxyFactory();
-    this._ready = new Trigger7();
+    this._ready = new Trigger6();
     this.sessions = /* @__PURE__ */ new Set();
     this._clientServices = new ClientServicesHost();
   }
+  get host() {
+    return this._clientServices;
+  }
   async start() {
     log13("starting...", {}, {
       file: "worker-runtime.ts",
-      line: 44,
+      line: 48,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3499,7 +3359,7 @@ var WorkerRuntime = class {
       this._ready.wake(void 0);
       log13("started", {}, {
         file: "worker-runtime.ts",
-        line: 61,
+        line: 65,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3507,7 +3367,7 @@ var WorkerRuntime = class {
       this._ready.wake(err);
       log13.catch(err, {}, {
         file: "worker-runtime.ts",
-        line: 64,
+        line: 68,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3557,13 +3417,15 @@ var WorkerRuntime = class {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-import { Trigger as Trigger8 } from "@dxos/async";
+import assert12 from "@dxos/node-std/assert";
+import { Trigger as Trigger7 } from "@dxos/async";
+import { Invitation as Invitation5 } from "@dxos/client";
 import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
 import { failUndefined as failUndefined2 } from "@dxos/debug";
 import { valueEncoding, MetadataStore, SpaceManager, DataServiceSubscriptions, SnapshotStore } from "@dxos/echo-pipeline";
 import { FeedFactory, FeedStore } from "@dxos/feed-store";
 import { Keyring } from "@dxos/keyring";
-import { PublicKey as PublicKey9 } from "@dxos/keys";
+import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log14 } from "@dxos/log";
 import { trace as trace2 } from "@dxos/protocols";
 var ServiceContext = class {
@@ -3572,9 +3434,10 @@ var ServiceContext = class {
     this.storage = storage;
     this.networkManager = networkManager;
     this.modelFactory = modelFactory;
-    this.initialized = new Trigger8();
+    this.initialized = new Trigger7();
     this.dataServiceSubscriptions = new DataServiceSubscriptions();
-    this._instanceId = PublicKey9.random().toHex();
+    this._handlerFactories = /* @__PURE__ */ new Map();
+    this._instanceId = PublicKey8.random().toHex();
     this.metadataStore = new MetadataStore(storage.createDirectory("metadata"));
     this.snapshotStore = new SnapshotStore(storage.createDirectory("snapshots"));
     this.keyring = new Keyring(storage.createDirectory("keyring"));
@@ -3592,28 +3455,24 @@ var ServiceContext = class {
       networkManager: this.networkManager
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
-    this.deviceInvitations = new DeviceInvitationsHandler({
-      networkManager: this.networkManager,
-      getIdentity: () => {
-        var _a;
-        return (_a = this.identityManager.identity) != null ? _a : failUndefined2();
-      },
-      acceptIdentity: this._acceptIdentity.bind(this),
-      keyring: this.keyring
-    });
+    this.invitations = new InvitationsHandler(this.networkManager);
+    this._handlerFactories.set(Invitation5.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
+      var _a;
+      return (_a = this.identityManager.identity) != null ? _a : failUndefined2();
+    }, this._acceptIdentity.bind(this)));
   }
   async open() {
     log14.trace("dxos.sdk.client-services", trace2.begin({
       id: this._instanceId
     }), {
       file: "service-context.ts",
-      line: 98,
+      line: 111,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     log14("opening...", {}, {
       file: "service-context.ts",
-      line: 100,
+      line: 113,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3625,7 +3484,7 @@ var ServiceContext = class {
     }
     log14("opened", {}, {
       file: "service-context.ts",
-      line: 107,
+      line: 120,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3634,7 +3493,7 @@ var ServiceContext = class {
     var _a, _b;
     log14("closing...", {}, {
       file: "service-context.ts",
-      line: 111,
+      line: 124,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3647,7 +3506,7 @@ var ServiceContext = class {
     this.dataServiceSubscriptions.clear();
     log14("closed", {}, {
       file: "service-context.ts",
-      line: 119,
+      line: 132,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3655,7 +3514,7 @@ var ServiceContext = class {
       id: this._instanceId
     }), {
       file: "service-context.ts",
-      line: 121,
+      line: 134,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3663,7 +3522,7 @@ var ServiceContext = class {
   async reset() {
     log14("resetting...", {}, {
       file: "service-context.ts",
-      line: 125,
+      line: 138,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3671,7 +3530,7 @@ var ServiceContext = class {
     await this.storage.reset();
     log14("reset", {}, {
       file: "service-context.ts",
-      line: 128,
+      line: 141,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3681,6 +3540,11 @@ var ServiceContext = class {
     await this._initialize();
     return identity;
   }
+  getInvitationHandler(invitation) {
+    const factory = this._handlerFactories.get(invitation.kind);
+    assert12(factory, `Unknown invitation kind: ${invitation.kind}`);
+    return factory(invitation);
+  }
   async _acceptIdentity(params) {
     const identity = await this.identityManager.acceptIdentity(params);
     await this._initialize();
@@ -3691,7 +3555,7 @@ var ServiceContext = class {
     var _a;
     log14("initializing spaces...", {}, {
       file: "service-context.ts",
-      line: 147,
+      line: 166,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3711,7 +3575,10 @@ var ServiceContext = class {
     };
     this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.modelFactory, this.feedStore, this.snapshotStore);
     await this.dataSpaceManager.open();
-    this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.dataSpaceManager, signingContext, this.keyring);
+    this._handlerFactories.set(Invitation5.Kind.SPACE, (invitation) => {
+      assert12(this.dataSpaceManager, "dataSpaceManager not initialized yet");
+      return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
+    });
     this.initialized.wake();
     this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
       process: async (credential) => {
@@ -3727,7 +3594,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             file: "service-context.ts",
-            line: 190,
+            line: 207,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3738,7 +3605,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             file: "service-context.ts",
-            line: 194,
+            line: 211,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3749,7 +3616,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             file: "service-context.ts",
-            line: 199,
+            line: 216,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3760,7 +3627,7 @@ var ServiceContext = class {
         } catch (err) {
           log14.catch(err, {}, {
             file: "service-context.ts",
-            line: 205,
+            line: 222,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3809,7 +3676,7 @@ var ClientServicesHost = class {
     this._statusUpdate = new Event7();
     this._opening = false;
     this._open = false;
-    this._instanceId = PublicKey10.random().toHex();
+    this._instanceId = PublicKey9.random().toHex();
     this._storage = storage;
     this._modelFactory = modelFactory;
     if (config) {
@@ -3838,7 +3705,7 @@ var ClientServicesHost = class {
         }
       },
       onReset: async () => {
-        assert12(this._serviceContext, "service host is closed");
+        assert13(this._serviceContext, "service host is closed");
         await this._serviceContext.reset();
       }
     });
@@ -3864,16 +3731,16 @@ var ClientServicesHost = class {
   * Can only be called once.
   */
   initialize({ config, networkManager }) {
-    assert12(!this._open, "service host is open");
+    assert13(!this._open, "service host is open");
     if (config) {
-      assert12(!this._config, "config already set");
+      assert13(!this._config, "config already set");
       this._config = config;
       if (!this._storage) {
         this._storage = createStorageObjects(config.get("runtime.client.storage", {})).storage;
       }
     }
     if (networkManager) {
-      assert12(!this._networkManager, "network manager already set");
+      assert13(!this._networkManager, "network manager already set");
       this._networkManager = networkManager;
     }
   }
@@ -3886,19 +3753,19 @@ var ClientServicesHost = class {
       id: this._instanceId
     }), {
       file: "service-host.ts",
-      line: 168,
+      line: 167,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    assert12(this._config, "config not set");
-    assert12(this._storage, "storage not set");
-    assert12(this._networkManager, "network manager not set");
+    assert13(this._config, "config not set");
+    assert13(this._storage, "storage not set");
+    assert13(this._networkManager, "network manager not set");
     this._opening = true;
     log15("opening...", {
       lockKey: (_a = this._resourceLock) == null ? void 0 : _a.lockKey
     }, {
       file: "service-host.ts",
-      line: 175,
+      line: 174,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3907,15 +3774,8 @@ var ClientServicesHost = class {
     this._serviceRegistry.setServices({
       SystemService: this._systemService,
       IdentityService: new IdentityServiceImpl(this._serviceContext),
+      InvitationsService: new InvitationsServiceImpl(this._serviceContext.invitations, (invitation) => this._serviceContext.getInvitationHandler(invitation)),
       DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
-      DeviceInvitationsService: new DeviceInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.deviceInvitations),
-      SpaceInvitationsService: new SpaceInvitationsServiceImpl(this._serviceContext.identityManager, () => {
-        var _a2;
-        return (_a2 = this._serviceContext.spaceInvitations) != null ? _a2 : raise3(new Error("SpaceInvitations not initialized"));
-      }, () => {
-        var _a2;
-        return (_a2 = this._serviceContext.dataSpaceManager) != null ? _a2 : raise3(new Error("SpaceManager not initialized"));
-      }),
       SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, this._serviceContext.dataServiceSubscriptions, async () => {
         await this._serviceContext.initialized.wait();
         return this._serviceContext.dataSpaceManager;
@@ -3939,7 +3799,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 229,
+      line: 221,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3954,7 +3814,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 238,
+      line: 230,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3968,7 +3828,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 243,
+      line: 235,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3976,7 +3836,7 @@ var ClientServicesHost = class {
       id: this._instanceId
     }), {
       file: "service-host.ts",
-      line: 245,
+      line: 237,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -4057,7 +3917,7 @@ var LOCK_KEY = "DXOS_RESOURCE_LOCK";
 var IFrameHostRuntime = class {
   constructor({ configProvider, appPort, shellPort }) {
     this._transportFactory = createWebRTCTransportFactory2();
-    this._ready = new Trigger9();
+    this._ready = new Trigger8();
     this._configProvider = configProvider;
     this._appPort = appPort;
     this._shellPort = shellPort;
@@ -4179,11 +4039,10 @@ export {
   Identity,
   IdentityManager,
   IdentityServiceImpl,
-  DeviceInvitationsHandler,
-  AbstractInvitationsService,
-  DeviceInvitationsServiceImpl,
-  SpaceInvitationsHandler,
-  SpaceInvitationsServiceImpl,
+  DeviceInvitationProtocol,
+  InvitationsHandler,
+  InvitationsServiceImpl,
+  SpaceInvitationProtocol,
   createStorageObjects,
   ShellRuntimeImpl,
   MemoryShellRuntime,
@@ -4198,4 +4057,4 @@ export {
   LocalClientServices,
   fromHost
 };
-//# sourceMappingURL=chunk-H5IXSSI7.mjs.map
+//# sourceMappingURL=chunk-OINEQJWM.mjs.map