@dxos/client-services 0.1.35 → 0.1.36-next.ef27157

package/dist/lib/node/packlets/testing/index.cjs

@@ -41,6 +41,7 @@ __export(testing_exports, {
   createSigningContext: () => createSigningContext,
   joinCommonSpace: () => joinCommonSpace,
   performInvitation: () => performInvitation,
+  sanitizeInvitation: () => sanitizeInvitation,
   syncItems: () => syncItems,
   syncItemsLocal: () => syncItemsLocal,
   testConfigWithLocalSignal: () => testConfigWithLocalSignal,
@@ -72,18 +73,17 @@ var import_testing = require("@dxos/echo-pipeline/testing");
 var import_feed_store5 = require("@dxos/feed-store");
 var import_keyring2 = require("@dxos/keyring");
 var import_messaging4 = require("@dxos/messaging");
-var import_network_manager7 = require("@dxos/network-manager");
+var import_network_manager6 = require("@dxos/network-manager");
 var import_random_access_storage2 = require("@dxos/random-access-storage");
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-var import_node_assert12 = __toESM(require("node:assert"));
-var import_async19 = require("@dxos/async");
+var import_node_assert13 = __toESM(require("node:assert"));
+var import_async18 = require("@dxos/async");
 var import_client8 = require("@dxos/client");
-var import_debug7 = require("@dxos/debug");
 var import_echo_pipeline5 = require("@dxos/echo-pipeline");
 var import_log16 = require("@dxos/log");
-var import_protocols7 = require("@dxos/protocols");
-var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
+var import_protocols6 = require("@dxos/protocols");
+var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 
 // packages/sdk/client-services/src/packlets/deprecated/tracing.ts
 var TracingServiceImpl = class {
@@ -973,8 +973,73 @@ var IdentityServiceImpl = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/device-invitations-handler.ts
+// packages/sdk/client-services/src/packlets/invitations/device-invitation-protocol.ts
 var import_node_assert4 = __toESM(require("node:assert"));
+var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
+var DeviceInvitationProtocol = class {
+  constructor(_keyring, _getIdentity, _acceptIdentity) {
+    this._keyring = _keyring;
+    this._getIdentity = _getIdentity;
+    this._acceptIdentity = _acceptIdentity;
+  }
+  toJSON() {
+    return {};
+  }
+  getInvitationContext() {
+    return {
+      kind: import_services2.Invitation.Kind.DEVICE
+    };
+  }
+  async admit(request) {
+    (0, import_node_assert4.default)(request.device);
+    const identity = this._getIdentity();
+    await identity.admitDevice(request.device);
+    return {
+      device: {
+        identityKey: identity.identityKey,
+        haloSpaceKey: identity.haloSpaceKey,
+        genesisFeedKey: identity.haloGenesisFeedKey,
+        controlTimeframe: identity.controlPipeline.state.timeframe
+      }
+    };
+  }
+  createIntroduction() {
+    return {};
+  }
+  async createAdmissionRequest() {
+    const deviceKey = await this._keyring.createKey();
+    const controlFeedKey = await this._keyring.createKey();
+    const dataFeedKey = await this._keyring.createKey();
+    return {
+      device: {
+        deviceKey,
+        controlFeedKey,
+        dataFeedKey
+      }
+    };
+  }
+  async accept(response, request) {
+    (0, import_node_assert4.default)(response.device);
+    const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
+    (0, import_node_assert4.default)(request.device);
+    const { deviceKey, controlFeedKey, dataFeedKey } = request.device;
+    await this._acceptIdentity({
+      identityKey,
+      deviceKey,
+      haloSpaceKey,
+      haloGenesisFeedKey: genesisFeedKey,
+      controlFeedKey,
+      dataFeedKey,
+      controlTimeframe
+    });
+    return {
+      identityKey
+    };
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
+var import_node_assert5 = __toESM(require("node:assert"));
 var import_async7 = require("@dxos/async");
 var import_client = require("@dxos/client");
 var import_context3 = require("@dxos/context");
@@ -983,141 +1048,206 @@ var import_keys6 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
 var import_network_manager = require("@dxos/network-manager");
 var import_protocols3 = require("@dxos/protocols");
-var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport = require("@dxos/teleport");
-var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHandler {
-  // prettier-ignore
-  constructor(_params) {
-    super(_params.networkManager);
-    this._params = _params;
+var MAX_OTP_ATTEMPTS = 3;
+var InvitationsHandler = class {
+  constructor(_networkManager) {
+    this._networkManager = _networkManager;
   }
-  /**
-  * Creates an invitation and listens for a join request from the invited (guest) peer.
-  */
-  createInvitation(context, options) {
-    const { type, timeout = import_client.INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    (0, import_node_assert4.default)(type !== import_services2.Invitation.Type.OFFLINE);
-    const identity = this._params.getIdentity();
+  createInvitation(protocol, options) {
+    var _a;
+    const { invitationId = import_keys6.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client.INVITATION_TIMEOUT, swarmKey = import_keys6.PublicKey.random() } = options != null ? options : {};
+    const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === import_services3.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials8.generatePasscode)(import_client.AUTHENTICATION_CODE_LENGTH) : void 0;
+    (0, import_node_assert5.default)(protocol);
     const invitation = {
+      invitationId,
       type,
-      invitationId: import_keys6.PublicKey.random().toHex(),
-      swarmKey: swarmKey != null ? swarmKey : import_keys6.PublicKey.random(),
-      authenticationCode: (0, import_credentials8.generatePasscode)(import_client.AUTHENTICATION_CODE_LENGTH)
+      authMethod,
+      state,
+      swarmKey,
+      authCode,
+      timeout,
+      ...protocol.getInvitationContext()
     };
+    const stream = new import_async7.PushStream();
     const ctx = new import_context3.Context({
       onError: (err) => {
         void ctx.dispose();
-        observable.callback.onError(err);
+        stream.error(err);
       }
     });
-    const observable = new import_client.InvitationObservableProvider(async () => {
-      await ctx.dispose();
+    ctx.onDispose(() => {
+      (0, import_log4.log)("complete", {
+        ...protocol.toJSON()
+      }, {
+        file: "invitations-handler.ts",
+        line: 102,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      stream.complete();
     });
-    let authenticationCode;
-    const complete = new import_async7.Trigger();
-    const createExtension = () => new HostHaloInvitationExtension({
-      requestAdmission: async () => {
-        var _a, _b;
-        (0, import_log4.log)("responding with admission offer", {
-          host: identity.deviceKey
-        }, {
-          file: "device-invitations-handler.ts",
-          line: 92,
-          scope: this,
-          callSite: (f, a) => f(...a)
-        });
-        (_b = (_a = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a, invitation);
-        return {
-          identityKey: identity.identityKey,
-          haloSpaceKey: identity.haloSpaceKey,
-          genesisFeedKey: identity.haloGenesisFeedKey,
-          controlTimeframe: identity.controlPipeline.state.timeframe
-        };
-      },
-      authenticate: async ({ authenticationCode: code }) => {
-        (0, import_log4.log)("received authentication request", {
-          authenticationCode: code
-        }, {
-          file: "device-invitations-handler.ts",
-          line: 107,
-          scope: this,
-          callSite: (f, a) => f(...a)
-        });
-        authenticationCode = code;
-        return {
-          status: import_invitations.AuthenticationResponse.Status.OK
-        };
-      },
-      // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
-      presentAdmissionCredentials: async (credentials) => {
-        try {
-          if (invitation.type !== import_services2.Invitation.Type.INTERACTIVE_TESTING) {
-            if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
-              throw new Error(`invalid authentication code: ${authenticationCode}`);
-            }
-          }
-          (0, import_log4.log)("writing guest credentials", {
-            host: identity.deviceKey,
-            guest: credentials.deviceKey
+    const createExtension = () => {
+      const success = new import_async7.Trigger();
+      let guestProfile;
+      let authenticationPassed = false;
+      let authenticationRetry = 0;
+      const extension = new InvitationHostExtension({
+        introduce: async ({ profile }) => {
+          (0, import_log4.log)("guest introduced itself", {
+            guestProfile: profile,
+            ...protocol.toJSON()
           }, {
-            file: "device-invitations-handler.ts",
-            line: 122,
+            file: "invitations-handler.ts",
+            line: 115,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          await identity.admitDevice(credentials);
-          complete.wake(credentials.deviceKey);
-        } catch (err) {
-          observable.callback.onError(err);
-          throw err;
-        }
-      },
-      onOpen: () => {
-        (0, import_async7.scheduleTask)(ctx, async () => {
-          var _a, _b;
+          guestProfile = profile;
+          stream.next({
+            ...invitation,
+            state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
+          });
+          return {
+            spaceKey: authMethod === import_services3.Invitation.AuthMethod.NONE ? protocol.getInvitationContext().spaceKey : void 0,
+            authMethod
+          };
+        },
+        authenticate: async ({ authCode: code }) => {
+          (0, import_log4.log)("received authentication request", {
+            authCode: code
+          }, {
+            file: "invitations-handler.ts",
+            line: 134,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          let status = import_invitations.AuthenticationResponse.Status.OK;
+          switch (invitation.authMethod) {
+            case import_services3.Invitation.AuthMethod.NONE: {
+              (0, import_log4.log)("authentication not required", {}, {
+                file: "invitations-handler.ts",
+                line: 139,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              return {
+                status: import_invitations.AuthenticationResponse.Status.OK
+              };
+            }
+            case import_services3.Invitation.AuthMethod.SHARED_SECRET: {
+              if (invitation.authCode) {
+                if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
+                  status = import_invitations.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
+                } else if (code !== invitation.authCode) {
+                  status = import_invitations.AuthenticationResponse.Status.INVALID_OTP;
+                } else {
+                  authenticationPassed = true;
+                }
+              }
+              break;
+            }
+            default: {
+              import_log4.log.error("invalid authentication method", {
+                authMethod: invitation.authMethod
+              }, {
+                file: "invitations-handler.ts",
+                line: 157,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              status = import_invitations.AuthenticationResponse.Status.INTERNAL_ERROR;
+              break;
+            }
+          }
+          return {
+            status
+          };
+        },
+        admit: async (admissionRequest) => {
+          var _a2, _b, _c;
           try {
-            (0, import_log4.log)("connected", {
-              host: identity.deviceKey
-            }, {
-              file: "device-invitations-handler.ts",
-              line: 138,
-              scope: this,
-              callSite: (f, a) => f(...a)
-            });
-            (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
-            const deviceKey = await complete.wait({
-              timeout
-            });
-            (0, import_log4.log)("admitted guest", {
-              host: identity.deviceKey,
-              guest: deviceKey
-            }, {
-              file: "device-invitations-handler.ts",
-              line: 141,
-              scope: this,
-              callSite: (f, a) => f(...a)
-            });
-            observable.callback.onSuccess(invitation);
+            if (isAuthenticationRequired(invitation) && !authenticationPassed) {
+              throw new Error("Not authenticated");
+            }
+            const deviceKey = (_c = (_a2 = admissionRequest.device) == null ? void 0 : _a2.deviceKey) != null ? _c : (_b = admissionRequest.space) == null ? void 0 : _b.deviceKey;
+            (0, import_node_assert5.default)(deviceKey);
+            const admissionResponse = await protocol.admit(admissionRequest, guestProfile);
+            success.wake(deviceKey);
+            return admissionResponse;
           } catch (err) {
-            if (!observable.cancelled) {
-              import_log4.log.error("failed", err, {
-                file: "device-invitations-handler.ts",
-                line: 145,
+            stream.error(err);
+            throw err;
+          }
+        },
+        onOpen: () => {
+          (0, import_async7.scheduleTask)(ctx, async () => {
+            try {
+              (0, import_log4.log)("connected", {
+                ...protocol.toJSON()
+              }, {
+                file: "invitations-handler.ts",
+                line: 191,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              stream.next({
+                ...invitation,
+                state: import_services3.Invitation.State.CONNECTED
+              });
+              const deviceKey = await success.wait({
+                timeout
+              });
+              (0, import_log4.log)("admitted guest", {
+                guest: deviceKey,
+                ...protocol.toJSON()
+              }, {
+                file: "invitations-handler.ts",
+                line: 194,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              observable.callback.onError(err);
+              stream.next({
+                ...invitation,
+                state: import_services3.Invitation.State.SUCCESS
+              });
+            } catch (err) {
+              if (err instanceof import_async7.TimeoutError) {
+                (0, import_log4.log)("timeout", {
+                  ...protocol.toJSON()
+                }, {
+                  file: "invitations-handler.ts",
+                  line: 198,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                stream.next({
+                  ...invitation,
+                  state: import_services3.Invitation.State.TIMEOUT
+                });
+              } else {
+                import_log4.log.error("failed", err, {
+                  file: "invitations-handler.ts",
+                  line: 201,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                stream.error(err);
+              }
+            } finally {
+              if (type !== import_services3.Invitation.Type.MULTIUSE) {
+                await (0, import_async7.sleep)(import_client.ON_CLOSE_DELAY);
+                await ctx.dispose();
+              }
             }
-          } finally {
-            await (0, import_async7.sleep)(import_client.ON_CLOSE_DELAY);
-            await ctx.dispose();
-          }
-        });
-      }
-    });
+          });
+        }
+      });
+      return extension;
+    };
     (0, import_async7.scheduleTask)(ctx, async () => {
-      var _a, _b;
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1128,126 +1258,210 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
         topology: new import_network_manager.StarTopology(topic)
       });
       ctx.onDispose(() => swarmConnection.close());
-      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
+      stream.next({
+        ...invitation,
+        state: import_services3.Invitation.State.CONNECTING
+      });
+    });
+    const observable = new import_client.CancellableInvitationObservable({
+      initialInvitation: invitation,
+      subscriber: stream.observable,
+      onCancel: async () => {
+        stream.next({
+          ...invitation,
+          state: import_services3.Invitation.State.CANCELLED
+        });
+        await ctx.dispose();
+      }
     });
     return observable;
   }
-  /**
-  * Waits for the host peer (inviter) to accept our join request.
-  * The local guest peer (invitee) then sends the local halo invitation to the host,
-  * which then writes the guest's credentials to the halo.
-  */
-  acceptInvitation(invitation, options) {
-    const { timeout = import_client.INVITATION_TIMEOUT } = options != null ? options : {};
+  acceptInvitation(protocol, invitation) {
+    const { timeout = import_client.INVITATION_TIMEOUT } = invitation;
+    (0, import_node_assert5.default)(protocol);
+    const authenticated = new import_async7.Trigger();
+    const stream = new import_async7.PushStream();
     const ctx = new import_context3.Context({
       onError: (err) => {
+        if (err instanceof import_async7.TimeoutError) {
+          (0, import_log4.log)("timeout", {
+            ...protocol.toJSON()
+          }, {
+            file: "invitations-handler.ts",
+            line: 255,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          stream.next({
+            ...invitation,
+            state: import_services3.Invitation.State.TIMEOUT
+          });
+        } else {
+          import_log4.log.warn("auth failed", err, {
+            file: "invitations-handler.ts",
+            line: 258,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          stream.error(err);
+        }
         void ctx.dispose();
-        observable.callback.onError(err);
       }
     });
-    const authenticated = new import_async7.Trigger();
-    const observable = new import_client.AuthenticatingInvitationProvider({
-      onCancel: async () => {
-        await ctx.dispose();
-      },
-      // TODO(burdon): Consider retry.
-      onAuthenticate: async (code) => {
-        authenticated.wake(code);
-      }
+    ctx.onDispose(() => {
+      (0, import_log4.log)("complete", {
+        ...protocol.toJSON()
+      }, {
+        file: "invitations-handler.ts",
+        line: 266,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      stream.complete();
     });
-    let connectionCount = 0;
-    const complete = new import_async7.Trigger();
     const createExtension = () => {
-      const extension = new GuestHaloInvitationExtension({
+      let connectionCount = 0;
+      const extension = new InvitationGuestExtension({
         onOpen: () => {
           (0, import_async7.scheduleTask)(ctx, async () => {
-            var _a, _b, _c, _d;
             try {
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
               }
-              (0, import_log4.log)("connected", {}, {
-                file: "device-invitations-handler.ts",
-                line: 216,
+              (0, import_async7.scheduleTask)(ctx, () => ctx.raise(new import_async7.TimeoutError(timeout)), timeout);
+              (0, import_log4.log)("connected", {
+                ...protocol.toJSON()
+              }, {
+                file: "invitations-handler.ts",
+                line: 284,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
-              (0, import_log4.log)("sending admission request", {}, {
-                file: "device-invitations-handler.ts",
-                line: 220,
+              stream.next({
+                ...invitation,
+                state: import_services3.Invitation.State.CONNECTED
+              });
+              (0, import_log4.log)("introduce", {
+                ...protocol.toJSON()
+              }, {
+                file: "invitations-handler.ts",
+                line: 288,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = await extension.rpc.HaloHostService.requestAdmission();
-              if (invitation.type === void 0 || invitation.type === import_services2.Invitation.Type.INTERACTIVE) {
-                (0, import_log4.log)("guest waiting for authentication code...", {}, {
-                  file: "device-invitations-handler.ts",
-                  line: 227,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
-                });
-                (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
-                const authenticationCode = await authenticated.wait({
-                  timeout
-                });
-                (0, import_log4.log)("sending authentication request", {}, {
-                  file: "device-invitations-handler.ts",
-                  line: 230,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
-                });
-                await extension.rpc.HaloHostService.authenticate({
-                  authenticationCode
+              const introductionResponse = await extension.rpc.InvitationHostService.introduce(protocol.createIntroduction());
+              (0, import_log4.log)("introduce response", {
+                ...protocol.toJSON(),
+                response: introductionResponse
+              }, {
+                file: "invitations-handler.ts",
+                line: 292,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              invitation.authMethod = introductionResponse.authMethod;
+              if (introductionResponse.spaceKey) {
+                invitation.spaceKey = introductionResponse.spaceKey;
+              }
+              if (isAuthenticationRequired(invitation)) {
+                for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
+                  (0, import_log4.log)("guest waiting for authentication code...", {}, {
+                    file: "invitations-handler.ts",
+                    line: 301,
+                    scope: this,
+                    callSite: (f, a) => f(...a)
+                  });
+                  stream.next({
+                    ...invitation,
+                    state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
+                  });
+                  const authCode = await authenticated.wait({
+                    timeout
+                  });
+                  (0, import_log4.log)("sending authentication request", {}, {
+                    file: "invitations-handler.ts",
+                    line: 305,
+                    scope: this,
+                    callSite: (f, a) => f(...a)
+                  });
+                  stream.next({
+                    ...invitation,
+                    state: import_services3.Invitation.State.AUTHENTICATING
+                  });
+                  const response = await extension.rpc.InvitationHostService.authenticate({
+                    authCode
+                  });
+                  if (response.status === void 0 || response.status === import_invitations.AuthenticationResponse.Status.OK) {
+                    break;
+                  }
+                  if (response.status === import_invitations.AuthenticationResponse.Status.INVALID_OTP) {
+                    if (attempt === MAX_OTP_ATTEMPTS) {
+                      throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
+                    } else {
+                      (0, import_log4.log)("retrying invalid code", {
+                        attempt
+                      }, {
+                        file: "invitations-handler.ts",
+                        line: 316,
+                        scope: this,
+                        callSite: (f, a) => f(...a)
+                      });
+                      authenticated.reset();
+                    }
+                  }
+                }
+              } else {
+                stream.next({
+                  ...invitation,
+                  state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
                 });
               }
-              const deviceKey = await this._params.keyring.createKey();
-              const controlFeedKey = await this._params.keyring.createKey();
-              const dataFeedKey = await this._params.keyring.createKey();
-              (0, import_log4.log)("presenting admission credentials", {
-                identityKey,
-                deviceKey,
-                controlFeedKey,
-                dataFeedKey
+              (0, import_log4.log)("request admission", {
+                ...protocol.toJSON()
               }, {
-                file: "device-invitations-handler.ts",
-                line: 239,
+                file: "invitations-handler.ts",
+                line: 327,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              await extension.rpc.HaloHostService.presentAdmissionCredentials({
-                deviceKey,
-                controlFeedKey,
-                dataFeedKey
-              });
-              const identity = await this._params.acceptIdentity({
-                identityKey,
-                deviceKey,
-                haloSpaceKey,
-                haloGenesisFeedKey: genesisFeedKey,
-                controlFeedKey,
-                dataFeedKey,
-                controlTimeframe
-              });
+              const admissionRequest = await protocol.createAdmissionRequest();
+              const admissionResponse = await extension.rpc.InvitationHostService.admit(admissionRequest);
+              const result = await protocol.accept(admissionResponse, admissionRequest);
               (0, import_log4.log)("admitted by host", {
-                guest: identity.deviceKey,
-                identityKey
+                ...protocol.toJSON()
               }, {
-                file: "device-invitations-handler.ts",
-                line: 259,
+                file: "invitations-handler.ts",
+                line: 335,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              complete.wake(identityKey);
+              stream.next({
+                ...invitation,
+                ...result,
+                state: import_services3.Invitation.State.SUCCESS
+              });
             } catch (err) {
-              if (!observable.cancelled) {
+              if (err instanceof import_async7.TimeoutError) {
+                (0, import_log4.log)("timeout", {
+                  ...protocol.toJSON()
+                }, {
+                  file: "invitations-handler.ts",
+                  line: 339,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                stream.next({
+                  ...invitation,
+                  state: import_services3.Invitation.State.TIMEOUT
+                });
+              } else {
                 import_log4.log.warn("auth failed", err, {
-                  file: "device-invitations-handler.ts",
-                  line: 263,
+                  file: "invitations-handler.ts",
+                  line: 342,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
-                observable.callback.onError(err);
+                stream.error(err);
               }
             } finally {
               await ctx.dispose();
@@ -1258,8 +1472,7 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
       return extension;
     };
     (0, import_async7.scheduleTask)(ctx, async () => {
-      var _a, _b;
-      (0, import_node_assert4.default)(invitation.swarmKey);
+      (0, import_node_assert5.default)(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1270,19 +1483,34 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
         topology: new import_network_manager.StarTopology(topic)
       });
       ctx.onDispose(() => swarmConnection.close());
-      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
-      invitation.identityKey = await complete.wait();
-      observable.callback.onSuccess(invitation);
-      await ctx.dispose();
+      stream.next({
+        ...invitation,
+        state: import_services3.Invitation.State.CONNECTING
+      });
+    });
+    const observable = new import_client.AuthenticatingInvitationObservable({
+      initialInvitation: invitation,
+      subscriber: stream.observable,
+      onCancel: async () => {
+        stream.next({
+          ...invitation,
+          state: import_services3.Invitation.State.CANCELLED
+        });
+        await ctx.dispose();
+      },
+      onAuthenticate: async (code) => {
+        authenticated.wake(code);
+      }
     });
     return observable;
   }
 };
-var HostHaloInvitationExtension = class extends import_teleport.RpcExtension {
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_services3.Invitation.AuthMethod.NONE;
+var InvitationHostExtension = class extends import_teleport.RpcExtension {
   constructor(_callbacks) {
     super({
       exposed: {
-        HaloHostService: import_protocols3.schema.getService("dxos.halo.invitations.HaloHostService")
+        InvitationHostService: import_protocols3.schema.getService("dxos.halo.invitations.InvitationHostService")
       }
     });
     this._callbacks = _callbacks;
@@ -1291,16 +1519,15 @@ var HostHaloInvitationExtension = class extends import_teleport.RpcExtension {
     return {
       // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
       // Perhaps in the future we will have more complex logic here.
-      HaloHostService: {
-        requestAdmission: async () => {
-          return this._callbacks.requestAdmission();
+      InvitationHostService: {
+        introduce: async (request) => {
+          return this._callbacks.introduce(request);
         },
-        authenticate: async (credentials) => {
-          return this._callbacks.authenticate(credentials);
+        authenticate: async (request) => {
+          return this._callbacks.authenticate(request);
         },
-        // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
-        presentAdmissionCredentials: async (credentials) => {
-          return this._callbacks.presentAdmissionCredentials(credentials);
+        admit: async (request) => {
+          return this._callbacks.admit(request);
         }
       }
     };
@@ -1310,11 +1537,11 @@ var HostHaloInvitationExtension = class extends import_teleport.RpcExtension {
     this._callbacks.onOpen();
   }
 };
-var GuestHaloInvitationExtension = class extends import_teleport.RpcExtension {
+var InvitationGuestExtension = class extends import_teleport.RpcExtension {
   constructor(_callbacks) {
     super({
       requested: {
-        HaloHostService: import_protocols3.schema.getService("dxos.halo.invitations.HaloHostService")
+        InvitationHostService: import_protocols3.schema.getService("dxos.halo.invitations.InvitationHostService")
       }
     });
     this._callbacks = _callbacks;
@@ -1329,98 +1556,102 @@ var GuestHaloInvitationExtension = class extends import_teleport.RpcExtension {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
-var import_node_assert5 = __toESM(require("node:assert"));
+var import_node_assert6 = __toESM(require("node:assert"));
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
 var import_log5 = require("@dxos/log");
-var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
-var AbstractInvitationsService = class {
-  // prettier-ignore
-  constructor(_identityManager, _getInvitationsHandler) {
-    this._identityManager = _identityManager;
-    this._getInvitationsHandler = _getInvitationsHandler;
+var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
+var InvitationsServiceImpl = class {
+  constructor(_invitationsHandler, _getHandler) {
+    this._invitationsHandler = _invitationsHandler;
+    this._getHandler = _getHandler;
     this._createInvitations = /* @__PURE__ */ new Map();
     this._acceptInvitations = /* @__PURE__ */ new Map();
   }
   // TODO(burdon): Guest/host label.
   getLoggingContext() {
-    var _a;
-    return {
-      deviceKey: (_a = this._identityManager.identity) == null ? void 0 : _a.deviceKey
-    };
+    return {};
   }
   createInvitation(invitation) {
     return new import_codec_protobuf8.Stream(({ next, close }) => {
-      const invitationsHandler = this._getInvitationsHandler();
-      const context = this.getContext(invitation);
+      const handler = this._getHandler(invitation);
       (0, import_log5.log)("stream opened", this.getLoggingContext(), {
         file: "invitations-service.ts",
-        line: 48,
+        line: 37,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       let invitationId;
-      const { type, swarmKey, authMethod } = invitation;
-      const observable = invitationsHandler.createInvitation(context, {
-        type,
-        swarmKey,
-        authMethod
-      });
-      observable.subscribe({
-        onConnecting: (invitation2) => {
-          (0, import_node_assert5.default)(invitation2.invitationId);
-          invitationId = invitation2.invitationId;
-          this._createInvitations.set(invitation2.invitationId, observable);
-          invitation2.state = import_services3.Invitation.State.CONNECTING;
-          next(invitation2);
-        },
-        onConnected: (invitation2) => {
-          (0, import_node_assert5.default)(invitation2.invitationId);
-          invitation2.state = import_services3.Invitation.State.CONNECTED;
-          next(invitation2);
-        },
-        onAuthenticating: (invitation2) => {
-          (0, import_node_assert5.default)(invitation2.invitationId);
-          invitation2.state = import_services3.Invitation.State.AUTHENTICATING;
-          next(invitation2);
-        },
-        onSuccess: (invitation2) => {
-          (0, import_node_assert5.default)(invitation2.invitationId);
-          invitation2.state = import_services3.Invitation.State.SUCCESS;
-          next(invitation2);
-          close();
-        },
-        onCancelled: () => {
-          (0, import_node_assert5.default)(invitationId);
-          invitation.invitationId = invitationId;
-          invitation.state = import_services3.Invitation.State.CANCELLED;
-          next(invitation);
-          close();
-        },
-        onTimeout: (err) => {
-          invitation.state = import_services3.Invitation.State.TIMEOUT;
-          close(err);
-        },
-        onError: (err) => {
-          invitation.state = import_services3.Invitation.State.ERROR;
-          close(err);
+      const observable = this._invitationsHandler.createInvitation(handler, invitation);
+      observable.subscribe((invitation2) => {
+        switch (invitation2.state) {
+          case import_services4.Invitation.State.CONNECTING: {
+            (0, import_node_assert6.default)(invitation2.invitationId);
+            invitationId = invitation2.invitationId;
+            this._createInvitations.set(invitation2.invitationId, observable);
+            invitation2.state = import_services4.Invitation.State.CONNECTING;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.CONNECTED: {
+            (0, import_node_assert6.default)(invitation2.invitationId);
+            invitation2.state = import_services4.Invitation.State.CONNECTED;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.READY_FOR_AUTHENTICATION: {
+            (0, import_node_assert6.default)(invitation2.invitationId);
+            invitation2.state = import_services4.Invitation.State.READY_FOR_AUTHENTICATION;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.AUTHENTICATING: {
+            (0, import_node_assert6.default)(invitation2.invitationId);
+            invitation2.state = import_services4.Invitation.State.AUTHENTICATING;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.SUCCESS: {
+            (0, import_node_assert6.default)(invitation2.invitationId);
+            invitation2.state = import_services4.Invitation.State.SUCCESS;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.CANCELLED: {
+            (0, import_node_assert6.default)(invitationId);
+            invitation2.invitationId = invitationId;
+            invitation2.state = import_services4.Invitation.State.CANCELLED;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.TIMEOUT: {
+            (0, import_node_assert6.default)(invitationId);
+            invitation2.invitationId = invitationId;
+            invitation2.state = import_services4.Invitation.State.TIMEOUT;
+            next(invitation2);
+            break;
+          }
         }
+      }, (err) => {
+        close(err);
+      }, () => {
+        close();
       });
       return (err) => {
-        const context2 = this.getLoggingContext();
+        const context = this.getLoggingContext();
         if (err) {
           import_log5.log.warn("stream closed", {
-            ...context2,
+            ...context,
             err
           }, {
             file: "invitations-service.ts",
-            line: 97,
+            line: 103,
             scope: this,
             callSite: (f, a) => f(...a)
           });
         } else {
-          (0, import_log5.log)("stream closed", context2, {
+          (0, import_log5.log)("stream closed", context, {
             file: "invitations-service.ts",
-            line: 99,
+            line: 105,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1429,55 +1660,69 @@ var AbstractInvitationsService = class {
       };
     });
   }
-  acceptInvitation(invitation, options) {
+  acceptInvitation(invitation) {
     return new import_codec_protobuf8.Stream(({ next, close }) => {
       (0, import_log5.log)("stream opened", this.getLoggingContext(), {
         file: "invitations-service.ts",
-        line: 109,
+        line: 115,
         scope: this,
         callSite: (f, a) => f(...a)
       });
-      const invitationsHandler = this._getInvitationsHandler();
+      const handler = this._getHandler(invitation);
       let invitationId;
-      const observable = invitationsHandler.acceptInvitation(invitation, options);
-      observable.subscribe({
-        onConnecting: (invitation2) => {
-          (0, import_node_assert5.default)(invitation2.invitationId);
-          invitationId = invitation2.invitationId;
-          this._acceptInvitations.set(invitation2.invitationId, observable);
-          invitation2.state = import_services3.Invitation.State.CONNECTING;
-          next(invitation2);
-        },
-        onConnected: (invitation2) => {
-          (0, import_node_assert5.default)(invitation2.invitationId);
-          invitation2.state = import_services3.Invitation.State.CONNECTED;
-          next(invitation2);
-        },
-        onAuthenticating: (invitation2) => {
-          (0, import_node_assert5.default)(invitation2.invitationId);
-          invitation2.state = import_services3.Invitation.State.AUTHENTICATING;
-          next(invitation2);
-        },
-        onSuccess: (invitation2) => {
-          invitation2.state = import_services3.Invitation.State.SUCCESS;
-          next(invitation2);
-          close();
-        },
-        onCancelled: () => {
-          (0, import_node_assert5.default)(invitationId);
-          invitation.invitationId = invitationId;
-          invitation.state = import_services3.Invitation.State.CANCELLED;
-          next(invitation);
-          close();
-        },
-        onTimeout: (err) => {
-          invitation.state = import_services3.Invitation.State.TIMEOUT;
-          close(err);
-        },
-        onError: (err) => {
-          invitation.state = import_services3.Invitation.State.ERROR;
-          close(err);
+      const observable = this._invitationsHandler.acceptInvitation(handler, invitation);
+      observable.subscribe((invitation2) => {
+        switch (invitation2.state) {
+          case import_services4.Invitation.State.CONNECTING: {
+            (0, import_node_assert6.default)(invitation2.invitationId);
+            invitationId = invitation2.invitationId;
+            this._acceptInvitations.set(invitation2.invitationId, observable);
+            invitation2.state = import_services4.Invitation.State.CONNECTING;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.CONNECTED: {
+            (0, import_node_assert6.default)(invitation2.invitationId);
+            invitation2.state = import_services4.Invitation.State.CONNECTED;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.READY_FOR_AUTHENTICATION: {
+            (0, import_node_assert6.default)(invitation2.invitationId);
+            invitation2.state = import_services4.Invitation.State.READY_FOR_AUTHENTICATION;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.AUTHENTICATING: {
+            (0, import_node_assert6.default)(invitation2.invitationId);
+            invitation2.state = import_services4.Invitation.State.AUTHENTICATING;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.SUCCESS: {
+            invitation2.state = import_services4.Invitation.State.SUCCESS;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.CANCELLED: {
+            (0, import_node_assert6.default)(invitationId);
+            invitation2.invitationId = invitationId;
+            invitation2.state = import_services4.Invitation.State.CANCELLED;
+            next(invitation2);
+            break;
+          }
+          case import_services4.Invitation.State.TIMEOUT: {
+            (0, import_node_assert6.default)(invitationId);
+            invitation2.invitationId = invitationId;
+            invitation2.state = import_services4.Invitation.State.TIMEOUT;
+            next(invitation2);
+            break;
+          }
         }
+      }, (err) => {
+        close(err);
+      }, () => {
+        close();
       });
       return (err) => {
         const context = this.getLoggingContext();
@@ -1487,14 +1732,14 @@ var AbstractInvitationsService = class {
             err
           }, {
             file: "invitations-service.ts",
-            line: 157,
+            line: 181,
             scope: this,
             callSite: (f, a) => f(...a)
           });
         } else {
           (0, import_log5.log)("stream closed", context, {
             file: "invitations-service.ts",
-            line: 159,
+            line: 183,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1503,531 +1748,140 @@ var AbstractInvitationsService = class {
       };
     });
   }
-  async authenticate({ invitationId, authenticationCode }) {
+  async authenticate({ invitationId, authCode }) {
     (0, import_log5.log)("authenticating...", {}, {
       file: "invitations-service.ts",
-      line: 168,
+      line: 192,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert5.default)(invitationId);
+    (0, import_node_assert6.default)(invitationId);
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
       import_log5.log.warn("invalid invitation", {
         invitationId
       }, {
         file: "invitations-service.ts",
-        line: 172,
+        line: 196,
         scope: this,
         callSite: (f, a) => f(...a)
       });
     } else {
-      await observable.authenticate(authenticationCode);
+      await observable.authenticate(authCode);
     }
   }
-  async cancelInvitation(invitation) {
+  async cancelInvitation({ invitationId }) {
     var _a;
     (0, import_log5.log)("cancelling...", {}, {
-      file: "invitations-service.ts",
-      line: 179,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    (0, import_node_assert5.default)(invitation.invitationId);
-    const observable = (_a = this._createInvitations.get(invitation.invitationId)) != null ? _a : this._acceptInvitations.get(invitation.invitationId);
-    if (!observable) {
-      import_log5.log.warn("invalid invitation", {
-        invitationId: invitation.invitationId
-      }, {
-        file: "invitations-service.ts",
-        line: 184,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    } else {
-      await (observable == null ? void 0 : observable.cancel());
-    }
-  }
-};
-
-// packages/sdk/client-services/src/packlets/invitations/device-invitations-service.ts
-var DeviceInvitationsServiceImpl = class extends AbstractInvitationsService {
-  // prettier-ignore
-  constructor(identityManager, invitationsHandler) {
-    super(identityManager, () => invitationsHandler);
-    this.invitationsHandler = invitationsHandler;
-  }
-  getContext(invitation) {
-  }
-};
-
-// packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts
-var import_node_assert6 = __toESM(require("node:assert"));
-var import_async8 = require("@dxos/async");
-var import_client2 = require("@dxos/client");
-var import_context4 = require("@dxos/context");
-var import_credentials9 = require("@dxos/credentials");
-var import_feed_store3 = require("@dxos/feed-store");
-var import_keys7 = require("@dxos/keys");
-var import_log6 = require("@dxos/log");
-var import_network_manager2 = require("@dxos/network-manager");
-var import_protocols4 = require("@dxos/protocols");
-var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
-var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations");
-var import_teleport2 = require("@dxos/teleport");
-var MAX_OTP_ATTEMPTS = 3;
-var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHandler {
-  constructor(networkManager, _spaceManager, _signingContext, _keyring) {
-    super(networkManager);
-    this._spaceManager = _spaceManager;
-    this._signingContext = _signingContext;
-    this._keyring = _keyring;
-  }
-  /**
-  * Creates an invitation and listens for a join request from the invited (guest) peer.
-  */
-  createInvitation(space, options) {
-    var _a;
-    let swarmConnection;
-    const { type, timeout = import_client2.INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    (0, import_node_assert6.default)(type !== import_services4.Invitation.Type.OFFLINE);
-    (0, import_node_assert6.default)(space);
-    const invitation = {
-      type,
-      invitationId: import_keys7.PublicKey.random().toHex(),
-      swarmKey: swarmKey != null ? swarmKey : import_keys7.PublicKey.random(),
-      spaceKey: space.key,
-      authMethod: (_a = options == null ? void 0 : options.authMethod) != null ? _a : import_invitations2.AuthMethod.SHARED_SECRET,
-      authenticationCode: (0, import_credentials9.generatePasscode)(import_client2.AUTHENTICATION_CODE_LENGTH)
-      // TODO(dmaretskyi): Don't generate if authMethod === NONE .
-    };
-    const ctx = new import_context4.Context({
-      onError: (err) => {
-        void ctx.dispose();
-        observable.callback.onError(err);
-      }
-    });
-    const observable = new import_client2.InvitationObservableProvider(async () => {
-      await (swarmConnection == null ? void 0 : swarmConnection.close());
-    });
-    let authenticationPassed = false;
-    let authenticationRetry = 0;
-    const createExtension = () => {
-      const complete = new import_async8.Trigger();
-      let guestProfile;
-      const hostInvitationExtension = new HostSpaceInvitationExtension({
-        introduce: async ({ profile }) => {
-          var _a2, _b;
-          (0, import_log6.log)("guest introduced itself", {
-            guestProfile: profile,
-            host: this._signingContext.deviceKey,
-            spaceKey: space.key
-          }, {
-            file: "space-invitations-handler.ts",
-            line: 101,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          guestProfile = profile;
-          (_b = (_a2 = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a2, invitation);
-          return {
-            spaceKey: type === import_services4.Invitation.Type.INTERACTIVE_TESTING || type === import_services4.Invitation.Type.MULTIUSE_TESTING ? space.key : void 0,
-            authMethod: invitation.authMethod
-          };
-        },
-        authenticate: async ({ authenticationCode: code }) => {
-          (0, import_log6.log)("received authentication request", {
-            authenticationCode: code
-          }, {
-            file: "space-invitations-handler.ts",
-            line: 123,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          let status = import_invitations2.AuthenticationResponse.Status.OK;
-          switch (invitation.authMethod) {
-            case import_invitations2.AuthMethod.NONE: {
-              (0, import_log6.log)("authentication not required", {}, {
-                file: "space-invitations-handler.ts",
-                line: 128,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              return {
-                status: import_invitations2.AuthenticationResponse.Status.OK
-              };
-            }
-            case import_invitations2.AuthMethod.SHARED_SECRET: {
-              if (invitation.authenticationCode) {
-                if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
-                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
-                } else if (code !== invitation.authenticationCode) {
-                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OTP;
-                } else {
-                  authenticationPassed = true;
-                }
-              }
-              break;
-            }
-            default: {
-              import_log6.log.error("invalid authentication method", {
-                authMethod: invitation.authMethod
-              }, {
-                file: "space-invitations-handler.ts",
-                line: 144,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              status = import_invitations2.AuthenticationResponse.Status.INTERNAL_ERROR;
-              break;
-            }
-          }
-          return {
-            status
-          };
-        },
-        requestAdmission: async ({ identityKey, deviceKey, controlFeedKey, dataFeedKey }) => {
-          var _a2;
-          try {
-            if (isAuthenticationRequired(invitation) && !authenticationPassed) {
-              throw new Error("Not authenticated");
-            }
-            (0, import_log6.log)("writing guest credentials", {
-              host: this._signingContext.deviceKey,
-              guest: deviceKey
-            }, {
-              file: "space-invitations-handler.ts",
-              line: 160,
-              scope: this,
-              callSite: (f, a) => f(...a)
-            });
-            const credentials = await (0, import_credentials9.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
-            (0, import_node_assert6.default)(credentials[0].credential);
-            const spaceMemberCredential = credentials[0].credential.credential;
-            (0, import_node_assert6.default)((0, import_credentials9.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
-            await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, credentials);
-            complete.wake(deviceKey);
-            return {
-              credential: spaceMemberCredential,
-              controlTimeframe: space.inner.controlPipeline.state.timeframe,
-              dataTimeframe: (_a2 = space.dataPipeline.pipelineState) == null ? void 0 : _a2.timeframe
-            };
-          } catch (err) {
-            observable.callback.onError(err);
-            throw err;
-          }
-        },
-        onOpen: () => {
-          (0, import_async8.scheduleTask)(ctx, async () => {
-            var _a2, _b;
-            try {
-              (0, import_log6.log)("connected", {
-                host: this._signingContext.deviceKey
-              }, {
-                file: "space-invitations-handler.ts",
-                line: 195,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              (_b = (_a2 = observable.callback).onConnected) == null ? void 0 : _b.call(_a2, invitation);
-              const deviceKey = await complete.wait({
-                timeout
-              });
-              (0, import_log6.log)("admitted guest", {
-                host: this._signingContext.deviceKey,
-                guest: deviceKey
-              }, {
-                file: "space-invitations-handler.ts",
-                line: 198,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              observable.callback.onSuccess(invitation);
-            } catch (err) {
-              if (!observable.cancelled) {
-                import_log6.log.error("failed", err, {
-                  file: "space-invitations-handler.ts",
-                  line: 202,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
-                });
-                observable.callback.onError(err);
-              }
-            } finally {
-              if (type !== import_services4.Invitation.Type.MULTIUSE_TESTING) {
-                await (0, import_async8.sleep)(import_client2.ON_CLOSE_DELAY);
-                await ctx.dispose();
-              }
-            }
-          });
-        }
-      });
-      return hostInvitationExtension;
-    };
-    (0, import_async8.scheduleTask)(ctx, async () => {
-      var _a2, _b;
-      const topic = invitation.swarmKey;
-      const swarmConnection2 = await this._networkManager.joinSwarm({
-        topic,
-        peerId: topic,
-        protocolProvider: (0, import_network_manager2.createTeleportProtocolFactory)(async (teleport) => {
-          teleport.addExtension("dxos.halo.invitations", createExtension());
-        }),
-        topology: new import_network_manager2.StarTopology(topic)
-      });
-      ctx.onDispose(() => swarmConnection2.close());
-      (_b = (_a2 = observable.callback).onConnecting) == null ? void 0 : _b.call(_a2, invitation);
-    });
-    return observable;
-  }
-  /**
-  * Waits for the host peer (inviter) to accept our join request.
-  * The local guest peer (invitee) then sends the local space invitation to the host,
-  * which then writes the guest's credentials to the space.
-  */
-  acceptInvitation(invitation, options) {
-    const { timeout = import_client2.INVITATION_TIMEOUT } = options != null ? options : {};
-    const ctx = new import_context4.Context({
-      onError: (err) => {
-        void ctx.dispose();
-        observable.callback.onError(err);
-      }
-    });
-    const authenticated = new import_async8.Trigger();
-    const observable = new import_client2.AuthenticatingInvitationProvider({
-      onCancel: async () => {
-        await ctx.dispose();
-      },
-      onAuthenticate: async (code) => {
-        authenticated.wake(code);
-      }
-    });
-    let connectionCount = 0;
-    const complete = new import_async8.Trigger();
-    const createExtension = () => {
-      const extension = new GuestSpaceInvitationExtension({
-        onOpen: () => {
-          (0, import_async8.scheduleTask)(ctx, async () => {
-            var _a, _b, _c, _d, _e, _f;
-            try {
-              if (++connectionCount > 1) {
-                throw new Error(`multiple connections detected: ${connectionCount}`);
-              }
-              (0, import_log6.log)("connected", {
-                guest: this._signingContext.deviceKey
-              }, {
-                file: "space-invitations-handler.ts",
-                line: 275,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
-              (0, import_log6.log)("introduce", {
-                guest: this._signingContext.deviceKey
-              }, {
-                file: "space-invitations-handler.ts",
-                line: 279,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              const introductionResponse = await extension.rpc.SpaceHostService.introduce({
-                profile: this._signingContext.profile
-              });
-              (0, import_log6.log)("introduce response", {
-                guest: this._signingContext.deviceKey,
-                response: introductionResponse
-              }, {
-                file: "space-invitations-handler.ts",
-                line: 283,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              invitation.authMethod = introductionResponse.authMethod;
-              if (introductionResponse.spaceKey) {
-                invitation.spaceKey = introductionResponse.spaceKey;
-              }
-              if (isAuthenticationRequired(invitation)) {
-                (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
-                for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  (0, import_log6.log)("guest waiting for authentication code...", {}, {
-                    file: "space-invitations-handler.ts",
-                    line: 297,
-                    scope: this,
-                    callSite: (f, a) => f(...a)
-                  });
-                  (_f = (_e = observable.callback).onAuthenticating) == null ? void 0 : _f.call(_e, invitation);
-                  const authenticationCode = await authenticated.wait({
-                    timeout
-                  });
-                  (0, import_log6.log)("sending authentication request", {}, {
-                    file: "space-invitations-handler.ts",
-                    line: 301,
-                    scope: this,
-                    callSite: (f, a) => f(...a)
-                  });
-                  const response = await extension.rpc.SpaceHostService.authenticate({
-                    authenticationCode
-                  });
-                  if (response.status === void 0 || response.status === import_invitations2.AuthenticationResponse.Status.OK) {
-                    break;
-                  }
-                  if (response.status === import_invitations2.AuthenticationResponse.Status.INVALID_OTP) {
-                    if (attempt === MAX_OTP_ATTEMPTS) {
-                      throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
-                    } else {
-                      (0, import_log6.log)("retrying invalid code", {
-                        attempt
-                      }, {
-                        file: "space-invitations-handler.ts",
-                        line: 311,
-                        scope: this,
-                        callSite: (f, a) => f(...a)
-                      });
-                      authenticated.reset();
-                    }
-                  }
-                }
-              }
-              const controlFeedKey = await this._keyring.createKey();
-              const dataFeedKey = await this._keyring.createKey();
-              (0, import_log6.log)("request admission", {
-                guest: this._signingContext.deviceKey
-              }, {
-                file: "space-invitations-handler.ts",
-                line: 322,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              const { credential, controlTimeframe, dataTimeframe } = await extension.rpc.SpaceHostService.requestAdmission({
-                identityKey: this._signingContext.identityKey,
-                deviceKey: this._signingContext.deviceKey,
-                controlFeedKey,
-                dataFeedKey
-              });
-              const assertion = (0, import_credentials9.getCredentialAssertion)(credential);
-              (0, import_node_assert6.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
-              (0, import_node_assert6.default)(credential.subject.id.equals(this._signingContext.identityKey));
-              const space = await this._spaceManager.acceptSpace({
-                spaceKey: assertion.spaceKey,
-                genesisFeedKey: assertion.genesisFeedKey,
-                controlTimeframe,
-                dataTimeframe
-              });
-              await this._signingContext.recordCredential(credential);
-              (0, import_log6.log)("admitted by host", {
-                guest: this._signingContext.deviceKey,
-                spaceKey: space.key
-              }, {
-                file: "space-invitations-handler.ts",
-                line: 347,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              complete.wake();
-            } catch (err) {
-              if (!observable.cancelled) {
-                import_log6.log.warn("auth failed", err, {
-                  file: "space-invitations-handler.ts",
-                  line: 351,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
-                });
-                observable.callback.onError(err);
-              }
-            } finally {
-              await ctx.dispose();
-            }
-          });
-        }
-      });
-      return extension;
-    };
-    (0, import_async8.scheduleTask)(ctx, async () => {
-      var _a, _b;
-      (0, import_node_assert6.default)(invitation.swarmKey);
-      const topic = invitation.swarmKey;
-      const swarmConnection = await this._networkManager.joinSwarm({
-        topic,
-        peerId: import_keys7.PublicKey.random(),
-        protocolProvider: (0, import_network_manager2.createTeleportProtocolFactory)(async (teleport) => {
-          teleport.addExtension("dxos.halo.invitations", createExtension());
-        }),
-        topology: new import_network_manager2.StarTopology(topic)
-      });
-      ctx.onDispose(() => swarmConnection.close());
-      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
-      await complete.wait();
-      observable.callback.onSuccess(invitation);
-      await ctx.dispose();
+      file: "invitations-service.ts",
+      line: 203,
+      scope: this,
+      callSite: (f, a) => f(...a)
     });
-    return observable;
+    (0, import_node_assert6.default)(invitationId);
+    const observable = (_a = this._createInvitations.get(invitationId)) != null ? _a : this._acceptInvitations.get(invitationId);
+    if (!observable) {
+      import_log5.log.warn("invalid invitation", {
+        invitationId
+      }, {
+        file: "invitations-service.ts",
+        line: 207,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } else {
+      await (observable == null ? void 0 : observable.cancel());
+    }
   }
 };
-var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_invitations2.AuthMethod.NONE && invitation.type !== import_services4.Invitation.Type.INTERACTIVE_TESTING && invitation.type !== import_services4.Invitation.Type.MULTIUSE_TESTING;
-var HostSpaceInvitationExtension = class extends import_teleport2.RpcExtension {
-  constructor(_callbacks) {
-    super({
-      exposed: {
-        SpaceHostService: import_protocols4.schema.getService("dxos.halo.invitations.SpaceHostService")
-      }
-    });
-    this._callbacks = _callbacks;
+
+// packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts
+var import_node_assert7 = __toESM(require("node:assert"));
+var import_credentials9 = require("@dxos/credentials");
+var import_feed_store3 = require("@dxos/feed-store");
+var import_log6 = require("@dxos/log");
+var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
+var SpaceInvitationProtocol = class {
+  constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
+    this._spaceManager = _spaceManager;
+    this._signingContext = _signingContext;
+    this._keyring = _keyring;
+    this._spaceKey = _spaceKey;
   }
-  async getHandlers() {
+  toJSON() {
     return {
-      // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
-      // Perhaps in the future we will have more complex logic here.
-      SpaceHostService: {
-        introduce: async (params) => {
-          return this._callbacks.introduce(params);
-        },
-        authenticate: async (credentials) => {
-          return this._callbacks.authenticate(credentials);
-        },
-        requestAdmission: async (credentials) => {
-          return this._callbacks.requestAdmission(credentials);
-        }
-      }
+      deviceKey: this._signingContext.deviceKey,
+      spaceKey: this._spaceKey
     };
   }
-  async onOpen(context) {
-    await super.onOpen(context);
-    this._callbacks.onOpen();
+  getInvitationContext() {
+    return {
+      kind: import_services5.Invitation.Kind.SPACE,
+      spaceKey: this._spaceKey
+    };
   }
-};
-var GuestSpaceInvitationExtension = class extends import_teleport2.RpcExtension {
-  constructor(_callbacks) {
-    super({
-      requested: {
-        SpaceHostService: import_protocols4.schema.getService("dxos.halo.invitations.SpaceHostService")
-      }
+  async admit(request, guestProfile) {
+    var _a;
+    (0, import_node_assert7.default)(this._spaceKey);
+    const space = await this._spaceManager.spaces.get(this._spaceKey);
+    (0, import_node_assert7.default)(space);
+    (0, import_node_assert7.default)(request.space);
+    const { identityKey, deviceKey } = request.space;
+    (0, import_log6.log)("writing guest credentials", {
+      host: this._signingContext.deviceKey,
+      guest: deviceKey
+    }, {
+      file: "space-invitation-protocol.ts",
+      line: 51,
+      scope: this,
+      callSite: (f, a) => f(...a)
     });
-    this._callbacks = _callbacks;
+    const credentials = await (0, import_credentials9.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
+    (0, import_node_assert7.default)(credentials[0].credential);
+    const spaceMemberCredential = credentials[0].credential.credential;
+    (0, import_node_assert7.default)((0, import_credentials9.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, credentials);
+    return {
+      space: {
+        credential: spaceMemberCredential,
+        controlTimeframe: space.inner.controlPipeline.state.timeframe,
+        dataTimeframe: (_a = space.dataPipeline.pipelineState) == null ? void 0 : _a.timeframe
+      }
+    };
   }
-  async getHandlers() {
-    return {};
+  createIntroduction() {
+    return {
+      profile: this._signingContext.profile
+    };
   }
-  async onOpen(context) {
-    await super.onOpen(context);
-    this._callbacks.onOpen();
+  async createAdmissionRequest() {
+    const controlFeedKey = await this._keyring.createKey();
+    const dataFeedKey = await this._keyring.createKey();
+    return {
+      space: {
+        identityKey: this._signingContext.identityKey,
+        deviceKey: this._signingContext.deviceKey,
+        controlFeedKey,
+        dataFeedKey
+      }
+    };
   }
-};
-
-// packages/sdk/client-services/src/packlets/invitations/space-invitations-service.ts
-var import_node_assert7 = __toESM(require("node:assert"));
-var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
-  // prettier-ignore
-  constructor(identityManager, invitationsHandler, _getSpaceManager) {
-    super(identityManager, invitationsHandler);
-    this.invitationsHandler = invitationsHandler;
-    this._getSpaceManager = _getSpaceManager;
-  }
-  getContext(invitation) {
-    (0, import_node_assert7.default)(invitation.spaceKey);
-    const spaceManager = this._getSpaceManager();
-    const space = spaceManager.spaces.get(invitation.spaceKey);
-    (0, import_node_assert7.default)(space);
-    return space;
+  async accept(response) {
+    (0, import_node_assert7.default)(response.space);
+    const { credential, controlTimeframe, dataTimeframe } = response.space;
+    const assertion = (0, import_credentials9.getCredentialAssertion)(credential);
+    (0, import_node_assert7.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
+    (0, import_node_assert7.default)(credential.subject.id.equals(this._signingContext.identityKey));
+    await this._spaceManager.acceptSpace({
+      spaceKey: assertion.spaceKey,
+      genesisFeedKey: assertion.genesisFeedKey,
+      controlTimeframe,
+      dataTimeframe
+    });
+    await this._signingContext.recordCredential(credential);
+    return {
+      spaceKey: assertion.spaceKey
+    };
   }
 };
 
@@ -2055,47 +1909,47 @@ var NetworkServiceImpl = class {
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
 var import_node_assert9 = __toESM(require("node:assert"));
-var import_async11 = require("@dxos/async");
-var import_client4 = require("@dxos/client");
-var import_context7 = require("@dxos/context");
+var import_async10 = require("@dxos/async");
+var import_client3 = require("@dxos/client");
+var import_context6 = require("@dxos/context");
 var import_credentials11 = require("@dxos/credentials");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
-var import_keys10 = require("@dxos/keys");
+var import_keys9 = require("@dxos/keys");
 var import_log9 = require("@dxos/log");
 var import_teleport_extension_gossip = require("@dxos/teleport-extension-gossip");
 var import_util5 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-var import_async10 = require("@dxos/async");
-var import_client3 = require("@dxos/client");
-var import_context6 = require("@dxos/context");
+var import_async9 = require("@dxos/async");
+var import_client2 = require("@dxos/client");
+var import_context5 = require("@dxos/context");
 var import_debug3 = require("@dxos/debug");
 var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_errors = require("@dxos/errors");
-var import_keys9 = require("@dxos/keys");
+var import_keys8 = require("@dxos/keys");
 var import_log8 = require("@dxos/log");
 var import_credentials10 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util4 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
 var import_node_assert8 = __toESM(require("node:assert"));
-var import_async9 = require("@dxos/async");
-var import_context5 = require("@dxos/context");
-var import_keys8 = require("@dxos/keys");
+var import_async8 = require("@dxos/async");
+var import_context4 = require("@dxos/context");
+var import_keys7 = require("@dxos/keys");
 var import_log7 = require("@dxos/log");
-var import_protocols5 = require("@dxos/protocols");
-var import_teleport3 = require("@dxos/teleport");
+var import_protocols4 = require("@dxos/protocols");
+var import_teleport2 = require("@dxos/teleport");
 var import_util3 = require("@dxos/util");
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
 var NotarizationPlugin = class {
   constructor() {
-    this._ctx = new import_context5.Context();
-    this._extensionOpened = new import_async9.Event();
+    this._ctx = new import_context4.Context();
+    this._extensionOpened = new import_async8.Event();
     this._extensions = /* @__PURE__ */ new Set();
-    this._processedCredentials = new import_util3.ComplexSet(import_keys8.PublicKey.hash);
-    this._processCredentialsTriggers = new import_util3.ComplexMap(import_keys8.PublicKey.hash);
+    this._processedCredentials = new import_util3.ComplexSet(import_keys7.PublicKey.hash);
+    this._processCredentialsTriggers = new import_util3.ComplexMap(import_keys7.PublicKey.hash);
   }
   async open() {
   }
@@ -2115,7 +1969,7 @@ var NotarizationPlugin = class {
       callSite: (f, a) => f(...a)
     });
     (0, import_node_assert8.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
-    const errors = new import_async9.Trigger();
+    const errors = new import_async8.Trigger();
     const ctx = this._ctx.derive({
       onError: (err) => {
         import_log7.log.warn("Notarization error", {
@@ -2132,7 +1986,7 @@ var NotarizationPlugin = class {
     });
     opCtx == null ? void 0 : opCtx.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
-      (0, import_async9.scheduleTask)(ctx, () => {
+      (0, import_async8.scheduleTask)(ctx, () => {
         import_log7.log.warn("Notarization timeout", {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
@@ -2143,12 +1997,12 @@ var NotarizationPlugin = class {
           callSite: (f, a) => f(...a)
         });
         void ctx.dispose();
-        errors.throw(new import_async9.TimeoutError(timeout, "Notarization timed out"));
+        errors.throw(new import_async8.TimeoutError(timeout, "Notarization timed out"));
       }, timeout);
     }
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
     const peersTried = /* @__PURE__ */ new Set();
-    const notarizeTask = new import_async9.DeferredTask(ctx, async () => {
+    const notarizeTask = new import_async8.DeferredTask(ctx, async () => {
       try {
         if (this._extensions.size === 0) {
           return;
@@ -2166,7 +2020,7 @@ var NotarizationPlugin = class {
             callSite: (f, a) => f(...a)
           });
           peersTried.clear();
-          (0, import_async9.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
+          (0, import_async8.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
           return;
         }
         peersTried.add(peer);
@@ -2188,7 +2042,7 @@ var NotarizationPlugin = class {
           scope: this,
           callSite: (f, a) => f(...a)
         });
-        await (0, import_async9.sleep)(successDelay);
+        await (0, import_async8.sleep)(successDelay);
       } catch (err) {
         import_log7.log.warn("error notarizing (recoverable)", err, {
           file: "notarization-plugin.ts",
@@ -2203,7 +2057,7 @@ var NotarizationPlugin = class {
     this._extensionOpened.on(ctx, () => notarizeTask.schedule());
     try {
       await Promise.race([
-        (0, import_context5.rejectOnDispose)(ctx),
+        (0, import_context4.rejectOnDispose)(ctx),
         allNotarized,
         errors.wait()
       ]);
@@ -2237,7 +2091,7 @@ var NotarizationPlugin = class {
     if (this._processedCredentials.has(id)) {
       return;
     }
-    await (0, import_util3.entry)(this._processCredentialsTriggers, id).orInsert(new import_async9.Trigger()).value.wait();
+    await (0, import_util3.entry)(this._processCredentialsTriggers, id).orInsert(new import_async8.Trigger()).value.wait();
   }
   /**
   * Requests from other peers to notarize credentials.
@@ -2285,14 +2139,14 @@ var NotarizationPlugin = class {
     return extension;
   }
 };
-var NotarizationTeleportExtension = class extends import_teleport3.RpcExtension {
+var NotarizationTeleportExtension = class extends import_teleport2.RpcExtension {
   constructor(_params) {
     super({
       requested: {
-        NotarizationService: import_protocols5.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: import_protocols4.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
       },
       exposed: {
-        NotarizationService: import_protocols5.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: import_protocols4.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
       }
     });
     this._params = _params;
@@ -2330,9 +2184,9 @@ var __decorate = function(decorators, target, key, desc) {
 var AUTH_TIMEOUT2 = 3e4;
 var DataSpace = class DataSpace2 {
   constructor(params) {
-    this._ctx = new import_context6.Context();
-    this._state = import_client3.SpaceState.CLOSED;
-    this.stateUpdate = new import_async10.Event();
+    this._ctx = new import_context5.Context();
+    this._state = import_client2.SpaceState.CLOSED;
+    this.stateUpdate = new import_async9.Event();
     var _a;
     this._inner = params.inner;
     this._inner.stateUpdate.on(this._ctx, () => this.stateUpdate.emit());
@@ -2353,7 +2207,7 @@ var DataSpace = class DataSpace2 {
       snapshotId: params.snapshotId
     });
     this.authVerifier = new TrustedKeySetAuthVerifier({
-      trustedKeysProvider: () => new import_util4.ComplexSet(import_keys9.PublicKey.hash, Array.from(this._inner.spaceState.members.keys())),
+      trustedKeysProvider: () => new import_util4.ComplexSet(import_keys8.PublicKey.hash, Array.from(this._inner.spaceState.members.keys())),
       update: this._inner.stateUpdate,
       authTimeout: AUTH_TIMEOUT2
     });
@@ -2385,10 +2239,10 @@ var DataSpace = class DataSpace2 {
     await this.notarizationPlugin.open();
     await this._notarizationPluginConsumer.open();
     await this._inner.open();
-    this._state = import_client3.SpaceState.INACTIVE;
+    this._state = import_client2.SpaceState.INACTIVE;
   }
   async close() {
-    this._state = import_client3.SpaceState.CLOSED;
+    this._state = import_client2.SpaceState.CLOSED;
     await this._ctx.dispose();
     await this._dataPipeline.close();
     await this.authVerifier.close();
@@ -2407,7 +2261,7 @@ var DataSpace = class DataSpace2 {
   * Initialize the data pipeline in a separate task.
   */
   initializeDataPipelineAsync() {
-    (0, import_async10.scheduleTask)(this._ctx, async () => {
+    (0, import_async9.scheduleTask)(this._ctx, async () => {
       try {
         await this.initializeDataPipeline();
       } catch (err) {
@@ -2431,10 +2285,10 @@ var DataSpace = class DataSpace2 {
   }
   async initializeDataPipeline() {
     var _a, _b, _c, _d;
-    if (this._state !== import_client3.SpaceState.INACTIVE) {
+    if (this._state !== import_client2.SpaceState.INACTIVE) {
       throw new import_errors.SystemError("Invalid operation");
     }
-    this._state = import_client3.SpaceState.INITIALIZING;
+    this._state = import_client2.SpaceState.INITIALIZING;
     await this._inner.controlPipeline.state.waitUntilReachedTargetTimeframe({
       ctx: this._ctx,
       breakOnStall: false
@@ -2478,7 +2332,7 @@ var DataSpace = class DataSpace2 {
       callSite: (f, a) => f(...a)
     });
     await ((_b = (_a = this._callbacks).beforeReady) == null ? void 0 : _b.call(_a));
-    this._state = import_client3.SpaceState.READY;
+    this._state = import_client2.SpaceState.READY;
     this.stateUpdate.emit();
     await ((_d = (_c = this._callbacks).afterReady) == null ? void 0 : _d.call(_c));
   }
@@ -2530,7 +2384,7 @@ __decorate([
   (0, import_debug3.timed)(1e4)
 ], DataSpace.prototype, "_createWritableFeeds", null);
 DataSpace = __decorate([
-  (0, import_async10.trackLeaks)("open", "close")
+  (0, import_async9.trackLeaks)("open", "close")
 ], DataSpace);
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
@@ -2554,9 +2408,9 @@ var DataSpaceManager = class DataSpaceManager2 {
     this._modelFactory = _modelFactory;
     this._feedStore = _feedStore;
     this._snapshotStore = _snapshotStore;
-    this._ctx = new import_context7.Context();
-    this.updated = new import_async11.Event();
-    this._spaces = new import_util5.ComplexMap(import_keys10.PublicKey.hash);
+    this._ctx = new import_context6.Context();
+    this.updated = new import_async10.Event();
+    this._spaces = new import_util5.ComplexMap(import_keys9.PublicKey.hash);
     this._isOpen = false;
   }
   // TODO(burdon): Remove.
@@ -2669,9 +2523,9 @@ var DataSpaceManager = class DataSpaceManager2 {
   * TODO(dmaretskyi): Consider removing.
   */
   async waitUntilSpaceReady(spaceKey) {
-    await (0, import_context7.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
+    await (0, import_context6.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
-      return !!space && space.state === import_client4.SpaceState.READY;
+      return !!space && space.state === import_client3.SpaceState.READY;
     }));
   }
   async _constructSpace(metadata) {
@@ -2768,28 +2622,28 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
 };
 __decorate2([
-  import_async11.synchronized
+  import_async10.synchronized
 ], DataSpaceManager.prototype, "open", null);
 __decorate2([
-  import_async11.synchronized
+  import_async10.synchronized
 ], DataSpaceManager.prototype, "close", null);
 __decorate2([
-  import_async11.synchronized
+  import_async10.synchronized
 ], DataSpaceManager.prototype, "createSpace", null);
 __decorate2([
-  import_async11.synchronized
+  import_async10.synchronized
 ], DataSpaceManager.prototype, "acceptSpace", null);
 DataSpaceManager = __decorate2([
-  (0, import_async11.trackLeaks)("open", "close")
+  (0, import_async10.trackLeaks)("open", "close")
 ], DataSpaceManager);
 
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
-var import_async12 = require("@dxos/async");
+var import_async11 = require("@dxos/async");
 var import_codec_protobuf10 = require("@dxos/codec-protobuf");
 var import_debug4 = require("@dxos/debug");
 var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_log10 = require("@dxos/log");
-var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util6 = require("@dxos/util");
 var TIMEFRAME_UPDATE_DEBOUNCE_TIME = 500;
 var SpacesServiceImpl = class {
@@ -2827,9 +2681,9 @@ var SpacesServiceImpl = class {
           spaces
         });
       };
-      (0, import_async12.scheduleTask)(ctx, async () => {
+      (0, import_async11.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const subscriptions = new import_async12.EventSubscriptions();
+        const subscriptions = new import_async11.EventSubscriptions();
         ctx.onDispose(() => subscriptions.clear());
         const subscribeSpaces = () => {
           subscriptions.clear();
@@ -2864,7 +2718,7 @@ var SpacesServiceImpl = class {
   }
   subscribeMessages({ spaceKey, channel }) {
     return new import_codec_protobuf10.Stream(({ ctx, next }) => {
-      (0, import_async12.scheduleTask)(ctx, async () => {
+      (0, import_async11.scheduleTask)(ctx, async () => {
         var _a;
         const dataSpaceManager = await this._getDataSpaceManager();
         const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug4.raise)(new import_echo_pipeline3.SpaceNotFoundError(spaceKey));
@@ -2885,7 +2739,7 @@ var SpacesServiceImpl = class {
         }
       });
       ctx.onDispose(() => processor.close());
-      (0, import_async12.scheduleTask)(ctx, () => processor.open());
+      (0, import_async11.scheduleTask)(ctx, () => processor.open());
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
@@ -2900,18 +2754,22 @@ var SpacesServiceImpl = class {
     }
   }
   _transformSpace(space) {
-    var _a, _b;
+    var _a, _b, _c, _d, _e;
     return {
       spaceKey: space.key,
       state: space.state,
       pipeline: {
-        targetControlTimeframe: space.inner.controlPipeline.state.targetTimeframe,
+        controlFeeds: space.inner.controlPipeline.state.feeds.map((feed) => feed.key),
         currentControlTimeframe: space.inner.controlPipeline.state.timeframe,
-        currentDataTimeframe: (_a = space.dataPipeline.pipelineState) == null ? void 0 : _a.timeframe,
-        targetDataTimeframe: (_b = space.dataPipeline.pipelineState) == null ? void 0 : _b.targetTimeframe
+        targetControlTimeframe: space.inner.controlPipeline.state.targetTimeframe,
+        totalControlTimeframe: space.inner.controlPipeline.state.endTimeframe,
+        dataFeeds: (_b = (_a = space.dataPipeline.pipelineState) == null ? void 0 : _a.feeds.map((feed) => feed.key)) != null ? _b : [],
+        currentDataTimeframe: (_c = space.dataPipeline.pipelineState) == null ? void 0 : _c.timeframe,
+        targetDataTimeframe: (_d = space.dataPipeline.pipelineState) == null ? void 0 : _d.targetTimeframe,
+        totalDataTimeframe: (_e = space.dataPipeline.pipelineState) == null ? void 0 : _e.endTimeframe
       },
       members: Array.from(space.inner.spaceState.members.values()).map((member) => {
-        var _a2, _b2, _c;
+        var _a2, _b2, _c2;
         return {
           identity: {
             identityKey: member.key,
@@ -2919,7 +2777,7 @@ var SpacesServiceImpl = class {
               displayName: (_b2 = (_a2 = member.assertion.profile) == null ? void 0 : _a2.displayName) != null ? _b2 : (0, import_util6.humanize)(member.key)
             }
           },
-          presence: ((_c = this._identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services5.SpaceMember.PresenceState.ONLINE : import_services5.SpaceMember.PresenceState.OFFLINE
+          presence: ((_c2 = this._identityManager.identity) == null ? void 0 : _c2.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services6.SpaceMember.PresenceState.ONLINE : import_services6.SpaceMember.PresenceState.OFFLINE
         };
       })
     };
@@ -3011,10 +2869,10 @@ var SystemServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
-var import_async14 = require("@dxos/async");
+var import_async13 = require("@dxos/async");
 var import_log11 = require("@dxos/log");
 var import_messaging = require("@dxos/messaging");
-var import_network_manager3 = require("@dxos/network-manager");
+var import_network_manager2 = require("@dxos/network-manager");
 var import_util7 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/services/client-rpc-server.ts
@@ -3072,14 +2930,14 @@ var ClientRpcServer = class {
 
 // packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
 var import_node_assert10 = __toESM(require("node:assert"));
-var import_async13 = require("@dxos/async");
-var import_client5 = require("@dxos/client");
+var import_async12 = require("@dxos/async");
+var import_client4 = require("@dxos/client");
 var import_iframe = require("@dxos/protocols/proto/dxos/iframe");
 var import_rpc2 = require("@dxos/rpc");
 var ShellRuntimeImpl = class {
   constructor(_port) {
     this._port = _port;
-    this.layoutUpdate = new import_async13.Event();
+    this.layoutUpdate = new import_async12.Event();
     this._layout = import_iframe.ShellLayout.DEFAULT;
   }
   get layout() {
@@ -3106,8 +2964,8 @@ var ShellRuntimeImpl = class {
   }
   async open() {
     this._appRpc = (0, import_rpc2.createProtoRpcPeer)({
-      requested: import_client5.appServiceBundle,
-      exposed: import_client5.shellServiceBundle,
+      requested: import_client4.appServiceBundle,
+      exposed: import_client4.shellServiceBundle,
       handlers: {
         ShellService: {
           setLayout: async (request) => {
@@ -3143,8 +3001,8 @@ var __decorate3 = function(decorators, target, key, desc) {
 var LOCK_KEY = "DXOS_RESOURCE_LOCK";
 var IFrameHostRuntime = class {
   constructor({ configProvider, appPort, shellPort }) {
-    this._transportFactory = (0, import_network_manager3.createWebRTCTransportFactory)();
-    this._ready = new import_async14.Trigger();
+    this._transportFactory = (0, import_network_manager2.createWebRTCTransportFactory)();
+    this._ready = new import_async13.Trigger();
     this._configProvider = configProvider;
     this._appPort = appPort;
     this._shellPort = shellPort;
@@ -3172,7 +3030,7 @@ var IFrameHostRuntime = class {
       this._clientServices = new LocalClientServices({
         lockKey: LOCK_KEY,
         config: this._config,
-        networkManager: new import_network_manager3.NetworkManager({
+        networkManager: new import_network_manager2.NetworkManager({
           log: true,
           signalManager: signalServer ? new import_messaging.WebsocketSignalManager([
             signalServer
@@ -3251,12 +3109,12 @@ __decorate3([
 ], IFrameHostRuntime.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
-var import_client6 = require("@dxos/client");
-var import_network_manager4 = require("@dxos/network-manager");
+var import_client5 = require("@dxos/client");
+var import_network_manager3 = require("@dxos/network-manager");
 var import_rpc3 = require("@dxos/rpc");
 
 // packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
-var import_async15 = require("@dxos/async");
+var import_async14 = require("@dxos/async");
 var import_log12 = require("@dxos/log");
 var __decorate4 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3275,7 +3133,7 @@ var Message;
 var VaultResourceLock = class {
   constructor({ lockKey, onAcquire, onRelease }) {
     this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
-    this._releaseTrigger = new import_async15.Trigger();
+    this._releaseTrigger = new import_async14.Trigger();
     this._lockKey = lockKey;
     this._onAcquire = onAcquire;
     this._onRelease = onRelease;
@@ -3295,7 +3153,7 @@ var VaultResourceLock = class {
         scope: this,
         callSite: (f, a) => f(...a)
       });
-      await (0, import_async15.asyncTimeout)(this._requestLock(), 3e3);
+      await (0, import_async14.asyncTimeout)(this._requestLock(), 3e3);
       (0, import_log12.log)("acquired lock", {}, {
         file: "vault-resource-lock.ts",
         line: 46,
@@ -3335,14 +3193,14 @@ var VaultResourceLock = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const acquired = new import_async15.Trigger();
+    const acquired = new import_async14.Trigger();
     void navigator.locks.request(this._lockKey, {
       steal
     }, async () => {
       var _a, _b;
       await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
       acquired.wake();
-      this._releaseTrigger = new import_async15.Trigger();
+      this._releaseTrigger = new import_async14.Trigger();
       await this._releaseTrigger.wait();
       (0, import_log12.log)("releasing lock...", {}, {
         file: "vault-resource-lock.ts",
@@ -3377,15 +3235,15 @@ __decorate4([
 ], VaultResourceLock.prototype, "lockKey", null);
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
-var import_async17 = require("@dxos/async");
+var import_async16 = require("@dxos/async");
 var import_log14 = require("@dxos/log");
 var import_messaging2 = require("@dxos/messaging");
-var import_network_manager5 = require("@dxos/network-manager");
+var import_network_manager4 = require("@dxos/network-manager");
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
 var import_node_assert11 = __toESM(require("node:assert"));
-var import_async16 = require("@dxos/async");
-var import_client7 = require("@dxos/client");
+var import_async15 = require("@dxos/async");
+var import_client6 = require("@dxos/client");
 var import_log13 = require("@dxos/log");
 var import_rpc4 = require("@dxos/rpc");
 var import_util8 = require("@dxos/util");
@@ -3403,7 +3261,7 @@ var WorkerSession = class {
   constructor({ serviceHost, systemPort, appPort, shellPort, readySignal, options = {
     heartbeatInterval: 1e3
   } }) {
-    this._startTrigger = new import_async16.Trigger();
+    this._startTrigger = new import_async15.Trigger();
     this.onClose = new import_util8.Callback();
     (0, import_node_assert11.default)(options);
     (0, import_node_assert11.default)(serviceHost);
@@ -3440,8 +3298,8 @@ var WorkerSession = class {
       ...middleware
     });
     this._iframeRpc = (0, import_rpc4.createProtoRpcPeer)({
-      requested: import_client7.iframeServiceBundle,
-      exposed: import_client7.workerServiceBundle,
+      requested: import_client6.iframeServiceBundle,
+      exposed: import_client6.workerServiceBundle,
       handlers: {
         WorkerService: {
           start: async (request) => {
@@ -3537,7 +3395,7 @@ var WorkerSession = class {
   }
   async _maybeOpenShell() {
     try {
-      await (0, import_async16.asyncTimeout)(this._shellClientRpc.open(), 1e3);
+      await (0, import_async15.asyncTimeout)(this._shellClientRpc.open(), 1e3);
     } catch (e) {
       import_log13.log.info("No shell connected.", {}, {
         file: "worker-session.ts",
@@ -3553,24 +3411,27 @@ __decorate5([
 ], WorkerSession.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-var import_async18 = require("@dxos/async");
+var import_node_assert12 = __toESM(require("node:assert"));
+var import_async17 = require("@dxos/async");
+var import_client7 = require("@dxos/client");
 var import_credentials12 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
 var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_keyring = require("@dxos/keyring");
-var import_keys11 = require("@dxos/keys");
+var import_keys10 = require("@dxos/keys");
 var import_log15 = require("@dxos/log");
-var import_protocols6 = require("@dxos/protocols");
+var import_protocols5 = require("@dxos/protocols");
 var ServiceContext = class {
   // prettier-ignore
   constructor(storage, networkManager, modelFactory) {
     this.storage = storage;
     this.networkManager = networkManager;
     this.modelFactory = modelFactory;
-    this.initialized = new import_async18.Trigger();
+    this.initialized = new import_async17.Trigger();
     this.dataServiceSubscriptions = new import_echo_pipeline4.DataServiceSubscriptions();
-    this._instanceId = import_keys11.PublicKey.random().toHex();
+    this._handlerFactories = /* @__PURE__ */ new Map();
+    this._instanceId = import_keys10.PublicKey.random().toHex();
     this.metadataStore = new import_echo_pipeline4.MetadataStore(storage.createDirectory("metadata"));
     this.snapshotStore = new import_echo_pipeline4.SnapshotStore(storage.createDirectory("snapshots"));
     this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
@@ -3588,28 +3449,24 @@ var ServiceContext = class {
       networkManager: this.networkManager
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
-    this.deviceInvitations = new DeviceInvitationsHandler({
-      networkManager: this.networkManager,
-      getIdentity: () => {
-        var _a;
-        return (_a = this.identityManager.identity) != null ? _a : (0, import_debug6.failUndefined)();
-      },
-      acceptIdentity: this._acceptIdentity.bind(this),
-      keyring: this.keyring
-    });
+    this.invitations = new InvitationsHandler(this.networkManager);
+    this._handlerFactories.set(import_client7.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
+      var _a;
+      return (_a = this.identityManager.identity) != null ? _a : (0, import_debug6.failUndefined)();
+    }, this._acceptIdentity.bind(this)));
   }
   async open() {
-    import_log15.log.trace("dxos.sdk.client-services", import_protocols6.trace.begin({
+    import_log15.log.trace("dxos.sdk.client-services", import_protocols5.trace.begin({
       id: this._instanceId
     }), {
       file: "service-context.ts",
-      line: 98,
+      line: 111,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     (0, import_log15.log)("opening...", {}, {
       file: "service-context.ts",
-      line: 100,
+      line: 113,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3621,7 +3478,7 @@ var ServiceContext = class {
     }
     (0, import_log15.log)("opened", {}, {
       file: "service-context.ts",
-      line: 107,
+      line: 120,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3630,7 +3487,7 @@ var ServiceContext = class {
     var _a, _b;
     (0, import_log15.log)("closing...", {}, {
       file: "service-context.ts",
-      line: 111,
+      line: 124,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3643,15 +3500,15 @@ var ServiceContext = class {
     this.dataServiceSubscriptions.clear();
     (0, import_log15.log)("closed", {}, {
       file: "service-context.ts",
-      line: 119,
+      line: 132,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    import_log15.log.trace("dxos.sdk.client-services", import_protocols6.trace.end({
+    import_log15.log.trace("dxos.sdk.client-services", import_protocols5.trace.end({
       id: this._instanceId
     }), {
       file: "service-context.ts",
-      line: 121,
+      line: 134,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3659,7 +3516,7 @@ var ServiceContext = class {
   async reset() {
     (0, import_log15.log)("resetting...", {}, {
       file: "service-context.ts",
-      line: 125,
+      line: 138,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3667,7 +3524,7 @@ var ServiceContext = class {
     await this.storage.reset();
     (0, import_log15.log)("reset", {}, {
       file: "service-context.ts",
-      line: 128,
+      line: 141,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3677,6 +3534,11 @@ var ServiceContext = class {
     await this._initialize();
     return identity;
   }
+  getInvitationHandler(invitation) {
+    const factory = this._handlerFactories.get(invitation.kind);
+    (0, import_node_assert12.default)(factory, `Unknown invitation kind: ${invitation.kind}`);
+    return factory(invitation);
+  }
   async _acceptIdentity(params) {
     const identity = await this.identityManager.acceptIdentity(params);
     await this._initialize();
@@ -3687,7 +3549,7 @@ var ServiceContext = class {
     var _a;
     (0, import_log15.log)("initializing spaces...", {}, {
       file: "service-context.ts",
-      line: 147,
+      line: 166,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3707,7 +3569,10 @@ var ServiceContext = class {
     };
     this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.modelFactory, this.feedStore, this.snapshotStore);
     await this.dataSpaceManager.open();
-    this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.dataSpaceManager, signingContext, this.keyring);
+    this._handlerFactories.set(import_client7.Invitation.Kind.SPACE, (invitation) => {
+      (0, import_node_assert12.default)(this.dataSpaceManager, "dataSpaceManager not initialized yet");
+      return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
+    });
     this.initialized.wake();
     this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
       process: async (credential) => {
@@ -3723,7 +3588,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             file: "service-context.ts",
-            line: 190,
+            line: 207,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3734,7 +3599,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             file: "service-context.ts",
-            line: 194,
+            line: 211,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3745,7 +3610,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             file: "service-context.ts",
-            line: 199,
+            line: 216,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3756,7 +3621,7 @@ var ServiceContext = class {
         } catch (err) {
           import_log15.log.catch(err, {}, {
             file: "service-context.ts",
-            line: 205,
+            line: 222,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3802,7 +3667,7 @@ var ClientServicesHost = class {
     // TODO(wittjosiah): Turn this on by default.
     lockKey
   } = {}) {
-    this._statusUpdate = new import_async19.Event();
+    this._statusUpdate = new import_async18.Event();
     this._opening = false;
     this._open = false;
     this._instanceId = import_client8.PublicKey.random().toHex();
@@ -3824,17 +3689,17 @@ var ClientServicesHost = class {
     this._systemService = new SystemServiceImpl({
       config: this._config,
       statusUpdate: this._statusUpdate,
-      getCurrentStatus: () => this.isOpen ? import_services8.SystemStatus.ACTIVE : import_services8.SystemStatus.INACTIVE,
+      getCurrentStatus: () => this.isOpen ? import_services9.SystemStatus.ACTIVE : import_services9.SystemStatus.INACTIVE,
       onUpdateStatus: async (status) => {
         var _a, _b;
-        if (!this.isOpen && status === import_services8.SystemStatus.ACTIVE) {
+        if (!this.isOpen && status === import_services9.SystemStatus.ACTIVE) {
           await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
-        } else if (this.isOpen && status === import_services8.SystemStatus.INACTIVE) {
+        } else if (this.isOpen && status === import_services9.SystemStatus.INACTIVE) {
           await ((_b = this._resourceLock) == null ? void 0 : _b.release());
         }
       },
       onReset: async () => {
-        (0, import_node_assert12.default)(this._serviceContext, "service host is closed");
+        (0, import_node_assert13.default)(this._serviceContext, "service host is closed");
         await this._serviceContext.reset();
       }
     });
@@ -3860,16 +3725,16 @@ var ClientServicesHost = class {
   * Can only be called once.
   */
   initialize({ config, networkManager }) {
-    (0, import_node_assert12.default)(!this._open, "service host is open");
+    (0, import_node_assert13.default)(!this._open, "service host is open");
     if (config) {
-      (0, import_node_assert12.default)(!this._config, "config already set");
+      (0, import_node_assert13.default)(!this._config, "config already set");
       this._config = config;
       if (!this._storage) {
         this._storage = createStorageObjects(config.get("runtime.client.storage", {})).storage;
       }
     }
     if (networkManager) {
-      (0, import_node_assert12.default)(!this._networkManager, "network manager already set");
+      (0, import_node_assert13.default)(!this._networkManager, "network manager already set");
       this._networkManager = networkManager;
     }
   }
@@ -3878,23 +3743,23 @@ var ClientServicesHost = class {
     if (this._open) {
       return;
     }
-    import_log16.log.trace("dxos.sdk.client-services-host", import_protocols7.trace.begin({
+    import_log16.log.trace("dxos.sdk.client-services-host", import_protocols6.trace.begin({
       id: this._instanceId
     }), {
       file: "service-host.ts",
-      line: 168,
+      line: 167,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert12.default)(this._config, "config not set");
-    (0, import_node_assert12.default)(this._storage, "storage not set");
-    (0, import_node_assert12.default)(this._networkManager, "network manager not set");
+    (0, import_node_assert13.default)(this._config, "config not set");
+    (0, import_node_assert13.default)(this._storage, "storage not set");
+    (0, import_node_assert13.default)(this._networkManager, "network manager not set");
     this._opening = true;
     (0, import_log16.log)("opening...", {
       lockKey: (_a = this._resourceLock) == null ? void 0 : _a.lockKey
     }, {
       file: "service-host.ts",
-      line: 175,
+      line: 174,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3903,15 +3768,8 @@ var ClientServicesHost = class {
     this._serviceRegistry.setServices({
       SystemService: this._systemService,
       IdentityService: new IdentityServiceImpl(this._serviceContext),
+      InvitationsService: new InvitationsServiceImpl(this._serviceContext.invitations, (invitation) => this._serviceContext.getInvitationHandler(invitation)),
       DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
-      DeviceInvitationsService: new DeviceInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.deviceInvitations),
-      SpaceInvitationsService: new SpaceInvitationsServiceImpl(this._serviceContext.identityManager, () => {
-        var _a2;
-        return (_a2 = this._serviceContext.spaceInvitations) != null ? _a2 : (0, import_debug7.raise)(new Error("SpaceInvitations not initialized"));
-      }, () => {
-        var _a2;
-        return (_a2 = this._serviceContext.dataSpaceManager) != null ? _a2 : (0, import_debug7.raise)(new Error("SpaceManager not initialized"));
-      }),
       SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, this._serviceContext.dataServiceSubscriptions, async () => {
         await this._serviceContext.initialized.wait();
         return this._serviceContext.dataSpaceManager;
@@ -3935,7 +3793,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 229,
+      line: 221,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3950,7 +3808,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 238,
+      line: 230,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3964,15 +3822,15 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 243,
+      line: 235,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    import_log16.log.trace("dxos.sdk.client-services-host", import_protocols7.trace.end({
+    import_log16.log.trace("dxos.sdk.client-services-host", import_protocols6.trace.end({
       id: this._instanceId
     }), {
       file: "service-host.ts",
-      line: 245,
+      line: 237,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -4005,13 +3863,13 @@ var LocalClientServices = class {
 var import_config2 = require("@dxos/config");
 var import_log17 = require("@dxos/log");
 var import_messaging3 = require("@dxos/messaging");
-var import_network_manager6 = require("@dxos/network-manager");
+var import_network_manager5 = require("@dxos/network-manager");
 
 // packages/sdk/client-services/src/packlets/testing/host-test-builder.ts
 var createServiceHost = (config, signalManagerContext) => {
-  const networkManager = new import_network_manager7.NetworkManager({
+  const networkManager = new import_network_manager6.NetworkManager({
     signalManager: new import_messaging4.MemorySignalManager(signalManagerContext),
-    transportFactory: import_network_manager7.MemoryTransportFactory
+    transportFactory: import_network_manager6.MemoryTransportFactory
   });
   return new ClientServicesHost({
     config,
@@ -4021,9 +3879,9 @@ var createServiceHost = (config, signalManagerContext) => {
 var createServiceContext = ({ signalContext = new import_messaging4.MemorySignalManagerContext(), storage = (0, import_random_access_storage2.createStorage)({
   type: import_random_access_storage2.StorageType.RAM
 }) } = {}) => {
-  const networkManager = new import_network_manager7.NetworkManager({
+  const networkManager = new import_network_manager6.NetworkManager({
     signalManager: new import_messaging4.MemorySignalManager(signalContext),
-    transportFactory: import_network_manager7.MemoryTransportFactory
+    transportFactory: import_network_manager6.MemoryTransportFactory
   });
   const modelFactory = (0, import_client9.createDefaultModelFactory)();
   return new ServiceContext(storage, networkManager, modelFactory);
@@ -4091,9 +3949,9 @@ var TestPeer = class {
   }
   get networkManager() {
     var _a, _b;
-    return (_b = (_a = this._props).networkManager) != null ? _b : _a.networkManager = new import_network_manager7.NetworkManager({
+    return (_b = (_a = this._props).networkManager) != null ? _b : _a.networkManager = new import_network_manager6.NetworkManager({
       signalManager: new import_messaging4.MemorySignalManager(this.signalContext),
-      transportFactory: import_network_manager7.MemoryTransportFactory
+      transportFactory: import_network_manager6.MemoryTransportFactory
     });
   }
   get spaceManager() {
@@ -4120,60 +3978,193 @@ var createSigningContext = async (keyring) => {
 };
 
 // packages/sdk/client-services/src/packlets/testing/invitation-utils.ts
-var import_node_assert13 = __toESM(require("node:assert"));
-var import_async20 = require("@dxos/async");
-var import_debug8 = require("@dxos/debug");
-var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
-var performInvitation = async (host, guest, context) => {
-  const done1 = new import_async20.Trigger();
-  const done2 = new import_async20.Trigger();
-  const observable1 = await host.createInvitation(context, {
-    type: import_services10.Invitation.Type.INTERACTIVE_TESTING
+var import_node_assert14 = __toESM(require("node:assert"));
+var import_async19 = require("@dxos/async");
+var import_client10 = require("@dxos/client");
+var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
+var sanitizeInvitation = (invitation) => {
+  return {
+    invitationId: invitation.invitationId,
+    type: invitation.type,
+    kind: invitation.kind,
+    authMethod: invitation.authMethod,
+    swarmKey: invitation.swarmKey,
+    state: invitation.state,
+    timeout: invitation.timeout
+  };
+};
+var performInvitation = ({ host, guest, options, hooks }) => {
+  const hostComplete = new import_async19.Trigger();
+  const guestComplete = new import_async19.Trigger();
+  const authCode = new import_async19.Trigger();
+  const hostObservable = createInvitation(host, options);
+  hostObservable.subscribe(async (hostInvitation) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n;
+    switch (hostInvitation.state) {
+      case import_services11.Invitation.State.CONNECTING: {
+        if ((_b = (_a = hooks == null ? void 0 : hooks.host) == null ? void 0 : _a.onConnecting) == null ? void 0 : _b.call(_a, hostObservable)) {
+          break;
+        }
+        const guestObservable = acceptInvitation(guest, hostInvitation);
+        guestObservable.subscribe(async (guestInvitation) => {
+          var _a2, _b2, _c2, _d2, _e2, _f2, _g2, _h2, _i2, _j2, _k2, _l2, _m2, _n2;
+          switch (guestInvitation.state) {
+            case import_services11.Invitation.State.CONNECTING: {
+              if ((_b2 = (_a2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _a2.onConnecting) == null ? void 0 : _b2.call(_a2, guestObservable)) {
+                break;
+              }
+              (0, import_node_assert14.default)(hostInvitation.swarmKey.equals(guestInvitation.swarmKey));
+              break;
+            }
+            case import_services11.Invitation.State.CONNECTED: {
+              (_d2 = (_c2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _c2.onConnected) == null ? void 0 : _d2.call(_c2, guestObservable);
+              break;
+            }
+            case import_services11.Invitation.State.READY_FOR_AUTHENTICATION: {
+              if ((_f2 = (_e2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _e2.onReady) == null ? void 0 : _f2.call(_e2, guestObservable)) {
+                break;
+              }
+              await guestObservable.authenticate(await authCode.wait());
+              break;
+            }
+            case import_services11.Invitation.State.AUTHENTICATING: {
+              (_h2 = (_g2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _g2.onAuthenticating) == null ? void 0 : _h2.call(_g2, guestObservable);
+              break;
+            }
+            case import_services11.Invitation.State.SUCCESS: {
+              if ((_j2 = (_i2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _i2.onSuccess) == null ? void 0 : _j2.call(_i2, guestObservable)) {
+                break;
+              }
+              guestComplete.wake({
+                invitation: guestInvitation
+              });
+              break;
+            }
+            case import_services11.Invitation.State.CANCELLED: {
+              if ((_l2 = (_k2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _k2.onCancelled) == null ? void 0 : _l2.call(_k2, guestObservable)) {
+                break;
+              }
+              guestComplete.wake({
+                invitation: guestInvitation
+              });
+              break;
+            }
+            case import_services11.Invitation.State.TIMEOUT: {
+              if ((_n2 = (_m2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _m2.onTimeout) == null ? void 0 : _n2.call(_m2, guestObservable)) {
+                return;
+              }
+              guestComplete.wake({
+                invitation: guestInvitation
+              });
+            }
+          }
+        }, (error) => {
+          var _a2, _b2;
+          if ((_b2 = (_a2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _a2.onError) == null ? void 0 : _b2.call(_a2, guestObservable)) {
+            return;
+          }
+          guestComplete.wake({
+            error
+          });
+        });
+        break;
+      }
+      case import_services11.Invitation.State.CONNECTED: {
+        (_d = (_c = hooks == null ? void 0 : hooks.host) == null ? void 0 : _c.onConnected) == null ? void 0 : _d.call(_c, hostObservable);
+        break;
+      }
+      case import_services11.Invitation.State.READY_FOR_AUTHENTICATION: {
+        if ((_f = (_e = hooks == null ? void 0 : hooks.host) == null ? void 0 : _e.onReady) == null ? void 0 : _f.call(_e, hostObservable)) {
+          break;
+        }
+        if (hostInvitation.authCode) {
+          authCode.wake(hostInvitation.authCode);
+        }
+        break;
+      }
+      case import_services11.Invitation.State.AUTHENTICATING: {
+        (_h = (_g = hooks == null ? void 0 : hooks.host) == null ? void 0 : _g.onAuthenticating) == null ? void 0 : _h.call(_g, hostObservable);
+        break;
+      }
+      case import_services11.Invitation.State.SUCCESS: {
+        if ((_j = (_i = hooks == null ? void 0 : hooks.host) == null ? void 0 : _i.onSuccess) == null ? void 0 : _j.call(_i, hostObservable)) {
+          break;
+        }
+        hostComplete.wake({
+          invitation: hostInvitation
+        });
+        break;
+      }
+      case import_services11.Invitation.State.CANCELLED: {
+        if ((_l = (_k = hooks == null ? void 0 : hooks.host) == null ? void 0 : _k.onCancelled) == null ? void 0 : _l.call(_k, hostObservable)) {
+          break;
+        }
+        hostComplete.wake({
+          invitation: hostInvitation
+        });
+        break;
+      }
+      case import_services11.Invitation.State.TIMEOUT: {
+        if ((_n = (_m = hooks == null ? void 0 : hooks.host) == null ? void 0 : _m.onTimeout) == null ? void 0 : _n.call(_m, hostObservable)) {
+          break;
+        }
+        hostComplete.wake({
+          invitation: hostInvitation
+        });
+        break;
+      }
+    }
+  }, (error) => {
+    var _a, _b;
+    if ((_b = (_a = hooks == null ? void 0 : hooks.host) == null ? void 0 : _a.onError) == null ? void 0 : _b.call(_a, hostObservable)) {
+      return;
+    }
+    hostComplete.wake({
+      error
+    });
   });
-  observable1.subscribe({
-    onConnecting: async (invitation1) => {
-      const observable2 = await guest.acceptInvitation(invitation1, {
-        type: import_services10.Invitation.Type.INTERACTIVE_TESTING
-      });
-      observable2.subscribe({
-        onConnecting: async (invitation2) => {
-          (0, import_node_assert13.default)(invitation1.swarmKey.equals(invitation2.swarmKey));
-        },
-        onConnected: async (invitation2) => {
-        },
-        onSuccess: (invitation) => {
-          done2.wake(invitation);
-        },
-        onCancelled: () => (0, import_debug8.raise)(new Error()),
-        onTimeout: (err) => (0, import_debug8.raise)(err),
-        onError: (err) => (0, import_debug8.raise)(err)
-      });
-    },
-    onConnected: async (invitation1) => {
-    },
-    onCancelled: () => (0, import_debug8.raise)(new Error("cancelled")),
-    onSuccess: (invitation) => {
-      done1.wake(invitation);
-    },
-    onTimeout: (err) => (0, import_debug8.raise)(err),
-    onError: (err) => (0, import_debug8.raise)(err)
+  return [
+    hostComplete.wait(),
+    guestComplete.wait()
+  ];
+};
+var createInvitation = (host, options) => {
+  options != null ? options : options = {
+    authMethod: import_services11.Invitation.AuthMethod.NONE,
+    ...options != null ? options : {}
+  };
+  if (host instanceof import_client10.InvitationsProxy || host instanceof import_client10.HaloProxy || host instanceof import_client10.SpaceProxy) {
+    return host.createInvitation(options);
+  }
+  const hostHandler = host.getInvitationHandler({
+    kind: import_services11.Invitation.Kind.SPACE,
+    ...options
+  });
+  return host.invitations.createInvitation(hostHandler, options);
+};
+var acceptInvitation = (guest, invitation) => {
+  invitation = sanitizeInvitation(invitation);
+  if (guest instanceof import_client10.InvitationsProxy || guest instanceof import_client10.HaloProxy || guest instanceof import_client10.EchoProxy || guest instanceof import_client10.Client) {
+    return guest.acceptInvitation(invitation);
+  }
+  const guestHandler = guest.getInvitationHandler({
+    kind: invitation.kind
   });
-  await done1.wait();
-  await done2.wait();
+  return guest.invitations.acceptInvitation(guestHandler, invitation);
 };
 
 // packages/sdk/client-services/src/packlets/testing/test-builder.ts
-var import_node_assert14 = __toESM(require("node:assert"));
-var import_async21 = require("@dxos/async");
-var import_client10 = require("@dxos/client");
+var import_node_assert15 = __toESM(require("node:assert"));
+var import_async20 = require("@dxos/async");
+var import_client11 = require("@dxos/client");
 var import_config3 = require("@dxos/config");
-var import_debug9 = require("@dxos/debug");
+var import_debug7 = require("@dxos/debug");
 var import_document_model = require("@dxos/document-model");
 var import_echo_db = require("@dxos/echo-db");
-var import_keys12 = require("@dxos/keys");
+var import_keys11 = require("@dxos/keys");
 var import_log18 = require("@dxos/log");
 var import_messaging5 = require("@dxos/messaging");
-var import_network_manager8 = require("@dxos/network-manager");
+var import_network_manager7 = require("@dxos/network-manager");
 var import_rpc5 = require("@dxos/rpc");
 var testConfigWithLocalSignal = new import_config3.Config({
   version: 1,
@@ -4188,7 +4179,7 @@ var testConfigWithLocalSignal = new import_config3.Config({
 });
 var TestBuilder = class {
   // prettier-ignore
-  constructor(config, _modelFactory = (0, import_client10.createDefaultModelFactory)(), _signalManagerContext = new import_messaging5.MemorySignalManagerContext()) {
+  constructor(config, _modelFactory = (0, import_client11.createDefaultModelFactory)(), _signalManagerContext = new import_messaging5.MemorySignalManagerContext()) {
     this._modelFactory = _modelFactory;
     this._signalManagerContext = _signalManagerContext;
     this._config = config != null ? config : new import_config3.Config();
@@ -4202,20 +4193,20 @@ var TestBuilder = class {
   get networkManager() {
     const signalServer = this._config.get("runtime.services.signal.server");
     if (signalServer) {
-      return new import_network_manager8.NetworkManager({
+      return new import_network_manager7.NetworkManager({
         log: true,
         signalManager: new import_messaging5.WebsocketSignalManager([
           signalServer
         ]),
-        transportFactory: (0, import_network_manager8.createWebRTCTransportFactory)({
+        transportFactory: (0, import_network_manager7.createWebRTCTransportFactory)({
           iceServers: this._config.get("runtime.services.ice")
         })
       });
     }
-    return new import_network_manager8.NetworkManager({
+    return new import_network_manager7.NetworkManager({
       log: true,
       signalManager: new import_messaging5.MemorySignalManager(this._signalManagerContext),
-      transportFactory: import_network_manager8.MemoryTransportFactory
+      transportFactory: import_network_manager7.MemoryTransportFactory
     });
   }
   /**
@@ -4250,8 +4241,8 @@ var TestBuilder = class {
       handlers: host.services,
       port: hostPort
     });
-    const client = new import_client10.Client({
-      services: new import_client10.ClientServicesProxy(proxyPort)
+    const client = new import_client11.Client({
+      services: new import_client11.ClientServicesProxy(proxyPort)
     });
     return [
       client,
@@ -4260,11 +4251,11 @@ var TestBuilder = class {
   }
 };
 var testSpace = async (create, check = create) => {
-  const objectId = import_keys12.PublicKey.random().toHex();
+  const objectId = import_keys11.PublicKey.random().toHex();
   const result = create.mutate((0, import_echo_db.genesisMutation)(objectId, import_document_model.DocumentModel.meta.type));
   await result.batch.getReceipt();
-  (0, import_node_assert14.default)(create._itemManager.entities.has(result.objectsUpdated[0].id));
-  await (0, import_async21.asyncTimeout)(check.itemUpdate.waitForCondition(() => check._itemManager.entities.has(objectId)), 1e3);
+  (0, import_node_assert15.default)(create._itemManager.entities.has(result.objectsUpdated[0].id));
+  await (0, import_async20.asyncTimeout)(check.itemUpdate.waitForCondition(() => check._itemManager.entities.has(objectId)), 1e3);
   return result;
 };
 var syncItems = async (db1, db2) => {
@@ -4273,12 +4264,12 @@ var syncItems = async (db1, db2) => {
 };
 var joinCommonSpace = async ([initialPeer, ...peers], spaceKey) => {
   const rootSpace = spaceKey ? initialPeer.getSpace(spaceKey) : await initialPeer.createSpace();
-  (0, import_node_assert14.default)(rootSpace, "Space not found.");
+  (0, import_node_assert15.default)(rootSpace, "Space not found.");
   await Promise.all(peers.map(async (peer) => {
-    const hostDone = new import_async21.Trigger();
-    const guestDone = new import_async21.Trigger();
-    const hostObservabli = rootSpace.createInvitation({
-      type: import_client10.Invitation.Type.INTERACTIVE_TESTING
+    const hostDone = new import_async20.Trigger();
+    const guestDone = new import_async20.Trigger();
+    const hostObservable = rootSpace.createInvitation({
+      authMethod: import_client11.Invitation.AuthMethod.NONE
     });
     (0, import_log18.log)("invitation created", {}, {
       file: "test-builder.ts",
@@ -4286,39 +4277,43 @@ var joinCommonSpace = async ([initialPeer, ...peers], spaceKey) => {
       scope: void 0,
       callSite: (f, a) => f(...a)
     });
-    hostObservabli.subscribe({
-      onConnecting: (invitation) => {
-        const guestObservable = peer.acceptInvitation(invitation);
-        (0, import_log18.log)("invitation accepted", {}, {
-          file: "test-builder.ts",
-          line: 158,
-          scope: void 0,
-          callSite: (f, a) => f(...a)
-        });
-        guestObservable.subscribe({
-          onSuccess: (invitation2) => {
-            guestDone.wake(invitation2);
-            (0, import_log18.log)("invitation guestDone", {}, {
-              file: "test-builder.ts",
-              line: 163,
-              scope: void 0,
-              callSite: (f, a) => f(...a)
-            });
-          },
-          onError: (err) => (0, import_debug9.raise)(err)
-        });
-      },
-      onSuccess: (invitation) => {
-        hostDone.wake(invitation);
-        (0, import_log18.log)("invitation hostDone", {}, {
-          file: "test-builder.ts",
-          line: 170,
-          scope: void 0,
-          callSite: (f, a) => f(...a)
-        });
-      },
-      onError: (err) => (0, import_debug9.raise)(err)
-    });
+    hostObservable.subscribe((hostInvitation) => {
+      switch (hostInvitation.state) {
+        case import_client11.Invitation.State.CONNECTING: {
+          const guestObservable = peer.acceptInvitation(hostInvitation);
+          (0, import_log18.log)("invitation accepted", {}, {
+            file: "test-builder.ts",
+            line: 160,
+            scope: void 0,
+            callSite: (f, a) => f(...a)
+          });
+          guestObservable.subscribe((guestInvitation) => {
+            switch (guestInvitation.state) {
+              case import_client11.Invitation.State.SUCCESS: {
+                guestDone.wake(guestInvitation);
+                (0, import_log18.log)("invitation guestDone", {}, {
+                  file: "test-builder.ts",
+                  line: 167,
+                  scope: void 0,
+                  callSite: (f, a) => f(...a)
+                });
+                break;
+              }
+            }
+          }, (err) => (0, import_debug7.raise)(err));
+          break;
+        }
+        case import_client11.Invitation.State.SUCCESS: {
+          hostDone.wake(hostInvitation);
+          (0, import_log18.log)("invitation hostDone", {}, {
+            file: "test-builder.ts",
+            line: 179,
+            scope: void 0,
+            callSite: (f, a) => f(...a)
+          });
+        }
+      }
+    }, (err) => (0, import_debug7.raise)(err));
     await Promise.all([
       hostDone.wait(),
       guestDone.wait()
@@ -4339,6 +4334,7 @@ var joinCommonSpace = async ([initialPeer, ...peers], spaceKey) => {
   createSigningContext,
   joinCommonSpace,
   performInvitation,
+  sanitizeInvitation,
   syncItems,
   syncItemsLocal,
   testConfigWithLocalSignal,