@dxos/client-services 0.1.46-next.c3cc04c → 0.1.47

package/dist/lib/browser/{chunk-ZHDJQGXL.mjs → chunk-LGYQZ6UO.mjs}

@@ -825,6 +825,14 @@ var IdentityManager = class {
       swarmIdentity,
       onNetworkConnection: () => {
       },
+      onAuthFailure: () => {
+        log3.warn("auth failure", {}, {
+          file: "identity-manager.ts",
+          line: 242,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+      },
       memberKey: identityKey
     });
   }
@@ -954,8 +962,8 @@ import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log as log5 } from "@dxos/log";
 import { createTeleportProtocolFactory, StarTopology } from "@dxos/network-manager";
 import { trace as trace3 } from "@dxos/protocols";
-import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
-import { AuthenticationResponse } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
+import { AuthenticationResponse as AuthenticationResponse2 } from "@dxos/protocols/proto/dxos/halo/invitations";
 
 // packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts
 import assert5 from "@dxos/node-std/assert";
@@ -965,9 +973,11 @@ import { InvalidInvitationExtensionRoleError } from "@dxos/errors";
 import { PublicKey as PublicKey4 } from "@dxos/keys";
 import { log as log4 } from "@dxos/log";
 import { schema as schema2, trace as trace2 } from "@dxos/protocols";
-import { Options } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
+import { AuthenticationResponse, Options } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { RpcExtension } from "@dxos/teleport";
 var OPTIONS_TIMEOUT = 1e4;
+var MAX_OTP_ATTEMPTS = 3;
 var InvitationHostExtension = class extends RpcExtension {
   constructor(_callbacks) {
     super({
@@ -981,6 +991,11 @@ var InvitationHostExtension = class extends RpcExtension {
     this._callbacks = _callbacks;
     this._ctx = new Context3();
     this._remoteOptionsTrigger = new Trigger2();
+    this.invitation = void 0;
+    this.guestProfile = void 0;
+    this.authenticationPassed = false;
+    this.authenticationRetry = 0;
+    this.completedTrigger = new Trigger2();
   }
   async getHandlers() {
     return {
@@ -993,49 +1008,129 @@ var InvitationHostExtension = class extends RpcExtension {
           this._remoteOptionsTrigger.wake();
         },
         introduce: async (request) => {
+          const { profile, invitationId } = request;
           const traceId = PublicKey4.random().toHex();
           log4.trace("dxos.sdk.invitation-handler.host.introduce", trace2.begin({
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 76,
+            line: 98,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          const invitation = await this._callbacks.resolveInvitation(request);
+          if (!invitation) {
+            log4.warn("invitation not found", {
+              invitationId
+            }, {
+              file: "invitation-extension.ts",
+              line: 102,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            this._callbacks.onError(new Error("Invitation not found."));
+            return {
+              authMethod: Invitation2.AuthMethod.NONE
+            };
+          }
+          this.invitation = invitation;
+          log4("guest introduced itself", {
+            guestProfile: profile
+          }, {
+            file: "invitation-extension.ts",
+            line: 111,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          const response = await this._callbacks.introduce(request);
+          this.guestProfile = profile;
+          this._callbacks.onStateUpdate({
+            ...this.invitation,
+            state: Invitation2.State.READY_FOR_AUTHENTICATION
+          });
           log4.trace("dxos.sdk.invitation-handler.host.introduce", trace2.end({
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 78,
+            line: 118,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          return response;
+          return {
+            spaceKey: this.invitation.authMethod === Invitation2.AuthMethod.NONE ? this.invitation.spaceKey : void 0,
+            authMethod: this.invitation.authMethod
+          };
         },
-        authenticate: async (request) => {
+        authenticate: async ({ authCode: code }) => {
           const traceId = PublicKey4.random().toHex();
           log4.trace("dxos.sdk.invitation-handler.host.authenticate", trace2.begin({
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 84,
+            line: 127,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          log4("received authentication request", {
+            authCode: code
+          }, {
+            file: "invitation-extension.ts",
+            line: 128,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          const response = await this._callbacks.authenticate(request);
+          let status = AuthenticationResponse.Status.OK;
+          assert5(this.invitation, "Invitation is not set.");
+          switch (this.invitation.authMethod) {
+            case Invitation2.AuthMethod.NONE: {
+              log4("authentication not required", {}, {
+                file: "invitation-extension.ts",
+                line: 134,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              return {
+                status: AuthenticationResponse.Status.OK
+              };
+            }
+            case Invitation2.AuthMethod.SHARED_SECRET: {
+              if (this.invitation.authCode) {
+                if (this.authenticationRetry++ > MAX_OTP_ATTEMPTS) {
+                  status = AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
+                } else if (code !== this.invitation.authCode) {
+                  status = AuthenticationResponse.Status.INVALID_OTP;
+                } else {
+                  this.authenticationPassed = true;
+                }
+              }
+              break;
+            }
+            default: {
+              log4.error("invalid authentication method", {
+                authMethod: this.invitation.authMethod
+              }, {
+                file: "invitation-extension.ts",
+                line: 152,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              status = AuthenticationResponse.Status.INTERNAL_ERROR;
+              break;
+            }
+          }
           log4.trace("dxos.sdk.invitation-handler.host.authenticate", trace2.end({
             id: traceId,
             data: {
-              ...response
+              status
             }
           }), {
             file: "invitation-extension.ts",
-            line: 86,
+            line: 158,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          return response;
+          return {
+            status
+          };
         },
         admit: async (request) => {
           const traceId = PublicKey4.random().toHex();
@@ -1043,20 +1138,29 @@ var InvitationHostExtension = class extends RpcExtension {
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 92,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          const response = await this._callbacks.admit(request);
-          log4.trace("dxos.sdk.invitation-handler.host.admit", trace2.end({
-            id: traceId
-          }), {
-            file: "invitation-extension.ts",
-            line: 94,
+            line: 164,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          return response;
+          try {
+            assert5(this.invitation, "Invitation is not set.");
+            if (isAuthenticationRequired(this.invitation) && !this.authenticationPassed) {
+              throw new Error("Not authenticated");
+            }
+            const response = await this._callbacks.admit(request);
+            log4.trace("dxos.sdk.invitation-handler.host.admit", trace2.end({
+              id: traceId
+            }), {
+              file: "invitation-extension.ts",
+              line: 175,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            return response;
+          } catch (err) {
+            this._callbacks.onError(err);
+            throw err;
+          }
         }
       }
     };
@@ -1126,7 +1230,7 @@ var InvitationGuestExtension = class extends RpcExtension {
     try {
       log4("begin options", {}, {
         file: "invitation-extension.ts",
-        line: 178,
+        line: 263,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1138,7 +1242,7 @@ var InvitationGuestExtension = class extends RpcExtension {
       }));
       log4("end options", {}, {
         file: "invitation-extension.ts",
-        line: 181,
+        line: 266,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1152,7 +1256,7 @@ var InvitationGuestExtension = class extends RpcExtension {
     } catch (err) {
       log4("openError", err, {
         file: "invitation-extension.ts",
-        line: 191,
+        line: 276,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1162,16 +1266,16 @@ var InvitationGuestExtension = class extends RpcExtension {
   async onClose() {
     log4("onClose", {}, {
       file: "invitation-extension.ts",
-      line: 197,
+      line: 282,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._ctx.dispose();
   }
 };
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== Invitation2.AuthMethod.NONE;
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-var MAX_OTP_ATTEMPTS = 3;
 var InvitationsHandler = class {
   /**
   * @internal
@@ -1181,8 +1285,8 @@ var InvitationsHandler = class {
   }
   createInvitation(protocol, options) {
     var _a;
-    const { invitationId = PublicKey5.random().toHex(), type = Invitation2.Type.INTERACTIVE, authMethod = Invitation2.AuthMethod.SHARED_SECRET, state = Invitation2.State.INIT, timeout = INVITATION_TIMEOUT, swarmKey = PublicKey5.random() } = options != null ? options : {};
-    const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === Invitation2.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0;
+    const { invitationId = PublicKey5.random().toHex(), type = Invitation3.Type.INTERACTIVE, authMethod = Invitation3.AuthMethod.SHARED_SECRET, state = Invitation3.State.INIT, timeout = INVITATION_TIMEOUT, swarmKey = PublicKey5.random() } = options != null ? options : {};
+    const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === Invitation3.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0;
     assert6(protocol);
     const invitation = {
       invitationId,
@@ -1206,99 +1310,33 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         file: "invitations-handler.ts",
-        line: 98,
+        line: 100,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       stream.complete();
     });
     const createExtension = () => {
-      const success = new Trigger3();
-      let guestProfile;
-      let authenticationPassed = false;
-      let authenticationRetry = 0;
       const extension = new InvitationHostExtension({
-        introduce: async ({ profile }) => {
-          log5("guest introduced itself", {
-            guestProfile: profile,
-            ...protocol.toJSON()
-          }, {
-            file: "invitations-handler.ts",
-            line: 111,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          guestProfile = profile;
+        onStateUpdate: (invitation2) => {
           stream.next({
-            ...invitation,
-            state: Invitation2.State.READY_FOR_AUTHENTICATION
+            ...invitation2,
+            state: Invitation3.State.READY_FOR_AUTHENTICATION
           });
-          return {
-            spaceKey: authMethod === Invitation2.AuthMethod.NONE ? protocol.getInvitationContext().spaceKey : void 0,
-            authMethod
-          };
         },
-        authenticate: async ({ authCode: code }) => {
-          log5("received authentication request", {
-            authCode: code
-          }, {
-            file: "invitations-handler.ts",
-            line: 130,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          let status = AuthenticationResponse.Status.OK;
-          switch (invitation.authMethod) {
-            case Invitation2.AuthMethod.NONE: {
-              log5("authentication not required", {}, {
-                file: "invitations-handler.ts",
-                line: 135,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              return {
-                status: AuthenticationResponse.Status.OK
-              };
-            }
-            case Invitation2.AuthMethod.SHARED_SECRET: {
-              if (invitation.authCode) {
-                if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
-                  status = AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
-                } else if (code !== invitation.authCode) {
-                  status = AuthenticationResponse.Status.INVALID_OTP;
-                } else {
-                  authenticationPassed = true;
-                }
-              }
-              break;
-            }
-            default: {
-              log5.error("invalid authentication method", {
-                authMethod: invitation.authMethod
-              }, {
-                file: "invitations-handler.ts",
-                line: 153,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              status = AuthenticationResponse.Status.INTERNAL_ERROR;
-              break;
-            }
+        resolveInvitation: async ({ invitationId: invitationId2 }) => {
+          if (invitationId2 && invitationId2 !== invitation.invitationId) {
+            return void 0;
           }
-          return {
-            status
-          };
+          return invitation;
         },
         admit: async (admissionRequest) => {
           var _a2, _b, _c;
           try {
-            if (isAuthenticationRequired(invitation) && !authenticationPassed) {
-              throw new Error("Not authenticated");
-            }
             const deviceKey = (_c = (_a2 = admissionRequest.device) == null ? void 0 : _a2.deviceKey) != null ? _c : (_b = admissionRequest.space) == null ? void 0 : _b.deviceKey;
             assert6(deviceKey);
-            const admissionResponse = await protocol.admit(admissionRequest, guestProfile);
-            success.wake(deviceKey);
+            const admissionResponse = await protocol.admit(admissionRequest, extension.guestProfile);
+            extension.completedTrigger.wake(deviceKey);
             return admissionResponse;
           } catch (err) {
             stream.error(err);
@@ -1313,7 +1351,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 188,
+                line: 139,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1321,15 +1359,15 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 189,
+                line: 140,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               stream.next({
                 ...invitation,
-                state: Invitation2.State.CONNECTED
+                state: Invitation3.State.CONNECTED
               });
-              const deviceKey = await success.wait({
+              const deviceKey = await extension.completedTrigger.wait({
                 timeout
               });
               log5("admitted guest", {
@@ -1337,19 +1375,19 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 192,
+                line: 143,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               stream.next({
                 ...invitation,
-                state: Invitation2.State.SUCCESS
+                state: Invitation3.State.SUCCESS
               });
               log5.trace("dxos.sdk.invitations-handler.host.onOpen", trace3.end({
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 194,
+                line: 145,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1359,18 +1397,18 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   file: "invitations-handler.ts",
-                  line: 197,
+                  line: 148,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 stream.next({
                   ...invitation,
-                  state: Invitation2.State.TIMEOUT
+                  state: Invitation3.State.TIMEOUT
                 });
               } else {
                 log5.error("failed", err, {
                   file: "invitations-handler.ts",
-                  line: 200,
+                  line: 151,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1381,12 +1419,12 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 file: "invitations-handler.ts",
-                line: 203,
+                line: 154,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
             } finally {
-              if (type !== Invitation2.Type.MULTIUSE) {
+              if (type !== Invitation3.Type.MULTIUSE) {
                 await sleep(ON_CLOSE_DELAY);
                 await ctx.dispose();
               }
@@ -1402,18 +1440,18 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               file: "invitations-handler.ts",
-              line: 217,
+              line: 168,
               scope: this,
               callSite: (f, a) => f(...a)
             });
             stream.next({
               ...invitation,
-              state: Invitation2.State.TIMEOUT
+              state: Invitation3.State.TIMEOUT
             });
           } else {
             log5.error("failed", err, {
               file: "invitations-handler.ts",
-              line: 220,
+              line: 171,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -1436,7 +1474,7 @@ var InvitationsHandler = class {
       ctx.onDispose(() => swarmConnection.close());
       stream.next({
         ...invitation,
-        state: Invitation2.State.CONNECTING
+        state: Invitation3.State.CONNECTING
       });
     });
     const observable = new CancellableInvitationObservable({
@@ -1445,7 +1483,7 @@ var InvitationsHandler = class {
       onCancel: async () => {
         stream.next({
           ...invitation,
-          state: Invitation2.State.CANCELLED
+          state: Invitation3.State.CANCELLED
         });
         await ctx.dispose();
       }
@@ -1473,17 +1511,17 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             file: "invitations-handler.ts",
-            line: 274,
+            line: 225,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           setState({
-            state: Invitation2.State.TIMEOUT
+            state: Invitation3.State.TIMEOUT
           });
         } else {
           log5.warn("auth failed", err, {
             file: "invitations-handler.ts",
-            line: 277,
+            line: 228,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1497,7 +1535,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         file: "invitations-handler.ts",
-        line: 285,
+        line: 236,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1512,11 +1550,11 @@ var InvitationsHandler = class {
               currentState
             }, {
               file: "invitations-handler.ts",
-              line: 295,
+              line: 246,
               scope: this,
               callSite: (f, a) => f(...a)
             });
-            if (currentState !== Invitation2.State.SUCCESS) {
+            if (currentState !== Invitation3.State.SUCCESS) {
               stream.error(new Error("Remote peer disconnected."));
             }
           });
@@ -1527,7 +1565,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 304,
+                line: 255,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1539,18 +1577,18 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 312,
+                line: 263,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               setState({
-                state: Invitation2.State.CONNECTED
+                state: Invitation3.State.CONNECTED
               });
               log5("introduce", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 316,
+                line: 267,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1560,7 +1598,7 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 file: "invitations-handler.ts",
-                line: 320,
+                line: 271,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1572,32 +1610,32 @@ var InvitationsHandler = class {
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
                   log5("guest waiting for authentication code...", {}, {
                     file: "invitations-handler.ts",
-                    line: 329,
+                    line: 280,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
                   setState({
-                    state: Invitation2.State.READY_FOR_AUTHENTICATION
+                    state: Invitation3.State.READY_FOR_AUTHENTICATION
                   });
                   const authCode = await authenticated.wait({
                     timeout
                   });
                   log5("sending authentication request", {}, {
                     file: "invitations-handler.ts",
-                    line: 333,
+                    line: 284,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
                   setState({
-                    state: Invitation2.State.AUTHENTICATING
+                    state: Invitation3.State.AUTHENTICATING
                   });
                   const response = await extension.rpc.InvitationHostService.authenticate({
                     authCode
                   });
-                  if (response.status === void 0 || response.status === AuthenticationResponse.Status.OK) {
+                  if (response.status === void 0 || response.status === AuthenticationResponse2.Status.OK) {
                     break;
                   }
-                  if (response.status === AuthenticationResponse.Status.INVALID_OTP) {
+                  if (response.status === AuthenticationResponse2.Status.INVALID_OTP) {
                     if (attempt === MAX_OTP_ATTEMPTS) {
                       throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
                     } else {
@@ -1605,7 +1643,7 @@ var InvitationsHandler = class {
                         attempt
                       }, {
                         file: "invitations-handler.ts",
-                        line: 344,
+                        line: 295,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -1615,14 +1653,14 @@ var InvitationsHandler = class {
                 }
               } else {
                 setState({
-                  state: Invitation2.State.READY_FOR_AUTHENTICATION
+                  state: Invitation3.State.READY_FOR_AUTHENTICATION
                 });
               }
               log5("request admission", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 355,
+                line: 306,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1633,19 +1671,19 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 363,
+                line: 314,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               setState({
                 ...result,
-                state: Invitation2.State.SUCCESS
+                state: Invitation3.State.SUCCESS
               });
               log5.trace("dxos.sdk.invitations-handler.guest.onOpen", trace3.end({
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 365,
+                line: 316,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1655,17 +1693,17 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   file: "invitations-handler.ts",
-                  line: 368,
+                  line: 319,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 setState({
-                  state: Invitation2.State.TIMEOUT
+                  state: Invitation3.State.TIMEOUT
                 });
               } else {
                 log5("auth failed", err, {
                   file: "invitations-handler.ts",
-                  line: 371,
+                  line: 322,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1676,7 +1714,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 file: "invitations-handler.ts",
-                line: 374,
+                line: 325,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1694,17 +1732,17 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               file: "invitations-handler.ts",
-              line: 385,
+              line: 336,
               scope: this,
               callSite: (f, a) => f(...a)
             });
             setState({
-              state: Invitation2.State.TIMEOUT
+              state: Invitation3.State.TIMEOUT
             });
           } else {
             log5("auth failed", err, {
               file: "invitations-handler.ts",
-              line: 388,
+              line: 339,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -1727,7 +1765,7 @@ var InvitationsHandler = class {
       });
       ctx.onDispose(() => swarmConnection.close());
       setState({
-        state: Invitation2.State.CONNECTING
+        state: Invitation3.State.CONNECTING
       });
     });
     const observable = new AuthenticatingInvitationObservable({
@@ -1735,7 +1773,7 @@ var InvitationsHandler = class {
       subscriber: stream.observable,
       onCancel: async () => {
         setState({
-          state: Invitation2.State.CANCELLED
+          state: Invitation3.State.CANCELLED
         });
         await ctx.dispose();
       },
@@ -1746,7 +1784,6 @@ var InvitationsHandler = class {
     return observable;
   }
 };
-var isAuthenticationRequired = (invitation) => invitation.authMethod !== Invitation2.AuthMethod.NONE;
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
 import assert7 from "@dxos/node-std/assert";
@@ -1921,7 +1958,7 @@ import assert8 from "@dxos/node-std/assert";
 import { createAdmissionCredentials, getCredentialAssertion } from "@dxos/credentials";
 import { writeMessages as writeMessages2 } from "@dxos/feed-store";
 import { log as log7 } from "@dxos/log";
-import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
+import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -1937,7 +1974,7 @@ var SpaceInvitationProtocol = class {
   }
   getInvitationContext() {
     return {
-      kind: Invitation3.Kind.SPACE,
+      kind: Invitation4.Kind.SPACE,
       spaceKey: this._spaceKey
     };
   }
@@ -2785,6 +2822,14 @@ var DataSpaceManager = class DataSpaceManager2 {
         session.addExtension("dxos.mesh.teleport.objectsync", space.snapshotManager.objectSync.createExtension());
         session.addExtension("dxos.mesh.teleport.notarization", dataSpace.notarizationPlugin.createExtension());
       },
+      onAuthFailure: () => {
+        log10.warn("auth failure", {}, {
+          file: "data-space-manager.ts",
+          line: 212,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+      },
       memberKey: this._signingContext.identityKey
     });
     controlFeed && space.setControlFeed(controlFeed);
@@ -2803,7 +2848,7 @@ var DataSpaceManager = class DataSpaceManager2 {
             space: space.key
           }, {
             file: "data-space-manager.ts",
-            line: 226,
+            line: 229,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -2815,7 +2860,7 @@ var DataSpaceManager = class DataSpaceManager2 {
             open: this._isOpen
           }, {
             file: "data-space-manager.ts",
-            line: 233,
+            line: 236,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3861,8 +3906,8 @@ import { FeedFactory, FeedStore } from "@dxos/feed-store";
 import { Keyring } from "@dxos/keyring";
 import { PublicKey as PublicKey9 } from "@dxos/keys";
 import { log as log17 } from "@dxos/log";
-import { trace as trace5 } from "@dxos/protocols";
-import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
+import { STORAGE_VERSION, trace as trace5 } from "@dxos/protocols";
+import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
 var ServiceContext = class {
   // prettier-ignore
   constructor(storage, networkManager, signalManager, modelFactory) {
@@ -3895,7 +3940,7 @@ var ServiceContext = class {
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
     this.invitations = new InvitationsHandler(this.networkManager);
-    this._handlerFactories.set(Invitation4.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
+    this._handlerFactories.set(Invitation5.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
       var _a;
       return (_a = this.identityManager.identity) != null ? _a : failUndefined3();
     }, this._acceptIdentity.bind(this)));
@@ -3909,9 +3954,10 @@ var ServiceContext = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    await this._checkStorageVersion();
     log17("opening...", {}, {
       file: "service-context.ts",
-      line: 121,
+      line: 123,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3924,7 +3970,7 @@ var ServiceContext = class {
     }
     log17("opened", {}, {
       file: "service-context.ts",
-      line: 129,
+      line: 131,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3932,7 +3978,7 @@ var ServiceContext = class {
       id: this._instanceId
     }), {
       file: "service-context.ts",
-      line: 130,
+      line: 132,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3941,7 +3987,7 @@ var ServiceContext = class {
     var _a, _b;
     log17("closing...", {}, {
       file: "service-context.ts",
-      line: 134,
+      line: 136,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3955,7 +4001,7 @@ var ServiceContext = class {
     this.dataServiceSubscriptions.clear();
     log17("closed", {}, {
       file: "service-context.ts",
-      line: 143,
+      line: 145,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3975,12 +4021,27 @@ var ServiceContext = class {
     await this._initialize();
     return identity;
   }
+  async _checkStorageVersion() {
+    await this.metadataStore.load();
+    if (this.metadataStore.version !== STORAGE_VERSION) {
+      log17.error("Invalid storage version", {
+        current: this.metadataStore.version,
+        expected: STORAGE_VERSION
+      }, {
+        file: "service-context.ts",
+        line: 171,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      await this.metadataStore.clear();
+    }
+  }
   // Called when identity is created.
   async _initialize() {
     var _a;
     log17("initializing spaces...", {}, {
       file: "service-context.ts",
-      line: 168,
+      line: 179,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -4000,7 +4061,7 @@ var ServiceContext = class {
     };
     this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.feedStore);
     await this.dataSpaceManager.open();
-    this._handlerFactories.set(Invitation4.Kind.SPACE, (invitation) => {
+    this._handlerFactories.set(Invitation5.Kind.SPACE, (invitation) => {
       assert13(this.dataSpaceManager, "dataSpaceManager not initialized yet");
       return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
     });
@@ -4019,7 +4080,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             file: "service-context.ts",
-            line: 207,
+            line: 218,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -4030,7 +4091,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             file: "service-context.ts",
-            line: 211,
+            line: 222,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -4041,7 +4102,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             file: "service-context.ts",
-            line: 216,
+            line: 227,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -4052,7 +4113,7 @@ var ServiceContext = class {
         } catch (err) {
           log17.catch(err, {}, {
             file: "service-context.ts",
-            line: 222,
+            line: 233,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -4494,4 +4555,4 @@ export {
   ClientServicesHost,
   LocalClientServices
 };
-//# sourceMappingURL=chunk-ZHDJQGXL.mjs.map
+//# sourceMappingURL=chunk-LGYQZ6UO.mjs.map