@dxos/client-services 0.1.46 → 0.1.47

package/dist/lib/node/index.cjs

@@ -892,6 +892,14 @@ var IdentityManager = class {
       swarmIdentity,
       onNetworkConnection: () => {
       },
+      onAuthFailure: () => {
+        import_log3.log.warn("auth failure", {}, {
+          file: "identity-manager.ts",
+          line: 242,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+      },
       memberKey: identityKey
     });
   }
@@ -1021,7 +1029,7 @@ var import_keys6 = require("@dxos/keys");
 var import_log5 = require("@dxos/log");
 var import_network_manager = require("@dxos/network-manager");
 var import_protocols4 = require("@dxos/protocols");
-var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations");
 
 // packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts
@@ -1032,9 +1040,11 @@ var import_errors = require("@dxos/errors");
 var import_keys5 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
 var import_protocols3 = require("@dxos/protocols");
+var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport = require("@dxos/teleport");
 var OPTIONS_TIMEOUT = 1e4;
+var MAX_OTP_ATTEMPTS = 3;
 var InvitationHostExtension = class extends import_teleport.RpcExtension {
   constructor(_callbacks) {
     super({
@@ -1048,6 +1058,11 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
     this._callbacks = _callbacks;
     this._ctx = new import_context3.Context();
     this._remoteOptionsTrigger = new import_async7.Trigger();
+    this.invitation = void 0;
+    this.guestProfile = void 0;
+    this.authenticationPassed = false;
+    this.authenticationRetry = 0;
+    this.completedTrigger = new import_async7.Trigger();
   }
   async getHandlers() {
     return {
@@ -1060,49 +1075,129 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
           this._remoteOptionsTrigger.wake();
         },
         introduce: async (request) => {
+          const { profile, invitationId } = request;
           const traceId = import_keys5.PublicKey.random().toHex();
           import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.begin({
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 76,
+            line: 98,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          const response = await this._callbacks.introduce(request);
+          const invitation = await this._callbacks.resolveInvitation(request);
+          if (!invitation) {
+            import_log4.log.warn("invitation not found", {
+              invitationId
+            }, {
+              file: "invitation-extension.ts",
+              line: 102,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            this._callbacks.onError(new Error("Invitation not found."));
+            return {
+              authMethod: import_services2.Invitation.AuthMethod.NONE
+            };
+          }
+          this.invitation = invitation;
+          (0, import_log4.log)("guest introduced itself", {
+            guestProfile: profile
+          }, {
+            file: "invitation-extension.ts",
+            line: 111,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          this.guestProfile = profile;
+          this._callbacks.onStateUpdate({
+            ...this.invitation,
+            state: import_services2.Invitation.State.READY_FOR_AUTHENTICATION
+          });
           import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.end({
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 78,
+            line: 118,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          return response;
+          return {
+            spaceKey: this.invitation.authMethod === import_services2.Invitation.AuthMethod.NONE ? this.invitation.spaceKey : void 0,
+            authMethod: this.invitation.authMethod
+          };
         },
-        authenticate: async (request) => {
+        authenticate: async ({ authCode: code }) => {
           const traceId = import_keys5.PublicKey.random().toHex();
           import_log4.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols3.trace.begin({
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 84,
+            line: 127,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          const response = await this._callbacks.authenticate(request);
+          (0, import_log4.log)("received authentication request", {
+            authCode: code
+          }, {
+            file: "invitation-extension.ts",
+            line: 128,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          let status = import_invitations.AuthenticationResponse.Status.OK;
+          (0, import_node_assert5.default)(this.invitation, "Invitation is not set.");
+          switch (this.invitation.authMethod) {
+            case import_services2.Invitation.AuthMethod.NONE: {
+              (0, import_log4.log)("authentication not required", {}, {
+                file: "invitation-extension.ts",
+                line: 134,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              return {
+                status: import_invitations.AuthenticationResponse.Status.OK
+              };
+            }
+            case import_services2.Invitation.AuthMethod.SHARED_SECRET: {
+              if (this.invitation.authCode) {
+                if (this.authenticationRetry++ > MAX_OTP_ATTEMPTS) {
+                  status = import_invitations.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
+                } else if (code !== this.invitation.authCode) {
+                  status = import_invitations.AuthenticationResponse.Status.INVALID_OTP;
+                } else {
+                  this.authenticationPassed = true;
+                }
+              }
+              break;
+            }
+            default: {
+              import_log4.log.error("invalid authentication method", {
+                authMethod: this.invitation.authMethod
+              }, {
+                file: "invitation-extension.ts",
+                line: 152,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              status = import_invitations.AuthenticationResponse.Status.INTERNAL_ERROR;
+              break;
+            }
+          }
           import_log4.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols3.trace.end({
             id: traceId,
             data: {
-              ...response
+              status
             }
           }), {
             file: "invitation-extension.ts",
-            line: 86,
+            line: 158,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          return response;
+          return {
+            status
+          };
         },
         admit: async (request) => {
           const traceId = import_keys5.PublicKey.random().toHex();
@@ -1110,20 +1205,29 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 92,
+            line: 164,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          const response = await this._callbacks.admit(request);
-          import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.end({
-            id: traceId
-          }), {
-            file: "invitation-extension.ts",
-            line: 94,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          return response;
+          try {
+            (0, import_node_assert5.default)(this.invitation, "Invitation is not set.");
+            if (isAuthenticationRequired(this.invitation) && !this.authenticationPassed) {
+              throw new Error("Not authenticated");
+            }
+            const response = await this._callbacks.admit(request);
+            import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.end({
+              id: traceId
+            }), {
+              file: "invitation-extension.ts",
+              line: 175,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            return response;
+          } catch (err) {
+            this._callbacks.onError(err);
+            throw err;
+          }
         }
       }
     };
@@ -1193,7 +1297,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     try {
       (0, import_log4.log)("begin options", {}, {
         file: "invitation-extension.ts",
-        line: 178,
+        line: 263,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1205,7 +1309,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
       }));
       (0, import_log4.log)("end options", {}, {
         file: "invitation-extension.ts",
-        line: 181,
+        line: 266,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1219,7 +1323,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     } catch (err) {
       (0, import_log4.log)("openError", err, {
         file: "invitation-extension.ts",
-        line: 191,
+        line: 276,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1229,16 +1333,16 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
   async onClose() {
     (0, import_log4.log)("onClose", {}, {
       file: "invitation-extension.ts",
-      line: 197,
+      line: 282,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._ctx.dispose();
   }
 };
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_services2.Invitation.AuthMethod.NONE;
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-var MAX_OTP_ATTEMPTS = 3;
 var InvitationsHandler = class {
   /**
   * @internal
@@ -1248,8 +1352,8 @@ var InvitationsHandler = class {
   }
   createInvitation(protocol, options) {
     var _a;
-    const { invitationId = import_keys6.PublicKey.random().toHex(), type = import_services2.Invitation.Type.INTERACTIVE, authMethod = import_services2.Invitation.AuthMethod.SHARED_SECRET, state = import_services2.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys6.PublicKey.random() } = options != null ? options : {};
-    const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === import_services2.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials7.generatePasscode)(import_client_protocol2.AUTHENTICATION_CODE_LENGTH) : void 0;
+    const { invitationId = import_keys6.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys6.PublicKey.random() } = options != null ? options : {};
+    const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === import_services3.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials7.generatePasscode)(import_client_protocol2.AUTHENTICATION_CODE_LENGTH) : void 0;
     (0, import_node_assert6.default)(protocol);
     const invitation = {
       invitationId,
@@ -1273,99 +1377,33 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         file: "invitations-handler.ts",
-        line: 98,
+        line: 100,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       stream.complete();
     });
     const createExtension = () => {
-      const success = new import_async8.Trigger();
-      let guestProfile;
-      let authenticationPassed = false;
-      let authenticationRetry = 0;
       const extension = new InvitationHostExtension({
-        introduce: async ({ profile }) => {
-          (0, import_log5.log)("guest introduced itself", {
-            guestProfile: profile,
-            ...protocol.toJSON()
-          }, {
-            file: "invitations-handler.ts",
-            line: 111,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          guestProfile = profile;
+        onStateUpdate: (invitation2) => {
           stream.next({
-            ...invitation,
-            state: import_services2.Invitation.State.READY_FOR_AUTHENTICATION
+            ...invitation2,
+            state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
           });
-          return {
-            spaceKey: authMethod === import_services2.Invitation.AuthMethod.NONE ? protocol.getInvitationContext().spaceKey : void 0,
-            authMethod
-          };
         },
-        authenticate: async ({ authCode: code }) => {
-          (0, import_log5.log)("received authentication request", {
-            authCode: code
-          }, {
-            file: "invitations-handler.ts",
-            line: 130,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          let status = import_invitations2.AuthenticationResponse.Status.OK;
-          switch (invitation.authMethod) {
-            case import_services2.Invitation.AuthMethod.NONE: {
-              (0, import_log5.log)("authentication not required", {}, {
-                file: "invitations-handler.ts",
-                line: 135,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              return {
-                status: import_invitations2.AuthenticationResponse.Status.OK
-              };
-            }
-            case import_services2.Invitation.AuthMethod.SHARED_SECRET: {
-              if (invitation.authCode) {
-                if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
-                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
-                } else if (code !== invitation.authCode) {
-                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OTP;
-                } else {
-                  authenticationPassed = true;
-                }
-              }
-              break;
-            }
-            default: {
-              import_log5.log.error("invalid authentication method", {
-                authMethod: invitation.authMethod
-              }, {
-                file: "invitations-handler.ts",
-                line: 153,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              status = import_invitations2.AuthenticationResponse.Status.INTERNAL_ERROR;
-              break;
-            }
+        resolveInvitation: async ({ invitationId: invitationId2 }) => {
+          if (invitationId2 && invitationId2 !== invitation.invitationId) {
+            return void 0;
           }
-          return {
-            status
-          };
+          return invitation;
         },
         admit: async (admissionRequest) => {
           var _a2, _b, _c;
           try {
-            if (isAuthenticationRequired(invitation) && !authenticationPassed) {
-              throw new Error("Not authenticated");
-            }
             const deviceKey = (_c = (_a2 = admissionRequest.device) == null ? void 0 : _a2.deviceKey) != null ? _c : (_b = admissionRequest.space) == null ? void 0 : _b.deviceKey;
             (0, import_node_assert6.default)(deviceKey);
-            const admissionResponse = await protocol.admit(admissionRequest, guestProfile);
-            success.wake(deviceKey);
+            const admissionResponse = await protocol.admit(admissionRequest, extension.guestProfile);
+            extension.completedTrigger.wake(deviceKey);
             return admissionResponse;
           } catch (err) {
             stream.error(err);
@@ -1380,7 +1418,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 188,
+                line: 139,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1388,15 +1426,15 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 189,
+                line: 140,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               stream.next({
                 ...invitation,
-                state: import_services2.Invitation.State.CONNECTED
+                state: import_services3.Invitation.State.CONNECTED
               });
-              const deviceKey = await success.wait({
+              const deviceKey = await extension.completedTrigger.wait({
                 timeout
               });
               (0, import_log5.log)("admitted guest", {
@@ -1404,19 +1442,19 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 192,
+                line: 143,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               stream.next({
                 ...invitation,
-                state: import_services2.Invitation.State.SUCCESS
+                state: import_services3.Invitation.State.SUCCESS
               });
               import_log5.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 194,
+                line: 145,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1426,18 +1464,18 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   file: "invitations-handler.ts",
-                  line: 197,
+                  line: 148,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 stream.next({
                   ...invitation,
-                  state: import_services2.Invitation.State.TIMEOUT
+                  state: import_services3.Invitation.State.TIMEOUT
                 });
               } else {
                 import_log5.log.error("failed", err, {
                   file: "invitations-handler.ts",
-                  line: 200,
+                  line: 151,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1448,12 +1486,12 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 file: "invitations-handler.ts",
-                line: 203,
+                line: 154,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
             } finally {
-              if (type !== import_services2.Invitation.Type.MULTIUSE) {
+              if (type !== import_services3.Invitation.Type.MULTIUSE) {
                 await (0, import_async8.sleep)(import_client_protocol2.ON_CLOSE_DELAY);
                 await ctx.dispose();
               }
@@ -1469,18 +1507,18 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               file: "invitations-handler.ts",
-              line: 217,
+              line: 168,
               scope: this,
               callSite: (f, a) => f(...a)
             });
             stream.next({
               ...invitation,
-              state: import_services2.Invitation.State.TIMEOUT
+              state: import_services3.Invitation.State.TIMEOUT
             });
           } else {
             import_log5.log.error("failed", err, {
               file: "invitations-handler.ts",
-              line: 220,
+              line: 171,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -1503,7 +1541,7 @@ var InvitationsHandler = class {
       ctx.onDispose(() => swarmConnection.close());
       stream.next({
         ...invitation,
-        state: import_services2.Invitation.State.CONNECTING
+        state: import_services3.Invitation.State.CONNECTING
       });
     });
     const observable = new import_client_protocol2.CancellableInvitationObservable({
@@ -1512,7 +1550,7 @@ var InvitationsHandler = class {
       onCancel: async () => {
         stream.next({
           ...invitation,
-          state: import_services2.Invitation.State.CANCELLED
+          state: import_services3.Invitation.State.CANCELLED
         });
         await ctx.dispose();
       }
@@ -1540,17 +1578,17 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             file: "invitations-handler.ts",
-            line: 274,
+            line: 225,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           setState({
-            state: import_services2.Invitation.State.TIMEOUT
+            state: import_services3.Invitation.State.TIMEOUT
           });
         } else {
           import_log5.log.warn("auth failed", err, {
             file: "invitations-handler.ts",
-            line: 277,
+            line: 228,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1564,7 +1602,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         file: "invitations-handler.ts",
-        line: 285,
+        line: 236,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1579,11 +1617,11 @@ var InvitationsHandler = class {
               currentState
             }, {
               file: "invitations-handler.ts",
-              line: 295,
+              line: 246,
               scope: this,
               callSite: (f, a) => f(...a)
             });
-            if (currentState !== import_services2.Invitation.State.SUCCESS) {
+            if (currentState !== import_services3.Invitation.State.SUCCESS) {
               stream.error(new Error("Remote peer disconnected."));
             }
           });
@@ -1594,7 +1632,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 304,
+                line: 255,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1606,18 +1644,18 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 312,
+                line: 263,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               setState({
-                state: import_services2.Invitation.State.CONNECTED
+                state: import_services3.Invitation.State.CONNECTED
               });
               (0, import_log5.log)("introduce", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 316,
+                line: 267,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1627,7 +1665,7 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 file: "invitations-handler.ts",
-                line: 320,
+                line: 271,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1639,24 +1677,24 @@ var InvitationsHandler = class {
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
                   (0, import_log5.log)("guest waiting for authentication code...", {}, {
                     file: "invitations-handler.ts",
-                    line: 329,
+                    line: 280,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
                   setState({
-                    state: import_services2.Invitation.State.READY_FOR_AUTHENTICATION
+                    state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
                   });
                   const authCode = await authenticated.wait({
                     timeout
                   });
                   (0, import_log5.log)("sending authentication request", {}, {
                     file: "invitations-handler.ts",
-                    line: 333,
+                    line: 284,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
                   setState({
-                    state: import_services2.Invitation.State.AUTHENTICATING
+                    state: import_services3.Invitation.State.AUTHENTICATING
                   });
                   const response = await extension.rpc.InvitationHostService.authenticate({
                     authCode
@@ -1672,7 +1710,7 @@ var InvitationsHandler = class {
                         attempt
                       }, {
                         file: "invitations-handler.ts",
-                        line: 344,
+                        line: 295,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -1682,14 +1720,14 @@ var InvitationsHandler = class {
                 }
               } else {
                 setState({
-                  state: import_services2.Invitation.State.READY_FOR_AUTHENTICATION
+                  state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
                 });
               }
               (0, import_log5.log)("request admission", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 355,
+                line: 306,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1700,19 +1738,19 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 363,
+                line: 314,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               setState({
                 ...result,
-                state: import_services2.Invitation.State.SUCCESS
+                state: import_services3.Invitation.State.SUCCESS
               });
               import_log5.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 365,
+                line: 316,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1722,17 +1760,17 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   file: "invitations-handler.ts",
-                  line: 368,
+                  line: 319,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 setState({
-                  state: import_services2.Invitation.State.TIMEOUT
+                  state: import_services3.Invitation.State.TIMEOUT
                 });
               } else {
                 (0, import_log5.log)("auth failed", err, {
                   file: "invitations-handler.ts",
-                  line: 371,
+                  line: 322,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1743,7 +1781,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 file: "invitations-handler.ts",
-                line: 374,
+                line: 325,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1761,17 +1799,17 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               file: "invitations-handler.ts",
-              line: 385,
+              line: 336,
               scope: this,
               callSite: (f, a) => f(...a)
             });
             setState({
-              state: import_services2.Invitation.State.TIMEOUT
+              state: import_services3.Invitation.State.TIMEOUT
             });
           } else {
             (0, import_log5.log)("auth failed", err, {
               file: "invitations-handler.ts",
-              line: 388,
+              line: 339,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -1794,7 +1832,7 @@ var InvitationsHandler = class {
       });
       ctx.onDispose(() => swarmConnection.close());
       setState({
-        state: import_services2.Invitation.State.CONNECTING
+        state: import_services3.Invitation.State.CONNECTING
       });
     });
     const observable = new import_client_protocol2.AuthenticatingInvitationObservable({
@@ -1802,7 +1840,7 @@ var InvitationsHandler = class {
       subscriber: stream.observable,
       onCancel: async () => {
         setState({
-          state: import_services2.Invitation.State.CANCELLED
+          state: import_services3.Invitation.State.CANCELLED
         });
         await ctx.dispose();
       },
@@ -1813,14 +1851,13 @@ var InvitationsHandler = class {
     return observable;
   }
 };
-var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_services2.Invitation.AuthMethod.NONE;
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
 var import_node_assert7 = __toESM(require("node:assert"));
 var import_async9 = require("@dxos/async");
 var import_codec_protobuf7 = require("@dxos/codec-protobuf");
 var import_log6 = require("@dxos/log");
-var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
 var InvitationsServiceImpl = class {
   constructor(_invitationsHandler, _getHandler) {
     this._invitationsHandler = _invitationsHandler;
@@ -1935,8 +1972,8 @@ var InvitationsServiceImpl = class {
     return new import_codec_protobuf7.Stream(({ next, ctx }) => {
       this._invitationCreated.on(ctx, (invitation) => {
         next({
-          action: import_services3.QueryInvitationsResponse.Action.ADDED,
-          type: import_services3.QueryInvitationsResponse.Type.CREATED,
+          action: import_services4.QueryInvitationsResponse.Action.ADDED,
+          type: import_services4.QueryInvitationsResponse.Type.CREATED,
           invitations: [
             invitation
           ]
@@ -1944,8 +1981,8 @@ var InvitationsServiceImpl = class {
       });
       this._invitationAccepted.on(ctx, (invitation) => {
         next({
-          action: import_services3.QueryInvitationsResponse.Action.ADDED,
-          type: import_services3.QueryInvitationsResponse.Type.ACCEPTED,
+          action: import_services4.QueryInvitationsResponse.Action.ADDED,
+          type: import_services4.QueryInvitationsResponse.Type.ACCEPTED,
           invitations: [
             invitation
           ]
@@ -1953,8 +1990,8 @@ var InvitationsServiceImpl = class {
       });
       this._removedCreated.on(ctx, (invitation) => {
         next({
-          action: import_services3.QueryInvitationsResponse.Action.REMOVED,
-          type: import_services3.QueryInvitationsResponse.Type.CREATED,
+          action: import_services4.QueryInvitationsResponse.Action.REMOVED,
+          type: import_services4.QueryInvitationsResponse.Type.CREATED,
           invitations: [
             invitation
           ]
@@ -1962,21 +1999,21 @@ var InvitationsServiceImpl = class {
       });
       this._removedAccepted.on(ctx, (invitation) => {
         next({
-          action: import_services3.QueryInvitationsResponse.Action.REMOVED,
-          type: import_services3.QueryInvitationsResponse.Type.ACCEPTED,
+          action: import_services4.QueryInvitationsResponse.Action.REMOVED,
+          type: import_services4.QueryInvitationsResponse.Type.ACCEPTED,
           invitations: [
             invitation
           ]
         });
       });
       next({
-        action: import_services3.QueryInvitationsResponse.Action.ADDED,
-        type: import_services3.QueryInvitationsResponse.Type.CREATED,
+        action: import_services4.QueryInvitationsResponse.Action.ADDED,
+        type: import_services4.QueryInvitationsResponse.Type.CREATED,
         invitations: Array.from(this._createInvitations.values()).map((invitation) => invitation.get())
       });
       next({
-        action: import_services3.QueryInvitationsResponse.Action.ADDED,
-        type: import_services3.QueryInvitationsResponse.Type.ACCEPTED,
+        action: import_services4.QueryInvitationsResponse.Action.ADDED,
+        type: import_services4.QueryInvitationsResponse.Type.ACCEPTED,
         invitations: Array.from(this._acceptInvitations.values()).map((invitation) => invitation.get())
       });
     });
@@ -1988,7 +2025,7 @@ var import_node_assert8 = __toESM(require("node:assert"));
 var import_credentials8 = require("@dxos/credentials");
 var import_feed_store3 = require("@dxos/feed-store");
 var import_log7 = require("@dxos/log");
-var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -2004,7 +2041,7 @@ var SpaceInvitationProtocol = class {
   }
   getInvitationContext() {
     return {
-      kind: import_services4.Invitation.Kind.SPACE,
+      kind: import_services5.Invitation.Kind.SPACE,
       spaceKey: this._spaceKey
     };
   }
@@ -2083,12 +2120,12 @@ var import_log19 = require("@dxos/log");
 var import_messaging3 = require("@dxos/messaging");
 var import_network_manager5 = require("@dxos/network-manager");
 var import_protocols9 = require("@dxos/protocols");
-var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
 
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
 var import_async10 = require("@dxos/async");
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
-var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
     this._identityManager = _identityManager;
@@ -2111,7 +2148,7 @@ var DevicesServiceImpl = class {
               var _a2;
               return {
                 deviceKey: key,
-                kind: ((_a2 = this._identityManager.identity) == null ? void 0 : _a2.deviceKey.equals(key)) ? import_services5.DeviceKind.CURRENT : import_services5.DeviceKind.TRUSTED
+                kind: ((_a2 = this._identityManager.identity) == null ? void 0 : _a2.deviceKey.equals(key)) ? import_services6.DeviceKind.CURRENT : import_services6.DeviceKind.TRUSTED
               };
             })
           });
@@ -2235,7 +2272,7 @@ var import_credentials12 = require("@dxos/credentials");
 var import_keys9 = require("@dxos/keys");
 var import_log11 = require("@dxos/log");
 var import_protocols6 = require("@dxos/protocols");
-var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_gossip = require("@dxos/teleport-extension-gossip");
 var import_util5 = require("@dxos/util");
 
@@ -2248,7 +2285,7 @@ var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_errors3 = require("@dxos/errors");
 var import_keys8 = require("@dxos/keys");
 var import_log10 = require("@dxos/log");
-var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
 var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util4 = require("@dxos/util");
 
@@ -2505,7 +2542,7 @@ var __decorate = function(decorators, target, key, desc) {
 var DataSpace = class DataSpace2 {
   constructor(params) {
     this._ctx = new import_context6.Context();
-    this._state = import_services6.SpaceState.CLOSED;
+    this._state = import_services7.SpaceState.CLOSED;
     /**
     * Error for _state === SpaceState.ERROR.
     */
@@ -2559,11 +2596,11 @@ var DataSpace = class DataSpace2 {
     await this.notarizationPlugin.open();
     await this._notarizationPluginConsumer.open();
     await this._inner.open();
-    this._state = import_services6.SpaceState.INACTIVE;
+    this._state = import_services7.SpaceState.INACTIVE;
     this.metrics.open = new Date();
   }
   async close() {
-    this._state = import_services6.SpaceState.CLOSED;
+    this._state = import_services7.SpaceState.CLOSED;
     await this._ctx.dispose();
     await this.authVerifier.close();
     await this._inner.close();
@@ -2601,7 +2638,7 @@ var DataSpace = class DataSpace2 {
           scope: this,
           callSite: (f, a) => f(...a)
         });
-        this._state = import_services6.SpaceState.ERROR;
+        this._state = import_services7.SpaceState.ERROR;
         this.error = err;
         this.stateUpdate.emit();
       } finally {
@@ -2611,10 +2648,10 @@ var DataSpace = class DataSpace2 {
   }
   async initializeDataPipeline() {
     var _a, _b, _c, _d;
-    if (this._state !== import_services6.SpaceState.INACTIVE) {
+    if (this._state !== import_services7.SpaceState.INACTIVE) {
       throw new import_errors3.SystemError("Invalid operation");
     }
-    this._state = import_services6.SpaceState.INITIALIZING;
+    this._state = import_services7.SpaceState.INITIALIZING;
     await this._inner.controlPipeline.state.waitUntilReachedTargetTimeframe({
       ctx: this._ctx,
       breakOnStall: false
@@ -2654,7 +2691,7 @@ var DataSpace = class DataSpace2 {
       callSite: (f, a) => f(...a)
     });
     await ((_b = (_a = this._callbacks).beforeReady) == null ? void 0 : _b.call(_a));
-    this._state = import_services6.SpaceState.READY;
+    this._state = import_services7.SpaceState.READY;
     this.stateUpdate.emit();
     await ((_d = (_c = this._callbacks).afterReady) == null ? void 0 : _d.call(_c));
   }
@@ -2965,7 +3002,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   async waitUntilSpaceReady(spaceKey) {
     await (0, import_context7.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
-      return !!space && space.state === import_services7.SpaceState.READY;
+      return !!space && space.state === import_services8.SpaceState.READY;
     }));
   }
   async _constructSpace(metadata) {
@@ -3006,6 +3043,14 @@ var DataSpaceManager = class DataSpaceManager2 {
         session.addExtension("dxos.mesh.teleport.objectsync", space.snapshotManager.objectSync.createExtension());
         session.addExtension("dxos.mesh.teleport.notarization", dataSpace.notarizationPlugin.createExtension());
       },
+      onAuthFailure: () => {
+        import_log11.log.warn("auth failure", {}, {
+          file: "data-space-manager.ts",
+          line: 212,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+      },
       memberKey: this._signingContext.identityKey
     });
     controlFeed && space.setControlFeed(controlFeed);
@@ -3024,7 +3069,7 @@ var DataSpaceManager = class DataSpaceManager2 {
             space: space.key
           }, {
             file: "data-space-manager.ts",
-            line: 226,
+            line: 229,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3036,7 +3081,7 @@ var DataSpaceManager = class DataSpaceManager2 {
             open: this._isOpen
           }, {
             file: "data-space-manager.ts",
-            line: 233,
+            line: 236,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3081,7 +3126,7 @@ var import_debug5 = require("@dxos/debug");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
 var import_log12 = require("@dxos/log");
 var import_protocols7 = require("@dxos/protocols");
-var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util6 = require("@dxos/util");
 var TIMEFRAME_UPDATE_DEBOUNCE_TIME = 500;
 var SpacesServiceImpl = class {
@@ -3222,7 +3267,7 @@ var SpacesServiceImpl = class {
               displayName: (_b2 = (_a2 = member.assertion.profile) == null ? void 0 : _a2.displayName) != null ? _b2 : (0, import_util6.humanize)(member.key)
             }
           },
-          presence: ((_c2 = this._identityManager.identity) == null ? void 0 : _c2.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services8.SpaceMember.PresenceState.ONLINE : import_services8.SpaceMember.PresenceState.OFFLINE
+          presence: ((_c2 = this._identityManager.identity) == null ? void 0 : _c2.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services9.SpaceMember.PresenceState.ONLINE : import_services9.SpaceMember.PresenceState.OFFLINE
         };
       }),
       cache: space.cache,
@@ -4046,7 +4091,7 @@ var import_keyring = require("@dxos/keyring");
 var import_keys10 = require("@dxos/keys");
 var import_log18 = require("@dxos/log");
 var import_protocols8 = require("@dxos/protocols");
-var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
 var ServiceContext = class {
   // prettier-ignore
   constructor(storage, networkManager, signalManager, modelFactory) {
@@ -4079,7 +4124,7 @@ var ServiceContext = class {
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
     this.invitations = new InvitationsHandler(this.networkManager);
-    this._handlerFactories.set(import_services11.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
+    this._handlerFactories.set(import_services12.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
       var _a;
       return (_a = this.identityManager.identity) != null ? _a : (0, import_debug7.failUndefined)();
     }, this._acceptIdentity.bind(this)));
@@ -4200,7 +4245,7 @@ var ServiceContext = class {
     };
     this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.feedStore);
     await this.dataSpaceManager.open();
-    this._handlerFactories.set(import_services11.Invitation.Kind.SPACE, (invitation) => {
+    this._handlerFactories.set(import_services12.Invitation.Kind.SPACE, (invitation) => {
       (0, import_node_assert13.default)(this.dataSpaceManager, "dataSpaceManager not initialized yet");
       return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
     });
@@ -4324,12 +4369,12 @@ var ClientServicesHost = class {
     this._systemService = new SystemServiceImpl({
       config: this._config,
       statusUpdate: this._statusUpdate,
-      getCurrentStatus: () => this.isOpen ? import_services12.SystemStatus.ACTIVE : import_services12.SystemStatus.INACTIVE,
+      getCurrentStatus: () => this.isOpen ? import_services13.SystemStatus.ACTIVE : import_services13.SystemStatus.INACTIVE,
       onUpdateStatus: async (status) => {
         var _a, _b;
-        if (!this.isOpen && status === import_services12.SystemStatus.ACTIVE) {
+        if (!this.isOpen && status === import_services13.SystemStatus.ACTIVE) {
           await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
-        } else if (this.isOpen && status === import_services12.SystemStatus.INACTIVE) {
+        } else if (this.isOpen && status === import_services13.SystemStatus.INACTIVE) {
           await ((_b = this._resourceLock) == null ? void 0 : _b.release());
         }
       },