@dxos/client-services 0.1.46 → 0.1.47

package/dist/lib/node/packlets/testing/index.cjs

@@ -63,7 +63,7 @@ var createMockCredential = async ({ signer, issuer }) => (0, import_credentials.
 // packages/sdk/client-services/src/packlets/testing/invitation-utils.ts
 var import_node_assert15 = __toESM(require("node:assert"));
 var import_async24 = require("@dxos/async");
-var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services14 = require("@dxos/protocols/proto/dxos/client/services");
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
 var import_node_assert14 = __toESM(require("node:assert"));
@@ -75,7 +75,7 @@ var import_log19 = require("@dxos/log");
 var import_messaging3 = require("@dxos/messaging");
 var import_network_manager5 = require("@dxos/network-manager");
 var import_protocols9 = require("@dxos/protocols");
-var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
 
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
 var import_async = require("@dxos/async");
@@ -916,6 +916,14 @@ var IdentityManager = class {
       swarmIdentity,
       onNetworkConnection: () => {
       },
+      onAuthFailure: () => {
+        import_log3.log.warn("auth failure", {}, {
+          file: "identity-manager.ts",
+          line: 242,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+      },
       memberKey: identityKey
     });
   }
@@ -1045,7 +1053,7 @@ var import_keys7 = require("@dxos/keys");
 var import_log5 = require("@dxos/log");
 var import_network_manager = require("@dxos/network-manager");
 var import_protocols4 = require("@dxos/protocols");
-var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations");
 
 // packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts
@@ -1056,9 +1064,11 @@ var import_errors = require("@dxos/errors");
 var import_keys6 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
 var import_protocols3 = require("@dxos/protocols");
+var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport = require("@dxos/teleport");
 var OPTIONS_TIMEOUT = 1e4;
+var MAX_OTP_ATTEMPTS = 3;
 var InvitationHostExtension = class extends import_teleport.RpcExtension {
   constructor(_callbacks) {
     super({
@@ -1072,6 +1082,11 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
     this._callbacks = _callbacks;
     this._ctx = new import_context3.Context();
     this._remoteOptionsTrigger = new import_async8.Trigger();
+    this.invitation = void 0;
+    this.guestProfile = void 0;
+    this.authenticationPassed = false;
+    this.authenticationRetry = 0;
+    this.completedTrigger = new import_async8.Trigger();
   }
   async getHandlers() {
     return {
@@ -1084,49 +1099,129 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
           this._remoteOptionsTrigger.wake();
         },
         introduce: async (request) => {
+          const { profile, invitationId } = request;
           const traceId = import_keys6.PublicKey.random().toHex();
           import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.begin({
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 76,
+            line: 98,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          const response = await this._callbacks.introduce(request);
+          const invitation = await this._callbacks.resolveInvitation(request);
+          if (!invitation) {
+            import_log4.log.warn("invitation not found", {
+              invitationId
+            }, {
+              file: "invitation-extension.ts",
+              line: 102,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            this._callbacks.onError(new Error("Invitation not found."));
+            return {
+              authMethod: import_services3.Invitation.AuthMethod.NONE
+            };
+          }
+          this.invitation = invitation;
+          (0, import_log4.log)("guest introduced itself", {
+            guestProfile: profile
+          }, {
+            file: "invitation-extension.ts",
+            line: 111,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          this.guestProfile = profile;
+          this._callbacks.onStateUpdate({
+            ...this.invitation,
+            state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
+          });
           import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.end({
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 78,
+            line: 118,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          return response;
+          return {
+            spaceKey: this.invitation.authMethod === import_services3.Invitation.AuthMethod.NONE ? this.invitation.spaceKey : void 0,
+            authMethod: this.invitation.authMethod
+          };
         },
-        authenticate: async (request) => {
+        authenticate: async ({ authCode: code }) => {
           const traceId = import_keys6.PublicKey.random().toHex();
           import_log4.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols3.trace.begin({
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 84,
+            line: 127,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          const response = await this._callbacks.authenticate(request);
+          (0, import_log4.log)("received authentication request", {
+            authCode: code
+          }, {
+            file: "invitation-extension.ts",
+            line: 128,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          let status = import_invitations.AuthenticationResponse.Status.OK;
+          (0, import_node_assert5.default)(this.invitation, "Invitation is not set.");
+          switch (this.invitation.authMethod) {
+            case import_services3.Invitation.AuthMethod.NONE: {
+              (0, import_log4.log)("authentication not required", {}, {
+                file: "invitation-extension.ts",
+                line: 134,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              return {
+                status: import_invitations.AuthenticationResponse.Status.OK
+              };
+            }
+            case import_services3.Invitation.AuthMethod.SHARED_SECRET: {
+              if (this.invitation.authCode) {
+                if (this.authenticationRetry++ > MAX_OTP_ATTEMPTS) {
+                  status = import_invitations.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
+                } else if (code !== this.invitation.authCode) {
+                  status = import_invitations.AuthenticationResponse.Status.INVALID_OTP;
+                } else {
+                  this.authenticationPassed = true;
+                }
+              }
+              break;
+            }
+            default: {
+              import_log4.log.error("invalid authentication method", {
+                authMethod: this.invitation.authMethod
+              }, {
+                file: "invitation-extension.ts",
+                line: 152,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              status = import_invitations.AuthenticationResponse.Status.INTERNAL_ERROR;
+              break;
+            }
+          }
           import_log4.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols3.trace.end({
             id: traceId,
             data: {
-              ...response
+              status
             }
           }), {
             file: "invitation-extension.ts",
-            line: 86,
+            line: 158,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          return response;
+          return {
+            status
+          };
         },
         admit: async (request) => {
           const traceId = import_keys6.PublicKey.random().toHex();
@@ -1134,20 +1229,29 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             id: traceId
           }), {
             file: "invitation-extension.ts",
-            line: 92,
+            line: 164,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          const response = await this._callbacks.admit(request);
-          import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.end({
-            id: traceId
-          }), {
-            file: "invitation-extension.ts",
-            line: 94,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          return response;
+          try {
+            (0, import_node_assert5.default)(this.invitation, "Invitation is not set.");
+            if (isAuthenticationRequired(this.invitation) && !this.authenticationPassed) {
+              throw new Error("Not authenticated");
+            }
+            const response = await this._callbacks.admit(request);
+            import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.end({
+              id: traceId
+            }), {
+              file: "invitation-extension.ts",
+              line: 175,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            return response;
+          } catch (err) {
+            this._callbacks.onError(err);
+            throw err;
+          }
         }
       }
     };
@@ -1217,7 +1321,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     try {
       (0, import_log4.log)("begin options", {}, {
         file: "invitation-extension.ts",
-        line: 178,
+        line: 263,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1229,7 +1333,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
       }));
       (0, import_log4.log)("end options", {}, {
         file: "invitation-extension.ts",
-        line: 181,
+        line: 266,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1243,7 +1347,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     } catch (err) {
       (0, import_log4.log)("openError", err, {
         file: "invitation-extension.ts",
-        line: 191,
+        line: 276,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1253,16 +1357,16 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
   async onClose() {
     (0, import_log4.log)("onClose", {}, {
       file: "invitation-extension.ts",
-      line: 197,
+      line: 282,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._ctx.dispose();
   }
 };
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_services3.Invitation.AuthMethod.NONE;
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-var MAX_OTP_ATTEMPTS = 3;
 var InvitationsHandler = class {
   /**
   * @internal
@@ -1272,8 +1376,8 @@ var InvitationsHandler = class {
   }
   createInvitation(protocol, options) {
     var _a;
-    const { invitationId = import_keys7.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys7.PublicKey.random() } = options != null ? options : {};
-    const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === import_services3.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials8.generatePasscode)(import_client_protocol2.AUTHENTICATION_CODE_LENGTH) : void 0;
+    const { invitationId = import_keys7.PublicKey.random().toHex(), type = import_services4.Invitation.Type.INTERACTIVE, authMethod = import_services4.Invitation.AuthMethod.SHARED_SECRET, state = import_services4.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys7.PublicKey.random() } = options != null ? options : {};
+    const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === import_services4.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials8.generatePasscode)(import_client_protocol2.AUTHENTICATION_CODE_LENGTH) : void 0;
     (0, import_node_assert6.default)(protocol);
     const invitation = {
       invitationId,
@@ -1297,99 +1401,33 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         file: "invitations-handler.ts",
-        line: 98,
+        line: 100,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       stream.complete();
     });
     const createExtension = () => {
-      const success = new import_async9.Trigger();
-      let guestProfile;
-      let authenticationPassed = false;
-      let authenticationRetry = 0;
       const extension = new InvitationHostExtension({
-        introduce: async ({ profile }) => {
-          (0, import_log5.log)("guest introduced itself", {
-            guestProfile: profile,
-            ...protocol.toJSON()
-          }, {
-            file: "invitations-handler.ts",
-            line: 111,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          guestProfile = profile;
+        onStateUpdate: (invitation2) => {
           stream.next({
-            ...invitation,
-            state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
+            ...invitation2,
+            state: import_services4.Invitation.State.READY_FOR_AUTHENTICATION
           });
-          return {
-            spaceKey: authMethod === import_services3.Invitation.AuthMethod.NONE ? protocol.getInvitationContext().spaceKey : void 0,
-            authMethod
-          };
         },
-        authenticate: async ({ authCode: code }) => {
-          (0, import_log5.log)("received authentication request", {
-            authCode: code
-          }, {
-            file: "invitations-handler.ts",
-            line: 130,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          let status = import_invitations2.AuthenticationResponse.Status.OK;
-          switch (invitation.authMethod) {
-            case import_services3.Invitation.AuthMethod.NONE: {
-              (0, import_log5.log)("authentication not required", {}, {
-                file: "invitations-handler.ts",
-                line: 135,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              return {
-                status: import_invitations2.AuthenticationResponse.Status.OK
-              };
-            }
-            case import_services3.Invitation.AuthMethod.SHARED_SECRET: {
-              if (invitation.authCode) {
-                if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
-                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
-                } else if (code !== invitation.authCode) {
-                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OTP;
-                } else {
-                  authenticationPassed = true;
-                }
-              }
-              break;
-            }
-            default: {
-              import_log5.log.error("invalid authentication method", {
-                authMethod: invitation.authMethod
-              }, {
-                file: "invitations-handler.ts",
-                line: 153,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              status = import_invitations2.AuthenticationResponse.Status.INTERNAL_ERROR;
-              break;
-            }
+        resolveInvitation: async ({ invitationId: invitationId2 }) => {
+          if (invitationId2 && invitationId2 !== invitation.invitationId) {
+            return void 0;
           }
-          return {
-            status
-          };
+          return invitation;
         },
         admit: async (admissionRequest) => {
           var _a2, _b, _c;
           try {
-            if (isAuthenticationRequired(invitation) && !authenticationPassed) {
-              throw new Error("Not authenticated");
-            }
             const deviceKey = (_c = (_a2 = admissionRequest.device) == null ? void 0 : _a2.deviceKey) != null ? _c : (_b = admissionRequest.space) == null ? void 0 : _b.deviceKey;
             (0, import_node_assert6.default)(deviceKey);
-            const admissionResponse = await protocol.admit(admissionRequest, guestProfile);
-            success.wake(deviceKey);
+            const admissionResponse = await protocol.admit(admissionRequest, extension.guestProfile);
+            extension.completedTrigger.wake(deviceKey);
             return admissionResponse;
           } catch (err) {
             stream.error(err);
@@ -1404,7 +1442,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 188,
+                line: 139,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1412,15 +1450,15 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 189,
+                line: 140,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               stream.next({
                 ...invitation,
-                state: import_services3.Invitation.State.CONNECTED
+                state: import_services4.Invitation.State.CONNECTED
               });
-              const deviceKey = await success.wait({
+              const deviceKey = await extension.completedTrigger.wait({
                 timeout
               });
               (0, import_log5.log)("admitted guest", {
@@ -1428,19 +1466,19 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 192,
+                line: 143,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               stream.next({
                 ...invitation,
-                state: import_services3.Invitation.State.SUCCESS
+                state: import_services4.Invitation.State.SUCCESS
               });
               import_log5.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 194,
+                line: 145,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1450,18 +1488,18 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   file: "invitations-handler.ts",
-                  line: 197,
+                  line: 148,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 stream.next({
                   ...invitation,
-                  state: import_services3.Invitation.State.TIMEOUT
+                  state: import_services4.Invitation.State.TIMEOUT
                 });
               } else {
                 import_log5.log.error("failed", err, {
                   file: "invitations-handler.ts",
-                  line: 200,
+                  line: 151,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1472,12 +1510,12 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 file: "invitations-handler.ts",
-                line: 203,
+                line: 154,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
             } finally {
-              if (type !== import_services3.Invitation.Type.MULTIUSE) {
+              if (type !== import_services4.Invitation.Type.MULTIUSE) {
                 await (0, import_async9.sleep)(import_client_protocol2.ON_CLOSE_DELAY);
                 await ctx.dispose();
               }
@@ -1493,18 +1531,18 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               file: "invitations-handler.ts",
-              line: 217,
+              line: 168,
               scope: this,
               callSite: (f, a) => f(...a)
             });
             stream.next({
               ...invitation,
-              state: import_services3.Invitation.State.TIMEOUT
+              state: import_services4.Invitation.State.TIMEOUT
             });
           } else {
             import_log5.log.error("failed", err, {
               file: "invitations-handler.ts",
-              line: 220,
+              line: 171,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -1527,7 +1565,7 @@ var InvitationsHandler = class {
       ctx.onDispose(() => swarmConnection.close());
       stream.next({
         ...invitation,
-        state: import_services3.Invitation.State.CONNECTING
+        state: import_services4.Invitation.State.CONNECTING
       });
     });
     const observable = new import_client_protocol2.CancellableInvitationObservable({
@@ -1536,7 +1574,7 @@ var InvitationsHandler = class {
       onCancel: async () => {
         stream.next({
           ...invitation,
-          state: import_services3.Invitation.State.CANCELLED
+          state: import_services4.Invitation.State.CANCELLED
         });
         await ctx.dispose();
       }
@@ -1564,17 +1602,17 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             file: "invitations-handler.ts",
-            line: 274,
+            line: 225,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           setState({
-            state: import_services3.Invitation.State.TIMEOUT
+            state: import_services4.Invitation.State.TIMEOUT
           });
         } else {
           import_log5.log.warn("auth failed", err, {
             file: "invitations-handler.ts",
-            line: 277,
+            line: 228,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1588,7 +1626,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         file: "invitations-handler.ts",
-        line: 285,
+        line: 236,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1603,11 +1641,11 @@ var InvitationsHandler = class {
               currentState
             }, {
               file: "invitations-handler.ts",
-              line: 295,
+              line: 246,
               scope: this,
               callSite: (f, a) => f(...a)
             });
-            if (currentState !== import_services3.Invitation.State.SUCCESS) {
+            if (currentState !== import_services4.Invitation.State.SUCCESS) {
               stream.error(new Error("Remote peer disconnected."));
             }
           });
@@ -1618,7 +1656,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 304,
+                line: 255,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1630,18 +1668,18 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 312,
+                line: 263,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               setState({
-                state: import_services3.Invitation.State.CONNECTED
+                state: import_services4.Invitation.State.CONNECTED
               });
               (0, import_log5.log)("introduce", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 316,
+                line: 267,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1651,7 +1689,7 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 file: "invitations-handler.ts",
-                line: 320,
+                line: 271,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1663,24 +1701,24 @@ var InvitationsHandler = class {
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
                   (0, import_log5.log)("guest waiting for authentication code...", {}, {
                     file: "invitations-handler.ts",
-                    line: 329,
+                    line: 280,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
                   setState({
-                    state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
+                    state: import_services4.Invitation.State.READY_FOR_AUTHENTICATION
                   });
                   const authCode = await authenticated.wait({
                     timeout
                   });
                   (0, import_log5.log)("sending authentication request", {}, {
                     file: "invitations-handler.ts",
-                    line: 333,
+                    line: 284,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
                   setState({
-                    state: import_services3.Invitation.State.AUTHENTICATING
+                    state: import_services4.Invitation.State.AUTHENTICATING
                   });
                   const response = await extension.rpc.InvitationHostService.authenticate({
                     authCode
@@ -1696,7 +1734,7 @@ var InvitationsHandler = class {
                         attempt
                       }, {
                         file: "invitations-handler.ts",
-                        line: 344,
+                        line: 295,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -1706,14 +1744,14 @@ var InvitationsHandler = class {
                 }
               } else {
                 setState({
-                  state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
+                  state: import_services4.Invitation.State.READY_FOR_AUTHENTICATION
                 });
               }
               (0, import_log5.log)("request admission", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 355,
+                line: 306,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1724,19 +1762,19 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 363,
+                line: 314,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               setState({
                 ...result,
-                state: import_services3.Invitation.State.SUCCESS
+                state: import_services4.Invitation.State.SUCCESS
               });
               import_log5.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 365,
+                line: 316,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1746,17 +1784,17 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   file: "invitations-handler.ts",
-                  line: 368,
+                  line: 319,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 setState({
-                  state: import_services3.Invitation.State.TIMEOUT
+                  state: import_services4.Invitation.State.TIMEOUT
                 });
               } else {
                 (0, import_log5.log)("auth failed", err, {
                   file: "invitations-handler.ts",
-                  line: 371,
+                  line: 322,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1767,7 +1805,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 file: "invitations-handler.ts",
-                line: 374,
+                line: 325,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1785,17 +1823,17 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               file: "invitations-handler.ts",
-              line: 385,
+              line: 336,
               scope: this,
               callSite: (f, a) => f(...a)
             });
             setState({
-              state: import_services3.Invitation.State.TIMEOUT
+              state: import_services4.Invitation.State.TIMEOUT
             });
           } else {
             (0, import_log5.log)("auth failed", err, {
               file: "invitations-handler.ts",
-              line: 388,
+              line: 339,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -1818,7 +1856,7 @@ var InvitationsHandler = class {
       });
       ctx.onDispose(() => swarmConnection.close());
       setState({
-        state: import_services3.Invitation.State.CONNECTING
+        state: import_services4.Invitation.State.CONNECTING
       });
     });
     const observable = new import_client_protocol2.AuthenticatingInvitationObservable({
@@ -1826,7 +1864,7 @@ var InvitationsHandler = class {
       subscriber: stream.observable,
       onCancel: async () => {
         setState({
-          state: import_services3.Invitation.State.CANCELLED
+          state: import_services4.Invitation.State.CANCELLED
         });
         await ctx.dispose();
       },
@@ -1837,14 +1875,13 @@ var InvitationsHandler = class {
     return observable;
   }
 };
-var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_services3.Invitation.AuthMethod.NONE;
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
 var import_node_assert7 = __toESM(require("node:assert"));
 var import_async10 = require("@dxos/async");
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
 var import_log6 = require("@dxos/log");
-var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
 var InvitationsServiceImpl = class {
   constructor(_invitationsHandler, _getHandler) {
     this._invitationsHandler = _invitationsHandler;
@@ -1959,8 +1996,8 @@ var InvitationsServiceImpl = class {
     return new import_codec_protobuf8.Stream(({ next, ctx }) => {
       this._invitationCreated.on(ctx, (invitation) => {
         next({
-          action: import_services4.QueryInvitationsResponse.Action.ADDED,
-          type: import_services4.QueryInvitationsResponse.Type.CREATED,
+          action: import_services5.QueryInvitationsResponse.Action.ADDED,
+          type: import_services5.QueryInvitationsResponse.Type.CREATED,
           invitations: [
             invitation
           ]
@@ -1968,8 +2005,8 @@ var InvitationsServiceImpl = class {
       });
       this._invitationAccepted.on(ctx, (invitation) => {
         next({
-          action: import_services4.QueryInvitationsResponse.Action.ADDED,
-          type: import_services4.QueryInvitationsResponse.Type.ACCEPTED,
+          action: import_services5.QueryInvitationsResponse.Action.ADDED,
+          type: import_services5.QueryInvitationsResponse.Type.ACCEPTED,
           invitations: [
             invitation
           ]
@@ -1977,8 +2014,8 @@ var InvitationsServiceImpl = class {
       });
       this._removedCreated.on(ctx, (invitation) => {
         next({
-          action: import_services4.QueryInvitationsResponse.Action.REMOVED,
-          type: import_services4.QueryInvitationsResponse.Type.CREATED,
+          action: import_services5.QueryInvitationsResponse.Action.REMOVED,
+          type: import_services5.QueryInvitationsResponse.Type.CREATED,
           invitations: [
             invitation
           ]
@@ -1986,21 +2023,21 @@ var InvitationsServiceImpl = class {
       });
       this._removedAccepted.on(ctx, (invitation) => {
         next({
-          action: import_services4.QueryInvitationsResponse.Action.REMOVED,
-          type: import_services4.QueryInvitationsResponse.Type.ACCEPTED,
+          action: import_services5.QueryInvitationsResponse.Action.REMOVED,
+          type: import_services5.QueryInvitationsResponse.Type.ACCEPTED,
           invitations: [
             invitation
           ]
         });
       });
       next({
-        action: import_services4.QueryInvitationsResponse.Action.ADDED,
-        type: import_services4.QueryInvitationsResponse.Type.CREATED,
+        action: import_services5.QueryInvitationsResponse.Action.ADDED,
+        type: import_services5.QueryInvitationsResponse.Type.CREATED,
         invitations: Array.from(this._createInvitations.values()).map((invitation) => invitation.get())
       });
       next({
-        action: import_services4.QueryInvitationsResponse.Action.ADDED,
-        type: import_services4.QueryInvitationsResponse.Type.ACCEPTED,
+        action: import_services5.QueryInvitationsResponse.Action.ADDED,
+        type: import_services5.QueryInvitationsResponse.Type.ACCEPTED,
         invitations: Array.from(this._acceptInvitations.values()).map((invitation) => invitation.get())
       });
     });
@@ -2012,7 +2049,7 @@ var import_node_assert8 = __toESM(require("node:assert"));
 var import_credentials9 = require("@dxos/credentials");
 var import_feed_store3 = require("@dxos/feed-store");
 var import_log7 = require("@dxos/log");
-var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -2028,7 +2065,7 @@ var SpaceInvitationProtocol = class {
   }
   getInvitationContext() {
     return {
-      kind: import_services5.Invitation.Kind.SPACE,
+      kind: import_services6.Invitation.Kind.SPACE,
       spaceKey: this._spaceKey
     };
   }
@@ -2200,7 +2237,7 @@ var import_credentials13 = require("@dxos/credentials");
 var import_keys10 = require("@dxos/keys");
 var import_log11 = require("@dxos/log");
 var import_protocols6 = require("@dxos/protocols");
-var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_gossip = require("@dxos/teleport-extension-gossip");
 var import_util5 = require("@dxos/util");
 
@@ -2213,7 +2250,7 @@ var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_errors3 = require("@dxos/errors");
 var import_keys9 = require("@dxos/keys");
 var import_log10 = require("@dxos/log");
-var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
 var import_credentials10 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util4 = require("@dxos/util");
 
@@ -2470,7 +2507,7 @@ var __decorate = function(decorators, target, key, desc) {
 var DataSpace = class DataSpace2 {
   constructor(params) {
     this._ctx = new import_context6.Context();
-    this._state = import_services6.SpaceState.CLOSED;
+    this._state = import_services7.SpaceState.CLOSED;
     /**
     * Error for _state === SpaceState.ERROR.
     */
@@ -2524,11 +2561,11 @@ var DataSpace = class DataSpace2 {
     await this.notarizationPlugin.open();
     await this._notarizationPluginConsumer.open();
     await this._inner.open();
-    this._state = import_services6.SpaceState.INACTIVE;
+    this._state = import_services7.SpaceState.INACTIVE;
     this.metrics.open = new Date();
   }
   async close() {
-    this._state = import_services6.SpaceState.CLOSED;
+    this._state = import_services7.SpaceState.CLOSED;
     await this._ctx.dispose();
     await this.authVerifier.close();
     await this._inner.close();
@@ -2566,7 +2603,7 @@ var DataSpace = class DataSpace2 {
           scope: this,
           callSite: (f, a) => f(...a)
         });
-        this._state = import_services6.SpaceState.ERROR;
+        this._state = import_services7.SpaceState.ERROR;
         this.error = err;
         this.stateUpdate.emit();
       } finally {
@@ -2576,10 +2613,10 @@ var DataSpace = class DataSpace2 {
   }
   async initializeDataPipeline() {
     var _a, _b, _c, _d;
-    if (this._state !== import_services6.SpaceState.INACTIVE) {
+    if (this._state !== import_services7.SpaceState.INACTIVE) {
       throw new import_errors3.SystemError("Invalid operation");
     }
-    this._state = import_services6.SpaceState.INITIALIZING;
+    this._state = import_services7.SpaceState.INITIALIZING;
     await this._inner.controlPipeline.state.waitUntilReachedTargetTimeframe({
       ctx: this._ctx,
       breakOnStall: false
@@ -2619,7 +2656,7 @@ var DataSpace = class DataSpace2 {
       callSite: (f, a) => f(...a)
     });
     await ((_b = (_a = this._callbacks).beforeReady) == null ? void 0 : _b.call(_a));
-    this._state = import_services6.SpaceState.READY;
+    this._state = import_services7.SpaceState.READY;
     this.stateUpdate.emit();
     await ((_d = (_c = this._callbacks).afterReady) == null ? void 0 : _d.call(_c));
   }
@@ -2930,7 +2967,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   async waitUntilSpaceReady(spaceKey) {
     await (0, import_context7.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
-      return !!space && space.state === import_services7.SpaceState.READY;
+      return !!space && space.state === import_services8.SpaceState.READY;
     }));
   }
   async _constructSpace(metadata) {
@@ -2971,6 +3008,14 @@ var DataSpaceManager = class DataSpaceManager2 {
         session.addExtension("dxos.mesh.teleport.objectsync", space.snapshotManager.objectSync.createExtension());
         session.addExtension("dxos.mesh.teleport.notarization", dataSpace.notarizationPlugin.createExtension());
       },
+      onAuthFailure: () => {
+        import_log11.log.warn("auth failure", {}, {
+          file: "data-space-manager.ts",
+          line: 212,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+      },
       memberKey: this._signingContext.identityKey
     });
     controlFeed && space.setControlFeed(controlFeed);
@@ -2989,7 +3034,7 @@ var DataSpaceManager = class DataSpaceManager2 {
             space: space.key
           }, {
             file: "data-space-manager.ts",
-            line: 226,
+            line: 229,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3001,7 +3046,7 @@ var DataSpaceManager = class DataSpaceManager2 {
             open: this._isOpen
           }, {
             file: "data-space-manager.ts",
-            line: 233,
+            line: 236,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3046,7 +3091,7 @@ var import_debug5 = require("@dxos/debug");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
 var import_log12 = require("@dxos/log");
 var import_protocols7 = require("@dxos/protocols");
-var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util6 = require("@dxos/util");
 var TIMEFRAME_UPDATE_DEBOUNCE_TIME = 500;
 var SpacesServiceImpl = class {
@@ -3187,7 +3232,7 @@ var SpacesServiceImpl = class {
               displayName: (_b2 = (_a2 = member.assertion.profile) == null ? void 0 : _a2.displayName) != null ? _b2 : (0, import_util6.humanize)(member.key)
             }
           },
-          presence: ((_c2 = this._identityManager.identity) == null ? void 0 : _c2.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services8.SpaceMember.PresenceState.ONLINE : import_services8.SpaceMember.PresenceState.OFFLINE
+          presence: ((_c2 = this._identityManager.identity) == null ? void 0 : _c2.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services9.SpaceMember.PresenceState.ONLINE : import_services9.SpaceMember.PresenceState.OFFLINE
         };
       }),
       cache: space.cache,
@@ -3818,7 +3863,7 @@ var import_keyring = require("@dxos/keyring");
 var import_keys11 = require("@dxos/keys");
 var import_log18 = require("@dxos/log");
 var import_protocols8 = require("@dxos/protocols");
-var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
 var ServiceContext = class {
   // prettier-ignore
   constructor(storage, networkManager, signalManager, modelFactory) {
@@ -3851,7 +3896,7 @@ var ServiceContext = class {
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
     this.invitations = new InvitationsHandler(this.networkManager);
-    this._handlerFactories.set(import_services11.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
+    this._handlerFactories.set(import_services12.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
       var _a;
       return (_a = this.identityManager.identity) != null ? _a : (0, import_debug7.failUndefined)();
     }, this._acceptIdentity.bind(this)));
@@ -3972,7 +4017,7 @@ var ServiceContext = class {
     };
     this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.feedStore);
     await this.dataSpaceManager.open();
-    this._handlerFactories.set(import_services11.Invitation.Kind.SPACE, (invitation) => {
+    this._handlerFactories.set(import_services12.Invitation.Kind.SPACE, (invitation) => {
       (0, import_node_assert13.default)(this.dataSpaceManager, "dataSpaceManager not initialized yet");
       return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
     });
@@ -4096,12 +4141,12 @@ var ClientServicesHost = class {
     this._systemService = new SystemServiceImpl({
       config: this._config,
       statusUpdate: this._statusUpdate,
-      getCurrentStatus: () => this.isOpen ? import_services12.SystemStatus.ACTIVE : import_services12.SystemStatus.INACTIVE,
+      getCurrentStatus: () => this.isOpen ? import_services13.SystemStatus.ACTIVE : import_services13.SystemStatus.INACTIVE,
       onUpdateStatus: async (status) => {
         var _a, _b;
-        if (!this.isOpen && status === import_services12.SystemStatus.ACTIVE) {
+        if (!this.isOpen && status === import_services13.SystemStatus.ACTIVE) {
           await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
-        } else if (this.isOpen && status === import_services12.SystemStatus.INACTIVE) {
+        } else if (this.isOpen && status === import_services13.SystemStatus.INACTIVE) {
           await ((_b = this._resourceLock) == null ? void 0 : _b.release());
         }
       },
@@ -4331,7 +4376,7 @@ var performInvitation = ({ host, guest, options, hooks }) => {
   hostObservable.subscribe(async (hostInvitation) => {
     var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n;
     switch (hostInvitation.state) {
-      case import_services13.Invitation.State.CONNECTING: {
+      case import_services14.Invitation.State.CONNECTING: {
         if ((_b = (_a = hooks == null ? void 0 : hooks.host) == null ? void 0 : _a.onConnecting) == null ? void 0 : _b.call(_a, hostObservable)) {
           break;
         }
@@ -4339,29 +4384,29 @@ var performInvitation = ({ host, guest, options, hooks }) => {
         guestObservable.subscribe(async (guestInvitation) => {
           var _a2, _b2, _c2, _d2, _e2, _f2, _g2, _h2, _i2, _j2, _k2, _l2, _m2, _n2;
           switch (guestInvitation.state) {
-            case import_services13.Invitation.State.CONNECTING: {
+            case import_services14.Invitation.State.CONNECTING: {
               if ((_b2 = (_a2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _a2.onConnecting) == null ? void 0 : _b2.call(_a2, guestObservable)) {
                 break;
               }
               (0, import_node_assert15.default)(hostInvitation.swarmKey.equals(guestInvitation.swarmKey));
               break;
             }
-            case import_services13.Invitation.State.CONNECTED: {
+            case import_services14.Invitation.State.CONNECTED: {
               (_d2 = (_c2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _c2.onConnected) == null ? void 0 : _d2.call(_c2, guestObservable);
               break;
             }
-            case import_services13.Invitation.State.READY_FOR_AUTHENTICATION: {
+            case import_services14.Invitation.State.READY_FOR_AUTHENTICATION: {
               if ((_f2 = (_e2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _e2.onReady) == null ? void 0 : _f2.call(_e2, guestObservable)) {
                 break;
               }
               await guestObservable.authenticate(await authCode.wait());
               break;
             }
-            case import_services13.Invitation.State.AUTHENTICATING: {
+            case import_services14.Invitation.State.AUTHENTICATING: {
               (_h2 = (_g2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _g2.onAuthenticating) == null ? void 0 : _h2.call(_g2, guestObservable);
               break;
             }
-            case import_services13.Invitation.State.SUCCESS: {
+            case import_services14.Invitation.State.SUCCESS: {
               if ((_j2 = (_i2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _i2.onSuccess) == null ? void 0 : _j2.call(_i2, guestObservable)) {
                 break;
               }
@@ -4370,7 +4415,7 @@ var performInvitation = ({ host, guest, options, hooks }) => {
               });
               break;
             }
-            case import_services13.Invitation.State.CANCELLED: {
+            case import_services14.Invitation.State.CANCELLED: {
               if ((_l2 = (_k2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _k2.onCancelled) == null ? void 0 : _l2.call(_k2, guestObservable)) {
                 break;
               }
@@ -4379,7 +4424,7 @@ var performInvitation = ({ host, guest, options, hooks }) => {
               });
               break;
             }
-            case import_services13.Invitation.State.TIMEOUT: {
+            case import_services14.Invitation.State.TIMEOUT: {
               if ((_n2 = (_m2 = hooks == null ? void 0 : hooks.guest) == null ? void 0 : _m2.onTimeout) == null ? void 0 : _n2.call(_m2, guestObservable)) {
                 return;
               }
@@ -4399,11 +4444,11 @@ var performInvitation = ({ host, guest, options, hooks }) => {
         });
         break;
       }
-      case import_services13.Invitation.State.CONNECTED: {
+      case import_services14.Invitation.State.CONNECTED: {
         (_d = (_c = hooks == null ? void 0 : hooks.host) == null ? void 0 : _c.onConnected) == null ? void 0 : _d.call(_c, hostObservable);
         break;
       }
-      case import_services13.Invitation.State.READY_FOR_AUTHENTICATION: {
+      case import_services14.Invitation.State.READY_FOR_AUTHENTICATION: {
         if ((_f = (_e = hooks == null ? void 0 : hooks.host) == null ? void 0 : _e.onReady) == null ? void 0 : _f.call(_e, hostObservable)) {
           break;
         }
@@ -4412,11 +4457,11 @@ var performInvitation = ({ host, guest, options, hooks }) => {
         }
         break;
       }
-      case import_services13.Invitation.State.AUTHENTICATING: {
+      case import_services14.Invitation.State.AUTHENTICATING: {
         (_h = (_g = hooks == null ? void 0 : hooks.host) == null ? void 0 : _g.onAuthenticating) == null ? void 0 : _h.call(_g, hostObservable);
         break;
       }
-      case import_services13.Invitation.State.SUCCESS: {
+      case import_services14.Invitation.State.SUCCESS: {
         if ((_j = (_i = hooks == null ? void 0 : hooks.host) == null ? void 0 : _i.onSuccess) == null ? void 0 : _j.call(_i, hostObservable)) {
           break;
         }
@@ -4425,7 +4470,7 @@ var performInvitation = ({ host, guest, options, hooks }) => {
         });
         break;
       }
-      case import_services13.Invitation.State.CANCELLED: {
+      case import_services14.Invitation.State.CANCELLED: {
         if ((_l = (_k = hooks == null ? void 0 : hooks.host) == null ? void 0 : _k.onCancelled) == null ? void 0 : _l.call(_k, hostObservable)) {
           break;
         }
@@ -4434,7 +4479,7 @@ var performInvitation = ({ host, guest, options, hooks }) => {
         });
         break;
       }
-      case import_services13.Invitation.State.TIMEOUT: {
+      case import_services14.Invitation.State.TIMEOUT: {
         if ((_n = (_m = hooks == null ? void 0 : hooks.host) == null ? void 0 : _m.onTimeout) == null ? void 0 : _n.call(_m, hostObservable)) {
           break;
         }
@@ -4460,12 +4505,12 @@ var performInvitation = ({ host, guest, options, hooks }) => {
 };
 var createInvitation = (host, options) => {
   options != null ? options : options = {
-    authMethod: import_services13.Invitation.AuthMethod.NONE,
+    authMethod: import_services14.Invitation.AuthMethod.NONE,
     ...options != null ? options : {}
   };
   if (host instanceof ServiceContext) {
     const hostHandler = host.getInvitationHandler({
-      kind: import_services13.Invitation.Kind.SPACE,
+      kind: import_services14.Invitation.Kind.SPACE,
       ...options
     });
     return host.invitations.createInvitation(hostHandler, options);