@dxos/client-services 0.4.10-main.c42bfdb → 0.4.10-main.c75170d

package/dist/lib/node/{chunk-JSVLZGJM.cjs → chunk-34EZSH65.cjs}

@@ -26,8 +26,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var chunk_JSVLZGJM_exports = {};
-__export(chunk_JSVLZGJM_exports, {
+var chunk_34EZSH65_exports = {};
+__export(chunk_34EZSH65_exports, {
   ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   ClientServicesProviderResource: () => ClientServicesProviderResource,
@@ -41,6 +41,7 @@ __export(chunk_JSVLZGJM_exports, {
   IdentityManager: () => IdentityManager,
   IdentityServiceImpl: () => IdentityServiceImpl,
   InvitationsHandler: () => InvitationsHandler,
+  InvitationsManager: () => InvitationsManager,
   InvitationsServiceImpl: () => InvitationsServiceImpl,
   Lock: () => Lock,
   ServiceContext: () => ServiceContext,
@@ -48,6 +49,7 @@ __export(chunk_JSVLZGJM_exports, {
   SpaceInvitationProtocol: () => SpaceInvitationProtocol,
   SpacesServiceImpl: () => SpacesServiceImpl,
   TrustedKeySetAuthVerifier: () => TrustedKeySetAuthVerifier,
+  createAdmissionKeypair: () => createAdmissionKeypair,
   createAuthProvider: () => createAuthProvider,
   createCollectDiagnosticsBroadcastHandler: () => createCollectDiagnosticsBroadcastHandler,
   createCollectDiagnosticsBroadcastSender: () => createCollectDiagnosticsBroadcastSender,
@@ -55,7 +57,6 @@ __export(chunk_JSVLZGJM_exports, {
   createLevel: () => createLevel,
   createStorageObjects: () => createStorageObjects,
   getNetworkPeers: () => getNetworkPeers,
-  invitationExpired: () => invitationExpired,
   isLocked: () => isLocked,
   subscribeToFeedBlocks: () => subscribeToFeedBlocks,
   subscribeToFeeds: () => subscribeToFeeds,
@@ -65,7 +66,7 @@ __export(chunk_JSVLZGJM_exports, {
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo
 });
-module.exports = __toCommonJS(chunk_JSVLZGJM_exports);
+module.exports = __toCommonJS(chunk_34EZSH65_exports);
 var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_feed_store = require("@dxos/feed-store");
@@ -120,6 +121,7 @@ var import_async7 = require("@dxos/async");
 var import_client_protocol2 = require("@dxos/client-protocol");
 var import_context4 = require("@dxos/context");
 var import_credentials7 = require("@dxos/credentials");
+var import_crypto = require("@dxos/crypto");
 var import_invariant5 = require("@dxos/invariant");
 var import_keys5 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
@@ -129,6 +131,7 @@ var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_async8 = require("@dxos/async");
 var import_context5 = require("@dxos/context");
+var import_crypto2 = require("@dxos/crypto");
 var import_invariant6 = require("@dxos/invariant");
 var import_keys6 = require("@dxos/keys");
 var import_log5 = require("@dxos/log");
@@ -136,29 +139,29 @@ var import_protocols5 = require("@dxos/protocols");
 var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport = require("@dxos/teleport");
-var import_async9 = require("@dxos/async");
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
-var import_context6 = require("@dxos/context");
-var import_invariant7 = require("@dxos/invariant");
-var import_log6 = require("@dxos/log");
 var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
 var import_credentials8 = require("@dxos/credentials");
 var import_feed_store3 = require("@dxos/feed-store");
-var import_invariant8 = require("@dxos/invariant");
-var import_log7 = require("@dxos/log");
+var import_invariant7 = require("@dxos/invariant");
+var import_log6 = require("@dxos/log");
 var import_protocols6 = require("@dxos/protocols");
 var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
+var import_async9 = require("@dxos/async");
+var import_echo_pipeline = require("@dxos/echo-pipeline");
+var import_invariant8 = require("@dxos/invariant");
+var import_log7 = require("@dxos/log");
 var import_codec_protobuf9 = require("@dxos/codec-protobuf");
 var import_debug2 = require("@dxos/debug");
 var import_rpc = require("@dxos/rpc");
 var import_tracing3 = require("@dxos/tracing");
 var import_async10 = require("@dxos/async");
 var import_client_protocol3 = require("@dxos/client-protocol");
-var import_context7 = require("@dxos/context");
+var import_context6 = require("@dxos/context");
 var import_debug3 = require("@dxos/debug");
 var import_echo_db = require("@dxos/echo-db");
-var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
+var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_invariant9 = require("@dxos/invariant");
 var import_keys7 = require("@dxos/keys");
 var import_log8 = require("@dxos/log");
@@ -171,7 +174,7 @@ var import_util4 = require("@dxos/util");
 var import_async11 = require("@dxos/async");
 var import_credentials10 = require("@dxos/credentials");
 var import_async12 = require("@dxos/async");
-var import_context8 = require("@dxos/context");
+var import_context7 = require("@dxos/context");
 var import_invariant10 = require("@dxos/invariant");
 var import_keys8 = require("@dxos/keys");
 var import_log9 = require("@dxos/log");
@@ -179,7 +182,7 @@ var import_protocols8 = require("@dxos/protocols");
 var import_teleport2 = require("@dxos/teleport");
 var import_util5 = require("@dxos/util");
 var import_async13 = require("@dxos/async");
-var import_context9 = require("@dxos/context");
+var import_context8 = require("@dxos/context");
 var import_credentials11 = require("@dxos/credentials");
 var import_invariant11 = require("@dxos/invariant");
 var import_keys9 = require("@dxos/keys");
@@ -200,10 +203,10 @@ var import_log11 = require("@dxos/log");
 var import_protocols10 = require("@dxos/protocols");
 var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 var import_async15 = require("@dxos/async");
-var import_context10 = require("@dxos/context");
+var import_context9 = require("@dxos/context");
 var import_credentials14 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
-var import_echo_pipeline3 = require("@dxos/echo-pipeline");
+var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_indexing = require("@dxos/indexing");
 var import_invariant13 = require("@dxos/invariant");
@@ -231,9 +234,9 @@ var import_tracing7 = require("@dxos/tracing");
 var import_util8 = require("@dxos/util");
 var import_async16 = require("@dxos/async");
 var import_client_protocol4 = require("@dxos/client-protocol");
-var import_context11 = require("@dxos/context");
-var import_echo_pipeline4 = require("@dxos/echo-pipeline");
-var E = __toESM(require("@dxos/echo-schema"));
+var import_context10 = require("@dxos/context");
+var import_echo_pipeline5 = require("@dxos/echo-pipeline");
+var import_echo_schema = require("@dxos/echo-schema");
 var import_indexing2 = require("@dxos/indexing");
 var import_invariant15 = require("@dxos/invariant");
 var import_keys11 = require("@dxos/keys");
@@ -1485,6 +1488,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
     this._callbacks = _callbacks;
     this._ctx = new import_context5.Context();
     this._remoteOptionsTrigger = new import_async8.Trigger();
+    this._challenge = void 0;
     this.invitation = void 0;
     this.guestProfile = void 0;
     this.authenticationPassed = false;
@@ -1499,7 +1503,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
         options: async (options) => {
           (0, import_invariant6.invariant)(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 87,
+            L: 90,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1516,7 +1520,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 96,
+            L: 99,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1526,7 +1530,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               invitationId
             }, {
               F: __dxlog_file6,
-              L: 100,
+              L: 103,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1540,7 +1544,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             guestProfile: profile
           }, {
             F: __dxlog_file6,
-            L: 109,
+            L: 112,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1549,25 +1553,27 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             ...this.invitation,
             state: import_services4.Invitation.State.READY_FOR_AUTHENTICATION
           });
+          this._challenge = this.invitation.authMethod === import_services4.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? (0, import_crypto2.randomBytes)(32) : void 0;
           import_log5.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols5.trace.end({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 116,
+            L: 122,
             S: this,
             C: (f, a) => f(...a)
           });
           return {
-            authMethod: this.invitation.authMethod
+            authMethod: this.invitation.authMethod,
+            challenge: this._challenge
           };
         },
-        authenticate: async ({ authCode: code }) => {
+        authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = import_keys6.PublicKey.random().toHex();
           import_log5.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols5.trace.begin({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 124,
+            L: 131,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1575,14 +1581,14 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             authCode: code
           }, {
             F: __dxlog_file6,
-            L: 125,
+            L: 132,
             S: this,
             C: (f, a) => f(...a)
           });
           let status = import_invitations2.AuthenticationResponse.Status.OK;
           (0, import_invariant6.invariant)(this.invitation, "Invitation is not set.", {
             F: __dxlog_file6,
-            L: 128,
+            L: 135,
             S: this,
             A: [
               "this.invitation",
@@ -1593,7 +1599,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             case import_services4.Invitation.AuthMethod.NONE: {
               (0, import_log5.log)("authentication not required", void 0, {
                 F: __dxlog_file6,
-                L: 131,
+                L: 138,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1613,12 +1619,25 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               }
               break;
             }
+            case import_services4.Invitation.AuthMethod.KNOWN_PUBLIC_KEY: {
+              if (!this.invitation.guestKeypair) {
+                status = import_invitations2.AuthenticationResponse.Status.INTERNAL_ERROR;
+                break;
+              }
+              const isSignatureValid = this._challenge && (0, import_crypto2.verify)(this._challenge, Buffer.from(signedChallenge ?? []), this.invitation.guestKeypair.publicKey.asBuffer());
+              if (isSignatureValid) {
+                this.authenticationPassed = true;
+              } else {
+                status = import_invitations2.AuthenticationResponse.Status.INVALID_SIGNATURE;
+              }
+              break;
+            }
             default: {
               import_log5.log.error("invalid authentication method", {
                 authMethod: this.invitation.authMethod
               }, {
                 F: __dxlog_file6,
-                L: 149,
+                L: 176,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1633,7 +1652,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             }
           }), {
             F: __dxlog_file6,
-            L: 155,
+            L: 182,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1647,14 +1666,14 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 161,
+            L: 188,
             S: this,
             C: (f, a) => f(...a)
           });
           try {
             (0, import_invariant6.invariant)(this.invitation, "Invitation is not set.", {
               F: __dxlog_file6,
-              L: 164,
+              L: 191,
               S: this,
               A: [
                 "this.invitation",
@@ -1669,7 +1688,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               id: traceId
             }), {
               F: __dxlog_file6,
-              L: 172,
+              L: 199,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1726,7 +1745,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
         options: async (options) => {
           (0, import_invariant6.invariant)(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 239,
+            L: 266,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1753,7 +1772,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     try {
       (0, import_log5.log)("begin options", void 0, {
         F: __dxlog_file6,
-        L: 260,
+        L: 287,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1765,7 +1784,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
       }));
       (0, import_log5.log)("end options", void 0, {
         F: __dxlog_file6,
-        L: 263,
+        L: 290,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1779,7 +1798,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     } catch (err) {
       (0, import_log5.log)("openError", err, {
         F: __dxlog_file6,
-        L: 273,
+        L: 300,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1789,7 +1808,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
   async onClose() {
     (0, import_log5.log)("onClose", void 0, {
       F: __dxlog_file6,
-      L: 279,
+      L: 306,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1806,11 +1825,11 @@ var InvitationsHandler = class {
     this._networkManager = _networkManager;
   }
   createInvitation(protocol, options) {
-    const { invitationId = import_keys5.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys5.PublicKey.random(), persistent = true, created = /* @__PURE__ */ new Date(), lifetime = 86400 } = options ?? {};
+    const { invitationId = import_keys5.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys5.PublicKey.random(), persistent = options?.authMethod !== import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
     const authCode = options?.authCode ?? (authMethod === import_services3.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials7.generatePasscode)(import_client_protocol2.AUTHENTICATION_CODE_LENGTH) : void 0);
     (0, import_invariant5.invariant)(protocol, void 0, {
       F: __dxlog_file7,
-      L: 84,
+      L: 87,
       S: this,
       A: [
         "protocol",
@@ -1825,9 +1844,11 @@ var InvitationsHandler = class {
       swarmKey,
       authCode,
       timeout,
-      persistent,
+      persistent: persistent && type !== import_services3.Invitation.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
       created,
       lifetime,
+      multiUse,
       ...protocol.getInvitationContext()
     };
     const stream = new import_async7.PushStream();
@@ -1842,7 +1863,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 109,
+        L: 115,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1867,7 +1888,7 @@ var InvitationsHandler = class {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             (0, import_invariant5.invariant)(deviceKey, void 0, {
               F: __dxlog_file7,
-              L: 130,
+              L: 136,
               S: this,
               A: [
                 "deviceKey",
@@ -1890,7 +1911,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 148,
+                L: 154,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1898,7 +1919,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 149,
+                L: 155,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1914,7 +1935,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 152,
+                L: 158,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1926,7 +1947,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 154,
+                L: 160,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1936,7 +1957,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 157,
+                  L: 163,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1947,7 +1968,7 @@ var InvitationsHandler = class {
               } else {
                 import_log4.log.error("failed", err, {
                   F: __dxlog_file7,
-                  L: 160,
+                  L: 166,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1958,12 +1979,12 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 163,
+                L: 169,
                 S: this,
                 C: (f, a) => f(...a)
               });
             } finally {
-              if (type !== import_services3.Invitation.Type.MULTIUSE) {
+              if (!multiUse) {
                 await swarmConnection.close();
                 await ctx.dispose();
               }
@@ -1979,7 +2000,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 178,
+              L: 184,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1990,7 +2011,7 @@ var InvitationsHandler = class {
           } else {
             import_log4.log.error("failed", err, {
               F: __dxlog_file7,
-              L: 181,
+              L: 187,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2000,11 +2021,11 @@ var InvitationsHandler = class {
       });
       return extension;
     };
-    if (invitation.lifetime && invitation.created && invitation.lifetime !== 0) {
+    if (invitation.lifetime && invitation.created) {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
         import_log4.log.warn("invitation has already expired", void 0, {
           F: __dxlog_file7,
-          L: 192,
+          L: 198,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2055,7 +2076,7 @@ var InvitationsHandler = class {
     const { timeout = import_client_protocol2.INVITATION_TIMEOUT } = invitation;
     (0, import_invariant5.invariant)(protocol, void 0, {
       F: __dxlog_file7,
-      L: 246,
+      L: 252,
       S: this,
       A: [
         "protocol",
@@ -2065,7 +2086,7 @@ var InvitationsHandler = class {
     if (deviceProfile) {
       (0, import_invariant5.invariant)(invitation.kind === import_services3.Invitation.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
         F: __dxlog_file7,
-        L: 250,
+        L: 255,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -2080,7 +2101,7 @@ var InvitationsHandler = class {
     const setState = (newData) => {
       (0, import_invariant5.invariant)(newData.state !== void 0, void 0, {
         F: __dxlog_file7,
-        L: 261,
+        L: 266,
         S: this,
         A: [
           "newData.state !== undefined",
@@ -2100,7 +2121,7 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             F: __dxlog_file7,
-            L: 269,
+            L: 274,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2110,7 +2131,7 @@ var InvitationsHandler = class {
         } else {
           import_log4.log.warn("auth failed", err, {
             F: __dxlog_file7,
-            L: 272,
+            L: 277,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2124,7 +2145,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 280,
+        L: 285,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2139,7 +2160,7 @@ var InvitationsHandler = class {
               currentState
             }, {
               F: __dxlog_file7,
-              L: 290,
+              L: 295,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2154,7 +2175,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 299,
+                L: 304,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2166,7 +2187,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 307,
+                L: 312,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2177,7 +2198,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 311,
+                L: 316,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2187,62 +2208,28 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 F: __dxlog_file7,
-                L: 315,
+                L: 320,
                 S: this,
                 C: (f, a) => f(...a)
               });
               invitation.authMethod = introductionResponse.authMethod;
               if (isAuthenticationRequired(invitation)) {
-                for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  (0, import_log4.log)("guest waiting for authentication code...", void 0, {
-                    F: __dxlog_file7,
-                    L: 321,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
-                  });
-                  const authCode = await authenticated.wait({
-                    timeout
-                  });
-                  (0, import_log4.log)("sending authentication request", void 0, {
-                    F: __dxlog_file7,
-                    L: 325,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: import_services3.Invitation.State.AUTHENTICATING
-                  });
-                  const response = await extension.rpc.InvitationHostService.authenticate({
-                    authCode
-                  });
-                  if (response.status === void 0 || response.status === import_invitations.AuthenticationResponse.Status.OK) {
+                switch (invitation.authMethod) {
+                  case import_services3.Invitation.AuthMethod.SHARED_SECRET:
+                    await this._handleGuestOtpAuth(extension, setState, authenticated, {
+                      timeout
+                    });
+                    break;
+                  case import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY:
+                    await this._handleGuestKpkAuth(extension, setState, invitation, introductionResponse);
                     break;
-                  }
-                  if (response.status === import_invitations.AuthenticationResponse.Status.INVALID_OTP) {
-                    if (attempt === MAX_OTP_ATTEMPTS) {
-                      throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
-                    } else {
-                      (0, import_log4.log)("retrying invalid code", {
-                        attempt
-                      }, {
-                        F: __dxlog_file7,
-                        L: 336,
-                        S: this,
-                        C: (f, a) => f(...a)
-                      });
-                      authenticated.reset();
-                    }
-                  }
                 }
               }
               (0, import_log4.log)("request admission", {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 344,
+                L: 336,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2254,7 +2241,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 355,
+                L: 347,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2267,7 +2254,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 357,
+                L: 349,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2277,7 +2264,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 360,
+                  L: 352,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2287,7 +2274,7 @@ var InvitationsHandler = class {
               } else {
                 (0, import_log4.log)("auth failed", err, {
                   F: __dxlog_file7,
-                  L: 363,
+                  L: 355,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2298,7 +2285,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 366,
+                L: 358,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2316,7 +2303,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 377,
+              L: 369,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2326,7 +2313,7 @@ var InvitationsHandler = class {
           } else {
             (0, import_log4.log)("auth failed", err, {
               F: __dxlog_file7,
-              L: 380,
+              L: 372,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2343,7 +2330,7 @@ var InvitationsHandler = class {
       } else {
         (0, import_invariant5.invariant)(invitation.swarmKey, void 0, {
           F: __dxlog_file7,
-          L: 394,
+          L: 386,
           S: this,
           A: [
             "invitation.swarmKey",
@@ -2381,198 +2368,111 @@ var InvitationsHandler = class {
     });
     return observable;
   }
+  async _handleGuestOtpAuth(extension, setState, authenticated, options) {
+    for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
+      (0, import_log4.log)("guest waiting for authentication code...", void 0, {
+        F: __dxlog_file7,
+        L: 426,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
+      });
+      const authCode = await authenticated.wait(options);
+      (0, import_log4.log)("sending authentication request", void 0, {
+        F: __dxlog_file7,
+        L: 430,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: import_services3.Invitation.State.AUTHENTICATING
+      });
+      const response = await extension.rpc.InvitationHostService.authenticate({
+        authCode
+      });
+      if (response.status === void 0 || response.status === import_invitations.AuthenticationResponse.Status.OK) {
+        break;
+      }
+      if (response.status === import_invitations.AuthenticationResponse.Status.INVALID_OTP) {
+        if (attempt === MAX_OTP_ATTEMPTS) {
+          throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
+        } else {
+          (0, import_log4.log)("retrying invalid code", {
+            attempt
+          }, {
+            F: __dxlog_file7,
+            L: 441,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          authenticated.reset();
+        }
+      }
+    }
+  }
+  async _handleGuestKpkAuth(extension, setState, invitation, introductionResponse) {
+    if (invitation.guestKeypair?.privateKey == null) {
+      throw new Error("keypair missing in the invitation");
+    }
+    if (introductionResponse.challenge == null) {
+      throw new Error("challenge missing in the introduction");
+    }
+    (0, import_log4.log)("sending authentication request", void 0, {
+      F: __dxlog_file7,
+      L: 460,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    setState({
+      state: import_services3.Invitation.State.AUTHENTICATING
+    });
+    const signature = (0, import_crypto.sign)(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
+    const response = await extension.rpc.InvitationHostService.authenticate({
+      signedChallenge: signature
+    });
+    if (response.status !== import_invitations.AuthenticationResponse.Status.OK) {
+      throw new Error(`Authentication failed with code: ${response.status}`);
+    }
+  }
 };
-var invitationExpired = (invitation) => {
-  return invitation.created && invitation.lifetime && invitation.lifetime !== 0 && invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now();
+var createAdmissionKeypair = () => {
+  const keypair = (0, import_crypto.createKeyPair)();
+  return {
+    publicKey: import_keys5.PublicKey.from(keypair.publicKey),
+    privateKey: keypair.secretKey
+  };
 };
-var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts";
 var InvitationsServiceImpl = class {
-  constructor(_invitationsHandler, _getHandler, _metadataStore) {
-    this._invitationsHandler = _invitationsHandler;
-    this._getHandler = _getHandler;
-    this._metadataStore = _metadataStore;
-    this._createInvitations = /* @__PURE__ */ new Map();
-    this._acceptInvitations = /* @__PURE__ */ new Map();
-    this._invitationCreated = new import_async9.Event();
-    this._invitationAccepted = new import_async9.Event();
-    this._removedCreated = new import_async9.Event();
-    this._removedAccepted = new import_async9.Event();
-    this._saved = new import_async9.Event();
-    this._persistentInvitationsLoadedEvent = new import_async9.Event();
-    this._persistentInvitationsLoaded = false;
+  constructor(_invitationsManager) {
+    this._invitationsManager = _invitationsManager;
   }
   // TODO(burdon): Guest/host label.
   getLoggingContext() {
     return {};
   }
   createInvitation(options) {
-    let invitation;
-    const savePersistentInvitationCtx = new import_context6.Context();
-    const existingInvitation = this._createInvitations.get(options.invitationId);
-    if (existingInvitation) {
-      invitation = existingInvitation;
-    } else {
-      const handler = this._getHandler(options);
-      invitation = this._invitationsHandler.createInvitation(handler, options);
-      this._createInvitations.set(invitation.get().invitationId, invitation);
-      this._invitationCreated.emit(invitation.get());
-    }
+    const invitation = this._invitationsManager.createInvitation(options);
     return new import_codec_protobuf8.Stream(({ next, close }) => {
-      if (invitation.get().persistent) {
-        (0, import_async9.scheduleTask)(savePersistentInvitationCtx, async () => {
-          try {
-            await this._metadataStore.addInvitation(invitation.get());
-            this._saved.emit(invitation.get());
-          } catch (err) {
-            close(err);
-          }
-        });
-      }
-      invitation.subscribe((invitation2) => {
-        next(invitation2);
-      }, async (err) => {
-        await savePersistentInvitationCtx.dispose();
-        close(err);
-      }, async () => {
-        close();
-        if (invitation.get().persistent) {
-          await savePersistentInvitationCtx.dispose();
-          await this._metadataStore.removeInvitation(invitation.get().invitationId);
-        }
-        this._createInvitations.delete(invitation.get().invitationId);
-        if (invitation.get().type !== import_services5.Invitation.Type.MULTIUSE) {
-          this._removedCreated.emit(invitation.get());
-        }
-      });
+      invitation.subscribe(next, close, close);
     });
   }
-  async loadPersistentInvitations() {
-    const persistentInvitations = this._metadataStore.getInvitations();
-    const freshInvitations = persistentInvitations.filter(async (invitation) => !invitationExpired(invitation));
-    const cInvitations = freshInvitations.map((persistentInvitation) => {
-      (0, import_invariant7.invariant)(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
-        F: __dxlog_file8,
-        L: 109,
-        S: this,
-        A: [
-          "!this._createInvitations.get(persistentInvitation.invitationId)",
-          "'invitation already exists'"
-        ]
-      });
-      const handler = this._getHandler(persistentInvitation);
-      const invitation = this._invitationsHandler.createInvitation(handler, persistentInvitation);
-      this._createInvitations.set(invitation.get().invitationId, invitation);
-      this._invitationCreated.emit(invitation.get());
-      return persistentInvitation;
-    });
-    this._persistentInvitationsLoadedEvent.emit();
-    this._persistentInvitationsLoaded = true;
-    return {
-      invitations: cInvitations
-    };
-  }
-  acceptInvitation({ invitation: options, deviceProfile }) {
-    let invitation;
-    if (deviceProfile) {
-      (0, import_invariant7.invariant)(options.kind === import_services5.Invitation.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
-        F: __dxlog_file8,
-        L: 127,
-        S: this,
-        A: [
-          "options.kind === Invitation.Kind.DEVICE",
-          "'deviceProfile provided for non-device invitation'"
-        ]
-      });
-    }
-    const existingInvitation = this._acceptInvitations.get(options.invitationId);
-    if (existingInvitation) {
-      invitation = existingInvitation;
-    } else {
-      const handler = this._getHandler(options);
-      invitation = this._invitationsHandler.acceptInvitation(handler, options, deviceProfile);
-      this._acceptInvitations.set(invitation.get().invitationId, invitation);
-      this._invitationAccepted.emit(invitation.get());
-    }
+  acceptInvitation(request) {
+    const invitation = this._invitationsManager.acceptInvitation(request);
     return new import_codec_protobuf8.Stream(({ next, close }) => {
-      invitation.subscribe((invitation2) => {
-        next(invitation2);
-      }, (err) => {
-        close(err);
-      }, () => {
-        close();
-        this._acceptInvitations.delete(invitation.get().invitationId);
-        if (invitation.get().type !== import_services5.Invitation.Type.MULTIUSE) {
-          this._removedAccepted.emit(invitation.get());
-        }
-      });
+      invitation.subscribe(next, close, close);
     });
   }
-  async authenticate({ invitationId, authCode }) {
-    (0, import_log6.log)("authenticating...", void 0, {
-      F: __dxlog_file8,
-      L: 160,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    (0, import_invariant7.invariant)(invitationId, void 0, {
-      F: __dxlog_file8,
-      L: 161,
-      S: this,
-      A: [
-        "invitationId",
-        ""
-      ]
-    });
-    const observable = this._acceptInvitations.get(invitationId);
-    if (!observable) {
-      import_log6.log.warn("invalid invitation", {
-        invitationId
-      }, {
-        F: __dxlog_file8,
-        L: 164,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    } else {
-      await observable.authenticate(authCode);
-    }
+  async authenticate(request) {
+    return this._invitationsManager.authenticate(request);
   }
-  async cancelInvitation({ invitationId }) {
-    (0, import_log6.log)("cancelInvitation...", {
-      invitationId
-    }, {
-      F: __dxlog_file8,
-      L: 171,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    (0, import_invariant7.invariant)(invitationId, void 0, {
-      F: __dxlog_file8,
-      L: 172,
-      S: this,
-      A: [
-        "invitationId",
-        ""
-      ]
-    });
-    const created = this._createInvitations.get(invitationId);
-    const accepted = this._acceptInvitations.get(invitationId);
-    if (created) {
-      await created.cancel();
-      this._createInvitations.delete(invitationId);
-      this._removedCreated.emit(created.get());
-      if (created.get().persistent) {
-        await this._metadataStore.removeInvitation(created.get().invitationId);
-      }
-    } else if (accepted) {
-      await accepted.cancel();
-      this._acceptInvitations.delete(invitationId);
-      this._removedAccepted.emit(accepted.get());
-    }
+  async cancelInvitation(request) {
+    return this._invitationsManager.cancelInvitation(request);
   }
   queryInvitations() {
     return new import_codec_protobuf8.Stream(({ next, ctx }) => {
-      this._invitationCreated.on(ctx, (invitation) => {
+      this._invitationsManager.invitationCreated.on(ctx, (invitation) => {
         next({
           action: import_services5.QueryInvitationsResponse.Action.ADDED,
           type: import_services5.QueryInvitationsResponse.Type.CREATED,
@@ -2581,7 +2481,7 @@ var InvitationsServiceImpl = class {
           ]
         });
       });
-      this._invitationAccepted.on(ctx, (invitation) => {
+      this._invitationsManager.invitationAccepted.on(ctx, (invitation) => {
         next({
           action: import_services5.QueryInvitationsResponse.Action.ADDED,
           type: import_services5.QueryInvitationsResponse.Type.ACCEPTED,
@@ -2590,7 +2490,7 @@ var InvitationsServiceImpl = class {
           ]
         });
       });
-      this._removedCreated.on(ctx, (invitation) => {
+      this._invitationsManager.removedCreated.on(ctx, (invitation) => {
         next({
           action: import_services5.QueryInvitationsResponse.Action.REMOVED,
           type: import_services5.QueryInvitationsResponse.Type.CREATED,
@@ -2599,7 +2499,7 @@ var InvitationsServiceImpl = class {
           ]
         });
       });
-      this._removedAccepted.on(ctx, (invitation) => {
+      this._invitationsManager.removedAccepted.on(ctx, (invitation) => {
         next({
           action: import_services5.QueryInvitationsResponse.Action.REMOVED,
           type: import_services5.QueryInvitationsResponse.Type.ACCEPTED,
@@ -2608,7 +2508,7 @@ var InvitationsServiceImpl = class {
           ]
         });
       });
-      this._saved.on(ctx, (invitation) => {
+      this._invitationsManager.saved.on(ctx, (invitation) => {
         next({
           action: import_services5.QueryInvitationsResponse.Action.SAVED,
           type: import_services5.QueryInvitationsResponse.Type.CREATED,
@@ -2620,32 +2520,25 @@ var InvitationsServiceImpl = class {
       next({
         action: import_services5.QueryInvitationsResponse.Action.ADDED,
         type: import_services5.QueryInvitationsResponse.Type.CREATED,
-        invitations: Array.from(this._createInvitations.values()).map((invitation) => invitation.get()),
+        invitations: this._invitationsManager.getCreatedInvitations(),
         existing: true
       });
       next({
         action: import_services5.QueryInvitationsResponse.Action.ADDED,
         type: import_services5.QueryInvitationsResponse.Type.ACCEPTED,
-        invitations: Array.from(this._acceptInvitations.values()).map((invitation) => invitation.get()),
+        invitations: this._invitationsManager.getAcceptedInvitations(),
         existing: true
       });
-      if (this._persistentInvitationsLoaded) {
+      this._invitationsManager.onPersistentInvitationsLoaded(ctx, () => {
         next({
           action: import_services5.QueryInvitationsResponse.Action.LOAD_COMPLETE,
           type: import_services5.QueryInvitationsResponse.Type.CREATED
         });
-      } else {
-        this._persistentInvitationsLoadedEvent.on(ctx, () => {
-          next({
-            action: import_services5.QueryInvitationsResponse.Action.LOAD_COMPLETE,
-            type: import_services5.QueryInvitationsResponse.Type.CREATED
-          });
-        });
-      }
+      });
     });
   }
 };
-var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
+var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -2666,8 +2559,8 @@ var SpaceInvitationProtocol = class {
     };
   }
   async admit(request, guestProfile) {
-    (0, import_invariant8.invariant)(this._spaceKey, void 0, {
-      F: __dxlog_file9,
+    (0, import_invariant7.invariant)(this._spaceKey, void 0, {
+      F: __dxlog_file8,
       L: 47,
       S: this,
       A: [
@@ -2676,8 +2569,8 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const space = await this._spaceManager.spaces.get(this._spaceKey);
-    (0, import_invariant8.invariant)(space, void 0, {
-      F: __dxlog_file9,
+    (0, import_invariant7.invariant)(space, void 0, {
+      F: __dxlog_file8,
       L: 49,
       S: this,
       A: [
@@ -2685,8 +2578,8 @@ var SpaceInvitationProtocol = class {
         ""
       ]
     });
-    (0, import_invariant8.invariant)(request.space, void 0, {
-      F: __dxlog_file9,
+    (0, import_invariant7.invariant)(request.space, void 0, {
+      F: __dxlog_file8,
       L: 51,
       S: this,
       A: [
@@ -2695,18 +2588,18 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { identityKey, deviceKey } = request.space;
-    (0, import_log7.log)("writing guest credentials", {
+    (0, import_log6.log)("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
-      F: __dxlog_file9,
+      F: __dxlog_file8,
       L: 54,
       S: this,
       C: (f, a) => f(...a)
     });
     const credentials = await (0, import_credentials8.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
-    (0, import_invariant8.invariant)(credentials[0].credential, void 0, {
-      F: __dxlog_file9,
+    (0, import_invariant7.invariant)(credentials[0].credential, void 0, {
+      F: __dxlog_file8,
       L: 65,
       S: this,
       A: [
@@ -2715,8 +2608,8 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const spaceMemberCredential = credentials[0].credential.credential;
-    (0, import_invariant8.invariant)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file9,
+    (0, import_invariant7.invariant)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file8,
       L: 67,
       S: this,
       A: [
@@ -2755,8 +2648,8 @@ var SpaceInvitationProtocol = class {
     };
   }
   async accept(response) {
-    (0, import_invariant8.invariant)(response.space, void 0, {
-      F: __dxlog_file9,
+    (0, import_invariant7.invariant)(response.space, void 0, {
+      F: __dxlog_file8,
       L: 107,
       S: this,
       A: [
@@ -2766,8 +2659,8 @@ var SpaceInvitationProtocol = class {
     });
     const { credential, controlTimeframe, dataTimeframe } = response.space;
     const assertion = (0, import_credentials8.getCredentialAssertion)(credential);
-    (0, import_invariant8.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
-      F: __dxlog_file9,
+    (0, import_invariant7.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
+      F: __dxlog_file8,
       L: 110,
       S: this,
       A: [
@@ -2775,8 +2668,8 @@ var SpaceInvitationProtocol = class {
         "'Invalid credential'"
       ]
     });
-    (0, import_invariant8.invariant)(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
-      F: __dxlog_file9,
+    (0, import_invariant7.invariant)(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
+      F: __dxlog_file8,
       L: 111,
       S: this,
       A: [
@@ -2799,6 +2692,221 @@ var SpaceInvitationProtocol = class {
     };
   }
 };
+var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
+var InvitationsManager = class {
+  constructor(_invitationsHandler, _getHandler, _metadataStore) {
+    this._invitationsHandler = _invitationsHandler;
+    this._getHandler = _getHandler;
+    this._metadataStore = _metadataStore;
+    this._createInvitations = /* @__PURE__ */ new Map();
+    this._acceptInvitations = /* @__PURE__ */ new Map();
+    this.invitationCreated = new import_async9.Event();
+    this.invitationAccepted = new import_async9.Event();
+    this.removedCreated = new import_async9.Event();
+    this.removedAccepted = new import_async9.Event();
+    this.saved = new import_async9.Event();
+    this._persistentInvitationsLoadedEvent = new import_async9.Event();
+    this._persistentInvitationsLoaded = false;
+  }
+  createInvitation(options) {
+    const existingInvitation = this._createInvitations.get(options.invitationId);
+    if (existingInvitation) {
+      return existingInvitation;
+    }
+    const handler = this._getHandler(options);
+    const invitation = this._invitationsHandler.createInvitation(handler, options);
+    this._createInvitations.set(invitation.get().invitationId, invitation);
+    this.invitationCreated.emit(invitation.get());
+    const saveInvitationTask = invitation.get().persistent ? this._safePersistInBackground(invitation) : Promise.resolve();
+    this._onInvitationComplete(invitation, async () => {
+      this._createInvitations.delete(invitation.get().invitationId);
+      this.removedCreated.emit(invitation.get());
+      if (invitation.get().persistent) {
+        await saveInvitationTask;
+        await this._safeDeleteInvitation(invitation.get());
+      }
+    });
+    return invitation;
+  }
+  async loadPersistentInvitations() {
+    if (this._persistentInvitationsLoaded) {
+      const invitations = this.getCreatedInvitations().filter((i) => i.persistent);
+      return {
+        invitations
+      };
+    }
+    try {
+      const persistentInvitations = this._metadataStore.getInvitations();
+      const freshInvitations = persistentInvitations.filter((invitation) => !(0, import_echo_pipeline.hasInvitationExpired)(invitation));
+      const cInvitations = freshInvitations.map((persistentInvitation) => {
+        (0, import_invariant8.invariant)(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
+          F: __dxlog_file9,
+          L: 82,
+          S: this,
+          A: [
+            "!this._createInvitations.get(persistentInvitation.invitationId)",
+            "'invitation already exists'"
+          ]
+        });
+        return this.createInvitation({
+          ...persistentInvitation,
+          persistent: false
+        }).get();
+      });
+      return {
+        invitations: cInvitations
+      };
+    } catch (err) {
+      import_log7.log.catch(err, void 0, {
+        F: __dxlog_file9,
+        L: 88,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return {
+        invitations: []
+      };
+    } finally {
+      this._persistentInvitationsLoadedEvent.emit();
+      this._persistentInvitationsLoaded = true;
+    }
+  }
+  acceptInvitation(request) {
+    const options = request.invitation;
+    const existingInvitation = this._acceptInvitations.get(options.invitationId);
+    if (existingInvitation) {
+      return existingInvitation;
+    }
+    const handler = this._getHandler(options);
+    const invitation = this._invitationsHandler.acceptInvitation(handler, options, request.deviceProfile);
+    this._acceptInvitations.set(invitation.get().invitationId, invitation);
+    this.invitationAccepted.emit(invitation.get());
+    this._onInvitationComplete(invitation, () => {
+      this._acceptInvitations.delete(invitation.get().invitationId);
+      this.removedAccepted.emit(invitation.get());
+    });
+    return invitation;
+  }
+  async authenticate({ invitationId, authCode }) {
+    (0, import_log7.log)("authenticating...", void 0, {
+      F: __dxlog_file9,
+      L: 117,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    (0, import_invariant8.invariant)(invitationId, void 0, {
+      F: __dxlog_file9,
+      L: 118,
+      S: this,
+      A: [
+        "invitationId",
+        ""
+      ]
+    });
+    const observable = this._acceptInvitations.get(invitationId);
+    if (!observable) {
+      import_log7.log.warn("invalid invitation", {
+        invitationId
+      }, {
+        F: __dxlog_file9,
+        L: 121,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    } else {
+      await observable.authenticate(authCode);
+    }
+  }
+  async cancelInvitation({ invitationId }) {
+    (0, import_log7.log)("cancelInvitation...", {
+      invitationId
+    }, {
+      F: __dxlog_file9,
+      L: 128,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    (0, import_invariant8.invariant)(invitationId, void 0, {
+      F: __dxlog_file9,
+      L: 129,
+      S: this,
+      A: [
+        "invitationId",
+        ""
+      ]
+    });
+    const created = this._createInvitations.get(invitationId);
+    if (created) {
+      if (created.get().persistent) {
+        await this._metadataStore.removeInvitation(invitationId);
+      }
+      await created.cancel();
+      this._createInvitations.delete(invitationId);
+      this.removedCreated.emit(created.get());
+      return;
+    }
+    const accepted = this._acceptInvitations.get(invitationId);
+    if (accepted) {
+      await accepted.cancel();
+      this._acceptInvitations.delete(invitationId);
+      this.removedAccepted.emit(accepted.get());
+    }
+  }
+  getCreatedInvitations() {
+    return [
+      ...this._createInvitations.values()
+    ].map((i) => i.get());
+  }
+  getAcceptedInvitations() {
+    return [
+      ...this._acceptInvitations.values()
+    ].map((i) => i.get());
+  }
+  onPersistentInvitationsLoaded(ctx, callback) {
+    if (this._persistentInvitationsLoaded) {
+      callback();
+    } else {
+      this._persistentInvitationsLoadedEvent.once(ctx, () => callback());
+    }
+  }
+  _safePersistInBackground(invitation) {
+    return new Promise((resolve) => {
+      setTimeout(async () => {
+        try {
+          await this._metadataStore.addInvitation(invitation.get());
+          this.saved.emit(invitation.get());
+        } catch (err) {
+          import_log7.log.catch(err, void 0, {
+            F: __dxlog_file9,
+            L: 173,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          await invitation.cancel();
+        } finally {
+          resolve();
+        }
+      });
+    });
+  }
+  async _safeDeleteInvitation(invitation) {
+    try {
+      await this._metadataStore.removeInvitation(invitation.invitationId);
+    } catch (err) {
+      import_log7.log.catch(err, void 0, {
+        F: __dxlog_file9,
+        L: 186,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
+  }
+  _onInvitationComplete(invitation, callback) {
+    invitation.subscribe(() => {
+    }, () => {
+    }, callback);
+  }
+};
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -2915,7 +3023,7 @@ var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
 var WRITER_NOT_SET_ERROR_CODE = "WRITER_NOT_SET";
 var NotarizationPlugin = class {
   constructor() {
-    this._ctx = new import_context8.Context();
+    this._ctx = new import_context7.Context();
     this._extensionOpened = new import_async12.Event();
     this._extensions = /* @__PURE__ */ new Set();
     this._processedCredentials = new import_util5.ComplexSet(import_keys8.PublicKey.hash);
@@ -3040,7 +3148,7 @@ var NotarizationPlugin = class {
     this._extensionOpened.on(ctx, () => notarizeTask.schedule());
     try {
       await Promise.race([
-        (0, import_context8.rejectOnDispose)(ctx),
+        (0, import_context7.rejectOnDispose)(ctx),
         allNotarized,
         errors.wait()
       ]);
@@ -3179,7 +3287,7 @@ function _ts_decorate4(decorators, target, key, desc) {
 var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
 var DataSpace = class {
   constructor(params) {
-    this._ctx = new import_context7.Context();
+    this._ctx = new import_context6.Context();
     this._notarizationPlugin = new NotarizationPlugin();
     this._cache = void 0;
     this._automergeSpaceState = new AutomergeSpaceState((rootUrl) => this._onNewAutomergeRoot(rootUrl));
@@ -3252,7 +3360,7 @@ var DataSpace = class {
     await this._notarizationPlugin.open();
     await this._inner.spaceState.addCredentialProcessor(this._notarizationPlugin);
     await this._inner.spaceState.addCredentialProcessor(this._automergeSpaceState);
-    await this._inner.open(new import_context7.Context());
+    await this._inner.open(new import_context6.Context());
     this._state = import_services7.SpaceState.CONTROL_ONLY;
     (0, import_log8.log)("new state", {
       state: import_services7.SpaceState[this._state]
@@ -3281,7 +3389,7 @@ var DataSpace = class {
       C: (f, a) => f(...a)
     });
     await this._ctx.dispose();
-    this._ctx = new import_context7.Context();
+    this._ctx = new import_context6.Context();
     await this.authVerifier.close();
     await this._inner.close();
     await this._inner.spaceState.removeCredentialProcessor(this._automergeSpaceState);
@@ -3305,7 +3413,7 @@ var DataSpace = class {
         this.metrics.pipelineInitBegin = /* @__PURE__ */ new Date();
         await this.initializeDataPipeline();
       } catch (err) {
-        if (err instanceof import_protocols7.CancelledError || err instanceof import_context7.ContextDisposedError) {
+        if (err instanceof import_protocols7.CancelledError || err instanceof import_context6.ContextDisposedError) {
           (0, import_log8.log)("data pipeline initialization cancelled", err, {
             F: __dxlog_file11,
             L: 245,
@@ -3352,7 +3460,7 @@ var DataSpace = class {
     await this._initializeAndReadControlPipeline();
     await (0, import_async10.sleep)(1);
     this._automergeSpaceState.startProcessingRootDocs();
-    await (0, import_context7.cancelWithContext)(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
+    await (0, import_context6.cancelWithContext)(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
     (0, import_log8.log)("data pipeline ready", void 0, {
       F: __dxlog_file11,
       L: 279,
@@ -3387,7 +3495,7 @@ var DataSpace = class {
     });
     this.stateUpdate.emit();
     if (!this.notarizationPlugin.hasWriter) {
-      this.notarizationPlugin.setWriter((0, import_echo_pipeline.createMappedFeedWriter)((credential) => ({
+      this.notarizationPlugin.setWriter((0, import_echo_pipeline2.createMappedFeedWriter)((credential) => ({
         credential: {
           credential
         }
@@ -3453,7 +3561,7 @@ var DataSpace = class {
     queueMicrotask(async () => {
       try {
         await (0, import_debug3.warnAfterTimeout)(5e3, "Automerge root doc load timeout (DataSpace)", async () => {
-          await (0, import_context7.cancelWithContext)(this._ctx, handle.whenReady());
+          await (0, import_context6.cancelWithContext)(this._ctx, handle.whenReady());
         });
         if (this._ctx.disposed) {
           return;
@@ -3467,7 +3575,7 @@ var DataSpace = class {
           });
         }
       } catch (err) {
-        if (err instanceof import_context7.ContextDisposedError) {
+        if (err instanceof import_context6.ContextDisposedError) {
           return;
         }
         import_log8.log.warn("error loading automerge root doc", {
@@ -3527,7 +3635,7 @@ var DataSpace = class {
         {
           const currentRootUrl = this._automergeSpaceState.rootUrl;
           const rootHandle = this._automergeHost.repo.find(currentRootUrl);
-          await (0, import_context7.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
+          await (0, import_context6.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
           const newRoot = this._automergeHost.repo.create(rootHandle.docSync());
           (0, import_invariant9.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file11,
@@ -3556,7 +3664,7 @@ var DataSpace = class {
           });
           const currentRootUrl = this._automergeSpaceState.rootUrl;
           const rootHandle = this._automergeHost.repo.find(currentRootUrl);
-          await (0, import_context7.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
+          await (0, import_context6.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
           const objects = Object.entries(rootHandle.docSync().objects);
           const properties = objects.find(([_, value]) => value.system.type?.itemId === import_echo_db.TYPE_PROPERTIES);
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
@@ -3585,7 +3693,7 @@ var DataSpace = class {
               ""
             ]
           });
-          const docLoader = new import_echo_pipeline2.AutomergeDocumentLoaderImpl(this.key, this._automergeHost.repo);
+          const docLoader = new import_echo_pipeline3.AutomergeDocumentLoaderImpl(this.key, this._automergeHost.repo);
           await docLoader.loadSpaceRootDocHandle(this._ctx, {
             rootUrl: newRoot.url
           });
@@ -3784,7 +3892,7 @@ var DataSpaceManager = class {
     this._signingContext = _signingContext;
     this._feedStore = _feedStore;
     this._automergeHost = _automergeHost;
-    this._ctx = new import_context9.Context();
+    this._ctx = new import_context8.Context();
     this.updated = new import_async13.Event();
     this._spaces = new import_util6.ComplexMap(import_keys9.PublicKey.hash);
     this._isOpen = false;
@@ -3973,7 +4081,7 @@ var DataSpaceManager = class {
   * TODO(dmaretskyi): Consider removing.
   */
   async waitUntilSpaceReady(spaceKey) {
-    await (0, import_context9.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
+    await (0, import_context8.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
       return !!space && space.state === import_services8.SpaceState.READY;
     }));
@@ -4396,7 +4504,7 @@ function _ts_decorate6(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
-var ServiceContext = class extends import_context10.Resource {
+var ServiceContext = class extends import_context9.Resource {
   constructor(storage, level, networkManager, signalManager, _runtimeParams) {
     super();
     this.storage = storage;
@@ -4407,8 +4515,8 @@ var ServiceContext = class extends import_context10.Resource {
     this.initialized = new import_async15.Trigger();
     this._handlerFactories = /* @__PURE__ */ new Map();
     this._instanceId = import_keys10.PublicKey.random().toHex();
-    this.metadataStore = new import_echo_pipeline3.MetadataStore(storage.createDirectory("metadata"));
-    this.snapshotStore = new import_echo_pipeline3.SnapshotStore(storage.createDirectory("snapshots"));
+    this.metadataStore = new import_echo_pipeline4.MetadataStore(storage.createDirectory("metadata"));
+    this.snapshotStore = new import_echo_pipeline4.SnapshotStore(storage.createDirectory("snapshots"));
     this.blobStore = new import_teleport_extension_object_sync.BlobStore(storage.createDirectory("blobs"));
     this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
     this.feedStore = new import_feed_store4.FeedStore({
@@ -4416,12 +4524,12 @@ var ServiceContext = class extends import_context10.Resource {
         root: storage.createDirectory("feeds"),
         signer: this.keyring,
         hypercore: {
-          valueEncoding: import_echo_pipeline3.valueEncoding,
+          valueEncoding: import_echo_pipeline4.valueEncoding,
           stats: true
         }
       })
     });
-    this.spaceManager = new import_echo_pipeline3.SpaceManager({
+    this.spaceManager = new import_echo_pipeline4.SpaceManager({
       feedStore: this.feedStore,
       networkManager: this.networkManager,
       blobStore: this.blobStore,
@@ -4432,26 +4540,31 @@ var ServiceContext = class extends import_context10.Resource {
     this.indexMetadata = new import_indexing.IndexMetadataStore({
       db: level.sublevel("index-metadata")
     });
-    this.automergeHost = new import_echo_pipeline3.AutomergeHost({
+    this.automergeHost = new import_echo_pipeline4.AutomergeHost({
       directory: storage.createDirectory("automerge"),
-      metadata: this.indexMetadata
+      db: level.sublevel("automerge"),
+      storageCallbacks: (0, import_indexing.createStorageCallbacks)({
+        host: () => this.automergeHost,
+        metadata: this.indexMetadata
+      })
     });
     this.indexer = new import_indexing.Indexer({
       indexStore: new import_indexing.IndexStore({
-        directory: storage.createDirectory("index-store")
+        db: level.sublevel("index-storage")
       }),
       metadataStore: this.indexMetadata,
       loadDocuments: createSelectedDocumentsIterator(this.automergeHost),
       getAllDocuments: createDocumentsIterator(this.automergeHost)
     });
     this.invitations = new InvitationsHandler(this.networkManager);
+    this.invitationsManager = new InvitationsManager(this.invitations, (invitation) => this.getInvitationHandler(invitation), this.metadataStore);
     this._handlerFactories.set(import_services10.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? (0, import_debug6.failUndefined)(), this._acceptIdentity.bind(this)));
   }
   async _open(ctx) {
     await this._checkStorageVersion();
     (0, import_log12.log)("opening...", void 0, {
       F: __dxlog_file14,
-      L: 156,
+      L: 164,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4459,29 +4572,39 @@ var ServiceContext = class extends import_context10.Resource {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 157,
+      L: 165,
       S: this,
       C: (f, a) => f(...a)
     });
     await this.signalManager.open();
     await this.networkManager.open();
+    await this.automergeHost.open();
     await this.metadataStore.load();
     await this.spaceManager.open();
     await this.identityManager.open(ctx);
     if (this.identityManager.identity) {
       await this._initialize(ctx);
     }
+    const loadedInvitations = await this.invitationsManager.loadPersistentInvitations();
+    (0, import_log12.log)("loaded persistent invitations", {
+      count: loadedInvitations.invitations?.length
+    }, {
+      F: __dxlog_file14,
+      L: 178,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     import_log12.log.trace("dxos.sdk.service-context.open", import_protocols11.trace.end({
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 167,
+      L: 180,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_log12.log)("opened", void 0, {
       F: __dxlog_file14,
-      L: 168,
+      L: 181,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4489,7 +4612,7 @@ var ServiceContext = class extends import_context10.Resource {
   async _close() {
     (0, import_log12.log)("closing...", void 0, {
       F: __dxlog_file14,
-      L: 172,
+      L: 185,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4507,21 +4630,21 @@ var ServiceContext = class extends import_context10.Resource {
     await this.indexer.destroy();
     (0, import_log12.log)("closed", void 0, {
       F: __dxlog_file14,
-      L: 185,
+      L: 198,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async createIdentity(params = {}) {
     const identity = await this.identityManager.createIdentity(params);
-    await this._initialize(new import_context10.Context());
+    await this._initialize(new import_context9.Context());
     return identity;
   }
   getInvitationHandler(invitation) {
     const factory = this._handlerFactories.get(invitation.kind);
     (0, import_invariant13.invariant)(factory, `Unknown invitation kind: ${invitation.kind}`, {
       F: __dxlog_file14,
-      L: 196,
+      L: 209,
       S: this,
       A: [
         "factory",
@@ -4540,7 +4663,7 @@ var ServiceContext = class extends import_context10.Resource {
   }
   async _acceptIdentity(params) {
     const identity = await this.identityManager.acceptIdentity(params);
-    await this._initialize(new import_context10.Context());
+    await this._initialize(new import_context9.Context());
     return identity;
   }
   async _checkStorageVersion() {
@@ -4553,7 +4676,7 @@ var ServiceContext = class extends import_context10.Resource {
   async _initialize(ctx) {
     (0, import_log12.log)("initializing spaces...", void 0, {
       F: __dxlog_file14,
-      L: 227,
+      L: 240,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4576,7 +4699,7 @@ var ServiceContext = class extends import_context10.Resource {
     this._handlerFactories.set(import_services10.Invitation.Kind.SPACE, (invitation) => {
       (0, import_invariant13.invariant)(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
         F: __dxlog_file14,
-        L: 251,
+        L: 264,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -4600,7 +4723,7 @@ var ServiceContext = class extends import_context10.Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 267,
+            L: 280,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4611,7 +4734,7 @@ var ServiceContext = class extends import_context10.Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 271,
+            L: 284,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4622,7 +4745,7 @@ var ServiceContext = class extends import_context10.Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 276,
+            L: 289,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4633,7 +4756,7 @@ var ServiceContext = class extends import_context10.Resource {
         } catch (err) {
           import_log12.log.catch(err, void 0, {
             F: __dxlog_file14,
-            L: 282,
+            L: 295,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4675,7 +4798,7 @@ var ServiceRegistry = class {
     delete this._handlers[name];
   }
 };
-var DXOS_VERSION = "0.4.10-main.c42bfdb";
+var DXOS_VERSION = "0.4.10-main.c75170d";
 var getPlatform = () => {
   if (process.browser) {
     if (typeof window !== "undefined") {
@@ -5151,7 +5274,7 @@ var toStorageType = (type) => {
 };
 var createLevel = async (config) => {
   const persistent = isPersistent(config);
-  const storagePath = persistent ? getRootPath(config) : import_node_path.default.join("tmp", "level", import_keys13.PublicKey.random().toHex());
+  const storagePath = persistent ? import_node_path.default.join(getRootPath(config), "level") : `/tmp/dxos-${import_keys13.PublicKey.random().toHex()}`;
   const level = new import_level.Level(storagePath);
   await level.open();
   return level;
@@ -5225,6 +5348,7 @@ var ClientServicesHost = class {
     transportFactory,
     signalManager,
     storage,
+    level,
     // TODO(wittjosiah): Turn this on by default.
     lockKey,
     callbacks,
@@ -5235,6 +5359,7 @@ var ClientServicesHost = class {
     this._opening = false;
     this._open = false;
     this._storage = storage;
+    this._level = level;
     this._callbacks = callbacks;
     this._runtimeParams = runtimeParams;
     if (config) {
@@ -5249,7 +5374,7 @@ var ClientServicesHost = class {
         lockKey,
         onAcquire: () => {
           if (!this._opening) {
-            void this.open(new import_context11.Context());
+            void this.open(new import_context10.Context());
           }
         },
         onRelease: () => this.close()
@@ -5306,7 +5431,7 @@ var ClientServicesHost = class {
   initialize({ config, ...options }) {
     (0, import_invariant15.invariant)(!this._open, "service host is open", {
       F: __dxlog_file18,
-      L: 188,
+      L: 197,
       S: this,
       A: [
         "!this._open",
@@ -5315,14 +5440,14 @@ var ClientServicesHost = class {
     });
     (0, import_log13.log)("initializing...", void 0, {
       F: __dxlog_file18,
-      L: 189,
+      L: 198,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
       (0, import_invariant15.invariant)(!this._config, "config already set", {
         F: __dxlog_file18,
-        L: 192,
+        L: 201,
         S: this,
         A: [
           "!this._config",
@@ -5337,7 +5462,7 @@ var ClientServicesHost = class {
     if (!options.signalManager) {
       import_log13.log.warn("running signaling without telemetry metadata.", void 0, {
         F: __dxlog_file18,
-        L: 200,
+        L: 209,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -5348,7 +5473,7 @@ var ClientServicesHost = class {
     this._signalManager = signalManager;
     (0, import_invariant15.invariant)(!this._networkManager, "network manager already set", {
       F: __dxlog_file18,
-      L: 211,
+      L: 220,
       S: this,
       A: [
         "!this._networkManager",
@@ -5362,7 +5487,7 @@ var ClientServicesHost = class {
     });
     (0, import_log13.log)("initialized", void 0, {
       F: __dxlog_file18,
-      L: 218,
+      L: 227,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5376,13 +5501,13 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file18,
-      L: 229,
+      L: 238,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant15.invariant)(this._config, "config not set", {
       F: __dxlog_file18,
-      L: 231,
+      L: 240,
       S: this,
       A: [
         "this._config",
@@ -5391,7 +5516,7 @@ var ClientServicesHost = class {
     });
     (0, import_invariant15.invariant)(this._storage, "storage not set", {
       F: __dxlog_file18,
-      L: 232,
+      L: 241,
       S: this,
       A: [
         "this._storage",
@@ -5400,7 +5525,7 @@ var ClientServicesHost = class {
     });
     (0, import_invariant15.invariant)(this._signalManager, "signal manager not set", {
       F: __dxlog_file18,
-      L: 233,
+      L: 242,
       S: this,
       A: [
         "this._signalManager",
@@ -5409,7 +5534,7 @@ var ClientServicesHost = class {
     });
     (0, import_invariant15.invariant)(this._networkManager, "network manager not set", {
       F: __dxlog_file18,
-      L: 234,
+      L: 243,
       S: this,
       A: [
         "this._networkManager",
@@ -5421,26 +5546,27 @@ var ClientServicesHost = class {
       lockKey: this._resourceLock?.lockKey
     }, {
       F: __dxlog_file18,
-      L: 237,
+      L: 246,
       S: this,
       C: (f, a) => f(...a)
     });
     if (!this._level) {
       this._level = await createLevel(this._config.get("runtime.client.storage", {}));
     }
+    await this._level.open();
     await this._resourceLock?.acquire();
     await this._loggingService.open();
     this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._runtimeParams);
     this._serviceRegistry.setServices({
       SystemService: this._systemService,
       IdentityService: new IdentityServiceImpl((params) => this._createIdentity(params), this._serviceContext.identityManager, this._serviceContext.keyring, (profile) => this._serviceContext.broadcastProfileUpdate(profile)),
-      InvitationsService: new InvitationsServiceImpl(this._serviceContext.invitations, (invitation) => this._serviceContext.getInvitationHandler(invitation), this._serviceContext.metadataStore),
+      InvitationsService: new InvitationsServiceImpl(this._serviceContext.invitationsManager),
       DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
       SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, async () => {
         await this._serviceContext.initialized.wait();
         return this._serviceContext.dataSpaceManager;
       }),
-      DataService: new import_echo_pipeline4.DataServiceImpl(this._serviceContext.automergeHost),
+      DataService: new import_echo_pipeline5.DataServiceImpl(this._serviceContext.automergeHost),
       IndexService: new import_indexing2.IndexServiceImpl({
         indexer: this._serviceContext.indexer,
         automergeHost: this._serviceContext.automergeHost
@@ -5456,24 +5582,6 @@ var ClientServicesHost = class {
       })
     });
     await this._serviceContext.open(ctx);
-    (0, import_invariant15.invariant)(this.serviceRegistry.services.InvitationsService, void 0, {
-      F: __dxlog_file18,
-      L: 303,
-      S: this,
-      A: [
-        "this.serviceRegistry.services.InvitationsService",
-        ""
-      ]
-    });
-    const loadedInvitations = await this.serviceRegistry.services.InvitationsService.loadPersistentInvitations();
-    (0, import_log13.log)("loaded persistent invitations", {
-      count: loadedInvitations.invitations?.length
-    }, {
-      F: __dxlog_file18,
-      L: 306,
-      S: this,
-      C: (f, a) => f(...a)
-    });
     const devtoolsProxy = this._config?.get("runtime.client.devtoolsProxy");
     if (devtoolsProxy) {
       this._devtoolsProxy = new import_websocket_rpc.WebsocketRpcClient({
@@ -5493,7 +5601,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file18,
-      L: 324,
+      L: 326,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5501,7 +5609,7 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file18,
-      L: 325,
+      L: 327,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5515,7 +5623,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file18,
-      L: 336,
+      L: 338,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5533,7 +5641,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file18,
-      L: 345,
+      L: 347,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5544,13 +5652,13 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file18,
-      L: 350,
+      L: 352,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_log13.log)("resetting...", void 0, {
       F: __dxlog_file18,
-      L: 352,
+      L: 354,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5558,7 +5666,7 @@ var ClientServicesHost = class {
     await this._storage.reset();
     (0, import_log13.log)("reset", void 0, {
       F: __dxlog_file18,
-      L: 355,
+      L: 357,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5566,7 +5674,7 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file18,
-      L: 356,
+      L: 358,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5579,7 +5687,7 @@ var ClientServicesHost = class {
     const automergeIndex = space.automergeSpaceState.rootUrl;
     (0, import_invariant15.invariant)(automergeIndex, void 0, {
       F: __dxlog_file18,
-      L: 368,
+      L: 370,
       S: this,
       A: [
         "automergeIndex",
@@ -5590,7 +5698,7 @@ var ClientServicesHost = class {
     await document.whenReady();
     const properties = {
       system: {
-        type: (0, import_echo_pipeline4.encodeReference)(E.getTypeReference(import_client_protocol4.Properties))
+        type: (0, import_echo_pipeline5.encodeReference)((0, import_echo_schema.getTypeReference)(import_client_protocol4.Properties))
       },
       data: {
         [import_client_protocol4.defaultKey]: identity.identityKey.toHex()
@@ -5674,6 +5782,7 @@ var findConfigs = () => {
   IdentityManager,
   IdentityServiceImpl,
   InvitationsHandler,
+  InvitationsManager,
   InvitationsServiceImpl,
   Lock,
   ServiceContext,
@@ -5681,6 +5790,7 @@ var findConfigs = () => {
   SpaceInvitationProtocol,
   SpacesServiceImpl,
   TrustedKeySetAuthVerifier,
+  createAdmissionKeypair,
   createAuthProvider,
   createCollectDiagnosticsBroadcastHandler,
   createCollectDiagnosticsBroadcastSender,
@@ -5688,7 +5798,6 @@ var findConfigs = () => {
   createLevel,
   createStorageObjects,
   getNetworkPeers,
-  invitationExpired,
   isLocked,
   subscribeToFeedBlocks,
   subscribeToFeeds,
@@ -5698,4 +5807,4 @@ var findConfigs = () => {
   subscribeToSpaces,
   subscribeToSwarmInfo
 });
-//# sourceMappingURL=chunk-JSVLZGJM.cjs.map
+//# sourceMappingURL=chunk-34EZSH65.cjs.map