@dxos/client-services 0.4.10-main.c42bfdb → 0.4.10-main.cb83c78

package/dist/lib/browser/{chunk-W7UANCHR.mjs → chunk-MR3A4F5A.mjs}

@@ -1282,6 +1282,7 @@ import { PushStream, scheduleTask as scheduleTask2, TimeoutError, Trigger as Tri
 import { AuthenticatingInvitation, AUTHENTICATION_CODE_LENGTH, CancellableInvitation, INVITATION_TIMEOUT } from "@dxos/client-protocol";
 import { Context as Context5 } from "@dxos/context";
 import { generatePasscode } from "@dxos/credentials";
+import { createKeyPair, sign } from "@dxos/crypto";
 import { invariant as invariant6 } from "@dxos/invariant";
 import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { log as log5 } from "@dxos/log";
@@ -1293,6 +1294,7 @@ import { AuthenticationResponse as AuthenticationResponse2 } from "@dxos/protoco
 // packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts
 import { Trigger as Trigger2 } from "@dxos/async";
 import { cancelWithContext, Context as Context4 } from "@dxos/context";
+import { randomBytes, verify } from "@dxos/crypto";
 import { invariant as invariant5 } from "@dxos/invariant";
 import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log as log4 } from "@dxos/log";
@@ -1316,6 +1318,7 @@ var InvitationHostExtension = class extends RpcExtension {
     this._callbacks = _callbacks;
     this._ctx = new Context4();
     this._remoteOptionsTrigger = new Trigger2();
+    this._challenge = void 0;
     this.invitation = void 0;
     this.guestProfile = void 0;
     this.authenticationPassed = false;
@@ -1330,7 +1333,7 @@ var InvitationHostExtension = class extends RpcExtension {
         options: async (options) => {
           invariant5(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 87,
+            L: 90,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1347,7 +1350,7 @@ var InvitationHostExtension = class extends RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 96,
+            L: 99,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1357,7 +1360,7 @@ var InvitationHostExtension = class extends RpcExtension {
               invitationId
             }, {
               F: __dxlog_file6,
-              L: 100,
+              L: 103,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1371,7 +1374,7 @@ var InvitationHostExtension = class extends RpcExtension {
             guestProfile: profile
           }, {
             F: __dxlog_file6,
-            L: 109,
+            L: 112,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1380,25 +1383,27 @@ var InvitationHostExtension = class extends RpcExtension {
             ...this.invitation,
             state: Invitation2.State.READY_FOR_AUTHENTICATION
           });
+          this._challenge = this.invitation.authMethod === Invitation2.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : void 0;
           log4.trace("dxos.sdk.invitation-handler.host.introduce", trace3.end({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 116,
+            L: 122,
             S: this,
             C: (f, a) => f(...a)
           });
           return {
-            authMethod: this.invitation.authMethod
+            authMethod: this.invitation.authMethod,
+            challenge: this._challenge
           };
         },
-        authenticate: async ({ authCode: code }) => {
+        authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = PublicKey5.random().toHex();
           log4.trace("dxos.sdk.invitation-handler.host.authenticate", trace3.begin({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 124,
+            L: 131,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1406,14 +1411,14 @@ var InvitationHostExtension = class extends RpcExtension {
             authCode: code
           }, {
             F: __dxlog_file6,
-            L: 125,
+            L: 132,
             S: this,
             C: (f, a) => f(...a)
           });
           let status = AuthenticationResponse.Status.OK;
           invariant5(this.invitation, "Invitation is not set.", {
             F: __dxlog_file6,
-            L: 128,
+            L: 135,
             S: this,
             A: [
               "this.invitation",
@@ -1424,7 +1429,7 @@ var InvitationHostExtension = class extends RpcExtension {
             case Invitation2.AuthMethod.NONE: {
               log4("authentication not required", void 0, {
                 F: __dxlog_file6,
-                L: 131,
+                L: 138,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1444,12 +1449,25 @@ var InvitationHostExtension = class extends RpcExtension {
               }
               break;
             }
+            case Invitation2.AuthMethod.KNOWN_PUBLIC_KEY: {
+              if (!this.invitation.guestKeypair) {
+                status = AuthenticationResponse.Status.INTERNAL_ERROR;
+                break;
+              }
+              const isSignatureValid = this._challenge && verify(this._challenge, Buffer.from(signedChallenge ?? []), this.invitation.guestKeypair.publicKey.asBuffer());
+              if (isSignatureValid) {
+                this.authenticationPassed = true;
+              } else {
+                status = AuthenticationResponse.Status.INVALID_SIGNATURE;
+              }
+              break;
+            }
             default: {
               log4.error("invalid authentication method", {
                 authMethod: this.invitation.authMethod
               }, {
                 F: __dxlog_file6,
-                L: 149,
+                L: 176,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1464,7 +1482,7 @@ var InvitationHostExtension = class extends RpcExtension {
             }
           }), {
             F: __dxlog_file6,
-            L: 155,
+            L: 182,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1478,14 +1496,14 @@ var InvitationHostExtension = class extends RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 161,
+            L: 188,
             S: this,
             C: (f, a) => f(...a)
           });
           try {
             invariant5(this.invitation, "Invitation is not set.", {
               F: __dxlog_file6,
-              L: 164,
+              L: 191,
               S: this,
               A: [
                 "this.invitation",
@@ -1500,7 +1518,7 @@ var InvitationHostExtension = class extends RpcExtension {
               id: traceId
             }), {
               F: __dxlog_file6,
-              L: 172,
+              L: 199,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1557,7 +1575,7 @@ var InvitationGuestExtension = class extends RpcExtension {
         options: async (options) => {
           invariant5(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 239,
+            L: 266,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1584,7 +1602,7 @@ var InvitationGuestExtension = class extends RpcExtension {
     try {
       log4("begin options", void 0, {
         F: __dxlog_file6,
-        L: 260,
+        L: 287,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1596,7 +1614,7 @@ var InvitationGuestExtension = class extends RpcExtension {
       }));
       log4("end options", void 0, {
         F: __dxlog_file6,
-        L: 263,
+        L: 290,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1610,7 +1628,7 @@ var InvitationGuestExtension = class extends RpcExtension {
     } catch (err) {
       log4("openError", err, {
         F: __dxlog_file6,
-        L: 273,
+        L: 300,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1620,7 +1638,7 @@ var InvitationGuestExtension = class extends RpcExtension {
   async onClose() {
     log4("onClose", void 0, {
       F: __dxlog_file6,
-      L: 279,
+      L: 306,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1639,11 +1657,11 @@ var InvitationsHandler = class {
     this._networkManager = _networkManager;
   }
   createInvitation(protocol, options) {
-    const { invitationId = PublicKey6.random().toHex(), type = Invitation3.Type.INTERACTIVE, authMethod = Invitation3.AuthMethod.SHARED_SECRET, state = Invitation3.State.INIT, timeout = INVITATION_TIMEOUT, swarmKey = PublicKey6.random(), persistent = true, created = /* @__PURE__ */ new Date(), lifetime = 86400 } = options ?? {};
+    const { invitationId = PublicKey6.random().toHex(), type = Invitation3.Type.INTERACTIVE, authMethod = Invitation3.AuthMethod.SHARED_SECRET, state = Invitation3.State.INIT, timeout = INVITATION_TIMEOUT, swarmKey = PublicKey6.random(), persistent = options?.authMethod !== Invitation3.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
     const authCode = options?.authCode ?? (authMethod === Invitation3.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0);
     invariant6(protocol, void 0, {
       F: __dxlog_file7,
-      L: 84,
+      L: 87,
       S: this,
       A: [
         "protocol",
@@ -1658,9 +1676,11 @@ var InvitationsHandler = class {
       swarmKey,
       authCode,
       timeout,
-      persistent,
+      persistent: persistent && type !== Invitation3.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === Invitation3.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
       created,
       lifetime,
+      multiUse,
       ...protocol.getInvitationContext()
     };
     const stream = new PushStream();
@@ -1675,7 +1695,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 109,
+        L: 115,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1700,7 +1720,7 @@ var InvitationsHandler = class {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             invariant6(deviceKey, void 0, {
               F: __dxlog_file7,
-              L: 130,
+              L: 136,
               S: this,
               A: [
                 "deviceKey",
@@ -1723,7 +1743,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 148,
+                L: 154,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1731,7 +1751,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 149,
+                L: 155,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1747,7 +1767,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 152,
+                L: 158,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1759,7 +1779,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 154,
+                L: 160,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1769,7 +1789,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 157,
+                  L: 163,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1780,7 +1800,7 @@ var InvitationsHandler = class {
               } else {
                 log5.error("failed", err, {
                   F: __dxlog_file7,
-                  L: 160,
+                  L: 166,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1791,12 +1811,12 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 163,
+                L: 169,
                 S: this,
                 C: (f, a) => f(...a)
               });
             } finally {
-              if (type !== Invitation3.Type.MULTIUSE) {
+              if (!multiUse) {
                 await swarmConnection.close();
                 await ctx.dispose();
               }
@@ -1812,7 +1832,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 178,
+              L: 184,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1823,7 +1843,7 @@ var InvitationsHandler = class {
           } else {
             log5.error("failed", err, {
               F: __dxlog_file7,
-              L: 181,
+              L: 187,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1837,7 +1857,7 @@ var InvitationsHandler = class {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
         log5.warn("invitation has already expired", void 0, {
           F: __dxlog_file7,
-          L: 192,
+          L: 198,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1888,7 +1908,7 @@ var InvitationsHandler = class {
     const { timeout = INVITATION_TIMEOUT } = invitation;
     invariant6(protocol, void 0, {
       F: __dxlog_file7,
-      L: 246,
+      L: 252,
       S: this,
       A: [
         "protocol",
@@ -1898,7 +1918,7 @@ var InvitationsHandler = class {
     if (deviceProfile) {
       invariant6(invitation.kind === Invitation3.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
         F: __dxlog_file7,
-        L: 250,
+        L: 256,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -1913,7 +1933,7 @@ var InvitationsHandler = class {
     const setState = (newData) => {
       invariant6(newData.state !== void 0, void 0, {
         F: __dxlog_file7,
-        L: 261,
+        L: 267,
         S: this,
         A: [
           "newData.state !== undefined",
@@ -1933,7 +1953,7 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             F: __dxlog_file7,
-            L: 269,
+            L: 275,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1943,7 +1963,7 @@ var InvitationsHandler = class {
         } else {
           log5.warn("auth failed", err, {
             F: __dxlog_file7,
-            L: 272,
+            L: 278,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1957,7 +1977,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 280,
+        L: 286,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1972,7 +1992,7 @@ var InvitationsHandler = class {
               currentState
             }, {
               F: __dxlog_file7,
-              L: 290,
+              L: 296,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1987,7 +2007,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 299,
+                L: 305,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1999,7 +2019,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 307,
+                L: 313,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2010,7 +2030,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 311,
+                L: 317,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2020,62 +2040,28 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 F: __dxlog_file7,
-                L: 315,
+                L: 321,
                 S: this,
                 C: (f, a) => f(...a)
               });
               invitation.authMethod = introductionResponse.authMethod;
               if (isAuthenticationRequired(invitation)) {
-                for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  log5("guest waiting for authentication code...", void 0, {
-                    F: __dxlog_file7,
-                    L: 321,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: Invitation3.State.READY_FOR_AUTHENTICATION
-                  });
-                  const authCode = await authenticated.wait({
-                    timeout
-                  });
-                  log5("sending authentication request", void 0, {
-                    F: __dxlog_file7,
-                    L: 325,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: Invitation3.State.AUTHENTICATING
-                  });
-                  const response = await extension.rpc.InvitationHostService.authenticate({
-                    authCode
-                  });
-                  if (response.status === void 0 || response.status === AuthenticationResponse2.Status.OK) {
+                switch (invitation.authMethod) {
+                  case Invitation3.AuthMethod.SHARED_SECRET:
+                    await this._handleGuestOtpAuth(extension, setState, authenticated, {
+                      timeout
+                    });
+                    break;
+                  case Invitation3.AuthMethod.KNOWN_PUBLIC_KEY:
+                    await this._handleGuestKpkAuth(extension, setState, invitation, introductionResponse);
                     break;
-                  }
-                  if (response.status === AuthenticationResponse2.Status.INVALID_OTP) {
-                    if (attempt === MAX_OTP_ATTEMPTS) {
-                      throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
-                    } else {
-                      log5("retrying invalid code", {
-                        attempt
-                      }, {
-                        F: __dxlog_file7,
-                        L: 336,
-                        S: this,
-                        C: (f, a) => f(...a)
-                      });
-                      authenticated.reset();
-                    }
-                  }
                 }
               }
               log5("request admission", {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 344,
+                L: 337,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2087,7 +2073,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 355,
+                L: 348,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2100,7 +2086,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 357,
+                L: 350,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2110,7 +2096,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 360,
+                  L: 353,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2120,7 +2106,7 @@ var InvitationsHandler = class {
               } else {
                 log5("auth failed", err, {
                   F: __dxlog_file7,
-                  L: 363,
+                  L: 356,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2131,7 +2117,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 366,
+                L: 359,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2149,7 +2135,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 377,
+              L: 370,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2159,7 +2145,7 @@ var InvitationsHandler = class {
           } else {
             log5("auth failed", err, {
               F: __dxlog_file7,
-              L: 380,
+              L: 373,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2176,7 +2162,7 @@ var InvitationsHandler = class {
       } else {
         invariant6(invitation.swarmKey, void 0, {
           F: __dxlog_file7,
-          L: 394,
+          L: 387,
           S: this,
           A: [
             "invitation.swarmKey",
@@ -2214,15 +2200,88 @@ var InvitationsHandler = class {
     });
     return observable;
   }
+  async _handleGuestOtpAuth(extension, setState, authenticated, options) {
+    for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
+      log5("guest waiting for authentication code...", void 0, {
+        F: __dxlog_file7,
+        L: 427,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: Invitation3.State.READY_FOR_AUTHENTICATION
+      });
+      const authCode = await authenticated.wait(options);
+      log5("sending authentication request", void 0, {
+        F: __dxlog_file7,
+        L: 431,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: Invitation3.State.AUTHENTICATING
+      });
+      const response = await extension.rpc.InvitationHostService.authenticate({
+        authCode
+      });
+      if (response.status === void 0 || response.status === AuthenticationResponse2.Status.OK) {
+        break;
+      }
+      if (response.status === AuthenticationResponse2.Status.INVALID_OTP) {
+        if (attempt === MAX_OTP_ATTEMPTS) {
+          throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
+        } else {
+          log5("retrying invalid code", {
+            attempt
+          }, {
+            F: __dxlog_file7,
+            L: 442,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          authenticated.reset();
+        }
+      }
+    }
+  }
+  async _handleGuestKpkAuth(extension, setState, invitation, introductionResponse) {
+    if (invitation.guestKeypair?.privateKey == null) {
+      throw new Error("keypair missing in the invitation");
+    }
+    if (introductionResponse.challenge == null) {
+      throw new Error("challenge missing in the introduction");
+    }
+    log5("sending authentication request", void 0, {
+      F: __dxlog_file7,
+      L: 461,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    setState({
+      state: Invitation3.State.AUTHENTICATING
+    });
+    const signature = sign(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
+    const response = await extension.rpc.InvitationHostService.authenticate({
+      signedChallenge: signature
+    });
+    if (response.status !== AuthenticationResponse2.Status.OK) {
+      throw new Error(`Authentication failed with code: ${response.status}`);
+    }
+  }
 };
-var invitationExpired = (invitation) => {
-  return invitation.created && invitation.lifetime && invitation.lifetime !== 0 && invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now();
+var createAdmissionKeypair = () => {
+  const keypair = createKeyPair();
+  return {
+    publicKey: PublicKey6.from(keypair.publicKey),
+    privateKey: keypair.secretKey
+  };
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
 import { Event as Event3, scheduleTask as scheduleTask3 } from "@dxos/async";
 import { Stream as Stream8 } from "@dxos/codec-protobuf";
 import { Context as Context6 } from "@dxos/context";
+import { hasInvitationExpired } from "@dxos/echo-pipeline";
 import { invariant as invariant7 } from "@dxos/invariant";
 import { log as log6 } from "@dxos/log";
 import { Invitation as Invitation4, QueryInvitationsResponse } from "@dxos/protocols/proto/dxos/client/services";
@@ -2281,7 +2340,7 @@ var InvitationsServiceImpl = class {
           await this._metadataStore.removeInvitation(invitation.get().invitationId);
         }
         this._createInvitations.delete(invitation.get().invitationId);
-        if (invitation.get().type !== Invitation4.Type.MULTIUSE) {
+        if (!invitation.get().multiUse) {
           this._removedCreated.emit(invitation.get());
         }
       });
@@ -2289,7 +2348,7 @@ var InvitationsServiceImpl = class {
   }
   async loadPersistentInvitations() {
     const persistentInvitations = this._metadataStore.getInvitations();
-    const freshInvitations = persistentInvitations.filter(async (invitation) => !invitationExpired(invitation));
+    const freshInvitations = persistentInvitations.filter(async (invitation) => !hasInvitationExpired(invitation));
     const cInvitations = freshInvitations.map((persistentInvitation) => {
       invariant7(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
         F: __dxlog_file8,
@@ -2342,7 +2401,7 @@ var InvitationsServiceImpl = class {
       }, () => {
         close();
         this._acceptInvitations.delete(invitation.get().invitationId);
-        if (invitation.get().type !== Invitation4.Type.MULTIUSE) {
+        if (!invitation.get().multiUse) {
           this._removedAccepted.emit(invitation.get());
         }
       });
@@ -4241,7 +4300,7 @@ import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credent
 import { failUndefined as failUndefined2 } from "@dxos/debug";
 import { AutomergeHost, MetadataStore, SnapshotStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
 import { FeedFactory, FeedStore } from "@dxos/feed-store";
-import { IndexMetadataStore, IndexStore, Indexer } from "@dxos/indexing";
+import { IndexMetadataStore, IndexStore, Indexer, createStorageCallbacks } from "@dxos/indexing";
 import { invariant as invariant13 } from "@dxos/invariant";
 import { Keyring } from "@dxos/keyring";
 import { PublicKey as PublicKey10 } from "@dxos/keys";
@@ -4381,11 +4440,15 @@ var ServiceContext = class extends Resource {
     });
     this.automergeHost = new AutomergeHost({
       directory: storage.createDirectory("automerge"),
-      metadata: this.indexMetadata
+      db: level.sublevel("automerge"),
+      storageCallbacks: createStorageCallbacks({
+        host: () => this.automergeHost,
+        metadata: this.indexMetadata
+      })
     });
     this.indexer = new Indexer({
       indexStore: new IndexStore({
-        directory: storage.createDirectory("index-store")
+        db: level.sublevel("index-store")
       }),
       metadataStore: this.indexMetadata,
       loadDocuments: createSelectedDocumentsIterator(this.automergeHost),
@@ -4398,7 +4461,7 @@ var ServiceContext = class extends Resource {
     await this._checkStorageVersion();
     log12("opening...", void 0, {
       F: __dxlog_file14,
-      L: 156,
+      L: 157,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4406,12 +4469,13 @@ var ServiceContext = class extends Resource {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 157,
+      L: 158,
       S: this,
       C: (f, a) => f(...a)
     });
     await this.signalManager.open();
     await this.networkManager.open();
+    await this.automergeHost.open();
     await this.metadataStore.load();
     await this.spaceManager.open();
     await this.identityManager.open(ctx);
@@ -4422,13 +4486,13 @@ var ServiceContext = class extends Resource {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 167,
+      L: 169,
       S: this,
       C: (f, a) => f(...a)
     });
     log12("opened", void 0, {
       F: __dxlog_file14,
-      L: 168,
+      L: 170,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4436,7 +4500,7 @@ var ServiceContext = class extends Resource {
   async _close() {
     log12("closing...", void 0, {
       F: __dxlog_file14,
-      L: 172,
+      L: 174,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4454,7 +4518,7 @@ var ServiceContext = class extends Resource {
     await this.indexer.destroy();
     log12("closed", void 0, {
       F: __dxlog_file14,
-      L: 185,
+      L: 187,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4468,7 +4532,7 @@ var ServiceContext = class extends Resource {
     const factory = this._handlerFactories.get(invitation.kind);
     invariant13(factory, `Unknown invitation kind: ${invitation.kind}`, {
       F: __dxlog_file14,
-      L: 196,
+      L: 198,
       S: this,
       A: [
         "factory",
@@ -4500,7 +4564,7 @@ var ServiceContext = class extends Resource {
   async _initialize(ctx) {
     log12("initializing spaces...", void 0, {
       F: __dxlog_file14,
-      L: 227,
+      L: 229,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4523,7 +4587,7 @@ var ServiceContext = class extends Resource {
     this._handlerFactories.set(Invitation6.Kind.SPACE, (invitation) => {
       invariant13(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
         F: __dxlog_file14,
-        L: 251,
+        L: 253,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -4547,7 +4611,7 @@ var ServiceContext = class extends Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 267,
+            L: 269,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4558,7 +4622,7 @@ var ServiceContext = class extends Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 271,
+            L: 273,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4569,7 +4633,7 @@ var ServiceContext = class extends Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 276,
+            L: 278,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4580,7 +4644,7 @@ var ServiceContext = class extends Resource {
         } catch (err) {
           log12.catch(err, void 0, {
             F: __dxlog_file14,
-            L: 282,
+            L: 284,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4634,7 +4698,7 @@ import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/client/s
 import { TRACE_PROCESSOR } from "@dxos/tracing";
 
 // packages/sdk/client-services/src/version.ts
-var DXOS_VERSION = "0.4.10-main.c42bfdb";
+var DXOS_VERSION = "0.4.10-main.cb83c78";
 
 // packages/sdk/client-services/src/packlets/services/platform.ts
 import { Platform } from "@dxos/protocols/proto/dxos/client/services";
@@ -4879,7 +4943,7 @@ import { Event as Event9, synchronized as synchronized3 } from "@dxos/async";
 import { clientServiceBundle, defaultKey, Properties } from "@dxos/client-protocol";
 import { Context as Context11 } from "@dxos/context";
 import { DataServiceImpl, encodeReference } from "@dxos/echo-pipeline";
-import * as E from "@dxos/echo-schema";
+import { getTypeReference } from "@dxos/echo-schema";
 import { IndexServiceImpl } from "@dxos/indexing";
 import { invariant as invariant16 } from "@dxos/invariant";
 import { PublicKey as PublicKey13 } from "@dxos/keys";
@@ -5323,7 +5387,7 @@ import path from "@dxos/node-std/path";
 import { PublicKey as PublicKey12 } from "@dxos/keys";
 var createLevel = async (config) => {
   const persistent = isPersistent(config);
-  const storagePath = persistent ? getRootPath(config) : path.join("tmp", "level", PublicKey12.random().toHex());
+  const storagePath = persistent ? path.join(getRootPath(config), "level") : `/tmp/dxos-${PublicKey12.random().toHex()}`;
   const level = new Level(storagePath);
   await level.open();
   return level;
@@ -5404,6 +5468,7 @@ var ClientServicesHost = class {
     transportFactory,
     signalManager,
     storage,
+    level,
     // TODO(wittjosiah): Turn this on by default.
     lockKey,
     callbacks,
@@ -5414,6 +5479,7 @@ var ClientServicesHost = class {
     this._opening = false;
     this._open = false;
     this._storage = storage;
+    this._level = level;
     this._callbacks = callbacks;
     this._runtimeParams = runtimeParams;
     if (config) {
@@ -5485,7 +5551,7 @@ var ClientServicesHost = class {
   initialize({ config, ...options }) {
     invariant16(!this._open, "service host is open", {
       F: __dxlog_file19,
-      L: 188,
+      L: 197,
       S: this,
       A: [
         "!this._open",
@@ -5494,14 +5560,14 @@ var ClientServicesHost = class {
     });
     log16("initializing...", void 0, {
       F: __dxlog_file19,
-      L: 189,
+      L: 198,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
       invariant16(!this._config, "config already set", {
         F: __dxlog_file19,
-        L: 192,
+        L: 201,
         S: this,
         A: [
           "!this._config",
@@ -5516,7 +5582,7 @@ var ClientServicesHost = class {
     if (!options.signalManager) {
       log16.warn("running signaling without telemetry metadata.", void 0, {
         F: __dxlog_file19,
-        L: 200,
+        L: 209,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -5527,7 +5593,7 @@ var ClientServicesHost = class {
     this._signalManager = signalManager;
     invariant16(!this._networkManager, "network manager already set", {
       F: __dxlog_file19,
-      L: 211,
+      L: 220,
       S: this,
       A: [
         "!this._networkManager",
@@ -5541,7 +5607,7 @@ var ClientServicesHost = class {
     });
     log16("initialized", void 0, {
       F: __dxlog_file19,
-      L: 218,
+      L: 227,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5555,13 +5621,13 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file19,
-      L: 229,
+      L: 238,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant16(this._config, "config not set", {
       F: __dxlog_file19,
-      L: 231,
+      L: 240,
       S: this,
       A: [
         "this._config",
@@ -5570,7 +5636,7 @@ var ClientServicesHost = class {
     });
     invariant16(this._storage, "storage not set", {
       F: __dxlog_file19,
-      L: 232,
+      L: 241,
       S: this,
       A: [
         "this._storage",
@@ -5579,7 +5645,7 @@ var ClientServicesHost = class {
     });
     invariant16(this._signalManager, "signal manager not set", {
       F: __dxlog_file19,
-      L: 233,
+      L: 242,
       S: this,
       A: [
         "this._signalManager",
@@ -5588,7 +5654,7 @@ var ClientServicesHost = class {
     });
     invariant16(this._networkManager, "network manager not set", {
       F: __dxlog_file19,
-      L: 234,
+      L: 243,
       S: this,
       A: [
         "this._networkManager",
@@ -5600,13 +5666,14 @@ var ClientServicesHost = class {
       lockKey: this._resourceLock?.lockKey
     }, {
       F: __dxlog_file19,
-      L: 237,
+      L: 246,
       S: this,
       C: (f, a) => f(...a)
     });
     if (!this._level) {
       this._level = await createLevel(this._config.get("runtime.client.storage", {}));
     }
+    await this._level.open();
     await this._resourceLock?.acquire();
     await this._loggingService.open();
     this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._runtimeParams);
@@ -5637,7 +5704,7 @@ var ClientServicesHost = class {
     await this._serviceContext.open(ctx);
     invariant16(this.serviceRegistry.services.InvitationsService, void 0, {
       F: __dxlog_file19,
-      L: 303,
+      L: 314,
       S: this,
       A: [
         "this.serviceRegistry.services.InvitationsService",
@@ -5649,7 +5716,7 @@ var ClientServicesHost = class {
       count: loadedInvitations.invitations?.length
     }, {
       F: __dxlog_file19,
-      L: 306,
+      L: 317,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5672,7 +5739,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file19,
-      L: 324,
+      L: 335,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5680,7 +5747,7 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file19,
-      L: 325,
+      L: 336,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5694,7 +5761,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file19,
-      L: 336,
+      L: 347,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5712,7 +5779,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file19,
-      L: 345,
+      L: 356,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5723,13 +5790,13 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file19,
-      L: 350,
+      L: 361,
       S: this,
       C: (f, a) => f(...a)
     });
     log16("resetting...", void 0, {
       F: __dxlog_file19,
-      L: 352,
+      L: 363,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5737,7 +5804,7 @@ var ClientServicesHost = class {
     await this._storage.reset();
     log16("reset", void 0, {
       F: __dxlog_file19,
-      L: 355,
+      L: 366,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5745,7 +5812,7 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file19,
-      L: 356,
+      L: 367,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5758,7 +5825,7 @@ var ClientServicesHost = class {
     const automergeIndex = space.automergeSpaceState.rootUrl;
     invariant16(automergeIndex, void 0, {
       F: __dxlog_file19,
-      L: 368,
+      L: 379,
       S: this,
       A: [
         "automergeIndex",
@@ -5769,7 +5836,7 @@ var ClientServicesHost = class {
     await document.whenReady();
     const properties = {
       system: {
-        type: encodeReference(E.getTypeReference(Properties))
+        type: encodeReference(getTypeReference(Properties))
       },
       data: {
         [defaultKey]: identity.identityKey.toHex()
@@ -5864,7 +5931,7 @@ export {
   IdentityServiceImpl,
   DeviceInvitationProtocol,
   InvitationsHandler,
-  invitationExpired,
+  createAdmissionKeypair,
   InvitationsServiceImpl,
   SpaceInvitationProtocol,
   ClientRpcServer,
@@ -5884,4 +5951,4 @@ export {
   ClientServicesHost,
   ClientServicesProviderResource
 };
-//# sourceMappingURL=chunk-W7UANCHR.mjs.map
+//# sourceMappingURL=chunk-MR3A4F5A.mjs.map