npm - @dxos/client-services - Versions diffs - 0.4.10-main.c5e8686 → 0.4.10-main.c9da257 - Mend

@dxos/client-services 0.4.10-main.c5e8686 → 0.4.10-main.c9da257

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (71) hide show

package/dist/lib/browser/{chunk-FUEOAPLA.mjs → chunk-NMSMHDG6.mjs} RENAMED Viewed

@@ -1086,7 +1086,9 @@ var IdentityManager = class {
           C: (f, a) => f(...a)
         });
       },
-      memberKey: identityKey
+      memberKey: identityKey,
+      onDelegatedInvitationStatusChange: async () => {
+      }
     });
   }
 };
@@ -1194,10 +1196,13 @@ var DeviceInvitationProtocol = class {
       kind: Invitation.Kind.DEVICE
     };
   }
-  async admit(request) {
+  async delegate(invitation) {
+    throw new Error("delegation not supported");
+  }
+  async admit(_, request) {
     invariant4(request.device, void 0, {
       F: __dxlog_file5,
-      L: 37,
+      L: 42,
       S: this,
       A: [
         "request.device",
@@ -1243,7 +1248,7 @@ var DeviceInvitationProtocol = class {
   async accept(response, request) {
     invariant4(response.device, void 0, {
       F: __dxlog_file5,
-      L: 82,
+      L: 87,
       S: this,
       A: [
         "response.device",
@@ -1253,7 +1258,7 @@ var DeviceInvitationProtocol = class {
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
     invariant4(request.device, void 0, {
       F: __dxlog_file5,
-      L: 85,
+      L: 90,
       S: this,
       A: [
         "request.device",
@@ -1279,9 +1284,8 @@ var DeviceInvitationProtocol = class {
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
 import { PushStream, scheduleTask as scheduleTask2, TimeoutError, Trigger as Trigger3 } from "@dxos/async";
-import { AuthenticatingInvitation, AUTHENTICATION_CODE_LENGTH, CancellableInvitation, INVITATION_TIMEOUT } from "@dxos/client-protocol";
+import { AuthenticatingInvitation, INVITATION_TIMEOUT } from "@dxos/client-protocol";
 import { Context as Context5 } from "@dxos/context";
-import { generatePasscode } from "@dxos/credentials";
 import { createKeyPair, sign } from "@dxos/crypto";
 import { invariant as invariant6 } from "@dxos/invariant";
 import { PublicKey as PublicKey6 } from "@dxos/keys";
@@ -1656,51 +1660,7 @@ var InvitationsHandler = class {
   constructor(_networkManager) {
     this._networkManager = _networkManager;
   }
-  createInvitation(protocol, options) {
-    const { invitationId = PublicKey6.random().toHex(), type = Invitation3.Type.INTERACTIVE, authMethod = Invitation3.AuthMethod.SHARED_SECRET, state = Invitation3.State.INIT, timeout = INVITATION_TIMEOUT, swarmKey = PublicKey6.random(), persistent = options?.authMethod !== Invitation3.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
-    const authCode = options?.authCode ?? (authMethod === Invitation3.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0);
-    invariant6(protocol, void 0, {
-      F: __dxlog_file7,
-      L: 87,
-      S: this,
-      A: [
-        "protocol",
-        ""
-      ]
-    });
-    const invitation = {
-      invitationId,
-      type,
-      authMethod,
-      state,
-      swarmKey,
-      authCode,
-      timeout,
-      persistent: persistent && type !== Invitation3.Type.DELEGATED,
-      guestKeypair: guestKeypair ?? (authMethod === Invitation3.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
-      created,
-      lifetime,
-      multiUse,
-      ...protocol.getInvitationContext()
-    };
-    const stream = new PushStream();
-    const ctx = new Context5({
-      onError: (err) => {
-        stream.error(err);
-        void ctx.dispose();
-      }
-    });
-    ctx.onDispose(() => {
-      log5("complete", {
-        ...protocol.toJSON()
-      }, {
-        F: __dxlog_file7,
-        L: 115,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      stream.complete();
-    });
+  handleInvitationFlow(ctx, stream, protocol, invitation) {
     const createExtension = () => {
       const extension = new InvitationHostExtension({
         onStateUpdate: (invitation2) => {
@@ -1709,8 +1669,8 @@ var InvitationsHandler = class {
             state: Invitation3.State.READY_FOR_AUTHENTICATION
           });
         },
-        resolveInvitation: async ({ invitationId: invitationId2 }) => {
-          if (invitationId2 && invitationId2 !== invitation.invitationId) {
+        resolveInvitation: async ({ invitationId }) => {
+          if (invitationId && invitationId !== invitation.invitationId) {
             return void 0;
           }
           return invitation;
@@ -1720,14 +1680,14 @@ var InvitationsHandler = class {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             invariant6(deviceKey, void 0, {
               F: __dxlog_file7,
-              L: 136,
+              L: 87,
               S: this,
               A: [
                 "deviceKey",
                 ""
               ]
             });
-            const admissionResponse = await protocol.admit(admissionRequest, extension.guestProfile);
+            const admissionResponse = await protocol.admit(invitation, admissionRequest, extension.guestProfile);
             extension.completedTrigger.wake(deviceKey);
             return admissionResponse;
           } catch (err) {
@@ -1743,7 +1703,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 154,
+                L: 105,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1751,7 +1711,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 155,
+                L: 106,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1760,14 +1720,14 @@ var InvitationsHandler = class {
                 state: Invitation3.State.CONNECTED
               });
               const deviceKey = await extension.completedTrigger.wait({
-                timeout
+                timeout: invitation.timeout
               });
               log5("admitted guest", {
                 guest: deviceKey,
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 158,
+                L: 109,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1779,7 +1739,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 160,
+                L: 111,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1789,7 +1749,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 163,
+                  L: 114,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1800,7 +1760,7 @@ var InvitationsHandler = class {
               } else {
                 log5.error("failed", err, {
                   F: __dxlog_file7,
-                  L: 166,
+                  L: 117,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1811,12 +1771,12 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 169,
+                L: 120,
                 S: this,
                 C: (f, a) => f(...a)
               });
             } finally {
-              if (!multiUse) {
+              if (!invitation.multiUse) {
                 await swarmConnection.close();
                 await ctx.dispose();
               }
@@ -1832,7 +1792,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 184,
+              L: 135,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1843,7 +1803,7 @@ var InvitationsHandler = class {
           } else {
             log5.error("failed", err, {
               F: __dxlog_file7,
-              L: 187,
+              L: 138,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1853,11 +1813,11 @@ var InvitationsHandler = class {
       });
       return extension;
     };
-    if (invitation.lifetime && invitation.created && invitation.lifetime !== 0) {
+    if (invitation.lifetime && invitation.created) {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
         log5.warn("invitation has already expired", void 0, {
           F: __dxlog_file7,
-          L: 198,
+          L: 149,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1891,24 +1851,12 @@ var InvitationsHandler = class {
         state: Invitation3.State.CONNECTING
       });
     });
-    const observable = new CancellableInvitation({
-      initialInvitation: invitation,
-      subscriber: stream.observable,
-      onCancel: async () => {
-        stream.next({
-          ...invitation,
-          state: Invitation3.State.CANCELLED
-        });
-        await ctx.dispose();
-      }
-    });
-    return observable;
   }
   acceptInvitation(protocol, invitation, deviceProfile) {
     const { timeout = INVITATION_TIMEOUT } = invitation;
     invariant6(protocol, void 0, {
       F: __dxlog_file7,
-      L: 252,
+      L: 191,
       S: this,
       A: [
         "protocol",
@@ -1918,7 +1866,7 @@ var InvitationsHandler = class {
     if (deviceProfile) {
       invariant6(invitation.kind === Invitation3.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
         F: __dxlog_file7,
-        L: 256,
+        L: 194,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -1933,7 +1881,7 @@ var InvitationsHandler = class {
     const setState = (newData) => {
       invariant6(newData.state !== void 0, void 0, {
         F: __dxlog_file7,
-        L: 267,
+        L: 205,
         S: this,
         A: [
           "newData.state !== undefined",
@@ -1953,7 +1901,7 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             F: __dxlog_file7,
-            L: 275,
+            L: 213,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1963,7 +1911,7 @@ var InvitationsHandler = class {
         } else {
           log5.warn("auth failed", err, {
             F: __dxlog_file7,
-            L: 278,
+            L: 216,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1977,7 +1925,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 286,
+        L: 224,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1992,7 +1940,7 @@ var InvitationsHandler = class {
               currentState
             }, {
               F: __dxlog_file7,
-              L: 296,
+              L: 234,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2007,7 +1955,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 305,
+                L: 243,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2019,7 +1967,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 313,
+                L: 251,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2030,7 +1978,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 317,
+                L: 255,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2040,7 +1988,7 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 F: __dxlog_file7,
-                L: 321,
+                L: 259,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2061,7 +2009,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 337,
+                L: 275,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2073,7 +2021,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 348,
+                L: 286,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2086,7 +2034,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 350,
+                L: 288,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2096,7 +2044,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 353,
+                  L: 291,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2106,7 +2054,7 @@ var InvitationsHandler = class {
               } else {
                 log5("auth failed", err, {
                   F: __dxlog_file7,
-                  L: 356,
+                  L: 294,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2117,7 +2065,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 359,
+                L: 297,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2135,7 +2083,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 370,
+              L: 308,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2145,7 +2093,7 @@ var InvitationsHandler = class {
           } else {
             log5("auth failed", err, {
               F: __dxlog_file7,
-              L: 373,
+              L: 311,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2162,7 +2110,7 @@ var InvitationsHandler = class {
       } else {
         invariant6(invitation.swarmKey, void 0, {
           F: __dxlog_file7,
-          L: 387,
+          L: 325,
           S: this,
           A: [
             "invitation.swarmKey",
@@ -2204,7 +2152,7 @@ var InvitationsHandler = class {
     for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
       log5("guest waiting for authentication code...", void 0, {
         F: __dxlog_file7,
-        L: 427,
+        L: 365,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2214,7 +2162,7 @@ var InvitationsHandler = class {
       const authCode = await authenticated.wait(options);
       log5("sending authentication request", void 0, {
         F: __dxlog_file7,
-        L: 431,
+        L: 369,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2235,7 +2183,7 @@ var InvitationsHandler = class {
             attempt
           }, {
             F: __dxlog_file7,
-            L: 442,
+            L: 380,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2253,7 +2201,7 @@ var InvitationsHandler = class {
     }
     log5("sending authentication request", void 0, {
       F: __dxlog_file7,
-      L: 461,
+      L: 399,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2278,201 +2226,36 @@ var createAdmissionKeypair = () => {
 };
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
-import { Event as Event3, scheduleTask as scheduleTask3 } from "@dxos/async";
 import { Stream as Stream8 } from "@dxos/codec-protobuf";
-import { Context as Context6 } from "@dxos/context";
-import { hasInvitationExpired } from "@dxos/echo-pipeline";
-import { invariant as invariant7 } from "@dxos/invariant";
-import { log as log6 } from "@dxos/log";
-import { Invitation as Invitation4, QueryInvitationsResponse } from "@dxos/protocols/proto/dxos/client/services";
-var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts";
+import { QueryInvitationsResponse } from "@dxos/protocols/proto/dxos/client/services";
 var InvitationsServiceImpl = class {
-  constructor(_invitationsHandler, _getHandler, _metadataStore) {
-    this._invitationsHandler = _invitationsHandler;
-    this._getHandler = _getHandler;
-    this._metadataStore = _metadataStore;
-    this._createInvitations = /* @__PURE__ */ new Map();
-    this._acceptInvitations = /* @__PURE__ */ new Map();
-    this._invitationCreated = new Event3();
-    this._invitationAccepted = new Event3();
-    this._removedCreated = new Event3();
-    this._removedAccepted = new Event3();
-    this._saved = new Event3();
-    this._persistentInvitationsLoadedEvent = new Event3();
-    this._persistentInvitationsLoaded = false;
+  constructor(_invitationsManager) {
+    this._invitationsManager = _invitationsManager;
   }
   // TODO(burdon): Guest/host label.
   getLoggingContext() {
     return {};
   }
   createInvitation(options) {
-    let invitation;
-    const savePersistentInvitationCtx = new Context6();
-    const existingInvitation = this._createInvitations.get(options.invitationId);
-    if (existingInvitation) {
-      invitation = existingInvitation;
-    } else {
-      const handler = this._getHandler(options);
-      invitation = this._invitationsHandler.createInvitation(handler, options);
-      this._createInvitations.set(invitation.get().invitationId, invitation);
-      this._invitationCreated.emit(invitation.get());
-    }
     return new Stream8(({ next, close }) => {
-      if (invitation.get().persistent) {
-        scheduleTask3(savePersistentInvitationCtx, async () => {
-          try {
-            await this._metadataStore.addInvitation(invitation.get());
-            this._saved.emit(invitation.get());
-          } catch (err) {
-            close(err);
-          }
-        });
-      }
-      invitation.subscribe((invitation2) => {
-        next(invitation2);
-      }, async (err) => {
-        await savePersistentInvitationCtx.dispose();
-        close(err);
-      }, async () => {
-        close();
-        if (invitation.get().persistent) {
-          await savePersistentInvitationCtx.dispose();
-          await this._metadataStore.removeInvitation(invitation.get().invitationId);
-        }
-        this._createInvitations.delete(invitation.get().invitationId);
-        if (!invitation.get().multiUse) {
-          this._removedCreated.emit(invitation.get());
-        }
-      });
+      void this._invitationsManager.createInvitation(options).then((invitation) => invitation.subscribe(next, close, close)).catch(close);
     });
   }
-  async loadPersistentInvitations() {
-    const persistentInvitations = this._metadataStore.getInvitations();
-    const freshInvitations = persistentInvitations.filter(async (invitation) => !hasInvitationExpired(invitation));
-    const cInvitations = freshInvitations.map((persistentInvitation) => {
-      invariant7(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
-        F: __dxlog_file8,
-        L: 109,
-        S: this,
-        A: [
-          "!this._createInvitations.get(persistentInvitation.invitationId)",
-          "'invitation already exists'"
-        ]
-      });
-      const handler = this._getHandler(persistentInvitation);
-      const invitation = this._invitationsHandler.createInvitation(handler, persistentInvitation);
-      this._createInvitations.set(invitation.get().invitationId, invitation);
-      this._invitationCreated.emit(invitation.get());
-      return persistentInvitation;
-    });
-    this._persistentInvitationsLoadedEvent.emit();
-    this._persistentInvitationsLoaded = true;
-    return {
-      invitations: cInvitations
-    };
-  }
-  acceptInvitation({ invitation: options, deviceProfile }) {
-    let invitation;
-    if (deviceProfile) {
-      invariant7(options.kind === Invitation4.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
-        F: __dxlog_file8,
-        L: 127,
-        S: this,
-        A: [
-          "options.kind === Invitation.Kind.DEVICE",
-          "'deviceProfile provided for non-device invitation'"
-        ]
-      });
-    }
-    const existingInvitation = this._acceptInvitations.get(options.invitationId);
-    if (existingInvitation) {
-      invitation = existingInvitation;
-    } else {
-      const handler = this._getHandler(options);
-      invitation = this._invitationsHandler.acceptInvitation(handler, options, deviceProfile);
-      this._acceptInvitations.set(invitation.get().invitationId, invitation);
-      this._invitationAccepted.emit(invitation.get());
-    }
+  acceptInvitation(request) {
+    const invitation = this._invitationsManager.acceptInvitation(request);
     return new Stream8(({ next, close }) => {
-      invitation.subscribe((invitation2) => {
-        next(invitation2);
-      }, (err) => {
-        close(err);
-      }, () => {
-        close();
-        this._acceptInvitations.delete(invitation.get().invitationId);
-        if (!invitation.get().multiUse) {
-          this._removedAccepted.emit(invitation.get());
-        }
-      });
+      invitation.subscribe(next, close, close);
     });
   }
-  async authenticate({ invitationId, authCode }) {
-    log6("authenticating...", void 0, {
-      F: __dxlog_file8,
-      L: 160,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    invariant7(invitationId, void 0, {
-      F: __dxlog_file8,
-      L: 161,
-      S: this,
-      A: [
-        "invitationId",
-        ""
-      ]
-    });
-    const observable = this._acceptInvitations.get(invitationId);
-    if (!observable) {
-      log6.warn("invalid invitation", {
-        invitationId
-      }, {
-        F: __dxlog_file8,
-        L: 164,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    } else {
-      await observable.authenticate(authCode);
-    }
+  async authenticate(request) {
+    return this._invitationsManager.authenticate(request);
   }
-  async cancelInvitation({ invitationId }) {
-    log6("cancelInvitation...", {
-      invitationId
-    }, {
-      F: __dxlog_file8,
-      L: 171,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    invariant7(invitationId, void 0, {
-      F: __dxlog_file8,
-      L: 172,
-      S: this,
-      A: [
-        "invitationId",
-        ""
-      ]
-    });
-    const created = this._createInvitations.get(invitationId);
-    const accepted = this._acceptInvitations.get(invitationId);
-    if (created) {
-      await created.cancel();
-      this._createInvitations.delete(invitationId);
-      this._removedCreated.emit(created.get());
-      if (created.get().persistent) {
-        await this._metadataStore.removeInvitation(created.get().invitationId);
-      }
-    } else if (accepted) {
-      await accepted.cancel();
-      this._acceptInvitations.delete(invitationId);
-      this._removedAccepted.emit(accepted.get());
-    }
+  async cancelInvitation(request) {
+    return this._invitationsManager.cancelInvitation(request);
   }
   queryInvitations() {
     return new Stream8(({ next, ctx }) => {
-      this._invitationCreated.on(ctx, (invitation) => {
+      this._invitationsManager.invitationCreated.on(ctx, (invitation) => {
         next({
           action: QueryInvitationsResponse.Action.ADDED,
           type: QueryInvitationsResponse.Type.CREATED,
@@ -2481,7 +2264,7 @@ var InvitationsServiceImpl = class {
           ]
         });
       });
-      this._invitationAccepted.on(ctx, (invitation) => {
+      this._invitationsManager.invitationAccepted.on(ctx, (invitation) => {
         next({
           action: QueryInvitationsResponse.Action.ADDED,
           type: QueryInvitationsResponse.Type.ACCEPTED,
@@ -2490,7 +2273,7 @@ var InvitationsServiceImpl = class {
           ]
         });
       });
-      this._removedCreated.on(ctx, (invitation) => {
+      this._invitationsManager.removedCreated.on(ctx, (invitation) => {
         next({
           action: QueryInvitationsResponse.Action.REMOVED,
           type: QueryInvitationsResponse.Type.CREATED,
@@ -2499,7 +2282,7 @@ var InvitationsServiceImpl = class {
           ]
         });
       });
-      this._removedAccepted.on(ctx, (invitation) => {
+      this._invitationsManager.removedAccepted.on(ctx, (invitation) => {
         next({
           action: QueryInvitationsResponse.Action.REMOVED,
           type: QueryInvitationsResponse.Type.ACCEPTED,
@@ -2508,7 +2291,7 @@ var InvitationsServiceImpl = class {
           ]
         });
       });
-      this._saved.on(ctx, (invitation) => {
+      this._invitationsManager.saved.on(ctx, (invitation) => {
         next({
           action: QueryInvitationsResponse.Action.SAVED,
           type: QueryInvitationsResponse.Type.CREATED,
@@ -2520,40 +2303,34 @@ var InvitationsServiceImpl = class {
       next({
         action: QueryInvitationsResponse.Action.ADDED,
         type: QueryInvitationsResponse.Type.CREATED,
-        invitations: Array.from(this._createInvitations.values()).map((invitation) => invitation.get()),
+        invitations: this._invitationsManager.getCreatedInvitations(),
         existing: true
       });
       next({
         action: QueryInvitationsResponse.Action.ADDED,
         type: QueryInvitationsResponse.Type.ACCEPTED,
-        invitations: Array.from(this._acceptInvitations.values()).map((invitation) => invitation.get()),
+        invitations: this._invitationsManager.getAcceptedInvitations(),
         existing: true
       });
-      if (this._persistentInvitationsLoaded) {
+      this._invitationsManager.onPersistentInvitationsLoaded(ctx, () => {
         next({
           action: QueryInvitationsResponse.Action.LOAD_COMPLETE,
           type: QueryInvitationsResponse.Type.CREATED
         });
-      } else {
-        this._persistentInvitationsLoadedEvent.on(ctx, () => {
-          next({
-            action: QueryInvitationsResponse.Action.LOAD_COMPLETE,
-            type: QueryInvitationsResponse.Type.CREATED
-          });
-        });
-      }
+      });
     });
   }
 };
 // packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts
-import { createAdmissionCredentials, getCredentialAssertion } from "@dxos/credentials";
+import { createAdmissionCredentials, createDelegatedSpaceInvitationCredential, getCredentialAssertion } from "@dxos/credentials";
 import { writeMessages as writeMessages2 } from "@dxos/feed-store";
-import { invariant as invariant8 } from "@dxos/invariant";
-import { log as log7 } from "@dxos/log";
+import { invariant as invariant7 } from "@dxos/invariant";
+import { log as log6 } from "@dxos/log";
 import { AlreadyJoinedError as AlreadyJoinedError2 } from "@dxos/protocols";
-import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
-var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
+import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -2569,14 +2346,14 @@ var SpaceInvitationProtocol = class {
   }
   getInvitationContext() {
     return {
-      kind: Invitation5.Kind.SPACE,
+      kind: Invitation4.Kind.SPACE,
       spaceKey: this._spaceKey
     };
   }
-  async admit(request, guestProfile) {
-    invariant8(this._spaceKey, void 0, {
-      F: __dxlog_file9,
-      L: 47,
+  async admit(invitation, request, guestProfile) {
+    invariant7(this._spaceKey, void 0, {
+      F: __dxlog_file8,
+      L: 55,
       S: this,
       A: [
         "this._spaceKey",
@@ -2584,18 +2361,18 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const space = await this._spaceManager.spaces.get(this._spaceKey);
-    invariant8(space, void 0, {
-      F: __dxlog_file9,
-      L: 49,
+    invariant7(space, void 0, {
+      F: __dxlog_file8,
+      L: 57,
       S: this,
       A: [
         "space",
         ""
       ]
     });
-    invariant8(request.space, void 0, {
-      F: __dxlog_file9,
-      L: 51,
+    invariant7(request.space, void 0, {
+      F: __dxlog_file8,
+      L: 59,
       S: this,
       A: [
         "request.space",
@@ -2603,19 +2380,19 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { identityKey, deviceKey } = request.space;
-    log7("writing guest credentials", {
+    log6("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
-      F: __dxlog_file9,
-      L: 54,
+      F: __dxlog_file8,
+      L: 62,
       S: this,
       C: (f, a) => f(...a)
     });
-    const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
-    invariant8(credentials[0].credential, void 0, {
-      F: __dxlog_file9,
-      L: 65,
+    const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile, invitation.delegationCredentialId);
+    invariant7(credentials[0].credential, void 0, {
+      F: __dxlog_file8,
+      L: 74,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2623,9 +2400,9 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const spaceMemberCredential = credentials[0].credential.credential;
-    invariant8(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file9,
-      L: 67,
+    invariant7(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file8,
+      L: 76,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2640,6 +2417,69 @@ var SpaceInvitationProtocol = class {
       }
     };
   }
+  async delegate(invitation) {
+    invariant7(this._spaceKey, void 0, {
+      F: __dxlog_file8,
+      L: 89,
+      S: this,
+      A: [
+        "this._spaceKey",
+        ""
+      ]
+    });
+    const space = await this._spaceManager.spaces.get(this._spaceKey);
+    invariant7(space, void 0, {
+      F: __dxlog_file8,
+      L: 91,
+      S: this,
+      A: [
+        "space",
+        ""
+      ]
+    });
+    if (invitation.authMethod === Invitation4.AuthMethod.KNOWN_PUBLIC_KEY) {
+      invariant7(invitation.guestKeypair?.publicKey, void 0, {
+        F: __dxlog_file8,
+        L: 93,
+        S: this,
+        A: [
+          "invitation.guestKeypair?.publicKey",
+          ""
+        ]
+      });
+    }
+    log6("writing delegate space invitation", {
+      host: this._signingContext.deviceKey,
+      id: invitation.invitationId
+    }, {
+      F: __dxlog_file8,
+      L: 96,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const credential = await createDelegatedSpaceInvitationCredential(this._signingContext.credentialSigner, space.key, {
+      invitationId: invitation.invitationId,
+      authMethod: invitation.authMethod,
+      swarmKey: invitation.swarmKey,
+      role: SpaceMember.Role.ADMIN,
+      expiresOn: invitation.lifetime ? new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime) : void 0,
+      multiUse: invitation.multiUse ?? false,
+      guestKey: invitation.authMethod === Invitation4.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
+    });
+    invariant7(credential.credential, void 0, {
+      F: __dxlog_file8,
+      L: 116,
+      S: this,
+      A: [
+        "credential.credential",
+        ""
+      ]
+    });
+    await writeMessages2(space.inner.controlPipeline.writer, [
+      credential
+    ]);
+    return credential.credential.credential.id;
+  }
   checkInvitation(invitation) {
     if (invitation.spaceKey && this._spaceManager.spaces.has(invitation.spaceKey)) {
       return new AlreadyJoinedError2("Already joined space.");
@@ -2663,9 +2503,9 @@ var SpaceInvitationProtocol = class {
     };
   }
   async accept(response) {
-    invariant8(response.space, void 0, {
-      F: __dxlog_file9,
-      L: 107,
+    invariant7(response.space, void 0, {
+      F: __dxlog_file8,
+      L: 149,
       S: this,
       A: [
         "response.space",
@@ -2674,18 +2514,18 @@ var SpaceInvitationProtocol = class {
     });
     const { credential, controlTimeframe, dataTimeframe } = response.space;
     const assertion = getCredentialAssertion(credential);
-    invariant8(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
-      F: __dxlog_file9,
-      L: 110,
+    invariant7(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
+      F: __dxlog_file8,
+      L: 152,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
         "'Invalid credential'"
       ]
     });
-    invariant8(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
-      F: __dxlog_file9,
-      L: 111,
+    invariant7(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
+      F: __dxlog_file8,
+      L: 153,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -2708,6 +2548,295 @@ var SpaceInvitationProtocol = class {
   }
 };
+// packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts
+import { Event as Event3, PushStream as PushStream2 } from "@dxos/async";
+import { AUTHENTICATION_CODE_LENGTH, CancellableInvitation, INVITATION_TIMEOUT as INVITATION_TIMEOUT2 } from "@dxos/client-protocol";
+import { Context as Context6 } from "@dxos/context";
+import { generatePasscode } from "@dxos/credentials";
+import { hasInvitationExpired } from "@dxos/echo-pipeline";
+import { invariant as invariant8 } from "@dxos/invariant";
+import { PublicKey as PublicKey7 } from "@dxos/keys";
+import { log as log7 } from "@dxos/log";
+import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
+var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
+var InvitationsManager = class {
+  constructor(_invitationsHandler, _getHandler, _metadataStore) {
+    this._invitationsHandler = _invitationsHandler;
+    this._getHandler = _getHandler;
+    this._metadataStore = _metadataStore;
+    this._createInvitations = /* @__PURE__ */ new Map();
+    this._acceptInvitations = /* @__PURE__ */ new Map();
+    this.invitationCreated = new Event3();
+    this.invitationAccepted = new Event3();
+    this.removedCreated = new Event3();
+    this.removedAccepted = new Event3();
+    this.saved = new Event3();
+    this._persistentInvitationsLoadedEvent = new Event3();
+    this._persistentInvitationsLoaded = false;
+  }
+  async createInvitation(options) {
+    if (options.invitationId) {
+      const existingInvitation = this._createInvitations.get(options.invitationId);
+      if (existingInvitation) {
+        return existingInvitation;
+      }
+    }
+    const handler = this._getHandler(options);
+    const invitation = this._createInvitation(handler, options);
+    const { ctx, stream, observableInvitation } = this._createObservableInvitation(handler, invitation);
+    this._createInvitations.set(invitation.invitationId, observableInvitation);
+    this.invitationCreated.emit(invitation);
+    this._onInvitationComplete(observableInvitation, async () => {
+      this._createInvitations.delete(observableInvitation.get().invitationId);
+      this.removedCreated.emit(observableInvitation.get());
+      if (observableInvitation.get().persistent) {
+        await this._safeDeleteInvitation(observableInvitation.get());
+      }
+    });
+    try {
+      await this._persistIfRequired(handler, stream, invitation);
+    } catch (err) {
+      log7.catch(err, void 0, {
+        F: __dxlog_file9,
+        L: 76,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await observableInvitation.cancel();
+      return observableInvitation;
+    }
+    this._invitationsHandler.handleInvitationFlow(ctx, stream, handler, observableInvitation.get());
+    return observableInvitation;
+  }
+  async loadPersistentInvitations() {
+    if (this._persistentInvitationsLoaded) {
+      const invitations = this.getCreatedInvitations().filter((i) => i.persistent);
+      return {
+        invitations
+      };
+    }
+    try {
+      const persistentInvitations = this._metadataStore.getInvitations();
+      const freshInvitations = persistentInvitations.filter((invitation) => !hasInvitationExpired(invitation));
+      const loadTasks = freshInvitations.map((persistentInvitation) => {
+        invariant8(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
+          F: __dxlog_file9,
+          L: 97,
+          S: this,
+          A: [
+            "!this._createInvitations.get(persistentInvitation.invitationId)",
+            "'invitation already exists'"
+          ]
+        });
+        return this.createInvitation({
+          ...persistentInvitation,
+          persistent: false
+        });
+      });
+      const cInvitations = await Promise.all(loadTasks);
+      return {
+        invitations: cInvitations.map((invitation) => invitation.get())
+      };
+    } catch (err) {
+      log7.catch(err, void 0, {
+        F: __dxlog_file9,
+        L: 104,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return {
+        invitations: []
+      };
+    } finally {
+      this._persistentInvitationsLoadedEvent.emit();
+      this._persistentInvitationsLoaded = true;
+    }
+  }
+  acceptInvitation(request) {
+    const options = request.invitation;
+    const existingInvitation = this._acceptInvitations.get(options.invitationId);
+    if (existingInvitation) {
+      return existingInvitation;
+    }
+    const handler = this._getHandler(options);
+    const invitation = this._invitationsHandler.acceptInvitation(handler, options, request.deviceProfile);
+    this._acceptInvitations.set(invitation.get().invitationId, invitation);
+    this.invitationAccepted.emit(invitation.get());
+    this._onInvitationComplete(invitation, () => {
+      this._acceptInvitations.delete(invitation.get().invitationId);
+      this.removedAccepted.emit(invitation.get());
+    });
+    return invitation;
+  }
+  async authenticate({ invitationId, authCode }) {
+    log7("authenticating...", void 0, {
+      F: __dxlog_file9,
+      L: 133,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    invariant8(invitationId, void 0, {
+      F: __dxlog_file9,
+      L: 134,
+      S: this,
+      A: [
+        "invitationId",
+        ""
+      ]
+    });
+    const observable = this._acceptInvitations.get(invitationId);
+    if (!observable) {
+      log7.warn("invalid invitation", {
+        invitationId
+      }, {
+        F: __dxlog_file9,
+        L: 137,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    } else {
+      await observable.authenticate(authCode);
+    }
+  }
+  async cancelInvitation({ invitationId }) {
+    log7("cancelInvitation...", {
+      invitationId
+    }, {
+      F: __dxlog_file9,
+      L: 144,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    invariant8(invitationId, void 0, {
+      F: __dxlog_file9,
+      L: 145,
+      S: this,
+      A: [
+        "invitationId",
+        ""
+      ]
+    });
+    const created = this._createInvitations.get(invitationId);
+    if (created) {
+      if (created.get().persistent) {
+        await this._metadataStore.removeInvitation(invitationId);
+      }
+      await created.cancel();
+      this._createInvitations.delete(invitationId);
+      this.removedCreated.emit(created.get());
+      return;
+    }
+    const accepted = this._acceptInvitations.get(invitationId);
+    if (accepted) {
+      await accepted.cancel();
+      this._acceptInvitations.delete(invitationId);
+      this.removedAccepted.emit(accepted.get());
+    }
+  }
+  getCreatedInvitations() {
+    return [
+      ...this._createInvitations.values()
+    ].map((i) => i.get());
+  }
+  getAcceptedInvitations() {
+    return [
+      ...this._acceptInvitations.values()
+    ].map((i) => i.get());
+  }
+  onPersistentInvitationsLoaded(ctx, callback) {
+    if (this._persistentInvitationsLoaded) {
+      callback();
+    } else {
+      this._persistentInvitationsLoadedEvent.once(ctx, () => callback());
+    }
+  }
+  _createInvitation(protocol, options) {
+    const { invitationId = PublicKey7.random().toHex(), type = Invitation5.Type.INTERACTIVE, authMethod = Invitation5.AuthMethod.SHARED_SECRET, state = Invitation5.State.INIT, timeout = INVITATION_TIMEOUT2, swarmKey = PublicKey7.random(), persistent = options?.authMethod !== Invitation5.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
+    const authCode = options?.authCode ?? (authMethod === Invitation5.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0);
+    return {
+      invitationId,
+      type,
+      authMethod,
+      state,
+      swarmKey,
+      authCode,
+      timeout,
+      persistent: persistent && type !== Invitation5.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === Invitation5.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
+      created,
+      lifetime,
+      multiUse,
+      delegationCredentialId: options?.delegationCredentialId,
+      ...protocol.getInvitationContext()
+    };
+  }
+  _createObservableInvitation(handler, invitation) {
+    const stream = new PushStream2();
+    const ctx = new Context6({
+      onError: (err) => {
+        stream.error(err);
+        void ctx.dispose();
+      }
+    });
+    ctx.onDispose(() => {
+      log7("complete", {
+        ...handler.toJSON()
+      }, {
+        F: __dxlog_file9,
+        L: 228,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      stream.complete();
+    });
+    const observableInvitation = new CancellableInvitation({
+      initialInvitation: invitation,
+      subscriber: stream.observable,
+      onCancel: async () => {
+        stream.next({
+          ...invitation,
+          state: Invitation5.State.CANCELLED
+        });
+        await ctx.dispose();
+      }
+    });
+    return {
+      ctx,
+      stream,
+      observableInvitation
+    };
+  }
+  async _persistIfRequired(handler, changeStream, invitation) {
+    if (invitation.type === Invitation5.Type.DELEGATED && invitation.delegationCredentialId == null) {
+      const delegationCredentialId = await handler.delegate(invitation);
+      changeStream.next({
+        ...invitation,
+        delegationCredentialId
+      });
+    } else if (invitation.persistent) {
+      await this._metadataStore.addInvitation(invitation);
+      this.saved.emit(invitation);
+    }
+  }
+  async _safeDeleteInvitation(invitation) {
+    try {
+      await this._metadataStore.removeInvitation(invitation.invitationId);
+    } catch (err) {
+      log7.catch(err, void 0, {
+        F: __dxlog_file9,
+        L: 260,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
+  }
+  _onInvitationComplete(invitation, callback) {
+    invitation.subscribe(() => {
+    }, () => {
+    }, callback);
+  }
+};
 // packages/sdk/client-services/src/packlets/services/client-rpc-server.ts
 import { Stream as Stream9 } from "@dxos/codec-protobuf";
 import { raise } from "@dxos/debug";
@@ -2790,15 +2919,15 @@ ClientRpcServer = _ts_decorate3([
 ], ClientRpcServer);
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-import { Event as Event6, asyncTimeout, scheduleTask as scheduleTask5, sleep as sleep2, synchronized, trackLeaks } from "@dxos/async";
+import { Event as Event6, asyncTimeout, scheduleTask as scheduleTask4, sleep as sleep2, synchronized, trackLeaks } from "@dxos/async";
 import { AUTH_TIMEOUT as AUTH_TIMEOUT2 } from "@dxos/client-protocol";
 import { cancelWithContext as cancelWithContext2, Context as Context8, ContextDisposedError } from "@dxos/context";
 import { timed, warnAfterTimeout } from "@dxos/debug";
-import { TYPE_PROPERTIES } from "@dxos/echo-db";
 import { createMappedFeedWriter } from "@dxos/echo-pipeline";
 import { AutomergeDocumentLoaderImpl } from "@dxos/echo-pipeline";
+import { TYPE_PROPERTIES } from "@dxos/echo-schema";
 import { failedInvariant, invariant as invariant10 } from "@dxos/invariant";
-import { PublicKey as PublicKey8 } from "@dxos/keys";
+import { PublicKey as PublicKey9 } from "@dxos/keys";
 import { log as log9 } from "@dxos/log";
 import { CancelledError, SystemError } from "@dxos/protocols";
 import { SpaceState, CreateEpochRequest } from "@dxos/protocols/proto/dxos/client/services";
@@ -2846,10 +2975,10 @@ var AutomergeSpaceState = class {
 };
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
-import { DeferredTask, Event as Event5, scheduleTask as scheduleTask4, sleep, TimeoutError as TimeoutError2, Trigger as Trigger4 } from "@dxos/async";
+import { DeferredTask, Event as Event5, scheduleTask as scheduleTask3, sleep, TimeoutError as TimeoutError2, Trigger as Trigger4 } from "@dxos/async";
 import { Context as Context7, rejectOnDispose } from "@dxos/context";
 import { invariant as invariant9 } from "@dxos/invariant";
-import { PublicKey as PublicKey7 } from "@dxos/keys";
+import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log8 } from "@dxos/log";
 import { schema as schema3 } from "@dxos/protocols";
 import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
@@ -2864,8 +2993,8 @@ var NotarizationPlugin = class {
     this._ctx = new Context7();
     this._extensionOpened = new Event5();
     this._extensions = /* @__PURE__ */ new Set();
-    this._processedCredentials = new ComplexSet2(PublicKey7.hash);
-    this._processCredentialsTriggers = new ComplexMap2(PublicKey7.hash);
+    this._processedCredentials = new ComplexSet2(PublicKey8.hash);
+    this._processCredentialsTriggers = new ComplexMap2(PublicKey8.hash);
   }
   get hasWriter() {
     return !!this._writer;
@@ -2913,7 +3042,7 @@ var NotarizationPlugin = class {
     });
     opCtx?.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
-      scheduleTask4(ctx, () => {
+      scheduleTask3(ctx, () => {
         log8.warn("Notarization timeout", {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
@@ -2947,7 +3076,7 @@ var NotarizationPlugin = class {
             C: (f, a) => f(...a)
           });
           peersTried.clear();
-          scheduleTask4(ctx, () => notarizeTask.schedule(), retryTimeout);
+          scheduleTask3(ctx, () => notarizeTask.schedule(), retryTimeout);
           return;
         }
         peersTried.add(peer);
@@ -3148,9 +3277,9 @@ var DataSpace = class {
     this._metadataStore = params.metadataStore;
     this._signingContext = params.signingContext;
     this._callbacks = params.callbacks ?? {};
-    this._automergeHost = params.automergeHost;
+    this._echoHost = params.echoHost;
     this.authVerifier = new TrustedKeySetAuthVerifier({
-      trustedKeysProvider: () => new ComplexSet3(PublicKey8.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => !member.removed).map((member) => member.key)),
+      trustedKeysProvider: () => new ComplexSet3(PublicKey9.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => !member.removed).map((member) => member.key)),
       update: this._inner.stateUpdate,
       authTimeout: AUTH_TIMEOUT2
     });
@@ -3160,7 +3289,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file11,
-      L: 140,
+      L: 135,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3210,7 +3339,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file11,
-      L: 198,
+      L: 193,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3228,7 +3357,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file11,
-      L: 212,
+      L: 207,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3252,7 +3381,7 @@ var DataSpace = class {
   * Initialize the data pipeline in a separate task.
   */
   initializeDataPipelineAsync() {
-    scheduleTask5(this._ctx, async () => {
+    scheduleTask4(this._ctx, async () => {
       try {
         this.metrics.pipelineInitBegin = /* @__PURE__ */ new Date();
         await this.initializeDataPipeline();
@@ -3260,7 +3389,7 @@ var DataSpace = class {
         if (err instanceof CancelledError || err instanceof ContextDisposedError) {
           log9("data pipeline initialization cancelled", err, {
             F: __dxlog_file11,
-            L: 245,
+            L: 240,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3268,7 +3397,7 @@ var DataSpace = class {
         }
         log9.error("Error initializing data pipeline", err, {
           F: __dxlog_file11,
-          L: 249,
+          L: 244,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3277,7 +3406,7 @@ var DataSpace = class {
           state: SpaceState[this._state]
         }, {
           F: __dxlog_file11,
-          L: 251,
+          L: 246,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3297,7 +3426,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file11,
-      L: 267,
+      L: 262,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3307,7 +3436,7 @@ var DataSpace = class {
     await cancelWithContext2(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
     log9("data pipeline ready", void 0, {
       F: __dxlog_file11,
-      L: 279,
+      L: 274,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3317,7 +3446,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file11,
-      L: 283,
+      L: 278,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3333,7 +3462,7 @@ var DataSpace = class {
     await this._createWritableFeeds();
     log9("writable feeds created", void 0, {
       F: __dxlog_file11,
-      L: 299,
+      L: 294,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3396,12 +3525,12 @@ var DataSpace = class {
       rootUrl
     }, {
       F: __dxlog_file11,
-      L: 365,
+      L: 360,
       S: this,
       C: (f, a) => f(...a)
     });
-    this._automergeHost._requestedDocs.add(rootUrl);
-    const handle = this._automergeHost.repo.find(rootUrl);
+    this._echoHost.replicateDocument(rootUrl);
+    const handle = this._echoHost.automergeRepo.find(rootUrl);
     queueMicrotask(async () => {
       try {
         await warnAfterTimeout(5e3, "Automerge root doc load timeout (DataSpace)", async () => {
@@ -3428,7 +3557,7 @@ var DataSpace = class {
           err
         }, {
           F: __dxlog_file11,
-          L: 388,
+          L: 383,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3466,7 +3595,7 @@ var DataSpace = class {
         break;
       case CreateEpochRequest.Migration.INIT_AUTOMERGE:
         {
-          const document = this._automergeHost.repo.create();
+          const document = this._echoHost.automergeRepo.create();
           epoch = {
             previousId: this._automergeSpaceState.lastEpoch?.id,
             number: (this._automergeSpaceState.lastEpoch?.subject.assertion.number ?? -1) + 1,
@@ -3478,12 +3607,12 @@ var DataSpace = class {
       case CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY:
         {
           const currentRootUrl = this._automergeSpaceState.rootUrl;
-          const rootHandle = this._automergeHost.repo.find(currentRootUrl);
+          const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
           await cancelWithContext2(this._ctx, asyncTimeout(rootHandle.whenReady(), 1e4));
-          const newRoot = this._automergeHost.repo.create(rootHandle.docSync());
+          const newRoot = this._echoHost.automergeRepo.create(rootHandle.docSync());
           invariant10(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file11,
-            L: 438,
+            L: 433,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -3502,19 +3631,19 @@ var DataSpace = class {
         {
           log9.info("Fragmenting", void 0, {
             F: __dxlog_file11,
-            L: 450,
+            L: 445,
             S: this,
             C: (f, a) => f(...a)
           });
           const currentRootUrl = this._automergeSpaceState.rootUrl;
-          const rootHandle = this._automergeHost.repo.find(currentRootUrl);
+          const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
           await cancelWithContext2(this._ctx, asyncTimeout(rootHandle.whenReady(), 1e4));
           const objects = Object.entries(rootHandle.docSync().objects);
           const properties = objects.find(([_, value]) => value.system.type?.itemId === TYPE_PROPERTIES);
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
           invariant10(properties, "Properties not found", {
             F: __dxlog_file11,
-            L: 460,
+            L: 455,
             S: this,
             A: [
               "properties",
@@ -3527,17 +3656,17 @@ var DataSpace = class {
               properties
             ])
           };
-          const newRoot = this._automergeHost.repo.create(newSpaceDoc);
+          const newRoot = this._echoHost.automergeRepo.create(newSpaceDoc);
           invariant10(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file11,
-            L: 465,
+            L: 460,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
               ""
             ]
           });
-          const docLoader = new AutomergeDocumentLoaderImpl(this.key, this._automergeHost.repo);
+          const docLoader = new AutomergeDocumentLoaderImpl(this.key, this._echoHost.automergeRepo);
           await docLoader.loadSpaceRootDocHandle(this._ctx, {
             rootUrl: newRoot.url
           });
@@ -3599,7 +3728,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file11,
-      L: 531,
+      L: 526,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3657,17 +3786,17 @@ import { Event as Event7, synchronized as synchronized2, trackLeaks as trackLeak
 import { Context as Context9, cancelWithContext as cancelWithContext3 } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
 import { invariant as invariant11 } from "@dxos/invariant";
-import { PublicKey as PublicKey9 } from "@dxos/keys";
+import { PublicKey as PublicKey10 } from "@dxos/keys";
 import { log as log10 } from "@dxos/log";
 import { trace as trace7 } from "@dxos/protocols";
-import { SpaceState as SpaceState2 } from "@dxos/protocols/proto/dxos/client/services";
+import { Invitation as Invitation6, SpaceState as SpaceState2 } from "@dxos/protocols/proto/dxos/client/services";
 import { Gossip as Gossip2, Presence as Presence2 } from "@dxos/teleport-extension-gossip";
 import { ComplexMap as ComplexMap3, deferFunction as deferFunction2, forEachAsync } from "@dxos/util";
 // packages/sdk/client-services/src/packlets/spaces/genesis.ts
 import { createCredential } from "@dxos/credentials";
 import { failUndefined } from "@dxos/debug";
-import { AdmittedFeed as AdmittedFeed4, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { AdmittedFeed as AdmittedFeed4, SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe3 } from "@dxos/timeframe";
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
@@ -3687,7 +3816,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey: space.key,
-        role: SpaceMember.Role.ADMIN,
+        role: SpaceMember2.Role.ADMIN,
         profile: signingContext.getProfile(),
         genesisFeedKey: space.controlFeedKey ?? failUndefined()
       }
@@ -3749,18 +3878,19 @@ var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/s
 var PRESENCE_ANNOUNCE_INTERVAL = 1e4;
 var PRESENCE_OFFLINE_TIMEOUT = 2e4;
 var DataSpaceManager = class {
-  constructor(_spaceManager, _metadataStore, _keyring, _signingContext, _feedStore, _automergeHost, params) {
+  constructor(_spaceManager, _metadataStore, _keyring, _signingContext, _feedStore, _echoHost, _invitationsManager, params) {
     this._spaceManager = _spaceManager;
     this._metadataStore = _metadataStore;
     this._keyring = _keyring;
     this._signingContext = _signingContext;
     this._feedStore = _feedStore;
-    this._automergeHost = _automergeHost;
+    this._echoHost = _echoHost;
+    this._invitationsManager = _invitationsManager;
     this._ctx = new Context9();
     this.updated = new Event7();
-    this._spaces = new ComplexMap3(PublicKey9.hash);
+    this._spaces = new ComplexMap3(PublicKey10.hash);
     this._isOpen = false;
-    this._instanceId = PublicKey9.random().toHex();
+    this._instanceId = PublicKey10.random().toHex();
     const { spaceMemberPresenceAnnounceInterval = PRESENCE_ANNOUNCE_INTERVAL, spaceMemberPresenceOfflineTimeout = PRESENCE_OFFLINE_TIMEOUT } = params ?? {};
     this._spaceMemberPresenceAnnounceInterval = spaceMemberPresenceAnnounceInterval;
     this._spaceMemberPresenceOfflineTimeout = spaceMemberPresenceOfflineTimeout;
@@ -3772,7 +3902,7 @@ var DataSpaceManager = class {
   async open() {
     log10("open", void 0, {
       F: __dxlog_file12,
-      L: 98,
+      L: 102,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3780,7 +3910,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file12,
-      L: 99,
+      L: 103,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3788,7 +3918,7 @@ var DataSpaceManager = class {
       spaces: this._metadataStore.spaces.length
     }, {
       F: __dxlog_file12,
-      L: 100,
+      L: 104,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3798,7 +3928,7 @@ var DataSpaceManager = class {
           spaceMetadata
         }, {
           F: __dxlog_file12,
-          L: 104,
+          L: 108,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3809,7 +3939,7 @@ var DataSpaceManager = class {
           err
         }, {
           F: __dxlog_file12,
-          L: 107,
+          L: 111,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3826,7 +3956,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file12,
-      L: 120,
+      L: 124,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3834,7 +3964,7 @@ var DataSpaceManager = class {
   async close() {
     log10("close", void 0, {
       F: __dxlog_file12,
-      L: 125,
+      L: 129,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3850,7 +3980,7 @@ var DataSpaceManager = class {
   async createSpace() {
     invariant11(this._isOpen, "Not open.", {
       F: __dxlog_file12,
-      L: 138,
+      L: 142,
       S: this,
       A: [
         "this._isOpen",
@@ -3871,18 +4001,13 @@ var DataSpaceManager = class {
       spaceKey
     }, {
       F: __dxlog_file12,
-      L: 150,
+      L: 154,
       S: this,
       C: (f, a) => f(...a)
     });
-    const automergeRoot = this._automergeHost.repo.create();
-    automergeRoot.change((doc) => {
-      doc.access = {
-        spaceKey: spaceKey.toHex()
-      };
-    });
+    const automergeRootUrl = await this._echoHost.createSpaceRoot(spaceKey);
     const space = await this._constructSpace(metadata);
-    const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRoot.url);
+    const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRootUrl);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
     invariant11(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
@@ -3987,8 +4112,8 @@ var DataSpaceManager = class {
           remotePeerId: session.remotePeerId
         }));
         session.addExtension("dxos.mesh.teleport.notarization", dataSpace.notarizationPlugin.createExtension());
-        this._automergeHost.authorizeDevice(space.key, session.remotePeerId);
-        session.addExtension("dxos.mesh.teleport.automerge", this._automergeHost.createExtension());
+        this._echoHost.authorizeDevice(space.key, session.remotePeerId);
+        session.addExtension("dxos.mesh.teleport.automerge", this._echoHost.createReplicationExtension());
       },
       onAuthFailure: () => {
         log10.warn("auth failure", void 0, {
@@ -3998,7 +4123,10 @@ var DataSpaceManager = class {
           C: (f, a) => f(...a)
         });
       },
-      memberKey: this._signingContext.identityKey
+      memberKey: this._signingContext.identityKey,
+      onDelegatedInvitationStatusChange: (invitation, isActive) => {
+        return this._handleInvitationStatusChange(dataSpace, invitation, isActive);
+      }
     });
     controlFeed && await space.setControlFeed(controlFeed);
     dataFeed && await space.setDataFeed(dataFeed);
@@ -4010,6 +4138,7 @@ var DataSpaceManager = class {
       presence,
       keyring: this._keyring,
       feedStore: this._feedStore,
+      echoHost: this._echoHost,
       signingContext: this._signingContext,
       callbacks: {
         beforeReady: async () => {
@@ -4017,7 +4146,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file12,
-            L: 265,
+            L: 269,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4028,11 +4157,14 @@ var DataSpaceManager = class {
             open: this._isOpen
           }, {
             F: __dxlog_file12,
-            L: 268,
+            L: 272,
             S: this,
             C: (f, a) => f(...a)
           });
           if (this._isOpen) {
+            await this._createDelegatedInvitations(dataSpace, [
+              ...space.spaceState.invitations.entries()
+            ]);
             this.updated.emit();
           }
         },
@@ -4041,14 +4173,13 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file12,
-            L: 274,
+            L: 279,
             S: this,
             C: (f, a) => f(...a)
           });
         }
       },
-      cache: metadata.cache,
-      automergeHost: this._automergeHost
+      cache: metadata.cache
     });
     if (metadata.state !== SpaceState2.INACTIVE) {
       await dataSpace.open();
@@ -4059,6 +4190,41 @@ var DataSpaceManager = class {
     this._spaces.set(metadata.key, dataSpace);
     return dataSpace;
   }
+  async _handleInvitationStatusChange(dataSpace, delegatedInvitation, isActive) {
+    if (dataSpace?.state !== SpaceState2.READY) {
+      return;
+    }
+    if (isActive) {
+      await this._createDelegatedInvitations(dataSpace, [
+        [
+          delegatedInvitation.credentialId,
+          delegatedInvitation.invitation
+        ]
+      ]);
+    } else {
+      await this._invitationsManager.cancelInvitation(delegatedInvitation.invitation);
+    }
+  }
+  async _createDelegatedInvitations(space, invitations) {
+    const tasks = invitations.map(([credentialId, invitation]) => {
+      return this._invitationsManager.createInvitation({
+        type: Invitation6.Type.DELEGATED,
+        kind: Invitation6.Kind.SPACE,
+        spaceKey: space.key,
+        authMethod: invitation.authMethod,
+        invitationId: invitation.invitationId,
+        swarmKey: invitation.swarmKey,
+        guestKeypair: invitation.guestKey ? {
+          publicKey: invitation.guestKey
+        } : void 0,
+        lifetime: invitation.expiresOn ? invitation.expiresOn.getTime() - Date.now() : void 0,
+        multiUse: invitation.multiUse,
+        delegationCredentialId: credentialId,
+        persistent: false
+      });
+    });
+    await Promise.all(tasks);
+  }
 };
 _ts_decorate5([
   synchronized2
@@ -4077,13 +4243,13 @@ DataSpaceManager = _ts_decorate5([
 ], DataSpaceManager);
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
-import { EventSubscriptions as EventSubscriptions2, UpdateScheduler, scheduleTask as scheduleTask6 } from "@dxos/async";
+import { EventSubscriptions as EventSubscriptions2, UpdateScheduler, scheduleTask as scheduleTask5 } from "@dxos/async";
 import { Stream as Stream10 } from "@dxos/codec-protobuf";
 import { raise as raise2 } from "@dxos/debug";
 import { invariant as invariant12 } from "@dxos/invariant";
 import { log as log11 } from "@dxos/log";
 import { ApiError, SpaceNotFoundError, encodeError } from "@dxos/protocols";
-import { SpaceMember as SpaceMember2, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember3, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
 var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _getDataSpaceManager) {
@@ -4134,7 +4300,7 @@ var SpacesServiceImpl = class {
       }, {
         maxFrequency: false ? void 0 : 2
       });
-      scheduleTask6(ctx, async () => {
+      scheduleTask5(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const subscriptions = new EventSubscriptions2();
         ctx.onDispose(() => subscriptions.clear());
@@ -4168,7 +4334,7 @@ var SpacesServiceImpl = class {
   }
   subscribeMessages({ spaceKey, channel }) {
     return new Stream10(({ ctx, next }) => {
-      scheduleTask6(ctx, async () => {
+      scheduleTask5(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
         const handle = space.listen(getChannelId(channel), (message) => {
@@ -4187,7 +4353,7 @@ var SpacesServiceImpl = class {
         }
       };
       ctx.onDispose(() => space.spaceState.removeCredentialProcessor(processor));
-      scheduleTask6(ctx, async () => {
+      scheduleTask5(ctx, async () => {
         await space.spaceState.addCredentialProcessor(processor);
         if (noTail) {
           close();
@@ -4281,7 +4447,7 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.removed ? SpaceMember2.PresenceState.REMOVED : isMe || peers.length > 0 ? SpaceMember2.PresenceState.ONLINE : SpaceMember2.PresenceState.OFFLINE,
+          presence: member.removed ? SpaceMember3.PresenceState.REMOVED : isMe || peers.length > 0 ? SpaceMember3.PresenceState.ONLINE : SpaceMember3.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4298,99 +4464,18 @@ import { Trigger as Trigger5 } from "@dxos/async";
 import { Context as Context10, Resource } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
 import { failUndefined as failUndefined2 } from "@dxos/debug";
-import { AutomergeHost, MetadataStore, SnapshotStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
+import { EchoHost } from "@dxos/echo-db";
+import { MetadataStore, SnapshotStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
 import { FeedFactory, FeedStore } from "@dxos/feed-store";
-import { IndexMetadataStore, IndexStore, Indexer, createStorageCallbacks } from "@dxos/indexing";
 import { invariant as invariant13 } from "@dxos/invariant";
 import { Keyring } from "@dxos/keyring";
-import { PublicKey as PublicKey10 } from "@dxos/keys";
+import { PublicKey as PublicKey11 } from "@dxos/keys";
 import { log as log12 } from "@dxos/log";
 import { InvalidStorageVersionError, STORAGE_VERSION, trace as trace8 } from "@dxos/protocols";
-import { Invitation as Invitation6 } from "@dxos/protocols/proto/dxos/client/services";
+import { Invitation as Invitation7 } from "@dxos/protocols/proto/dxos/client/services";
 import { BlobStore } from "@dxos/teleport-extension-object-sync";
 import { trace as Trace2 } from "@dxos/tracing";
 import { safeInstanceof } from "@dxos/util";
-// packages/sdk/client-services/src/packlets/indexing/util.ts
-import { getHeads } from "@dxos/automerge/automerge";
-import { warnAfterTimeout as warnAfterTimeout2 } from "@dxos/debug";
-import { idCodec } from "@dxos/protocols";
-var createSelectedDocumentsIterator = (automergeHost) => (
-  /**
-  * Get object data blobs from Automerge Repo by ids.
-  * @param ids
-  */
-  // TODO(mykola): Unload automerge handles after usage.
-  async function* loadDocuments(ids) {
-    for (const id of ids) {
-      const { documentId, objectId } = idCodec.decode(id);
-      const handle = automergeHost.repo.find(documentId);
-      await warnAfterTimeout2(5e3, "to long to load doc", () => handle.whenReady());
-      const doc = handle.docSync();
-      const hash = getHeads(doc).join("");
-      yield doc.objects?.[objectId] ? [
-        {
-          id,
-          object: doc.objects[objectId],
-          currentHash: hash
-        }
-      ] : [];
-    }
-  }
-);
-var createDocumentsIterator = (automergeHost) => (
-  /**
-  * Recursively get all object data blobs from Automerge Repo.
-  * @param ids
-  */
-  // TODO(mykola): Unload automerge handles after usage.
-  async function* getAllDocuments() {
-    const visited = /* @__PURE__ */ new Set();
-    async function* getObjectsFromHandle(handle) {
-      if (visited.has(handle.documentId)) {
-        return;
-      }
-      await warnAfterTimeout2(5e3, "to long to load doc", () => handle.whenReady());
-      const doc = handle.docSync();
-      const heads = getHeads(doc);
-      if (doc.objects) {
-        yield Object.entries(doc.objects).map(([objectId, object]) => {
-          return {
-            id: idCodec.encode({
-              documentId: handle.documentId,
-              objectId
-            }),
-            object,
-            currentHash: heads.join("")
-          };
-        });
-      }
-      if (doc.links) {
-        for (const id of Object.values(doc.links)) {
-          if (visited.has(id)) {
-            continue;
-          }
-          const linkHandle = automergeHost.repo.find(id);
-          for await (const result of getObjectsFromHandle(linkHandle)) {
-            yield result;
-          }
-        }
-      }
-      visited.add(handle.documentId);
-    }
-    for (const handle of Object.values(automergeHost.repo.handles)) {
-      if (visited.has(handle.documentId)) {
-        continue;
-      }
-      for await (const result of getObjectsFromHandle(handle)) {
-        yield result;
-      }
-      visited.add(handle.documentId);
-    }
-  }
-);
-// packages/sdk/client-services/src/packlets/services/service-context.ts
 function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -4412,7 +4497,7 @@ var ServiceContext = class extends Resource {
     this._runtimeParams = _runtimeParams;
     this.initialized = new Trigger5();
     this._handlerFactories = /* @__PURE__ */ new Map();
-    this._instanceId = PublicKey10.random().toHex();
+    this._instanceId = PublicKey11.random().toHex();
     this.metadataStore = new MetadataStore(storage.createDirectory("metadata"));
     this.snapshotStore = new SnapshotStore(storage.createDirectory("snapshots"));
     this.blobStore = new BlobStore(storage.createDirectory("blobs"));
@@ -4435,33 +4520,19 @@ var ServiceContext = class extends Resource {
       snapshotStore: this.snapshotStore
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager, this._runtimeParams);
-    this.indexMetadata = new IndexMetadataStore({
-      db: level.sublevel("index-metadata")
-    });
-    this.automergeHost = new AutomergeHost({
-      directory: storage.createDirectory("automerge"),
-      db: level.sublevel("automerge"),
-      storageCallbacks: createStorageCallbacks({
-        host: () => this.automergeHost,
-        metadata: this.indexMetadata
-      })
-    });
-    this.indexer = new Indexer({
-      indexStore: new IndexStore({
-        db: level.sublevel("index-storage")
-      }),
-      metadataStore: this.indexMetadata,
-      loadDocuments: createSelectedDocumentsIterator(this.automergeHost),
-      getAllDocuments: createDocumentsIterator(this.automergeHost)
+    this.echoHost = new EchoHost({
+      kv: this.level,
+      storage: this.storage
     });
     this.invitations = new InvitationsHandler(this.networkManager);
-    this._handlerFactories.set(Invitation6.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? failUndefined2(), this._acceptIdentity.bind(this)));
+    this.invitationsManager = new InvitationsManager(this.invitations, (invitation) => this.getInvitationHandler(invitation), this.metadataStore);
+    this._handlerFactories.set(Invitation7.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? failUndefined2(), this._acceptIdentity.bind(this)));
   }
   async _open(ctx) {
     await this._checkStorageVersion();
     log12("opening...", void 0, {
       F: __dxlog_file14,
-      L: 157,
+      L: 151,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4469,56 +4540,64 @@ var ServiceContext = class extends Resource {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 158,
+      L: 152,
       S: this,
       C: (f, a) => f(...a)
     });
     await this.signalManager.open();
     await this.networkManager.open();
-    await this.automergeHost.open();
+    await this.echoHost.open(ctx);
     await this.metadataStore.load();
     await this.spaceManager.open();
     await this.identityManager.open(ctx);
     if (this.identityManager.identity) {
       await this._initialize(ctx);
     }
+    const loadedInvitations = await this.invitationsManager.loadPersistentInvitations();
+    log12("loaded persistent invitations", {
+      count: loadedInvitations.invitations?.length
+    }, {
+      F: __dxlog_file14,
+      L: 165,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     log12.trace("dxos.sdk.service-context.open", trace8.end({
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 169,
+      L: 167,
       S: this,
       C: (f, a) => f(...a)
     });
     log12("opened", void 0, {
       F: __dxlog_file14,
-      L: 170,
+      L: 168,
       S: this,
       C: (f, a) => f(...a)
     });
   }
-  async _close() {
+  async _close(ctx) {
     log12("closing...", void 0, {
       F: __dxlog_file14,
-      L: 174,
+      L: 172,
       S: this,
       C: (f, a) => f(...a)
     });
     if (this._deviceSpaceSync && this.identityManager.identity) {
       await this.identityManager.identity.space.spaceState.removeCredentialProcessor(this._deviceSpaceSync);
     }
-    await this.automergeHost.close();
     await this.dataSpaceManager?.close();
     await this.identityManager.close();
     await this.spaceManager.close();
     await this.feedStore.close();
+    await this.metadataStore.close();
+    await this.echoHost.close(ctx);
     await this.networkManager.close();
     await this.signalManager.close();
-    await this.metadataStore.close();
-    await this.indexer.destroy();
     log12("closed", void 0, {
       F: __dxlog_file14,
-      L: 187,
+      L: 184,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4532,7 +4611,7 @@ var ServiceContext = class extends Resource {
     const factory = this._handlerFactories.get(invitation.kind);
     invariant13(factory, `Unknown invitation kind: ${invitation.kind}`, {
       F: __dxlog_file14,
-      L: 198,
+      L: 195,
       S: this,
       A: [
         "factory",
@@ -4564,7 +4643,7 @@ var ServiceContext = class extends Resource {
   async _initialize(ctx) {
     log12("initializing spaces...", void 0, {
       F: __dxlog_file14,
-      L: 229,
+      L: 226,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4582,12 +4661,12 @@ var ServiceContext = class extends Resource {
         });
       }
     };
-    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.keyring, signingContext, this.feedStore, this.automergeHost, this._runtimeParams);
+    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.keyring, signingContext, this.feedStore, this.echoHost, this.invitationsManager, this._runtimeParams);
     await this.dataSpaceManager.open();
-    this._handlerFactories.set(Invitation6.Kind.SPACE, (invitation) => {
+    this._handlerFactories.set(Invitation7.Kind.SPACE, (invitation) => {
       invariant13(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
         F: __dxlog_file14,
-        L: 253,
+        L: 251,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -4611,7 +4690,7 @@ var ServiceContext = class extends Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 269,
+            L: 267,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4622,7 +4701,7 @@ var ServiceContext = class extends Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 273,
+            L: 271,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4633,7 +4712,7 @@ var ServiceContext = class extends Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 278,
+            L: 276,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4644,7 +4723,7 @@ var ServiceContext = class extends Resource {
         } catch (err) {
           log12.catch(err, void 0, {
             F: __dxlog_file14,
-            L: 284,
+            L: 282,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4694,11 +4773,11 @@ import { getFirstStreamValue } from "@dxos/codec-protobuf";
 import { credentialTypeFilter } from "@dxos/credentials";
 import { invariant as invariant14 } from "@dxos/invariant";
 import { STORAGE_VERSION as STORAGE_VERSION2 } from "@dxos/protocols";
-import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember4 } from "@dxos/protocols/proto/dxos/client/services";
 import { TRACE_PROCESSOR } from "@dxos/tracing";
 // packages/sdk/client-services/src/version.ts
-var DXOS_VERSION = "0.4.10-main.c5e8686";
+var DXOS_VERSION = "0.4.10-main.c9da257";
 // packages/sdk/client-services/src/packlets/services/platform.ts
 import { Platform } from "@dxos/protocols/proto/dxos/client/services";
@@ -4820,7 +4899,7 @@ var getSpaceStats = async (space) => {
           displayName: member.assertion.profile?.displayName
         }
       },
-      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember3.PresenceState.ONLINE : SpaceMember3.PresenceState.OFFLINE
+      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember4.PresenceState.ONLINE : SpaceMember4.PresenceState.OFFLINE
     })),
     pipeline: {
       // TODO(burdon): Pick properties from credentials if needed.
@@ -4942,11 +5021,10 @@ import { jsonKeyReplacer as jsonKeyReplacer2, nonNullable } from "@dxos/util";
 import { Event as Event9, synchronized as synchronized3 } from "@dxos/async";
 import { clientServiceBundle, defaultKey, Properties } from "@dxos/client-protocol";
 import { Context as Context11 } from "@dxos/context";
-import { DataServiceImpl, encodeReference } from "@dxos/echo-pipeline";
+import { encodeReference } from "@dxos/echo-pipeline";
 import { getTypeReference } from "@dxos/echo-schema";
-import { IndexServiceImpl } from "@dxos/indexing";
 import { invariant as invariant16 } from "@dxos/invariant";
-import { PublicKey as PublicKey13 } from "@dxos/keys";
+import { PublicKey as PublicKey14 } from "@dxos/keys";
 import { log as log16 } from "@dxos/log";
 import { WebsocketSignalManager } from "@dxos/messaging";
 import { NetworkManager, createSimplePeerTransportFactory } from "@dxos/network-manager";
@@ -5165,7 +5243,7 @@ var isLocked = (lockPath) => {
 // packages/sdk/client-services/src/packlets/logging/logging-service.ts
 import { Event as Event8 } from "@dxos/async";
 import { Stream as Stream12 } from "@dxos/codec-protobuf";
-import { PublicKey as PublicKey11 } from "@dxos/keys";
+import { PublicKey as PublicKey12 } from "@dxos/keys";
 import { getContextFromEntry, log as log15 } from "@dxos/log";
 import { QueryLogsRequest } from "@dxos/protocols/proto/dxos/client/services";
 import { getDebugName, jsonify, numericalValues, tracer } from "@dxos/util";
@@ -5173,7 +5251,7 @@ var LoggingServiceImpl = class {
   constructor() {
     this._logs = new Event8();
     this._started = Date.now();
-    this._sessionId = PublicKey11.random().toHex();
+    this._sessionId = PublicKey12.random().toHex();
     this._logProcessor = (_config, entry2) => {
       this._logs.emit(entry2);
     };
@@ -5384,10 +5462,10 @@ var toStorageType = (type) => {
 // packages/sdk/client-services/src/packlets/storage/level.ts
 import { Level } from "level";
 import path from "@dxos/node-std/path";
-import { PublicKey as PublicKey12 } from "@dxos/keys";
+import { PublicKey as PublicKey13 } from "@dxos/keys";
 var createLevel = async (config) => {
   const persistent = isPersistent(config);
-  const storagePath = persistent ? path.join(getRootPath(config), "level") : `/tmp/dxos-${PublicKey12.random().toHex()}`;
+  const storagePath = persistent ? path.join(getRootPath(config), "level") : `/tmp/dxos-${PublicKey13.random().toHex()}`;
   const level = new Level(storagePath);
   await level.open();
   return level;
@@ -5551,7 +5629,7 @@ var ClientServicesHost = class {
   initialize({ config, ...options }) {
     invariant16(!this._open, "service host is open", {
       F: __dxlog_file19,
-      L: 197,
+      L: 190,
       S: this,
       A: [
         "!this._open",
@@ -5560,14 +5638,14 @@ var ClientServicesHost = class {
     });
     log16("initializing...", void 0, {
       F: __dxlog_file19,
-      L: 198,
+      L: 191,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
       invariant16(!this._config, "config already set", {
         F: __dxlog_file19,
-        L: 201,
+        L: 194,
         S: this,
         A: [
           "!this._config",
@@ -5582,7 +5660,7 @@ var ClientServicesHost = class {
     if (!options.signalManager) {
       log16.warn("running signaling without telemetry metadata.", void 0, {
         F: __dxlog_file19,
-        L: 209,
+        L: 202,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -5593,7 +5671,7 @@ var ClientServicesHost = class {
     this._signalManager = signalManager;
     invariant16(!this._networkManager, "network manager already set", {
       F: __dxlog_file19,
-      L: 220,
+      L: 213,
       S: this,
       A: [
         "!this._networkManager",
@@ -5607,7 +5685,7 @@ var ClientServicesHost = class {
     });
     log16("initialized", void 0, {
       F: __dxlog_file19,
-      L: 227,
+      L: 220,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5616,18 +5694,18 @@ var ClientServicesHost = class {
     if (this._open) {
       return;
     }
-    const traceId = PublicKey13.random().toHex();
+    const traceId = PublicKey14.random().toHex();
     log16.trace("dxos.client-services.host.open", trace9.begin({
       id: traceId
     }), {
       F: __dxlog_file19,
-      L: 238,
+      L: 231,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant16(this._config, "config not set", {
       F: __dxlog_file19,
-      L: 240,
+      L: 233,
       S: this,
       A: [
         "this._config",
@@ -5636,7 +5714,7 @@ var ClientServicesHost = class {
     });
     invariant16(this._storage, "storage not set", {
       F: __dxlog_file19,
-      L: 241,
+      L: 234,
       S: this,
       A: [
         "this._storage",
@@ -5645,7 +5723,7 @@ var ClientServicesHost = class {
     });
     invariant16(this._signalManager, "signal manager not set", {
       F: __dxlog_file19,
-      L: 242,
+      L: 235,
       S: this,
       A: [
         "this._signalManager",
@@ -5654,7 +5732,7 @@ var ClientServicesHost = class {
     });
     invariant16(this._networkManager, "network manager not set", {
       F: __dxlog_file19,
-      L: 243,
+      L: 236,
       S: this,
       A: [
         "this._networkManager",
@@ -5666,7 +5744,7 @@ var ClientServicesHost = class {
       lockKey: this._resourceLock?.lockKey
     }, {
       F: __dxlog_file19,
-      L: 246,
+      L: 239,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5680,17 +5758,14 @@ var ClientServicesHost = class {
     this._serviceRegistry.setServices({
       SystemService: this._systemService,
       IdentityService: new IdentityServiceImpl((params) => this._createIdentity(params), this._serviceContext.identityManager, this._serviceContext.keyring, (profile) => this._serviceContext.broadcastProfileUpdate(profile)),
-      InvitationsService: new InvitationsServiceImpl(this._serviceContext.invitations, (invitation) => this._serviceContext.getInvitationHandler(invitation), this._serviceContext.metadataStore),
+      InvitationsService: new InvitationsServiceImpl(this._serviceContext.invitationsManager),
       DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
       SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, async () => {
         await this._serviceContext.initialized.wait();
         return this._serviceContext.dataSpaceManager;
       }),
-      DataService: new DataServiceImpl(this._serviceContext.automergeHost),
-      IndexService: new IndexServiceImpl({
-        indexer: this._serviceContext.indexer,
-        automergeHost: this._serviceContext.automergeHost
-      }),
+      DataService: this._serviceContext.echoHost.dataService,
+      QueryService: this._serviceContext.echoHost.queryService,
       NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager, this._serviceContext.signalManager),
       LoggingService: this._loggingService,
       TracingService: this._tracingService,
@@ -5702,24 +5777,6 @@ var ClientServicesHost = class {
       })
     });
     await this._serviceContext.open(ctx);
-    invariant16(this.serviceRegistry.services.InvitationsService, void 0, {
-      F: __dxlog_file19,
-      L: 314,
-      S: this,
-      A: [
-        "this.serviceRegistry.services.InvitationsService",
-        ""
-      ]
-    });
-    const loadedInvitations = await this.serviceRegistry.services.InvitationsService.loadPersistentInvitations();
-    log16("loaded persistent invitations", {
-      count: loadedInvitations.invitations?.length
-    }, {
-      F: __dxlog_file19,
-      L: 317,
-      S: this,
-      C: (f, a) => f(...a)
-    });
     const devtoolsProxy = this._config?.get("runtime.client.devtoolsProxy");
     if (devtoolsProxy) {
       this._devtoolsProxy = new WebsocketRpcClient({
@@ -5739,7 +5796,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file19,
-      L: 335,
+      L: 315,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5747,7 +5804,7 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file19,
-      L: 336,
+      L: 316,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5761,7 +5818,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file19,
-      L: 347,
+      L: 327,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5779,24 +5836,24 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file19,
-      L: 356,
+      L: 336,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async reset() {
-    const traceId = PublicKey13.random().toHex();
+    const traceId = PublicKey14.random().toHex();
     log16.trace("dxos.sdk.client-services-host.reset", trace9.begin({
       id: traceId
     }), {
       F: __dxlog_file19,
-      L: 361,
+      L: 341,
       S: this,
       C: (f, a) => f(...a)
     });
     log16("resetting...", void 0, {
       F: __dxlog_file19,
-      L: 363,
+      L: 343,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5804,7 +5861,7 @@ var ClientServicesHost = class {
     await this._storage.reset();
     log16("reset", void 0, {
       F: __dxlog_file19,
-      L: 366,
+      L: 346,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5812,7 +5869,7 @@ var ClientServicesHost = class {
       id: traceId
     }), {
       F: __dxlog_file19,
-      L: 367,
+      L: 347,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5825,14 +5882,14 @@ var ClientServicesHost = class {
     const automergeIndex = space.automergeSpaceState.rootUrl;
     invariant16(automergeIndex, void 0, {
       F: __dxlog_file19,
-      L: 379,
+      L: 359,
       S: this,
       A: [
         "automergeIndex",
         ""
       ]
     });
-    const document = await this._serviceContext.automergeHost.repo.find(automergeIndex);
+    const document = await this._serviceContext.echoHost.automergeRepo.find(automergeIndex);
     await document.whenReady();
     const properties = {
       system: {
@@ -5845,14 +5902,14 @@ var ClientServicesHost = class {
         keys: []
       }
     };
-    const propertiesId = PublicKey13.random().toHex();
+    const propertiesId = PublicKey14.random().toHex();
     document.change((doc) => {
       assignDeep2(doc, [
         "objects",
         propertiesId
       ], properties);
     });
-    await this._serviceContext.automergeHost.repo.flush();
+    await this._serviceContext.echoHost.flush();
     return identity;
   }
 };
@@ -5875,7 +5932,7 @@ ClientServicesHost = _ts_decorate8([
 ], ClientServicesHost);
 // packages/sdk/client-services/src/packlets/services/util.ts
-import { PublicKey as PublicKey14 } from "@dxos/keys";
+import { PublicKey as PublicKey15 } from "@dxos/keys";
 import { humanize } from "@dxos/util";
 var ClientServicesProviderResource = Symbol.for("dxos.resource.ClientServices");
@@ -5934,6 +5991,7 @@ export {
   createAdmissionKeypair,
   InvitationsServiceImpl,
   SpaceInvitationProtocol,
+  InvitationsManager,
   ClientRpcServer,
   DataSpace,
   DataSpaceManager,
@@ -5951,4 +6009,4 @@ export {
   ClientServicesHost,
   ClientServicesProviderResource
 };
-//# sourceMappingURL=chunk-FUEOAPLA.mjs.map
+//# sourceMappingURL=chunk-NMSMHDG6.mjs.map