@dxos/client-services 0.4.10-main.e96274c → 0.4.10-main.e99db3e

package/dist/lib/node/{chunk-GZWBW7OC.cjs → chunk-GAS53XAH.cjs}

@@ -26,8 +26,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var chunk_GZWBW7OC_exports = {};
-__export(chunk_GZWBW7OC_exports, {
+var chunk_GAS53XAH_exports = {};
+__export(chunk_GAS53XAH_exports, {
   ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   ClientServicesProviderResource: () => ClientServicesProviderResource,
@@ -66,7 +66,7 @@ __export(chunk_GZWBW7OC_exports, {
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo
 });
-module.exports = __toCommonJS(chunk_GZWBW7OC_exports);
+module.exports = __toCommonJS(chunk_GAS53XAH_exports);
 var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_feed_store = require("@dxos/feed-store");
@@ -120,7 +120,6 @@ var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
 var import_async7 = require("@dxos/async");
 var import_client_protocol2 = require("@dxos/client-protocol");
 var import_context4 = require("@dxos/context");
-var import_credentials7 = require("@dxos/credentials");
 var import_crypto = require("@dxos/crypto");
 var import_invariant5 = require("@dxos/invariant");
 var import_keys5 = require("@dxos/keys");
@@ -141,59 +140,65 @@ var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations")
 var import_teleport = require("@dxos/teleport");
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
 var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials8 = require("@dxos/credentials");
+var import_credentials7 = require("@dxos/credentials");
 var import_feed_store3 = require("@dxos/feed-store");
 var import_invariant7 = require("@dxos/invariant");
 var import_log6 = require("@dxos/log");
 var import_protocols6 = require("@dxos/protocols");
 var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
+var import_credentials8 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_async9 = require("@dxos/async");
+var import_client_protocol3 = require("@dxos/client-protocol");
+var import_context6 = require("@dxos/context");
+var import_credentials9 = require("@dxos/credentials");
 var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_invariant8 = require("@dxos/invariant");
+var import_keys7 = require("@dxos/keys");
 var import_log7 = require("@dxos/log");
+var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
 var import_codec_protobuf9 = require("@dxos/codec-protobuf");
 var import_debug2 = require("@dxos/debug");
 var import_rpc = require("@dxos/rpc");
 var import_tracing3 = require("@dxos/tracing");
 var import_async10 = require("@dxos/async");
-var import_client_protocol3 = require("@dxos/client-protocol");
-var import_context6 = require("@dxos/context");
+var import_client_protocol4 = require("@dxos/client-protocol");
+var import_context7 = require("@dxos/context");
 var import_debug3 = require("@dxos/debug");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
 var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_echo_schema = require("@dxos/echo-schema");
 var import_invariant9 = require("@dxos/invariant");
-var import_keys7 = require("@dxos/keys");
+var import_keys8 = require("@dxos/keys");
 var import_log8 = require("@dxos/log");
 var import_protocols7 = require("@dxos/protocols");
-var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
+var import_credentials10 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe2 = require("@dxos/timeframe");
 var import_tracing4 = require("@dxos/tracing");
 var import_util4 = require("@dxos/util");
 var import_async11 = require("@dxos/async");
-var import_credentials10 = require("@dxos/credentials");
+var import_credentials11 = require("@dxos/credentials");
 var import_async12 = require("@dxos/async");
-var import_context7 = require("@dxos/context");
+var import_context8 = require("@dxos/context");
 var import_invariant10 = require("@dxos/invariant");
-var import_keys8 = require("@dxos/keys");
+var import_keys9 = require("@dxos/keys");
 var import_log9 = require("@dxos/log");
 var import_protocols8 = require("@dxos/protocols");
 var import_teleport2 = require("@dxos/teleport");
 var import_util5 = require("@dxos/util");
 var import_async13 = require("@dxos/async");
-var import_context8 = require("@dxos/context");
-var import_credentials11 = require("@dxos/credentials");
+var import_context9 = require("@dxos/context");
+var import_credentials12 = require("@dxos/credentials");
 var import_invariant11 = require("@dxos/invariant");
-var import_keys9 = require("@dxos/keys");
+var import_keys10 = require("@dxos/keys");
 var import_log10 = require("@dxos/log");
 var import_protocols9 = require("@dxos/protocols");
-var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_gossip2 = require("@dxos/teleport-extension-gossip");
 var import_util6 = require("@dxos/util");
-var import_credentials12 = require("@dxos/credentials");
+var import_credentials13 = require("@dxos/credentials");
 var import_debug4 = require("@dxos/debug");
-var import_credentials13 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials14 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe3 = require("@dxos/timeframe");
 var import_async14 = require("@dxos/async");
 var import_codec_protobuf10 = require("@dxos/codec-protobuf");
@@ -201,79 +206,79 @@ var import_debug5 = require("@dxos/debug");
 var import_invariant12 = require("@dxos/invariant");
 var import_log11 = require("@dxos/log");
 var import_protocols10 = require("@dxos/protocols");
-var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
 var import_async15 = require("@dxos/async");
-var import_context9 = require("@dxos/context");
-var import_credentials14 = require("@dxos/credentials");
+var import_context10 = require("@dxos/context");
+var import_credentials15 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
 var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_indexing = require("@dxos/indexing");
 var import_invariant13 = require("@dxos/invariant");
 var import_keyring = require("@dxos/keyring");
-var import_keys10 = require("@dxos/keys");
+var import_keys11 = require("@dxos/keys");
 var import_log12 = require("@dxos/log");
 var import_protocols11 = require("@dxos/protocols");
-var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_object_sync = require("@dxos/teleport-extension-object-sync");
 var import_tracing5 = require("@dxos/tracing");
 var import_util7 = require("@dxos/util");
 var import_automerge = require("@dxos/automerge/automerge");
 var import_protocols12 = require("@dxos/protocols");
 var import_codec_protobuf11 = require("@dxos/codec-protobuf");
-var import_credentials15 = require("@dxos/credentials");
+var import_credentials16 = require("@dxos/credentials");
 var import_invariant14 = require("@dxos/invariant");
 var import_protocols13 = require("@dxos/protocols");
-var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
-var import_tracing6 = require("@dxos/tracing");
 var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
-var import_config = require("@dxos/config");
+var import_tracing6 = require("@dxos/tracing");
 var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
+var import_config = require("@dxos/config");
+var import_services14 = require("@dxos/protocols/proto/dxos/client/services");
 var import_tracing7 = require("@dxos/tracing");
 var import_util8 = require("@dxos/util");
 var import_async16 = require("@dxos/async");
-var import_client_protocol4 = require("@dxos/client-protocol");
-var import_context10 = require("@dxos/context");
+var import_client_protocol5 = require("@dxos/client-protocol");
+var import_context11 = require("@dxos/context");
 var import_echo_pipeline5 = require("@dxos/echo-pipeline");
 var import_echo_schema2 = require("@dxos/echo-schema");
 var import_indexing2 = require("@dxos/indexing");
 var import_invariant15 = require("@dxos/invariant");
-var import_keys11 = require("@dxos/keys");
+var import_keys12 = require("@dxos/keys");
 var import_log13 = require("@dxos/log");
 var import_messaging = require("@dxos/messaging");
 var import_network_manager2 = require("@dxos/network-manager");
 var import_protocols14 = require("@dxos/protocols");
-var import_services14 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services15 = require("@dxos/protocols/proto/dxos/client/services");
 var import_tracing8 = require("@dxos/tracing");
 var import_util9 = require("@dxos/util");
 var import_websocket_rpc = require("@dxos/websocket-rpc");
 var import_async17 = require("@dxos/async");
 var import_codec_protobuf12 = require("@dxos/codec-protobuf");
 var import_invariant16 = require("@dxos/invariant");
-var import_services15 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invariant17 = require("@dxos/invariant");
 var import_lock_file = require("@dxos/lock-file");
 var import_log14 = require("@dxos/log");
 var import_async18 = require("@dxos/async");
 var import_codec_protobuf13 = require("@dxos/codec-protobuf");
-var import_keys12 = require("@dxos/keys");
+var import_keys13 = require("@dxos/keys");
 var import_log15 = require("@dxos/log");
-var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services17 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util10 = require("@dxos/util");
 var import_codec_protobuf14 = require("@dxos/codec-protobuf");
 var import_protocols15 = require("@dxos/protocols");
 var import_config2 = require("@dxos/protocols/proto/dxos/config");
 var import_random_access_storage = require("@dxos/random-access-storage");
-var import_client_protocol5 = require("@dxos/client-protocol");
+var import_client_protocol6 = require("@dxos/client-protocol");
 var import_config3 = require("@dxos/protocols/proto/dxos/config");
 var import_util11 = require("@dxos/util");
 var import_level = require("level");
 var import_node_path = __toESM(require("node:path"));
-var import_keys13 = require("@dxos/keys");
+var import_keys14 = require("@dxos/keys");
 var import_codec_protobuf15 = require("@dxos/codec-protobuf");
-var import_services17 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services18 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util12 = require("@dxos/util");
-var import_keys14 = require("@dxos/keys");
+var import_keys15 = require("@dxos/keys");
 var import_util13 = require("@dxos/util");
 var subscribeToFeeds = ({ feedStore }, { feedKeys }) => {
   return new import_codec_protobuf.Stream(({ next }) => {
@@ -1292,7 +1297,9 @@ var IdentityManager = class {
           C: (f, a) => f(...a)
         });
       },
-      memberKey: identityKey
+      memberKey: identityKey,
+      onDelegatedInvitationStatusChange: async () => {
+      }
     });
   }
 };
@@ -1389,10 +1396,13 @@ var DeviceInvitationProtocol = class {
       kind: import_services2.Invitation.Kind.DEVICE
     };
   }
-  async admit(request) {
+  async delegate(invitation) {
+    throw new Error("delegation not supported");
+  }
+  async admit(_, request) {
     (0, import_invariant4.invariant)(request.device, void 0, {
       F: __dxlog_file5,
-      L: 37,
+      L: 42,
       S: this,
       A: [
         "request.device",
@@ -1438,7 +1448,7 @@ var DeviceInvitationProtocol = class {
   async accept(response, request) {
     (0, import_invariant4.invariant)(response.device, void 0, {
       F: __dxlog_file5,
-      L: 82,
+      L: 87,
       S: this,
       A: [
         "response.device",
@@ -1448,7 +1458,7 @@ var DeviceInvitationProtocol = class {
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
     (0, import_invariant4.invariant)(request.device, void 0, {
       F: __dxlog_file5,
-      L: 85,
+      L: 90,
       S: this,
       A: [
         "request.device",
@@ -1823,51 +1833,7 @@ var InvitationsHandler = class {
   constructor(_networkManager) {
     this._networkManager = _networkManager;
   }
-  createInvitation(protocol, options) {
-    const { invitationId = import_keys5.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys5.PublicKey.random(), persistent = options?.authMethod !== import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
-    const authCode = options?.authCode ?? (authMethod === import_services3.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials7.generatePasscode)(import_client_protocol2.AUTHENTICATION_CODE_LENGTH) : void 0);
-    (0, import_invariant5.invariant)(protocol, void 0, {
-      F: __dxlog_file7,
-      L: 87,
-      S: this,
-      A: [
-        "protocol",
-        ""
-      ]
-    });
-    const invitation = {
-      invitationId,
-      type,
-      authMethod,
-      state,
-      swarmKey,
-      authCode,
-      timeout,
-      persistent: persistent && type !== import_services3.Invitation.Type.DELEGATED,
-      guestKeypair: guestKeypair ?? (authMethod === import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
-      created,
-      lifetime,
-      multiUse,
-      ...protocol.getInvitationContext()
-    };
-    const stream = new import_async7.PushStream();
-    const ctx = new import_context4.Context({
-      onError: (err) => {
-        stream.error(err);
-        void ctx.dispose();
-      }
-    });
-    ctx.onDispose(() => {
-      (0, import_log4.log)("complete", {
-        ...protocol.toJSON()
-      }, {
-        F: __dxlog_file7,
-        L: 115,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      stream.complete();
-    });
+  handleInvitationFlow(ctx, stream, protocol, invitation) {
     const createExtension = () => {
       const extension = new InvitationHostExtension({
         onStateUpdate: (invitation2) => {
@@ -1876,8 +1842,8 @@ var InvitationsHandler = class {
             state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
           });
         },
-        resolveInvitation: async ({ invitationId: invitationId2 }) => {
-          if (invitationId2 && invitationId2 !== invitation.invitationId) {
+        resolveInvitation: async ({ invitationId }) => {
+          if (invitationId && invitationId !== invitation.invitationId) {
             return void 0;
           }
           return invitation;
@@ -1887,14 +1853,14 @@ var InvitationsHandler = class {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             (0, import_invariant5.invariant)(deviceKey, void 0, {
               F: __dxlog_file7,
-              L: 136,
+              L: 87,
               S: this,
               A: [
                 "deviceKey",
                 ""
               ]
             });
-            const admissionResponse = await protocol.admit(admissionRequest, extension.guestProfile);
+            const admissionResponse = await protocol.admit(invitation, admissionRequest, extension.guestProfile);
             extension.completedTrigger.wake(deviceKey);
             return admissionResponse;
           } catch (err) {
@@ -1910,7 +1876,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 154,
+                L: 105,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1918,7 +1884,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 155,
+                L: 106,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1927,14 +1893,14 @@ var InvitationsHandler = class {
                 state: import_services3.Invitation.State.CONNECTED
               });
               const deviceKey = await extension.completedTrigger.wait({
-                timeout
+                timeout: invitation.timeout
               });
               (0, import_log4.log)("admitted guest", {
                 guest: deviceKey,
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 158,
+                L: 109,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1946,7 +1912,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 160,
+                L: 111,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1956,7 +1922,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 163,
+                  L: 114,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1967,7 +1933,7 @@ var InvitationsHandler = class {
               } else {
                 import_log4.log.error("failed", err, {
                   F: __dxlog_file7,
-                  L: 166,
+                  L: 117,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1978,12 +1944,12 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 169,
+                L: 120,
                 S: this,
                 C: (f, a) => f(...a)
               });
             } finally {
-              if (!multiUse) {
+              if (!invitation.multiUse) {
                 await swarmConnection.close();
                 await ctx.dispose();
               }
@@ -1999,7 +1965,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 184,
+              L: 135,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2010,7 +1976,7 @@ var InvitationsHandler = class {
           } else {
             import_log4.log.error("failed", err, {
               F: __dxlog_file7,
-              L: 187,
+              L: 138,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2024,7 +1990,7 @@ var InvitationsHandler = class {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
         import_log4.log.warn("invitation has already expired", void 0, {
           F: __dxlog_file7,
-          L: 198,
+          L: 149,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2058,24 +2024,12 @@ var InvitationsHandler = class {
         state: import_services3.Invitation.State.CONNECTING
       });
     });
-    const observable = new import_client_protocol2.CancellableInvitation({
-      initialInvitation: invitation,
-      subscriber: stream.observable,
-      onCancel: async () => {
-        stream.next({
-          ...invitation,
-          state: import_services3.Invitation.State.CANCELLED
-        });
-        await ctx.dispose();
-      }
-    });
-    return observable;
   }
   acceptInvitation(protocol, invitation, deviceProfile) {
     const { timeout = import_client_protocol2.INVITATION_TIMEOUT } = invitation;
     (0, import_invariant5.invariant)(protocol, void 0, {
       F: __dxlog_file7,
-      L: 252,
+      L: 191,
       S: this,
       A: [
         "protocol",
@@ -2085,7 +2039,7 @@ var InvitationsHandler = class {
     if (deviceProfile) {
       (0, import_invariant5.invariant)(invitation.kind === import_services3.Invitation.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
         F: __dxlog_file7,
-        L: 255,
+        L: 194,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -2100,7 +2054,7 @@ var InvitationsHandler = class {
     const setState = (newData) => {
       (0, import_invariant5.invariant)(newData.state !== void 0, void 0, {
         F: __dxlog_file7,
-        L: 266,
+        L: 205,
         S: this,
         A: [
           "newData.state !== undefined",
@@ -2120,7 +2074,7 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             F: __dxlog_file7,
-            L: 274,
+            L: 213,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2130,7 +2084,7 @@ var InvitationsHandler = class {
         } else {
           import_log4.log.warn("auth failed", err, {
             F: __dxlog_file7,
-            L: 277,
+            L: 216,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2144,7 +2098,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 285,
+        L: 224,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2159,7 +2113,7 @@ var InvitationsHandler = class {
               currentState
             }, {
               F: __dxlog_file7,
-              L: 295,
+              L: 234,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2174,7 +2128,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 304,
+                L: 243,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2186,7 +2140,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 312,
+                L: 251,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2197,7 +2151,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 316,
+                L: 255,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2207,7 +2161,7 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 F: __dxlog_file7,
-                L: 320,
+                L: 259,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2228,7 +2182,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 336,
+                L: 275,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2240,7 +2194,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 347,
+                L: 286,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2253,7 +2207,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 349,
+                L: 288,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2263,7 +2217,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 352,
+                  L: 291,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2273,7 +2227,7 @@ var InvitationsHandler = class {
               } else {
                 (0, import_log4.log)("auth failed", err, {
                   F: __dxlog_file7,
-                  L: 355,
+                  L: 294,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2284,7 +2238,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 358,
+                L: 297,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2302,7 +2256,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 369,
+              L: 308,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2312,7 +2266,7 @@ var InvitationsHandler = class {
           } else {
             (0, import_log4.log)("auth failed", err, {
               F: __dxlog_file7,
-              L: 372,
+              L: 311,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2329,7 +2283,7 @@ var InvitationsHandler = class {
       } else {
         (0, import_invariant5.invariant)(invitation.swarmKey, void 0, {
           F: __dxlog_file7,
-          L: 386,
+          L: 325,
           S: this,
           A: [
             "invitation.swarmKey",
@@ -2371,7 +2325,7 @@ var InvitationsHandler = class {
     for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
       (0, import_log4.log)("guest waiting for authentication code...", void 0, {
         F: __dxlog_file7,
-        L: 426,
+        L: 365,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2381,7 +2335,7 @@ var InvitationsHandler = class {
       const authCode = await authenticated.wait(options);
       (0, import_log4.log)("sending authentication request", void 0, {
         F: __dxlog_file7,
-        L: 430,
+        L: 369,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2402,7 +2356,7 @@ var InvitationsHandler = class {
             attempt
           }, {
             F: __dxlog_file7,
-            L: 441,
+            L: 380,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2420,7 +2374,7 @@ var InvitationsHandler = class {
     }
     (0, import_log4.log)("sending authentication request", void 0, {
       F: __dxlog_file7,
-      L: 460,
+      L: 399,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2452,9 +2406,8 @@ var InvitationsServiceImpl = class {
     return {};
   }
   createInvitation(options) {
-    const invitation = this._invitationsManager.createInvitation(options);
     return new import_codec_protobuf8.Stream(({ next, close }) => {
-      invitation.subscribe(next, close, close);
+      void this._invitationsManager.createInvitation(options).then((invitation) => invitation.subscribe(next, close, close)).catch(close);
     });
   }
   acceptInvitation(request) {
@@ -2557,10 +2510,10 @@ var SpaceInvitationProtocol = class {
       spaceKey: this._spaceKey
     };
   }
-  async admit(request, guestProfile) {
+  async admit(invitation, request, guestProfile) {
     (0, import_invariant7.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file8,
-      L: 47,
+      L: 55,
       S: this,
       A: [
         "this._spaceKey",
@@ -2570,7 +2523,7 @@ var SpaceInvitationProtocol = class {
     const space = await this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant7.invariant)(space, void 0, {
       F: __dxlog_file8,
-      L: 49,
+      L: 57,
       S: this,
       A: [
         "space",
@@ -2579,7 +2532,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant7.invariant)(request.space, void 0, {
       F: __dxlog_file8,
-      L: 51,
+      L: 59,
       S: this,
       A: [
         "request.space",
@@ -2592,14 +2545,14 @@ var SpaceInvitationProtocol = class {
       guest: deviceKey
     }, {
       F: __dxlog_file8,
-      L: 54,
+      L: 62,
       S: this,
       C: (f, a) => f(...a)
     });
-    const credentials = await (0, import_credentials8.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
+    const credentials = await (0, import_credentials7.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile, invitation.delegationCredentialId);
     (0, import_invariant7.invariant)(credentials[0].credential, void 0, {
       F: __dxlog_file8,
-      L: 65,
+      L: 74,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2607,9 +2560,9 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const spaceMemberCredential = credentials[0].credential.credential;
-    (0, import_invariant7.invariant)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+    (0, import_invariant7.invariant)((0, import_credentials7.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file8,
-      L: 67,
+      L: 76,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2624,6 +2577,69 @@ var SpaceInvitationProtocol = class {
       }
     };
   }
+  async delegate(invitation) {
+    (0, import_invariant7.invariant)(this._spaceKey, void 0, {
+      F: __dxlog_file8,
+      L: 89,
+      S: this,
+      A: [
+        "this._spaceKey",
+        ""
+      ]
+    });
+    const space = await this._spaceManager.spaces.get(this._spaceKey);
+    (0, import_invariant7.invariant)(space, void 0, {
+      F: __dxlog_file8,
+      L: 91,
+      S: this,
+      A: [
+        "space",
+        ""
+      ]
+    });
+    if (invitation.authMethod === import_services6.Invitation.AuthMethod.KNOWN_PUBLIC_KEY) {
+      (0, import_invariant7.invariant)(invitation.guestKeypair?.publicKey, void 0, {
+        F: __dxlog_file8,
+        L: 93,
+        S: this,
+        A: [
+          "invitation.guestKeypair?.publicKey",
+          ""
+        ]
+      });
+    }
+    (0, import_log6.log)("writing delegate space invitation", {
+      host: this._signingContext.deviceKey,
+      id: invitation.invitationId
+    }, {
+      F: __dxlog_file8,
+      L: 96,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const credential = await (0, import_credentials7.createDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, {
+      invitationId: invitation.invitationId,
+      authMethod: invitation.authMethod,
+      swarmKey: invitation.swarmKey,
+      role: import_credentials8.SpaceMember.Role.ADMIN,
+      expiresOn: invitation.lifetime ? new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime) : void 0,
+      multiUse: invitation.multiUse ?? false,
+      guestKey: invitation.authMethod === import_services6.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
+    });
+    (0, import_invariant7.invariant)(credential.credential, void 0, {
+      F: __dxlog_file8,
+      L: 116,
+      S: this,
+      A: [
+        "credential.credential",
+        ""
+      ]
+    });
+    await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, [
+      credential
+    ]);
+    return credential.credential.credential.id;
+  }
   checkInvitation(invitation) {
     if (invitation.spaceKey && this._spaceManager.spaces.has(invitation.spaceKey)) {
       return new import_protocols6.AlreadyJoinedError("Already joined space.");
@@ -2649,7 +2665,7 @@ var SpaceInvitationProtocol = class {
   async accept(response) {
     (0, import_invariant7.invariant)(response.space, void 0, {
       F: __dxlog_file8,
-      L: 107,
+      L: 149,
       S: this,
       A: [
         "response.space",
@@ -2657,10 +2673,10 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { credential, controlTimeframe, dataTimeframe } = response.space;
-    const assertion = (0, import_credentials8.getCredentialAssertion)(credential);
+    const assertion = (0, import_credentials7.getCredentialAssertion)(credential);
     (0, import_invariant7.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file8,
-      L: 110,
+      L: 152,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2669,7 +2685,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant7.invariant)(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
       F: __dxlog_file8,
-      L: 111,
+      L: 153,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -2707,25 +2723,39 @@ var InvitationsManager = class {
     this._persistentInvitationsLoadedEvent = new import_async9.Event();
     this._persistentInvitationsLoaded = false;
   }
-  createInvitation(options) {
-    const existingInvitation = this._createInvitations.get(options.invitationId);
-    if (existingInvitation) {
-      return existingInvitation;
+  async createInvitation(options) {
+    if (options.invitationId) {
+      const existingInvitation = this._createInvitations.get(options.invitationId);
+      if (existingInvitation) {
+        return existingInvitation;
+      }
     }
     const handler = this._getHandler(options);
-    const invitation = this._invitationsHandler.createInvitation(handler, options);
-    this._createInvitations.set(invitation.get().invitationId, invitation);
-    this.invitationCreated.emit(invitation.get());
-    const saveInvitationTask = invitation.get().persistent ? this._safePersistInBackground(invitation) : Promise.resolve();
-    this._onInvitationComplete(invitation, async () => {
-      this._createInvitations.delete(invitation.get().invitationId);
-      this.removedCreated.emit(invitation.get());
-      if (invitation.get().persistent) {
-        await saveInvitationTask;
-        await this._safeDeleteInvitation(invitation.get());
+    const invitation = this._createInvitation(handler, options);
+    const { ctx, stream, observableInvitation } = this._createObservableInvitation(handler, invitation);
+    this._createInvitations.set(invitation.invitationId, observableInvitation);
+    this.invitationCreated.emit(invitation);
+    this._onInvitationComplete(observableInvitation, async () => {
+      this._createInvitations.delete(observableInvitation.get().invitationId);
+      this.removedCreated.emit(observableInvitation.get());
+      if (observableInvitation.get().persistent) {
+        await this._safeDeleteInvitation(observableInvitation.get());
       }
     });
-    return invitation;
+    try {
+      await this._persistIfRequired(handler, stream, invitation);
+    } catch (err) {
+      import_log7.log.catch(err, void 0, {
+        F: __dxlog_file9,
+        L: 76,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await observableInvitation.cancel();
+      return observableInvitation;
+    }
+    this._invitationsHandler.handleInvitationFlow(ctx, stream, handler, observableInvitation.get());
+    return observableInvitation;
   }
   async loadPersistentInvitations() {
     if (this._persistentInvitationsLoaded) {
@@ -2737,10 +2767,10 @@ var InvitationsManager = class {
     try {
       const persistentInvitations = this._metadataStore.getInvitations();
       const freshInvitations = persistentInvitations.filter((invitation) => !(0, import_echo_pipeline.hasInvitationExpired)(invitation));
-      const cInvitations = freshInvitations.map((persistentInvitation) => {
+      const loadTasks = freshInvitations.map((persistentInvitation) => {
         (0, import_invariant8.invariant)(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
           F: __dxlog_file9,
-          L: 82,
+          L: 97,
           S: this,
           A: [
             "!this._createInvitations.get(persistentInvitation.invitationId)",
@@ -2750,15 +2780,16 @@ var InvitationsManager = class {
         return this.createInvitation({
           ...persistentInvitation,
           persistent: false
-        }).get();
+        });
       });
+      const cInvitations = await Promise.all(loadTasks);
       return {
-        invitations: cInvitations
+        invitations: cInvitations.map((invitation) => invitation.get())
       };
     } catch (err) {
       import_log7.log.catch(err, void 0, {
         F: __dxlog_file9,
-        L: 88,
+        L: 104,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2789,13 +2820,13 @@ var InvitationsManager = class {
   async authenticate({ invitationId, authCode }) {
     (0, import_log7.log)("authenticating...", void 0, {
       F: __dxlog_file9,
-      L: 117,
+      L: 133,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant8.invariant)(invitationId, void 0, {
       F: __dxlog_file9,
-      L: 118,
+      L: 134,
       S: this,
       A: [
         "invitationId",
@@ -2808,7 +2839,7 @@ var InvitationsManager = class {
         invitationId
       }, {
         F: __dxlog_file9,
-        L: 121,
+        L: 137,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2821,13 +2852,13 @@ var InvitationsManager = class {
       invitationId
     }, {
       F: __dxlog_file9,
-      L: 128,
+      L: 144,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant8.invariant)(invitationId, void 0, {
       F: __dxlog_file9,
-      L: 129,
+      L: 145,
       S: this,
       A: [
         "invitationId",
@@ -2868,25 +2899,73 @@ var InvitationsManager = class {
       this._persistentInvitationsLoadedEvent.once(ctx, () => callback());
     }
   }
-  _safePersistInBackground(invitation) {
-    return new Promise((resolve) => {
-      setTimeout(async () => {
-        try {
-          await this._metadataStore.addInvitation(invitation.get());
-          this.saved.emit(invitation.get());
-        } catch (err) {
-          import_log7.log.catch(err, void 0, {
-            F: __dxlog_file9,
-            L: 173,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          await invitation.cancel();
-        } finally {
-          resolve();
-        }
+  _createInvitation(protocol, options) {
+    const { invitationId = import_keys7.PublicKey.random().toHex(), type = import_services7.Invitation.Type.INTERACTIVE, authMethod = import_services7.Invitation.AuthMethod.SHARED_SECRET, state = import_services7.Invitation.State.INIT, timeout = import_client_protocol3.INVITATION_TIMEOUT, swarmKey = import_keys7.PublicKey.random(), persistent = options?.authMethod !== import_services7.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
+    const authCode = options?.authCode ?? (authMethod === import_services7.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials9.generatePasscode)(import_client_protocol3.AUTHENTICATION_CODE_LENGTH) : void 0);
+    return {
+      invitationId,
+      type,
+      authMethod,
+      state,
+      swarmKey,
+      authCode,
+      timeout,
+      persistent: persistent && type !== import_services7.Invitation.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === import_services7.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
+      created,
+      lifetime,
+      multiUse,
+      delegationCredentialId: options?.delegationCredentialId,
+      ...protocol.getInvitationContext()
+    };
+  }
+  _createObservableInvitation(handler, invitation) {
+    const stream = new import_async9.PushStream();
+    const ctx = new import_context6.Context({
+      onError: (err) => {
+        stream.error(err);
+        void ctx.dispose();
+      }
+    });
+    ctx.onDispose(() => {
+      (0, import_log7.log)("complete", {
+        ...handler.toJSON()
+      }, {
+        F: __dxlog_file9,
+        L: 228,
+        S: this,
+        C: (f, a) => f(...a)
       });
+      stream.complete();
+    });
+    const observableInvitation = new import_client_protocol3.CancellableInvitation({
+      initialInvitation: invitation,
+      subscriber: stream.observable,
+      onCancel: async () => {
+        stream.next({
+          ...invitation,
+          state: import_services7.Invitation.State.CANCELLED
+        });
+        await ctx.dispose();
+      }
     });
+    return {
+      ctx,
+      stream,
+      observableInvitation
+    };
+  }
+  async _persistIfRequired(handler, changeStream, invitation) {
+    if (invitation.type === import_services7.Invitation.Type.DELEGATED && invitation.delegationCredentialId == null) {
+      const delegationCredentialId = await handler.delegate(invitation);
+      changeStream.next({
+        ...invitation,
+        delegationCredentialId
+      });
+    } else if (invitation.persistent) {
+      await this._metadataStore.addInvitation(invitation);
+      this.saved.emit(invitation);
+    }
   }
   async _safeDeleteInvitation(invitation) {
     try {
@@ -2894,7 +2973,7 @@ var InvitationsManager = class {
     } catch (err) {
       import_log7.log.catch(err, void 0, {
         F: __dxlog_file9,
-        L: 186,
+        L: 260,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2990,7 +3069,7 @@ var AutomergeSpaceState = class {
     this._isProcessingRootDocs = false;
   }
   async processCredential(credential) {
-    if (!(0, import_credentials10.checkCredentialType)(credential, "dxos.halo.credentials.Epoch")) {
+    if (!(0, import_credentials11.checkCredentialType)(credential, "dxos.halo.credentials.Epoch")) {
       return;
     }
     this.lastEpoch = credential;
@@ -3022,11 +3101,11 @@ var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
 var WRITER_NOT_SET_ERROR_CODE = "WRITER_NOT_SET";
 var NotarizationPlugin = class {
   constructor() {
-    this._ctx = new import_context7.Context();
+    this._ctx = new import_context8.Context();
     this._extensionOpened = new import_async12.Event();
     this._extensions = /* @__PURE__ */ new Set();
-    this._processedCredentials = new import_util5.ComplexSet(import_keys8.PublicKey.hash);
-    this._processCredentialsTriggers = new import_util5.ComplexMap(import_keys8.PublicKey.hash);
+    this._processedCredentials = new import_util5.ComplexSet(import_keys9.PublicKey.hash);
+    this._processCredentialsTriggers = new import_util5.ComplexMap(import_keys9.PublicKey.hash);
   }
   get hasWriter() {
     return !!this._writer;
@@ -3147,7 +3226,7 @@ var NotarizationPlugin = class {
     this._extensionOpened.on(ctx, () => notarizeTask.schedule());
     try {
       await Promise.race([
-        (0, import_context7.rejectOnDispose)(ctx),
+        (0, import_context8.rejectOnDispose)(ctx),
         allNotarized,
         errors.wait()
       ]);
@@ -3286,11 +3365,11 @@ function _ts_decorate4(decorators, target, key, desc) {
 var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
 var DataSpace = class {
   constructor(params) {
-    this._ctx = new import_context6.Context();
+    this._ctx = new import_context7.Context();
     this._notarizationPlugin = new NotarizationPlugin();
     this._cache = void 0;
     this._automergeSpaceState = new AutomergeSpaceState((rootUrl) => this._onNewAutomergeRoot(rootUrl));
-    this._state = import_services7.SpaceState.CLOSED;
+    this._state = import_services8.SpaceState.CLOSED;
     this.error = void 0;
     this.stateUpdate = new import_async10.Event();
     this.metrics = {};
@@ -3305,14 +3384,14 @@ var DataSpace = class {
     this._callbacks = params.callbacks ?? {};
     this._automergeHost = params.automergeHost;
     this.authVerifier = new TrustedKeySetAuthVerifier({
-      trustedKeysProvider: () => new import_util4.ComplexSet(import_keys7.PublicKey.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => !member.removed).map((member) => member.key)),
+      trustedKeysProvider: () => new import_util4.ComplexSet(import_keys8.PublicKey.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => !member.removed).map((member) => member.key)),
       update: this._inner.stateUpdate,
-      authTimeout: import_client_protocol3.AUTH_TIMEOUT
+      authTimeout: import_client_protocol4.AUTH_TIMEOUT
     });
     this._cache = params.cache;
     this._state = params.initialState;
     (0, import_log8.log)("new state", {
-      state: import_services7.SpaceState[this._state]
+      state: import_services8.SpaceState[this._state]
     }, {
       F: __dxlog_file11,
       L: 140,
@@ -3359,10 +3438,10 @@ var DataSpace = class {
     await this._notarizationPlugin.open();
     await this._inner.spaceState.addCredentialProcessor(this._notarizationPlugin);
     await this._inner.spaceState.addCredentialProcessor(this._automergeSpaceState);
-    await this._inner.open(new import_context6.Context());
-    this._state = import_services7.SpaceState.CONTROL_ONLY;
+    await this._inner.open(new import_context7.Context());
+    this._state = import_services8.SpaceState.CONTROL_ONLY;
     (0, import_log8.log)("new state", {
-      state: import_services7.SpaceState[this._state]
+      state: import_services8.SpaceState[this._state]
     }, {
       F: __dxlog_file11,
       L: 198,
@@ -3378,9 +3457,9 @@ var DataSpace = class {
   }
   async _close() {
     await this._callbacks.beforeClose?.();
-    this._state = import_services7.SpaceState.CLOSED;
+    this._state = import_services8.SpaceState.CLOSED;
     (0, import_log8.log)("new state", {
-      state: import_services7.SpaceState[this._state]
+      state: import_services8.SpaceState[this._state]
     }, {
       F: __dxlog_file11,
       L: 212,
@@ -3388,7 +3467,7 @@ var DataSpace = class {
       C: (f, a) => f(...a)
     });
     await this._ctx.dispose();
-    this._ctx = new import_context6.Context();
+    this._ctx = new import_context7.Context();
     await this.authVerifier.close();
     await this._inner.close();
     await this._inner.spaceState.removeCredentialProcessor(this._automergeSpaceState);
@@ -3412,7 +3491,7 @@ var DataSpace = class {
         this.metrics.pipelineInitBegin = /* @__PURE__ */ new Date();
         await this.initializeDataPipeline();
       } catch (err) {
-        if (err instanceof import_protocols7.CancelledError || err instanceof import_context6.ContextDisposedError) {
+        if (err instanceof import_protocols7.CancelledError || err instanceof import_context7.ContextDisposedError) {
           (0, import_log8.log)("data pipeline initialization cancelled", err, {
             F: __dxlog_file11,
             L: 245,
@@ -3427,9 +3506,9 @@ var DataSpace = class {
           S: this,
           C: (f, a) => f(...a)
         });
-        this._state = import_services7.SpaceState.ERROR;
+        this._state = import_services8.SpaceState.ERROR;
         (0, import_log8.log)("new state", {
-          state: import_services7.SpaceState[this._state]
+          state: import_services8.SpaceState[this._state]
         }, {
           F: __dxlog_file11,
           L: 251,
@@ -3444,12 +3523,12 @@ var DataSpace = class {
     });
   }
   async initializeDataPipeline() {
-    if (this._state !== import_services7.SpaceState.CONTROL_ONLY) {
+    if (this._state !== import_services8.SpaceState.CONTROL_ONLY) {
       throw new import_protocols7.SystemError("Invalid operation");
     }
-    this._state = import_services7.SpaceState.INITIALIZING;
+    this._state = import_services8.SpaceState.INITIALIZING;
     (0, import_log8.log)("new state", {
-      state: import_services7.SpaceState[this._state]
+      state: import_services8.SpaceState[this._state]
     }, {
       F: __dxlog_file11,
       L: 267,
@@ -3459,7 +3538,7 @@ var DataSpace = class {
     await this._initializeAndReadControlPipeline();
     await (0, import_async10.sleep)(1);
     this._automergeSpaceState.startProcessingRootDocs();
-    await (0, import_context6.cancelWithContext)(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
+    await (0, import_context7.cancelWithContext)(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
     (0, import_log8.log)("data pipeline ready", void 0, {
       F: __dxlog_file11,
       L: 279,
@@ -3467,9 +3546,9 @@ var DataSpace = class {
       C: (f, a) => f(...a)
     });
     await this._callbacks.beforeReady?.();
-    this._state = import_services7.SpaceState.READY;
+    this._state = import_services8.SpaceState.READY;
     (0, import_log8.log)("new state", {
-      state: import_services7.SpaceState[this._state]
+      state: import_services8.SpaceState[this._state]
     }, {
       F: __dxlog_file11,
       L: 283,
@@ -3515,7 +3594,7 @@ var DataSpace = class {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials9.AdmittedFeed.Designation.CONTROL
+          designation: import_credentials10.AdmittedFeed.Designation.CONTROL
         }
       }));
     }
@@ -3532,7 +3611,7 @@ var DataSpace = class {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials9.AdmittedFeed.Designation.DATA
+          designation: import_credentials10.AdmittedFeed.Designation.DATA
         }
       }));
     }
@@ -3560,7 +3639,7 @@ var DataSpace = class {
     queueMicrotask(async () => {
       try {
         await (0, import_debug3.warnAfterTimeout)(5e3, "Automerge root doc load timeout (DataSpace)", async () => {
-          await (0, import_context6.cancelWithContext)(this._ctx, handle.whenReady());
+          await (0, import_context7.cancelWithContext)(this._ctx, handle.whenReady());
         });
         if (this._ctx.disposed) {
           return;
@@ -3574,7 +3653,7 @@ var DataSpace = class {
           });
         }
       } catch (err) {
-        if (err instanceof import_context6.ContextDisposedError) {
+        if (err instanceof import_context7.ContextDisposedError) {
           return;
         }
         import_log8.log.warn("error loading automerge root doc", {
@@ -3609,7 +3688,7 @@ var DataSpace = class {
     let epoch;
     switch (options?.migration) {
       case void 0:
-      case import_services7.CreateEpochRequest.Migration.NONE:
+      case import_services8.CreateEpochRequest.Migration.NONE:
         {
           epoch = {
             previousId: this._automergeSpaceState.lastEpoch?.id,
@@ -3619,7 +3698,7 @@ var DataSpace = class {
           };
         }
         break;
-      case import_services7.CreateEpochRequest.Migration.INIT_AUTOMERGE:
+      case import_services8.CreateEpochRequest.Migration.INIT_AUTOMERGE:
         {
           const document = this._automergeHost.repo.create();
           epoch = {
@@ -3630,11 +3709,11 @@ var DataSpace = class {
           };
         }
         break;
-      case import_services7.CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY:
+      case import_services8.CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY:
         {
           const currentRootUrl = this._automergeSpaceState.rootUrl;
           const rootHandle = this._automergeHost.repo.find(currentRootUrl);
-          await (0, import_context6.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
+          await (0, import_context7.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
           const newRoot = this._automergeHost.repo.create(rootHandle.docSync());
           (0, import_invariant9.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file11,
@@ -3653,7 +3732,7 @@ var DataSpace = class {
           };
         }
         break;
-      case import_services7.CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT:
+      case import_services8.CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT:
         {
           import_log8.log.info("Fragmenting", void 0, {
             F: __dxlog_file11,
@@ -3663,7 +3742,7 @@ var DataSpace = class {
           });
           const currentRootUrl = this._automergeSpaceState.rootUrl;
           const rootHandle = this._automergeHost.repo.find(currentRootUrl);
-          await (0, import_context6.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
+          await (0, import_context7.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
           const objects = Object.entries(rootHandle.docSync().objects);
           const properties = objects.find(([_, value]) => value.system.type?.itemId === import_echo_schema.TYPE_PROPERTIES);
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
@@ -3736,22 +3815,22 @@ var DataSpace = class {
     ]));
   }
   async activate() {
-    if (this._state !== import_services7.SpaceState.INACTIVE) {
+    if (this._state !== import_services8.SpaceState.INACTIVE) {
       return;
     }
-    await this._metadataStore.setSpaceState(this.key, import_services7.SpaceState.ACTIVE);
+    await this._metadataStore.setSpaceState(this.key, import_services8.SpaceState.ACTIVE);
     await this._open();
     this.initializeDataPipelineAsync();
   }
   async deactivate() {
-    if (this._state === import_services7.SpaceState.INACTIVE) {
+    if (this._state === import_services8.SpaceState.INACTIVE) {
       return;
     }
-    await this._metadataStore.setSpaceState(this.key, import_services7.SpaceState.INACTIVE);
+    await this._metadataStore.setSpaceState(this.key, import_services8.SpaceState.INACTIVE);
     await this._close();
-    this._state = import_services7.SpaceState.INACTIVE;
+    this._state = import_services8.SpaceState.INACTIVE;
     (0, import_log8.log)("new state", {
-      state: import_services7.SpaceState[this._state]
+      state: import_services8.SpaceState[this._state]
     }, {
       F: __dxlog_file11,
       L: 531,
@@ -3769,7 +3848,7 @@ _ts_decorate4([
 ], DataSpace.prototype, "key", null);
 _ts_decorate4([
   import_tracing4.trace.info({
-    enum: import_services7.SpaceState
+    enum: import_services8.SpaceState
   })
 ], DataSpace.prototype, "state", null);
 _ts_decorate4([
@@ -3808,7 +3887,7 @@ DataSpace = _ts_decorate4([
 ], DataSpace);
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
-    await (0, import_credentials12.createCredential)({
+    await (0, import_credentials13.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: space.key,
@@ -3817,14 +3896,14 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key
       }
     }),
-    await (0, import_credentials12.createCredential)({
+    await (0, import_credentials13.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: signingContext.identityKey,
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey: space.key,
-        role: import_credentials13.SpaceMember.Role.ADMIN,
+        role: import_credentials14.SpaceMember.Role.ADMIN,
         profile: signingContext.getProfile(),
         genesisFeedKey: space.controlFeedKey ?? (0, import_debug4.failUndefined)()
       }
@@ -3836,7 +3915,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials13.AdmittedFeed.Designation.CONTROL
+        designation: import_credentials14.AdmittedFeed.Designation.CONTROL
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -3846,7 +3925,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials13.AdmittedFeed.Designation.DATA
+        designation: import_credentials14.AdmittedFeed.Designation.DATA
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -3884,18 +3963,19 @@ var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/s
 var PRESENCE_ANNOUNCE_INTERVAL = 1e4;
 var PRESENCE_OFFLINE_TIMEOUT = 2e4;
 var DataSpaceManager = class {
-  constructor(_spaceManager, _metadataStore, _keyring, _signingContext, _feedStore, _automergeHost, params) {
+  constructor(_spaceManager, _metadataStore, _keyring, _signingContext, _feedStore, _automergeHost, _invitationsManager, params) {
     this._spaceManager = _spaceManager;
     this._metadataStore = _metadataStore;
     this._keyring = _keyring;
     this._signingContext = _signingContext;
     this._feedStore = _feedStore;
     this._automergeHost = _automergeHost;
-    this._ctx = new import_context8.Context();
+    this._invitationsManager = _invitationsManager;
+    this._ctx = new import_context9.Context();
     this.updated = new import_async13.Event();
-    this._spaces = new import_util6.ComplexMap(import_keys9.PublicKey.hash);
+    this._spaces = new import_util6.ComplexMap(import_keys10.PublicKey.hash);
     this._isOpen = false;
-    this._instanceId = import_keys9.PublicKey.random().toHex();
+    this._instanceId = import_keys10.PublicKey.random().toHex();
     const { spaceMemberPresenceAnnounceInterval = PRESENCE_ANNOUNCE_INTERVAL, spaceMemberPresenceOfflineTimeout = PRESENCE_OFFLINE_TIMEOUT } = params ?? {};
     this._spaceMemberPresenceAnnounceInterval = spaceMemberPresenceAnnounceInterval;
     this._spaceMemberPresenceOfflineTimeout = spaceMemberPresenceOfflineTimeout;
@@ -3907,7 +3987,7 @@ var DataSpaceManager = class {
   async open() {
     (0, import_log10.log)("open", void 0, {
       F: __dxlog_file12,
-      L: 98,
+      L: 101,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3915,7 +3995,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file12,
-      L: 99,
+      L: 102,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3923,7 +4003,7 @@ var DataSpaceManager = class {
       spaces: this._metadataStore.spaces.length
     }, {
       F: __dxlog_file12,
-      L: 100,
+      L: 103,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3933,7 +4013,7 @@ var DataSpaceManager = class {
           spaceMetadata
         }, {
           F: __dxlog_file12,
-          L: 104,
+          L: 107,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3944,7 +4024,7 @@ var DataSpaceManager = class {
           err
         }, {
           F: __dxlog_file12,
-          L: 107,
+          L: 110,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3953,7 +4033,7 @@ var DataSpaceManager = class {
     this._isOpen = true;
     this.updated.emit();
     for (const space of this._spaces.values()) {
-      if (space.state !== import_services8.SpaceState.INACTIVE) {
+      if (space.state !== import_services9.SpaceState.INACTIVE) {
         space.initializeDataPipelineAsync();
       }
     }
@@ -3961,7 +4041,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file12,
-      L: 120,
+      L: 123,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3969,7 +4049,7 @@ var DataSpaceManager = class {
   async close() {
     (0, import_log10.log)("close", void 0, {
       F: __dxlog_file12,
-      L: 125,
+      L: 128,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3985,7 +4065,7 @@ var DataSpaceManager = class {
   async createSpace() {
     (0, import_invariant11.invariant)(this._isOpen, "Not open.", {
       F: __dxlog_file12,
-      L: 138,
+      L: 141,
       S: this,
       A: [
         "this._isOpen",
@@ -4000,13 +4080,13 @@ var DataSpaceManager = class {
       genesisFeedKey: controlFeedKey,
       controlFeedKey,
       dataFeedKey,
-      state: import_services8.SpaceState.ACTIVE
+      state: import_services9.SpaceState.ACTIVE
     };
     (0, import_log10.log)("creating space...", {
       spaceKey
     }, {
       F: __dxlog_file12,
-      L: 150,
+      L: 153,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4020,9 +4100,9 @@ var DataSpaceManager = class {
     const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRoot.url);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    (0, import_invariant11.invariant)((0, import_credentials11.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+    (0, import_invariant11.invariant)((0, import_credentials12.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file12,
-      L: 163,
+      L: 166,
       S: this,
       A: [
         "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -4040,13 +4120,13 @@ var DataSpaceManager = class {
       opts
     }, {
       F: __dxlog_file12,
-      L: 175,
+      L: 178,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant11.invariant)(this._isOpen, "Not open.", {
       F: __dxlog_file12,
-      L: 176,
+      L: 179,
       S: this,
       A: [
         "this._isOpen",
@@ -4055,7 +4135,7 @@ var DataSpaceManager = class {
     });
     (0, import_invariant11.invariant)(!this._spaces.has(opts.spaceKey), "Space already exists.", {
       F: __dxlog_file12,
-      L: 177,
+      L: 180,
       S: this,
       A: [
         "!this._spaces.has(opts.spaceKey)",
@@ -4080,9 +4160,9 @@ var DataSpaceManager = class {
   * TODO(dmaretskyi): Consider removing.
   */
   async waitUntilSpaceReady(spaceKey) {
-    await (0, import_context8.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
+    await (0, import_context9.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
-      return !!space && space.state === import_services8.SpaceState.READY;
+      return !!space && space.state === import_services9.SpaceState.READY;
     }));
   }
   async _constructSpace(metadata) {
@@ -4090,7 +4170,7 @@ var DataSpaceManager = class {
       metadata
     }, {
       F: __dxlog_file12,
-      L: 210,
+      L: 213,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4128,18 +4208,21 @@ var DataSpaceManager = class {
       onAuthFailure: () => {
         import_log10.log.warn("auth failure", void 0, {
           F: __dxlog_file12,
-          L: 247,
+          L: 250,
           S: this,
           C: (f, a) => f(...a)
         });
       },
-      memberKey: this._signingContext.identityKey
+      memberKey: this._signingContext.identityKey,
+      onDelegatedInvitationStatusChange: (invitation, isActive) => {
+        return this._handleInvitationStatusChange(dataSpace, invitation, isActive);
+      }
     });
     controlFeed && await space.setControlFeed(controlFeed);
     dataFeed && await space.setDataFeed(dataFeed);
     const dataSpace = new DataSpace({
       inner: space,
-      initialState: metadata.state === import_services8.SpaceState.INACTIVE ? import_services8.SpaceState.INACTIVE : import_services8.SpaceState.CLOSED,
+      initialState: metadata.state === import_services9.SpaceState.INACTIVE ? import_services9.SpaceState.INACTIVE : import_services9.SpaceState.CLOSED,
       metadataStore: this._metadataStore,
       gossip,
       presence,
@@ -4152,7 +4235,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file12,
-            L: 265,
+            L: 271,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4163,11 +4246,14 @@ var DataSpaceManager = class {
             open: this._isOpen
           }, {
             F: __dxlog_file12,
-            L: 268,
+            L: 274,
             S: this,
             C: (f, a) => f(...a)
           });
           if (this._isOpen) {
+            await this._createDelegatedInvitations(dataSpace, [
+              ...space.spaceState.invitations.entries()
+            ]);
             this.updated.emit();
           }
         },
@@ -4176,7 +4262,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file12,
-            L: 274,
+            L: 281,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4185,7 +4271,7 @@ var DataSpaceManager = class {
       cache: metadata.cache,
       automergeHost: this._automergeHost
     });
-    if (metadata.state !== import_services8.SpaceState.INACTIVE) {
+    if (metadata.state !== import_services9.SpaceState.INACTIVE) {
       await dataSpace.open();
     }
     if (metadata.controlTimeframe) {
@@ -4194,6 +4280,41 @@ var DataSpaceManager = class {
     this._spaces.set(metadata.key, dataSpace);
     return dataSpace;
   }
+  async _handleInvitationStatusChange(dataSpace, delegatedInvitation, isActive) {
+    if (dataSpace?.state !== import_services9.SpaceState.READY) {
+      return;
+    }
+    if (isActive) {
+      await this._createDelegatedInvitations(dataSpace, [
+        [
+          delegatedInvitation.credentialId,
+          delegatedInvitation.invitation
+        ]
+      ]);
+    } else {
+      await this._invitationsManager.cancelInvitation(delegatedInvitation.invitation);
+    }
+  }
+  async _createDelegatedInvitations(space, invitations) {
+    const tasks = invitations.map(([credentialId, invitation]) => {
+      return this._invitationsManager.createInvitation({
+        type: import_services9.Invitation.Type.DELEGATED,
+        kind: import_services9.Invitation.Kind.SPACE,
+        spaceKey: space.key,
+        authMethod: invitation.authMethod,
+        invitationId: invitation.invitationId,
+        swarmKey: invitation.swarmKey,
+        guestKeypair: invitation.guestKey ? {
+          publicKey: invitation.guestKey
+        } : void 0,
+        lifetime: invitation.expiresOn ? invitation.expiresOn.getTime() - Date.now() : void 0,
+        multiUse: invitation.multiUse,
+        delegationCredentialId: credentialId,
+        persistent: false
+      });
+    });
+    await Promise.all(tasks);
+  }
 };
 _ts_decorate5([
   import_async13.synchronized
@@ -4230,10 +4351,10 @@ var SpacesServiceImpl = class {
     const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
     if (state) {
       switch (state) {
-        case import_services9.SpaceState.ACTIVE:
+        case import_services10.SpaceState.ACTIVE:
           await space.activate();
           break;
-        case import_services9.SpaceState.INACTIVE:
+        case import_services10.SpaceState.INACTIVE:
           await space.deactivate();
           break;
         default:
@@ -4407,7 +4528,7 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.removed ? import_services9.SpaceMember.PresenceState.REMOVED : isMe || peers.length > 0 ? import_services9.SpaceMember.PresenceState.ONLINE : import_services9.SpaceMember.PresenceState.OFFLINE,
+          presence: member.removed ? import_services10.SpaceMember.PresenceState.REMOVED : isMe || peers.length > 0 ? import_services10.SpaceMember.PresenceState.ONLINE : import_services10.SpaceMember.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4443,59 +4564,6 @@ var createSelectedDocumentsIterator = (automergeHost) => (
     }
   }
 );
-var createDocumentsIterator = (automergeHost) => (
-  /**
-  * Recursively get all object data blobs from Automerge Repo.
-  * @param ids
-  */
-  // TODO(mykola): Unload automerge handles after usage.
-  async function* getAllDocuments() {
-    const visited = /* @__PURE__ */ new Set();
-    async function* getObjectsFromHandle(handle) {
-      if (visited.has(handle.documentId)) {
-        return;
-      }
-      if (!handle.isReady()) {
-        await handle.whenReady();
-      }
-      const doc = handle.docSync();
-      const heads = (0, import_automerge.getHeads)(doc);
-      if (doc.objects) {
-        yield Object.entries(doc.objects).map(([objectId, object]) => {
-          return {
-            id: import_protocols12.idCodec.encode({
-              documentId: handle.documentId,
-              objectId
-            }),
-            object,
-            currentHash: heads.join("")
-          };
-        });
-      }
-      if (doc.links) {
-        for (const id of Object.values(doc.links)) {
-          if (visited.has(id)) {
-            continue;
-          }
-          const linkHandle = automergeHost.repo.handles[id] ?? automergeHost.repo.find(id);
-          for await (const result of getObjectsFromHandle(linkHandle)) {
-            yield result;
-          }
-        }
-      }
-      visited.add(handle.documentId);
-    }
-    for (const handle of Object.values(automergeHost.repo.handles)) {
-      if (visited.has(handle.documentId)) {
-        continue;
-      }
-      for await (const result of getObjectsFromHandle(handle)) {
-        yield result;
-      }
-      visited.add(handle.documentId);
-    }
-  }
-);
 function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -4507,7 +4575,7 @@ function _ts_decorate6(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
-var ServiceContext = class extends import_context9.Resource {
+var ServiceContext = class extends import_context10.Resource {
   constructor(storage, level, networkManager, signalManager, _runtimeParams) {
     super();
     this.storage = storage;
@@ -4517,7 +4585,7 @@ var ServiceContext = class extends import_context9.Resource {
     this._runtimeParams = _runtimeParams;
     this.initialized = new import_async15.Trigger();
     this._handlerFactories = /* @__PURE__ */ new Map();
-    this._instanceId = import_keys10.PublicKey.random().toHex();
+    this._instanceId = import_keys11.PublicKey.random().toHex();
     this.metadataStore = new import_echo_pipeline4.MetadataStore(storage.createDirectory("metadata"));
     this.snapshotStore = new import_echo_pipeline4.SnapshotStore(storage.createDirectory("snapshots"));
     this.blobStore = new import_teleport_extension_object_sync.BlobStore(storage.createDirectory("blobs"));
@@ -4552,16 +4620,16 @@ var ServiceContext = class extends import_context9.Resource {
       })
     });
     this.indexer = new import_indexing.Indexer({
+      db: this.level,
       indexStore: new import_indexing.IndexStore({
         db: level.sublevel("index-storage")
       }),
       metadataStore: this.indexMetadata,
-      loadDocuments: createSelectedDocumentsIterator(this.automergeHost),
-      getAllDocuments: createDocumentsIterator(this.automergeHost)
+      loadDocuments: createSelectedDocumentsIterator(this.automergeHost)
     });
     this.invitations = new InvitationsHandler(this.networkManager);
     this.invitationsManager = new InvitationsManager(this.invitations, (invitation) => this.getInvitationHandler(invitation), this.metadataStore);
-    this._handlerFactories.set(import_services10.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? (0, import_debug6.failUndefined)(), this._acceptIdentity.bind(this)));
+    this._handlerFactories.set(import_services11.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? (0, import_debug6.failUndefined)(), this._acceptIdentity.bind(this)));
   }
   async _open(ctx) {
     await this._checkStorageVersion();
@@ -4640,7 +4708,7 @@ var ServiceContext = class extends import_context9.Resource {
   }
   async createIdentity(params = {}) {
     const identity = await this.identityManager.createIdentity(params);
-    await this._initialize(new import_context9.Context());
+    await this._initialize(new import_context10.Context());
     return identity;
   }
   getInvitationHandler(invitation) {
@@ -4666,7 +4734,7 @@ var ServiceContext = class extends import_context9.Resource {
   }
   async _acceptIdentity(params) {
     const identity = await this.identityManager.acceptIdentity(params);
-    await this._initialize(new import_context9.Context());
+    await this._initialize(new import_context10.Context());
     return identity;
   }
   async _checkStorageVersion() {
@@ -4697,12 +4765,12 @@ var ServiceContext = class extends import_context9.Resource {
         });
       }
     };
-    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.keyring, signingContext, this.feedStore, this.automergeHost, this._runtimeParams);
+    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.keyring, signingContext, this.feedStore, this.automergeHost, this.invitationsManager, this._runtimeParams);
     await this.dataSpaceManager.open();
-    this._handlerFactories.set(import_services10.Invitation.Kind.SPACE, (invitation) => {
+    this._handlerFactories.set(import_services11.Invitation.Kind.SPACE, (invitation) => {
       (0, import_invariant13.invariant)(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
         F: __dxlog_file14,
-        L: 264,
+        L: 265,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -4714,7 +4782,7 @@ var ServiceContext = class extends import_context9.Resource {
     this.initialized.wake();
     this._deviceSpaceSync = {
       processCredential: async (credential) => {
-        const assertion = (0, import_credentials14.getCredentialAssertion)(credential);
+        const assertion = (0, import_credentials15.getCredentialAssertion)(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
         }
@@ -4726,7 +4794,7 @@ var ServiceContext = class extends import_context9.Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 280,
+            L: 281,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4737,7 +4805,7 @@ var ServiceContext = class extends import_context9.Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 284,
+            L: 285,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4748,7 +4816,7 @@ var ServiceContext = class extends import_context9.Resource {
             details: assertion
           }, {
             F: __dxlog_file14,
-            L: 289,
+            L: 290,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4759,7 +4827,7 @@ var ServiceContext = class extends import_context9.Resource {
         } catch (err) {
           import_log12.log.catch(err, void 0, {
             F: __dxlog_file14,
-            L: 295,
+            L: 296,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4801,26 +4869,26 @@ var ServiceRegistry = class {
     delete this._handlers[name];
   }
 };
-var DXOS_VERSION = "0.4.10-main.e96274c";
+var DXOS_VERSION = "0.4.10-main.e99db3e";
 var getPlatform = () => {
   if (process.browser) {
     if (typeof window !== "undefined") {
       const { userAgent } = window.navigator;
       return {
-        type: import_services12.Platform.PLATFORM_TYPE.BROWSER,
+        type: import_services13.Platform.PLATFORM_TYPE.BROWSER,
         userAgent,
         uptime: Math.floor((Date.now() - window.performance.timeOrigin) / 1e3)
       };
     } else {
       return {
-        type: import_services12.Platform.PLATFORM_TYPE.SHARED_WORKER,
+        type: import_services13.Platform.PLATFORM_TYPE.SHARED_WORKER,
         uptime: Math.floor((Date.now() - performance.timeOrigin) / 1e3)
       };
     }
   } else {
     const { platform: platform2, version, arch } = process;
     return {
-      type: import_services12.Platform.PLATFORM_TYPE.NODE,
+      type: import_services13.Platform.PLATFORM_TYPE.NODE,
       platform: platform2,
       arch,
       runtime: version,
@@ -4907,7 +4975,7 @@ var getSpaceStats = async (space) => {
   const stats = {
     key: space.key,
     metrics: space.metrics,
-    epochs: space.inner.spaceState.credentials.filter((0, import_credentials15.credentialTypeFilter)("dxos.halo.credentials.Epoch")).map((credential) => ({
+    epochs: space.inner.spaceState.credentials.filter((0, import_credentials16.credentialTypeFilter)("dxos.halo.credentials.Epoch")).map((credential) => ({
       ...credential.subject.assertion,
       id: credential.id
     })),
@@ -4918,7 +4986,7 @@ var getSpaceStats = async (space) => {
           displayName: member.assertion.profile?.displayName
         }
       },
-      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services11.SpaceMember.PresenceState.ONLINE : import_services11.SpaceMember.PresenceState.OFFLINE
+      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services12.SpaceMember.PresenceState.ONLINE : import_services12.SpaceMember.PresenceState.OFFLINE
     })),
     pipeline: {
       // TODO(burdon): Pick properties from credentials if needed.
@@ -4982,9 +5050,9 @@ var DevicesServiceImpl = class {
               const peerState = peers.find((peer) => peer.identityKey.equals(key));
               return {
                 deviceKey: key,
-                kind: this._identityManager.identity?.deviceKey.equals(key) ? import_services15.DeviceKind.CURRENT : import_services15.DeviceKind.TRUSTED,
+                kind: this._identityManager.identity?.deviceKey.equals(key) ? import_services16.DeviceKind.CURRENT : import_services16.DeviceKind.TRUSTED,
                 profile,
-                presence: isMe ? import_services15.Device.PresenceState.ONLINE : peerState ? import_services15.Device.PresenceState.ONLINE : import_services15.Device.PresenceState.OFFLINE
+                presence: isMe ? import_services16.Device.PresenceState.ONLINE : peerState ? import_services16.Device.PresenceState.ONLINE : import_services16.Device.PresenceState.OFFLINE
               };
             })
           });
@@ -5083,7 +5151,7 @@ var LoggingServiceImpl = class {
   constructor() {
     this._logs = new import_async18.Event();
     this._started = Date.now();
-    this._sessionId = import_keys12.PublicKey.random().toHex();
+    this._sessionId = import_keys13.PublicKey.random().toHex();
     this._logProcessor = (_config, entry2) => {
       this._logs.emit(entry2);
     };
@@ -5180,16 +5248,16 @@ var LoggingServiceImpl = class {
 };
 var matchFilter = (filter, level, path2, options) => {
   switch (options) {
-    case import_services16.QueryLogsRequest.MatchingOptions.INCLUSIVE:
+    case import_services17.QueryLogsRequest.MatchingOptions.INCLUSIVE:
       return level >= filter.level && (!filter.pattern || path2.includes(filter.pattern));
-    case import_services16.QueryLogsRequest.MatchingOptions.EXPLICIT:
+    case import_services17.QueryLogsRequest.MatchingOptions.EXPLICIT:
       return level === filter.level && (!filter.pattern || path2.includes(filter.pattern));
   }
 };
 var shouldLog = (entry2, request) => {
-  const options = request.options ?? import_services16.QueryLogsRequest.MatchingOptions.INCLUSIVE;
+  const options = request.options ?? import_services17.QueryLogsRequest.MatchingOptions.INCLUSIVE;
   if (request.filters === void 0) {
-    return options === import_services16.QueryLogsRequest.MatchingOptions.INCLUSIVE;
+    return options === import_services17.QueryLogsRequest.MatchingOptions.INCLUSIVE;
   } else {
     return request.filters.some((filter) => matchFilter(filter, entry2.level, entry2.meta?.F ?? "", options));
   }
@@ -5226,7 +5294,7 @@ var NetworkServiceImpl = class {
   }
 };
 var getRootPath = (config) => {
-  const { dataRoot = (0, import_util11.isNode)() ? import_client_protocol5.DX_DATA : "dxos/storage" } = config ?? {};
+  const { dataRoot = (0, import_util11.isNode)() ? import_client_protocol6.DX_DATA : "dxos/storage" } = config ?? {};
   return `${dataRoot}/`;
 };
 var isPersistent = (config) => {
@@ -5277,7 +5345,7 @@ var toStorageType = (type) => {
 };
 var createLevel = async (config) => {
   const persistent = isPersistent(config);
-  const storagePath = persistent ? import_node_path.default.join(getRootPath(config), "level") : `/tmp/dxos-${import_keys13.PublicKey.random().toHex()}`;
+  const storagePath = persistent ? import_node_path.default.join(getRootPath(config), "level") : `/tmp/dxos-${import_keys14.PublicKey.random().toHex()}`;
   const level = new import_level.Level(storagePath);
   await level.open();
   return level;
@@ -5302,8 +5370,8 @@ var SystemServiceImpl = class {
     return {
       timestamp: /* @__PURE__ */ new Date(),
       diagnostics: JSON.parse(JSON.stringify(diagnostics, (0, import_util12.jsonKeyReplacer)({
-        truncate: keys === import_services17.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE,
-        humanize: keys === import_services17.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE
+        truncate: keys === import_services18.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE,
+        humanize: keys === import_services18.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE
       })))
     };
   }
@@ -5377,7 +5445,7 @@ var ClientServicesHost = class {
         lockKey,
         onAcquire: () => {
           if (!this._opening) {
-            void this.open(new import_context10.Context());
+            void this.open(new import_context11.Context());
           }
         },
         onRelease: () => this.close()
@@ -5386,14 +5454,14 @@ var ClientServicesHost = class {
     this._systemService = new SystemServiceImpl({
       config: () => this._config,
       statusUpdate: this._statusUpdate,
-      getCurrentStatus: () => this.isOpen ? import_services14.SystemStatus.ACTIVE : import_services14.SystemStatus.INACTIVE,
+      getCurrentStatus: () => this.isOpen ? import_services15.SystemStatus.ACTIVE : import_services15.SystemStatus.INACTIVE,
       getDiagnostics: () => {
         return createDiagnostics(this._serviceRegistry.services, this._serviceContext, this._config);
       },
       onUpdateStatus: async (status) => {
-        if (!this.isOpen && status === import_services14.SystemStatus.ACTIVE) {
+        if (!this.isOpen && status === import_services15.SystemStatus.ACTIVE) {
           await this._resourceLock?.acquire();
-        } else if (this.isOpen && status === import_services14.SystemStatus.INACTIVE) {
+        } else if (this.isOpen && status === import_services15.SystemStatus.INACTIVE) {
           await this._resourceLock?.release();
         }
       },
@@ -5403,7 +5471,7 @@ var ClientServicesHost = class {
     });
     this.diagnosticsBroadcastHandler = createCollectDiagnosticsBroadcastHandler(this._systemService);
     this._loggingService = new LoggingServiceImpl();
-    this._serviceRegistry = new ServiceRegistry(import_client_protocol4.clientServiceBundle, {
+    this._serviceRegistry = new ServiceRegistry(import_client_protocol5.clientServiceBundle, {
       SystemService: this._systemService,
       TracingService: this._tracingService
     });
@@ -5499,7 +5567,7 @@ var ClientServicesHost = class {
     if (this._open) {
       return;
     }
-    const traceId = import_keys11.PublicKey.random().toHex();
+    const traceId = import_keys12.PublicKey.random().toHex();
     import_log13.log.trace("dxos.client-services.host.open", import_protocols14.trace.begin({
       id: traceId
     }), {
@@ -5592,7 +5660,7 @@ var ClientServicesHost = class {
       this._devtoolsProxy = new import_websocket_rpc.WebsocketRpcClient({
         url: devtoolsProxy,
         requested: {},
-        exposed: import_client_protocol4.clientServiceBundle,
+        exposed: import_client_protocol5.clientServiceBundle,
         handlers: this.services
       });
       void this._devtoolsProxy.open();
@@ -5653,7 +5721,7 @@ var ClientServicesHost = class {
     });
   }
   async reset() {
-    const traceId = import_keys11.PublicKey.random().toHex();
+    const traceId = import_keys12.PublicKey.random().toHex();
     import_log13.log.trace("dxos.sdk.client-services-host.reset", import_protocols14.trace.begin({
       id: traceId
     }), {
@@ -5704,16 +5772,16 @@ var ClientServicesHost = class {
     await document.whenReady();
     const properties = {
       system: {
-        type: (0, import_echo_pipeline5.encodeReference)((0, import_echo_schema2.getTypeReference)(import_client_protocol4.Properties))
+        type: (0, import_echo_pipeline5.encodeReference)((0, import_echo_schema2.getTypeReference)(import_client_protocol5.Properties))
       },
       data: {
-        [import_client_protocol4.defaultKey]: identity.identityKey.toHex()
+        [import_client_protocol5.defaultKey]: identity.identityKey.toHex()
       },
       meta: {
         keys: []
       }
     };
-    const propertiesId = import_keys11.PublicKey.random().toHex();
+    const propertiesId = import_keys12.PublicKey.random().toHex();
     document.change((doc) => {
       (0, import_util9.assignDeep)(doc, [
         "objects",
@@ -5748,7 +5816,7 @@ var DiagnosticsCollector = class {
   }
   static async collect(config = findConfigs(), services = findSystemServiceProvider(), options = {}) {
     const serviceDiagnostics = await services?.services?.SystemService?.getDiagnostics({
-      keys: options.humanize ? import_services13.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE : options.truncate ? import_services13.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE : void 0
+      keys: options.humanize ? import_services14.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE : options.truncate ? import_services14.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE : void 0
     });
     const clientDiagnostics = {
       config,
@@ -5813,4 +5881,4 @@ var findConfigs = () => {
   subscribeToSpaces,
   subscribeToSwarmInfo
 });
-//# sourceMappingURL=chunk-GZWBW7OC.cjs.map
+//# sourceMappingURL=chunk-GAS53XAH.cjs.map