@dxos/client-services 0.5.1-main.d514f85 → 0.5.1-main.e46fa49

package/dist/lib/node/{chunk-GGYOXDXO.cjs → chunk-42RIUNTR.cjs}

@@ -26,8 +26,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var chunk_GGYOXDXO_exports = {};
-__export(chunk_GGYOXDXO_exports, {
+var chunk_42RIUNTR_exports = {};
+__export(chunk_42RIUNTR_exports, {
   ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   ClientServicesProviderResource: () => ClientServicesProviderResource,
@@ -66,7 +66,7 @@ __export(chunk_GGYOXDXO_exports, {
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo
 });
-module.exports = __toCommonJS(chunk_GGYOXDXO_exports);
+module.exports = __toCommonJS(chunk_42RIUNTR_exports);
 var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_feed_store = require("@dxos/feed-store");
@@ -128,155 +128,175 @@ var import_network_manager = require("@dxos/network-manager");
 var import_protocols4 = require("@dxos/protocols");
 var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
+var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations");
+var import_util4 = require("@dxos/util");
 var import_async8 = require("@dxos/async");
 var import_context5 = require("@dxos/context");
-var import_crypto2 = require("@dxos/crypto");
 var import_invariant6 = require("@dxos/invariant");
-var import_keys6 = require("@dxos/keys");
 var import_log5 = require("@dxos/log");
 var import_protocols5 = require("@dxos/protocols");
-var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
-var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations");
+var import_invitations3 = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport = require("@dxos/teleport");
-var import_codec_protobuf8 = require("@dxos/codec-protobuf");
-var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials7 = require("@dxos/credentials");
-var import_feed_store3 = require("@dxos/feed-store");
+var import_context6 = require("@dxos/context");
+var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
+var import_async9 = require("@dxos/async");
+var import_context7 = require("@dxos/context");
+var import_crypto2 = require("@dxos/crypto");
 var import_invariant7 = require("@dxos/invariant");
+var import_keys6 = require("@dxos/keys");
 var import_log6 = require("@dxos/log");
 var import_protocols6 = require("@dxos/protocols");
+var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
+var import_invitations4 = require("@dxos/protocols/proto/dxos/halo/invitations");
+var import_teleport2 = require("@dxos/teleport");
+var import_invariant8 = require("@dxos/invariant");
+var import_keys7 = require("@dxos/keys");
+var import_log7 = require("@dxos/log");
+var import_invitations5 = require("@dxos/protocols/proto/dxos/halo/invitations");
+var import_util5 = require("@dxos/util");
+var import_codec_protobuf8 = require("@dxos/codec-protobuf");
 var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
+var import_credentials7 = require("@dxos/credentials");
+var import_feed_store3 = require("@dxos/feed-store");
+var import_invariant9 = require("@dxos/invariant");
+var import_log8 = require("@dxos/log");
+var import_protocols7 = require("@dxos/protocols");
+var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
 var import_credentials8 = require("@dxos/protocols/proto/dxos/halo/credentials");
-var import_async9 = require("@dxos/async");
+var import_async10 = require("@dxos/async");
 var import_client_protocol3 = require("@dxos/client-protocol");
-var import_context6 = require("@dxos/context");
+var import_context8 = require("@dxos/context");
 var import_credentials9 = require("@dxos/credentials");
 var import_echo_pipeline = require("@dxos/echo-pipeline");
-var import_invariant8 = require("@dxos/invariant");
-var import_keys7 = require("@dxos/keys");
-var import_log7 = require("@dxos/log");
-var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
+var import_invariant10 = require("@dxos/invariant");
+var import_keys8 = require("@dxos/keys");
+var import_log9 = require("@dxos/log");
+var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
+var import_credentials10 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_codec_protobuf9 = require("@dxos/codec-protobuf");
 var import_debug2 = require("@dxos/debug");
 var import_rpc = require("@dxos/rpc");
 var import_tracing3 = require("@dxos/tracing");
-var import_async10 = require("@dxos/async");
+var import_async11 = require("@dxos/async");
 var import_client_protocol4 = require("@dxos/client-protocol");
-var import_context7 = require("@dxos/context");
+var import_context9 = require("@dxos/context");
 var import_debug3 = require("@dxos/debug");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
 var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_echo_schema = require("@dxos/echo-schema");
-var import_invariant9 = require("@dxos/invariant");
-var import_keys8 = require("@dxos/keys");
-var import_log8 = require("@dxos/log");
-var import_protocols7 = require("@dxos/protocols");
-var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials10 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_invariant11 = require("@dxos/invariant");
+var import_keys9 = require("@dxos/keys");
+var import_log10 = require("@dxos/log");
+var import_protocols8 = require("@dxos/protocols");
+var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
+var import_credentials11 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials12 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe2 = require("@dxos/timeframe");
 var import_tracing4 = require("@dxos/tracing");
-var import_util4 = require("@dxos/util");
-var import_async11 = require("@dxos/async");
-var import_credentials11 = require("@dxos/credentials");
+var import_util6 = require("@dxos/util");
 var import_async12 = require("@dxos/async");
-var import_context8 = require("@dxos/context");
-var import_invariant10 = require("@dxos/invariant");
-var import_keys9 = require("@dxos/keys");
-var import_log9 = require("@dxos/log");
-var import_protocols8 = require("@dxos/protocols");
-var import_teleport2 = require("@dxos/teleport");
-var import_util5 = require("@dxos/util");
+var import_credentials13 = require("@dxos/credentials");
 var import_async13 = require("@dxos/async");
-var import_context9 = require("@dxos/context");
-var import_credentials12 = require("@dxos/credentials");
-var import_invariant11 = require("@dxos/invariant");
+var import_context10 = require("@dxos/context");
+var import_invariant12 = require("@dxos/invariant");
 var import_keys10 = require("@dxos/keys");
-var import_log10 = require("@dxos/log");
+var import_log11 = require("@dxos/log");
 var import_protocols9 = require("@dxos/protocols");
-var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
+var import_teleport3 = require("@dxos/teleport");
+var import_util7 = require("@dxos/util");
+var import_async14 = require("@dxos/async");
+var import_context11 = require("@dxos/context");
+var import_credentials14 = require("@dxos/credentials");
+var import_invariant13 = require("@dxos/invariant");
+var import_keys11 = require("@dxos/keys");
+var import_log12 = require("@dxos/log");
+var import_protocols10 = require("@dxos/protocols");
+var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_gossip2 = require("@dxos/teleport-extension-gossip");
-var import_util6 = require("@dxos/util");
-var import_credentials13 = require("@dxos/credentials");
+var import_util8 = require("@dxos/util");
+var import_credentials15 = require("@dxos/credentials");
 var import_debug4 = require("@dxos/debug");
-var import_credentials14 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials16 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe3 = require("@dxos/timeframe");
-var import_async14 = require("@dxos/async");
+var import_async15 = require("@dxos/async");
 var import_codec_protobuf10 = require("@dxos/codec-protobuf");
 var import_debug5 = require("@dxos/debug");
-var import_invariant12 = require("@dxos/invariant");
-var import_log11 = require("@dxos/log");
-var import_protocols10 = require("@dxos/protocols");
-var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
-var import_async15 = require("@dxos/async");
-var import_context10 = require("@dxos/context");
-var import_credentials15 = require("@dxos/credentials");
+var import_invariant14 = require("@dxos/invariant");
+var import_log13 = require("@dxos/log");
+var import_protocols11 = require("@dxos/protocols");
+var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
+var import_credentials17 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_async16 = require("@dxos/async");
+var import_context12 = require("@dxos/context");
+var import_credentials18 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
 var import_echo_db = require("@dxos/echo-db");
 var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
-var import_invariant13 = require("@dxos/invariant");
+var import_invariant15 = require("@dxos/invariant");
 var import_keyring = require("@dxos/keyring");
-var import_keys11 = require("@dxos/keys");
-var import_log12 = require("@dxos/log");
-var import_protocols11 = require("@dxos/protocols");
-var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
+var import_keys12 = require("@dxos/keys");
+var import_log14 = require("@dxos/log");
+var import_protocols12 = require("@dxos/protocols");
+var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_object_sync = require("@dxos/teleport-extension-object-sync");
 var import_tracing5 = require("@dxos/tracing");
-var import_util7 = require("@dxos/util");
+var import_util9 = require("@dxos/util");
+var import_async17 = require("@dxos/async");
 var import_codec_protobuf11 = require("@dxos/codec-protobuf");
-var import_credentials16 = require("@dxos/credentials");
-var import_invariant14 = require("@dxos/invariant");
-var import_protocols12 = require("@dxos/protocols");
-var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
-var import_tracing6 = require("@dxos/tracing");
+var import_credentials19 = require("@dxos/credentials");
+var import_invariant16 = require("@dxos/invariant");
+var import_protocols13 = require("@dxos/protocols");
 var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
-var import_config = require("@dxos/config");
+var import_tracing6 = require("@dxos/tracing");
 var import_services14 = require("@dxos/protocols/proto/dxos/client/services");
+var import_config = require("@dxos/config");
+var import_services15 = require("@dxos/protocols/proto/dxos/client/services");
 var import_tracing7 = require("@dxos/tracing");
-var import_util8 = require("@dxos/util");
-var import_async16 = require("@dxos/async");
+var import_util10 = require("@dxos/util");
+var import_async18 = require("@dxos/async");
 var import_client_protocol5 = require("@dxos/client-protocol");
-var import_context11 = require("@dxos/context");
-var import_echo_pipeline5 = require("@dxos/echo-pipeline");
+var import_context13 = require("@dxos/context");
+var import_echo_protocol = require("@dxos/echo-protocol");
 var import_echo_schema2 = require("@dxos/echo-schema");
-var import_invariant15 = require("@dxos/invariant");
-var import_keys12 = require("@dxos/keys");
-var import_log13 = require("@dxos/log");
+var import_invariant17 = require("@dxos/invariant");
+var import_keys13 = require("@dxos/keys");
+var import_log15 = require("@dxos/log");
 var import_messaging = require("@dxos/messaging");
 var import_network_manager2 = require("@dxos/network-manager");
-var import_protocols13 = require("@dxos/protocols");
-var import_services15 = require("@dxos/protocols/proto/dxos/client/services");
+var import_protocols14 = require("@dxos/protocols");
+var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
 var import_tracing8 = require("@dxos/tracing");
-var import_util9 = require("@dxos/util");
+var import_util11 = require("@dxos/util");
 var import_websocket_rpc = require("@dxos/websocket-rpc");
-var import_async17 = require("@dxos/async");
+var import_async19 = require("@dxos/async");
 var import_codec_protobuf12 = require("@dxos/codec-protobuf");
-var import_invariant16 = require("@dxos/invariant");
-var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
-var import_invariant17 = require("@dxos/invariant");
+var import_invariant18 = require("@dxos/invariant");
+var import_services17 = require("@dxos/protocols/proto/dxos/client/services");
+var import_invariant19 = require("@dxos/invariant");
 var import_lock_file = require("@dxos/lock-file");
-var import_log14 = require("@dxos/log");
-var import_async18 = require("@dxos/async");
+var import_log16 = require("@dxos/log");
+var import_async20 = require("@dxos/async");
 var import_codec_protobuf13 = require("@dxos/codec-protobuf");
-var import_keys13 = require("@dxos/keys");
-var import_log15 = require("@dxos/log");
-var import_services17 = require("@dxos/protocols/proto/dxos/client/services");
-var import_util10 = require("@dxos/util");
+var import_keys14 = require("@dxos/keys");
+var import_log17 = require("@dxos/log");
+var import_services18 = require("@dxos/protocols/proto/dxos/client/services");
+var import_util12 = require("@dxos/util");
 var import_codec_protobuf14 = require("@dxos/codec-protobuf");
-var import_protocols14 = require("@dxos/protocols");
+var import_protocols15 = require("@dxos/protocols");
 var import_config2 = require("@dxos/protocols/proto/dxos/config");
 var import_random_access_storage = require("@dxos/random-access-storage");
 var import_client_protocol6 = require("@dxos/client-protocol");
 var import_config3 = require("@dxos/protocols/proto/dxos/config");
-var import_util11 = require("@dxos/util");
-var import_level = require("level");
+var import_util13 = require("@dxos/util");
 var import_node_path = __toESM(require("node:path"));
-var import_keys14 = require("@dxos/keys");
-var import_codec_protobuf15 = require("@dxos/codec-protobuf");
-var import_services18 = require("@dxos/protocols/proto/dxos/client/services");
-var import_util12 = require("@dxos/util");
 var import_keys15 = require("@dxos/keys");
-var import_util13 = require("@dxos/util");
+var import_kv_store = require("@dxos/kv-store");
+var import_codec_protobuf15 = require("@dxos/codec-protobuf");
+var import_services19 = require("@dxos/protocols/proto/dxos/client/services");
+var import_util14 = require("@dxos/util");
+var import_keys16 = require("@dxos/keys");
+var import_util15 = require("@dxos/util");
 var subscribeToFeeds = ({ feedStore }, { feedKeys }) => {
   return new import_codec_protobuf.Stream(({ next }) => {
     const subscriptions = new import_async.EventSubscriptions();
@@ -1393,13 +1413,16 @@ var DeviceInvitationProtocol = class {
       kind: import_services2.Invitation.Kind.DEVICE
     };
   }
-  async delegate(invitation) {
+  async delegate() {
+    throw new Error("delegation not supported");
+  }
+  async cancelDelegation() {
     throw new Error("delegation not supported");
   }
   async admit(_, request) {
     (0, import_invariant4.invariant)(request.device, void 0, {
       F: __dxlog_file5,
-      L: 42,
+      L: 46,
       S: this,
       A: [
         "request.device",
@@ -1445,7 +1468,7 @@ var DeviceInvitationProtocol = class {
   async accept(response, request) {
     (0, import_invariant4.invariant)(response.device, void 0, {
       F: __dxlog_file5,
-      L: 87,
+      L: 91,
       S: this,
       A: [
         "response.device",
@@ -1455,7 +1478,7 @@ var DeviceInvitationProtocol = class {
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
     (0, import_invariant4.invariant)(request.device, void 0, {
       F: __dxlog_file5,
-      L: 90,
+      L: 94,
       S: this,
       A: [
         "request.device",
@@ -1478,11 +1501,25 @@ var DeviceInvitationProtocol = class {
     };
   }
 };
-var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts";
+var stateToString = (state) => {
+  return Object.entries(import_services4.Invitation.State).find(([key, val]) => val === state)?.[0] ?? "unknown";
+};
+var tryAcquireBeforeContextDisposed = async (ctx, mutex) => {
+  let guard;
+  return (0, import_context6.cancelWithContext)(ctx, (async () => {
+    guard = await mutex.acquire();
+    if (ctx.disposed) {
+      guard.release();
+      guard = void 0;
+      throw new import_context6.ContextDisposedError();
+    }
+    return guard;
+  })());
+};
+var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts";
 var OPTIONS_TIMEOUT = 1e4;
-var MAX_OTP_ATTEMPTS = 3;
-var InvitationHostExtension = class extends import_teleport.RpcExtension {
-  constructor(_callbacks) {
+var InvitationGuestExtension = class extends import_teleport.RpcExtension {
+  constructor(_invitationFlowMutex, _callbacks) {
     super({
       requested: {
         InvitationHostService: import_protocols5.schema.getService("dxos.halo.invitations.InvitationHostService")
@@ -1491,25 +1528,22 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
         InvitationHostService: import_protocols5.schema.getService("dxos.halo.invitations.InvitationHostService")
       }
     });
+    this._invitationFlowMutex = _invitationFlowMutex;
     this._callbacks = _callbacks;
     this._ctx = new import_context5.Context();
     this._remoteOptionsTrigger = new import_async8.Trigger();
-    this._challenge = void 0;
-    this.invitation = void 0;
-    this.guestProfile = void 0;
-    this.authenticationPassed = false;
-    this.authenticationRetry = 0;
-    this.completedTrigger = new import_async8.Trigger();
+    this._invitationFlowLock = null;
+  }
+  hasFlowLock() {
+    return this._invitationFlowLock != null;
   }
   async getHandlers() {
     return {
-      // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
-      // Perhaps in the future we will have more complex logic here.
       InvitationHostService: {
         options: async (options) => {
           (0, import_invariant6.invariant)(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 90,
+            L: 63,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1519,190 +1553,14 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
           this._remoteOptions = options;
           this._remoteOptionsTrigger.wake();
         },
-        introduce: async (request) => {
-          const { profile, invitationId } = request;
-          const traceId = import_keys6.PublicKey.random().toHex();
-          import_log5.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols5.trace.begin({
-            id: traceId
-          }), {
-            F: __dxlog_file6,
-            L: 99,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          const invitation = await this._callbacks.resolveInvitation(request);
-          if (!invitation) {
-            import_log5.log.warn("invitation not found", {
-              invitationId
-            }, {
-              F: __dxlog_file6,
-              L: 103,
-              S: this,
-              C: (f, a) => f(...a)
-            });
-            this._callbacks.onError(new Error("Invitation not found."));
-            return {
-              authMethod: import_services4.Invitation.AuthMethod.NONE
-            };
-          }
-          this.invitation = invitation;
-          (0, import_log5.log)("guest introduced itself", {
-            guestProfile: profile
-          }, {
-            F: __dxlog_file6,
-            L: 112,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          this.guestProfile = profile;
-          this._callbacks.onStateUpdate({
-            ...this.invitation,
-            state: import_services4.Invitation.State.READY_FOR_AUTHENTICATION
-          });
-          this._challenge = this.invitation.authMethod === import_services4.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? (0, import_crypto2.randomBytes)(32) : void 0;
-          import_log5.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols5.trace.end({
-            id: traceId
-          }), {
-            F: __dxlog_file6,
-            L: 122,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return {
-            authMethod: this.invitation.authMethod,
-            challenge: this._challenge
-          };
+        introduce: () => {
+          throw new Error("Method not allowed.");
         },
-        authenticate: async ({ authCode: code, signedChallenge }) => {
-          const traceId = import_keys6.PublicKey.random().toHex();
-          import_log5.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols5.trace.begin({
-            id: traceId
-          }), {
-            F: __dxlog_file6,
-            L: 131,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          (0, import_log5.log)("received authentication request", {
-            authCode: code
-          }, {
-            F: __dxlog_file6,
-            L: 132,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          let status = import_invitations2.AuthenticationResponse.Status.OK;
-          (0, import_invariant6.invariant)(this.invitation, "Invitation is not set.", {
-            F: __dxlog_file6,
-            L: 135,
-            S: this,
-            A: [
-              "this.invitation",
-              "'Invitation is not set.'"
-            ]
-          });
-          switch (this.invitation.authMethod) {
-            case import_services4.Invitation.AuthMethod.NONE: {
-              (0, import_log5.log)("authentication not required", void 0, {
-                F: __dxlog_file6,
-                L: 138,
-                S: this,
-                C: (f, a) => f(...a)
-              });
-              return {
-                status: import_invitations2.AuthenticationResponse.Status.OK
-              };
-            }
-            case import_services4.Invitation.AuthMethod.SHARED_SECRET: {
-              if (this.invitation.authCode) {
-                if (this.authenticationRetry++ > MAX_OTP_ATTEMPTS) {
-                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
-                } else if (code !== this.invitation.authCode) {
-                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OTP;
-                } else {
-                  this.authenticationPassed = true;
-                }
-              }
-              break;
-            }
-            case import_services4.Invitation.AuthMethod.KNOWN_PUBLIC_KEY: {
-              if (!this.invitation.guestKeypair) {
-                status = import_invitations2.AuthenticationResponse.Status.INTERNAL_ERROR;
-                break;
-              }
-              const isSignatureValid = this._challenge && (0, import_crypto2.verify)(this._challenge, Buffer.from(signedChallenge ?? []), this.invitation.guestKeypair.publicKey.asBuffer());
-              if (isSignatureValid) {
-                this.authenticationPassed = true;
-              } else {
-                status = import_invitations2.AuthenticationResponse.Status.INVALID_SIGNATURE;
-              }
-              break;
-            }
-            default: {
-              import_log5.log.error("invalid authentication method", {
-                authMethod: this.invitation.authMethod
-              }, {
-                F: __dxlog_file6,
-                L: 176,
-                S: this,
-                C: (f, a) => f(...a)
-              });
-              status = import_invitations2.AuthenticationResponse.Status.INTERNAL_ERROR;
-              break;
-            }
-          }
-          import_log5.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols5.trace.end({
-            id: traceId,
-            data: {
-              status
-            }
-          }), {
-            F: __dxlog_file6,
-            L: 182,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return {
-            status
-          };
+        authenticate: () => {
+          throw new Error("Method not allowed.");
         },
-        admit: async (request) => {
-          const traceId = import_keys6.PublicKey.random().toHex();
-          import_log5.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols5.trace.begin({
-            id: traceId
-          }), {
-            F: __dxlog_file6,
-            L: 188,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          try {
-            (0, import_invariant6.invariant)(this.invitation, "Invitation is not set.", {
-              F: __dxlog_file6,
-              L: 191,
-              S: this,
-              A: [
-                "this.invitation",
-                "'Invitation is not set.'"
-              ]
-            });
-            if (isAuthenticationRequired(this.invitation) && !this.authenticationPassed) {
-              throw new Error("Not authenticated");
-            }
-            const response = await this._callbacks.admit(request);
-            import_log5.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols5.trace.end({
-              id: traceId
-            }), {
-              F: __dxlog_file6,
-              L: 199,
-              S: this,
-              C: (f, a) => f(...a)
-            });
-            return response;
-          } catch (err) {
-            this._callbacks.onError(err);
-            throw err;
-          }
+        admit: () => {
+          throw new Error("Method not allowed.");
         }
       }
     };
@@ -1710,48 +1568,110 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
   async onOpen(context) {
     await super.onOpen(context);
     try {
-      await this.rpc.InvitationHostService.options({
-        role: import_invitations2.Options.Role.HOST
+      (0, import_log5.log)("guest acquire lock", void 0, {
+        F: __dxlog_file6,
+        L: 84,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
+      (0, import_log5.log)("guest lock acquired", void 0, {
+        F: __dxlog_file6,
+        L: 86,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await (0, import_context5.cancelWithContext)(this._ctx, this.rpc.InvitationHostService.options({
+        role: import_invitations3.Options.Role.GUEST
+      }));
+      (0, import_log5.log)("options sent", void 0, {
+        F: __dxlog_file6,
+        L: 88,
+        S: this,
+        C: (f, a) => f(...a)
       });
       await (0, import_context5.cancelWithContext)(this._ctx, this._remoteOptionsTrigger.wait({
         timeout: OPTIONS_TIMEOUT
       }));
-      if (this._remoteOptions?.role !== import_invitations2.Options.Role.GUEST) {
+      (0, import_log5.log)("options received", void 0, {
+        F: __dxlog_file6,
+        L: 90,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      if (this._remoteOptions?.role !== import_invitations3.Options.Role.HOST) {
         throw new import_protocols5.InvalidInvitationExtensionRoleError(void 0, {
-          expected: import_invitations2.Options.Role.GUEST,
-          remoteOptions: this._remoteOptions
+          expected: import_invitations3.Options.Role.HOST,
+          remoteOptions: this._remoteOptions,
+          remotePeerId: context.remotePeerId
         });
       }
-      this._callbacks.onOpen();
+      this._callbacks.onOpen(this._ctx, context);
     } catch (err) {
-      this._callbacks.onError(err);
+      if (this._invitationFlowLock != null) {
+        this._callbacks.onError(err);
+      }
+      if (!this._ctx.disposed) {
+        context.close(err);
+      }
     }
   }
   async onClose() {
+    await this._destroy();
+  }
+  async onAbort() {
+    await this._destroy();
+  }
+  async _destroy() {
     await this._ctx.dispose();
+    if (this._invitationFlowLock != null) {
+      this._invitationFlowLock.release();
+      this._invitationFlowLock = null;
+      (0, import_log5.log)("invitation flow lock released", void 0, {
+        F: __dxlog_file6,
+        L: 123,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
   }
 };
-var InvitationGuestExtension = class extends import_teleport.RpcExtension {
-  constructor(_callbacks) {
+var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-host-extension.ts";
+var OPTIONS_TIMEOUT2 = 1e4;
+var MAX_OTP_ATTEMPTS = 3;
+var InvitationHostExtension = class extends import_teleport2.RpcExtension {
+  constructor(_invitationFlowMutex, _callbacks) {
     super({
       requested: {
-        InvitationHostService: import_protocols5.schema.getService("dxos.halo.invitations.InvitationHostService")
+        InvitationHostService: import_protocols6.schema.getService("dxos.halo.invitations.InvitationHostService")
       },
       exposed: {
-        InvitationHostService: import_protocols5.schema.getService("dxos.halo.invitations.InvitationHostService")
+        InvitationHostService: import_protocols6.schema.getService("dxos.halo.invitations.InvitationHostService")
       }
     });
+    this._invitationFlowMutex = _invitationFlowMutex;
     this._callbacks = _callbacks;
-    this._ctx = new import_context5.Context();
-    this._remoteOptionsTrigger = new import_async8.Trigger();
+    this._ctx = new import_context7.Context();
+    this._remoteOptionsTrigger = new import_async9.Trigger();
+    this._challenge = void 0;
+    this.guestProfile = void 0;
+    this.authenticationPassed = false;
+    this.authenticationRetry = 0;
+    this.completedTrigger = new import_async9.Trigger();
+    this._invitationFlowLock = null;
+  }
+  hasFlowLock() {
+    return this._invitationFlowLock != null;
   }
   async getHandlers() {
     return {
+      // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
+      // Perhaps in the future we will have more complex logic here.
       InvitationHostService: {
         options: async (options) => {
-          (0, import_invariant6.invariant)(!this._remoteOptions, "Remote options already set.", {
-            F: __dxlog_file6,
-            L: 266,
+          (0, import_invariant7.invariant)(!this._remoteOptions, "Remote options already set.", {
+            F: __dxlog_file7,
+            L: 101,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1761,14 +1681,191 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
           this._remoteOptions = options;
           this._remoteOptionsTrigger.wake();
         },
-        introduce: () => {
-          throw new Error("Method not allowed.");
+        introduce: async (request) => {
+          const { profile, invitationId } = request;
+          const traceId = import_keys6.PublicKey.random().toHex();
+          import_log6.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols6.trace.begin({
+            id: traceId
+          }), {
+            F: __dxlog_file7,
+            L: 110,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          const invitation = this._requireActiveInvitation();
+          this._assertInvitationState(import_services5.Invitation.State.CONNECTED);
+          if (invitationId !== invitation?.invitationId) {
+            import_log6.log.warn("incorrect invitationId", {
+              expected: invitation.invitationId,
+              actual: invitationId
+            }, {
+              F: __dxlog_file7,
+              L: 116,
+              S: this,
+              C: (f, a) => f(...a)
+            });
+            this._callbacks.onError(new Error("Incorrect invitationId."));
+            (0, import_async9.scheduleTask)(this._ctx, () => this.close());
+            return {
+              authMethod: import_services5.Invitation.AuthMethod.NONE
+            };
+          }
+          (0, import_log6.log)("guest introduced themselves", {
+            guestProfile: profile
+          }, {
+            F: __dxlog_file7,
+            L: 125,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          this.guestProfile = profile;
+          this._callbacks.onStateUpdate(import_services5.Invitation.State.READY_FOR_AUTHENTICATION);
+          this._challenge = invitation.authMethod === import_services5.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? (0, import_crypto2.randomBytes)(32) : void 0;
+          import_log6.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols6.trace.end({
+            id: traceId
+          }), {
+            F: __dxlog_file7,
+            L: 132,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return {
+            authMethod: invitation.authMethod,
+            challenge: this._challenge
+          };
         },
-        authenticate: () => {
-          throw new Error("Method not allowed.");
+        authenticate: async ({ authCode: code, signedChallenge }) => {
+          const traceId = import_keys6.PublicKey.random().toHex();
+          import_log6.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols6.trace.begin({
+            id: traceId
+          }), {
+            F: __dxlog_file7,
+            L: 141,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          const invitation = this._requireActiveInvitation();
+          (0, import_log6.log)("received authentication request", {
+            authCode: code
+          }, {
+            F: __dxlog_file7,
+            L: 144,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          let status = import_invitations4.AuthenticationResponse.Status.OK;
+          this._assertInvitationState([
+            import_services5.Invitation.State.AUTHENTICATING,
+            import_services5.Invitation.State.READY_FOR_AUTHENTICATION
+          ]);
+          this._callbacks.onStateUpdate(import_services5.Invitation.State.AUTHENTICATING);
+          switch (invitation.authMethod) {
+            case import_services5.Invitation.AuthMethod.NONE: {
+              (0, import_log6.log)("authentication not required", void 0, {
+                F: __dxlog_file7,
+                L: 152,
+                S: this,
+                C: (f, a) => f(...a)
+              });
+              return {
+                status: import_invitations4.AuthenticationResponse.Status.OK
+              };
+            }
+            case import_services5.Invitation.AuthMethod.SHARED_SECRET: {
+              if (invitation.authCode) {
+                if (this.authenticationRetry++ > MAX_OTP_ATTEMPTS) {
+                  status = import_invitations4.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
+                } else if (code !== invitation.authCode) {
+                  status = import_invitations4.AuthenticationResponse.Status.INVALID_OTP;
+                } else {
+                  this.authenticationPassed = true;
+                }
+              }
+              break;
+            }
+            case import_services5.Invitation.AuthMethod.KNOWN_PUBLIC_KEY: {
+              if (!invitation.guestKeypair) {
+                status = import_invitations4.AuthenticationResponse.Status.INTERNAL_ERROR;
+                break;
+              }
+              const isSignatureValid = this._challenge && (0, import_crypto2.verify)(this._challenge, Buffer.from(signedChallenge ?? []), invitation.guestKeypair.publicKey.asBuffer());
+              if (isSignatureValid) {
+                this.authenticationPassed = true;
+              } else {
+                status = import_invitations4.AuthenticationResponse.Status.INVALID_SIGNATURE;
+              }
+              break;
+            }
+            default: {
+              import_log6.log.error("invalid authentication method", {
+                authMethod: invitation.authMethod
+              }, {
+                F: __dxlog_file7,
+                L: 190,
+                S: this,
+                C: (f, a) => f(...a)
+              });
+              status = import_invitations4.AuthenticationResponse.Status.INTERNAL_ERROR;
+              break;
+            }
+          }
+          if (![
+            import_invitations4.AuthenticationResponse.Status.OK,
+            import_invitations4.AuthenticationResponse.Status.INVALID_OTP
+          ].includes(status)) {
+            this._callbacks.onError(new Error(`Authentication failed, with status=${status}`));
+            (0, import_async9.scheduleTask)(this._ctx, () => this.close());
+            return {
+              status
+            };
+          }
+          import_log6.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols6.trace.end({
+            id: traceId,
+            data: {
+              status
+            }
+          }), {
+            F: __dxlog_file7,
+            L: 202,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return {
+            status
+          };
         },
-        admit: () => {
-          throw new Error("Method not allowed.");
+        admit: async (request) => {
+          const traceId = import_keys6.PublicKey.random().toHex();
+          import_log6.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols6.trace.begin({
+            id: traceId
+          }), {
+            F: __dxlog_file7,
+            L: 208,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          const invitation = this._requireActiveInvitation();
+          try {
+            if (isAuthenticationRequired(invitation)) {
+              this._assertInvitationState(import_services5.Invitation.State.AUTHENTICATING);
+              if (!this.authenticationPassed) {
+                throw new Error("Not authenticated");
+              }
+            }
+            const response = await this._callbacks.admit(request);
+            import_log6.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols6.trace.end({
+              id: traceId
+            }), {
+              F: __dxlog_file7,
+              L: 222,
+              S: this,
+              C: (f, a) => f(...a)
+            });
+            return response;
+          } catch (err) {
+            this._callbacks.onError(err);
+            throw err;
+          }
         }
       }
     };
@@ -1776,81 +1873,195 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
   async onOpen(context) {
     await super.onOpen(context);
     try {
-      (0, import_log5.log)("begin options", void 0, {
-        F: __dxlog_file6,
-        L: 287,
+      (0, import_log6.log)("host acquire lock", void 0, {
+        F: __dxlog_file7,
+        L: 237,
         S: this,
         C: (f, a) => f(...a)
       });
-      await (0, import_context5.cancelWithContext)(this._ctx, this.rpc.InvitationHostService.options({
-        role: import_invitations2.Options.Role.GUEST
-      }));
-      await (0, import_context5.cancelWithContext)(this._ctx, this._remoteOptionsTrigger.wait({
-        timeout: OPTIONS_TIMEOUT
+      this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
+      (0, import_log6.log)("host lock acquired", void 0, {
+        F: __dxlog_file7,
+        L: 239,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      const lastState = this._requireActiveInvitation().state;
+      this._callbacks.onStateUpdate(import_services5.Invitation.State.CONNECTING);
+      await this.rpc.InvitationHostService.options({
+        role: import_invitations4.Options.Role.HOST
+      });
+      (0, import_log6.log)("options sent", void 0, {
+        F: __dxlog_file7,
+        L: 243,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await (0, import_context7.cancelWithContext)(this._ctx, this._remoteOptionsTrigger.wait({
+        timeout: OPTIONS_TIMEOUT2
       }));
-      (0, import_log5.log)("end options", void 0, {
-        F: __dxlog_file6,
-        L: 290,
+      (0, import_log6.log)("options received", void 0, {
+        F: __dxlog_file7,
+        L: 245,
         S: this,
         C: (f, a) => f(...a)
       });
-      if (this._remoteOptions?.role !== import_invitations2.Options.Role.HOST) {
-        throw new import_protocols5.InvalidInvitationExtensionRoleError(void 0, {
-          expected: import_invitations2.Options.Role.HOST,
-          remoteOptions: this._remoteOptions
+      if (this._remoteOptions?.role !== import_invitations4.Options.Role.GUEST) {
+        this._callbacks.onStateUpdate(lastState);
+        throw new import_protocols6.InvalidInvitationExtensionRoleError(void 0, {
+          expected: import_invitations4.Options.Role.GUEST,
+          remoteOptions: this._remoteOptions,
+          remotePeerId: context.remotePeerId
         });
       }
-      this._callbacks.onOpen(this._ctx);
+      this._callbacks.onStateUpdate(import_services5.Invitation.State.CONNECTED);
+      this._callbacks.onOpen(this._ctx, context);
     } catch (err) {
-      (0, import_log5.log)("openError", err, {
-        F: __dxlog_file6,
+      if (this._invitationFlowLock != null) {
+        this._callbacks.onError(err);
+      }
+      if (!this._ctx.disposed) {
+        context.close(err);
+      }
+    }
+  }
+  _requireActiveInvitation() {
+    const invitation = this._callbacks.activeInvitation;
+    if (invitation == null) {
+      (0, import_async9.scheduleTask)(this._ctx, () => this.close());
+      throw new Error("Active invitation not found");
+    }
+    return invitation;
+  }
+  _assertInvitationState(stateOrMany) {
+    const invitation = this._requireActiveInvitation();
+    const validStates = Array.isArray(stateOrMany) ? stateOrMany : [
+      stateOrMany
+    ];
+    if (!validStates.includes(invitation.state)) {
+      (0, import_async9.scheduleTask)(this._ctx, () => this.close());
+      throw new import_invariant7.InvariantViolation(`Expected ${stateToString(invitation.state)} to be one of [${validStates.map(stateToString).join(", ")}]`);
+    }
+  }
+  async onClose() {
+    await this._destroy();
+  }
+  async onAbort() {
+    await this._destroy();
+  }
+  async _destroy() {
+    await this._ctx.dispose();
+    if (this._invitationFlowLock != null) {
+      this._invitationFlowLock?.release();
+      this._invitationFlowLock = null;
+      (0, import_log6.log)("invitation flow lock released", void 0, {
+        F: __dxlog_file7,
         L: 300,
         S: this,
         C: (f, a) => f(...a)
       });
-      this._callbacks.onError(err);
     }
   }
-  async onClose() {
-    (0, import_log5.log)("onClose", void 0, {
-      F: __dxlog_file6,
-      L: 306,
+};
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_services5.Invitation.AuthMethod.NONE;
+var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-topology.ts";
+var InvitationTopology = class {
+  constructor(_role) {
+    this._role = _role;
+    this._seenPeers = new import_util5.ComplexSet(import_keys7.PublicKey.hash);
+  }
+  init(controller) {
+    (0, import_invariant8.invariant)(!this._controller, "Already initialized.", {
+      F: __dxlog_file8,
+      L: 42,
+      S: this,
+      A: [
+        "!this._controller",
+        "'Already initialized.'"
+      ]
+    });
+    this._controller = controller;
+  }
+  update() {
+    (0, import_invariant8.invariant)(this._controller, "Not initialized.", {
+      F: __dxlog_file8,
+      L: 47,
+      S: this,
+      A: [
+        "this._controller",
+        "'Not initialized.'"
+      ]
+    });
+    const { ownPeerId, candidates, connected, allPeers } = this._controller.getState();
+    if (this._role === import_invitations5.Options.Role.GUEST) {
+      return;
+    }
+    if (connected.length > 0) {
+      connected.forEach((c) => this._seenPeers.add(c));
+      return;
+    }
+    const firstUnknownPeer = candidates.find((peerId) => !this._seenPeers.has(peerId));
+    this._seenPeers = new import_util5.ComplexSet(import_keys7.PublicKey.hash, allPeers.filter((peerId) => this._seenPeers.has(peerId)));
+    if (firstUnknownPeer != null) {
+      (0, import_log7.log)("invitation connect", {
+        ownPeerId,
+        remotePeerId: firstUnknownPeer
+      }, {
+        F: __dxlog_file8,
+        L: 69,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      this._controller.connect(firstUnknownPeer);
+      this._seenPeers.add(firstUnknownPeer);
+    }
+  }
+  async onOffer(peer) {
+    (0, import_invariant8.invariant)(this._controller, "Not initialized.", {
+      F: __dxlog_file8,
+      L: 76,
       S: this,
-      C: (f, a) => f(...a)
+      A: [
+        "this._controller",
+        "'Not initialized.'"
+      ]
     });
-    await this._ctx.dispose();
+    return !this._seenPeers.has(peer);
+  }
+  async destroy() {
+    this._seenPeers.clear();
+  }
+  toString() {
+    return `InvitationTopology(${this._role === import_invitations5.Options.Role.GUEST ? "guest" : "host"})`;
   }
 };
-var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_services4.Invitation.AuthMethod.NONE;
-var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts";
+var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts";
+var MAX_DELEGATED_INVITATION_HOST_TRIES = 3;
 var InvitationsHandler = class {
   /**
   * @internal
   */
-  constructor(_networkManager) {
+  constructor(_networkManager, _defaultTeleportParams) {
     this._networkManager = _networkManager;
+    this._defaultTeleportParams = _defaultTeleportParams;
   }
   handleInvitationFlow(ctx, stream, protocol, invitation) {
+    const guardedState = this._createGuardedState(ctx, invitation, stream);
     const createExtension = () => {
-      const extension = new InvitationHostExtension({
-        onStateUpdate: (invitation2) => {
-          stream.next({
-            ...invitation2,
-            state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
-          });
+      const extension = new InvitationHostExtension(guardedState.mutex, {
+        get activeInvitation() {
+          return ctx.disposed ? null : guardedState.current;
         },
-        resolveInvitation: async ({ invitationId }) => {
-          if (invitationId && invitationId !== invitation.invitationId) {
-            return void 0;
-          }
-          return invitation;
+        onStateUpdate: (newState) => {
+          guardedState.set(extension, newState);
+          return guardedState.current;
         },
         admit: async (admissionRequest) => {
           try {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             (0, import_invariant5.invariant)(deviceKey, void 0, {
-              F: __dxlog_file7,
-              L: 87,
+              F: __dxlog_file9,
+              L: 90,
               S: this,
               A: [
                 "deviceKey",
@@ -1861,34 +2072,36 @@ var InvitationsHandler = class {
             extension.completedTrigger.wake(deviceKey);
             return admissionResponse;
           } catch (err) {
-            stream.error(err);
+            guardedState.error(extension, err);
             throw err;
           }
         },
-        onOpen: () => {
-          (0, import_async7.scheduleTask)(ctx, async () => {
+        onOpen: (connectionCtx, extensionsCtx) => {
+          let admitted = false;
+          connectionCtx.onDispose(() => {
+            if (!admitted) {
+              guardedState.error(extension, new import_context4.ContextDisposedError());
+            }
+          });
+          (0, import_async7.scheduleTask)(connectionCtx, async () => {
             const traceId = import_keys5.PublicKey.random().toHex();
             try {
               import_log4.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.begin({
                 id: traceId
               }), {
-                F: __dxlog_file7,
-                L: 105,
+                F: __dxlog_file9,
+                L: 115,
                 S: this,
                 C: (f, a) => f(...a)
               });
               (0, import_log4.log)("connected", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 106,
+                F: __dxlog_file9,
+                L: 116,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              stream.next({
-                ...invitation,
-                state: import_services3.Invitation.State.CONNECTED
-              });
               const deviceKey = await extension.completedTrigger.wait({
                 timeout: invitation.timeout
               });
@@ -1896,88 +2109,91 @@ var InvitationsHandler = class {
                 guest: deviceKey,
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 109,
+                F: __dxlog_file9,
+                L: 118,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              stream.next({
-                ...invitation,
-                state: import_services3.Invitation.State.SUCCESS
-              });
+              guardedState.set(extension, import_services3.Invitation.State.SUCCESS);
               import_log4.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
-                F: __dxlog_file7,
-                L: 111,
+                F: __dxlog_file9,
+                L: 120,
                 S: this,
                 C: (f, a) => f(...a)
               });
+              admitted = true;
+              if (!invitation.multiUse) {
+                await ctx.dispose();
+              }
             } catch (err) {
               if (err instanceof import_async7.TimeoutError) {
-                (0, import_log4.log)("timeout", {
-                  ...protocol.toJSON()
-                }, {
-                  F: __dxlog_file7,
-                  L: 114,
-                  S: this,
-                  C: (f, a) => f(...a)
-                });
-                stream.next({
-                  ...invitation,
-                  state: import_services3.Invitation.State.TIMEOUT
-                });
+                if (guardedState.set(extension, import_services3.Invitation.State.TIMEOUT)) {
+                  (0, import_log4.log)("timeout", {
+                    ...protocol.toJSON()
+                  }, {
+                    F: __dxlog_file9,
+                    L: 129,
+                    S: this,
+                    C: (f, a) => f(...a)
+                  });
+                }
               } else {
-                import_log4.log.error("failed", err, {
-                  F: __dxlog_file7,
-                  L: 117,
-                  S: this,
-                  C: (f, a) => f(...a)
-                });
-                stream.error(err);
+                if (guardedState.error(extension, err)) {
+                  import_log4.log.error("failed", err, {
+                    F: __dxlog_file9,
+                    L: 133,
+                    S: this,
+                    C: (f, a) => f(...a)
+                  });
+                }
               }
               import_log4.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.error({
                 id: traceId,
                 error: err
               }), {
-                F: __dxlog_file7,
-                L: 120,
+                F: __dxlog_file9,
+                L: 136,
                 S: this,
                 C: (f, a) => f(...a)
               });
-            } finally {
-              if (!invitation.multiUse) {
-                await swarmConnection.close();
-                await ctx.dispose();
-              }
+              extensionsCtx.close(err);
             }
           });
         },
         onError: (err) => {
           if (err instanceof import_protocols4.InvalidInvitationExtensionRoleError) {
-            return;
-          }
-          if (err instanceof import_async7.TimeoutError) {
-            (0, import_log4.log)("timeout", {
-              ...protocol.toJSON()
+            (0, import_log4.log)("invalid role", {
+              ...err.context
             }, {
-              F: __dxlog_file7,
-              L: 135,
+              F: __dxlog_file9,
+              L: 144,
               S: this,
               C: (f, a) => f(...a)
             });
-            stream.next({
-              ...invitation,
-              state: import_services3.Invitation.State.TIMEOUT
-            });
+            return;
+          }
+          if (err instanceof import_async7.TimeoutError) {
+            if (guardedState.set(extension, import_services3.Invitation.State.TIMEOUT)) {
+              (0, import_log4.log)("timeout", {
+                err
+              }, {
+                F: __dxlog_file9,
+                L: 149,
+                S: this,
+                C: (f, a) => f(...a)
+              });
+            }
           } else {
-            import_log4.log.error("failed", err, {
-              F: __dxlog_file7,
-              L: 138,
-              S: this,
-              C: (f, a) => f(...a)
-            });
-            stream.error(err);
+            if (guardedState.error(extension, err)) {
+              import_log4.log.error("failed", err, {
+                F: __dxlog_file9,
+                L: 153,
+                S: this,
+                C: (f, a) => f(...a)
+              });
+            }
           }
         }
       });
@@ -1986,57 +2202,31 @@ var InvitationsHandler = class {
     if (invitation.lifetime && invitation.created) {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
         import_log4.log.warn("invitation has already expired", void 0, {
-          F: __dxlog_file7,
-          L: 149,
+          F: __dxlog_file9,
+          L: 164,
           S: this,
           C: (f, a) => f(...a)
         });
       } else {
         (0, import_async7.scheduleTask)(ctx, async () => {
           await swarmConnection.close();
-          stream.next({
-            ...invitation,
-            state: import_services3.Invitation.State.EXPIRED
-          });
+          guardedState.set(null, import_services3.Invitation.State.EXPIRED);
           await ctx.dispose();
         }, invitation.created.getTime() + invitation.lifetime * 1e3 - Date.now());
       }
     }
     let swarmConnection;
-    const invitationLabel = "invitation host for " + (invitation.kind === import_services3.Invitation.Kind.DEVICE ? "device" : `space ${invitation.spaceKey?.truncate()}`);
     (0, import_async7.scheduleTask)(ctx, async () => {
-      const topic = invitation.swarmKey;
-      swarmConnection = await this._networkManager.joinSwarm({
-        topic,
-        peerId: topic,
-        protocolProvider: (0, import_network_manager.createTeleportProtocolFactory)(async (teleport) => {
-          teleport.addExtension("dxos.halo.invitations", createExtension());
-        }),
-        topology: new import_network_manager.StarTopology(topic),
-        label: invitationLabel
-      });
-      ctx.onDispose(() => swarmConnection.close());
-      stream.next({
-        ...invitation,
-        state: import_services3.Invitation.State.CONNECTING
-      });
+      swarmConnection = await this._joinSwarm(ctx, invitation, import_invitations2.Options.Role.HOST, createExtension);
+      guardedState.set(null, import_services3.Invitation.State.CONNECTING);
     });
   }
-  acceptInvitation(protocol, invitation, deviceProfile) {
+  acceptInvitation(ctx, stream, protocol, invitation, otpEnteredTrigger, deviceProfile) {
     const { timeout = import_client_protocol2.INVITATION_TIMEOUT } = invitation;
-    (0, import_invariant5.invariant)(protocol, void 0, {
-      F: __dxlog_file7,
-      L: 191,
-      S: this,
-      A: [
-        "protocol",
-        ""
-      ]
-    });
     if (deviceProfile) {
       (0, import_invariant5.invariant)(invitation.kind === import_services3.Invitation.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
-        F: __dxlog_file7,
-        L: 194,
+        F: __dxlog_file9,
+        L: 197,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -2044,121 +2234,96 @@ var InvitationsHandler = class {
         ]
       });
     }
-    const authenticated = new import_async7.Trigger();
-    let admitted = false;
-    let currentState;
-    const stream = new import_async7.PushStream();
-    const setState = (newData) => {
-      (0, import_invariant5.invariant)(newData.state !== void 0, void 0, {
-        F: __dxlog_file7,
-        L: 205,
-        S: this,
-        A: [
-          "newData.state !== undefined",
-          ""
-        ]
-      });
-      currentState = newData.state;
-      stream.next({
-        ...invitation,
-        ...newData
-      });
-    };
-    const ctx = new import_context4.Context({
-      onError: (err) => {
-        if (err instanceof import_async7.TimeoutError) {
-          (0, import_log4.log)("timeout", {
-            ...protocol.toJSON()
-          }, {
-            F: __dxlog_file7,
-            L: 213,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          setState({
-            state: import_services3.Invitation.State.TIMEOUT
-          });
-        } else {
-          import_log4.log.warn("auth failed", err, {
-            F: __dxlog_file7,
-            L: 216,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          stream.error(err);
-        }
-        void ctx.dispose();
-      }
-    });
-    ctx.onDispose(() => {
-      (0, import_log4.log)("complete", {
-        ...protocol.toJSON()
+    const triedPeersIds = new import_util4.ComplexSet(import_keys5.PublicKey.hash);
+    const guardedState = this._createGuardedState(ctx, invitation, stream);
+    const shouldCancelInvitationFlow = (extension) => {
+      const isLockedByAnotherConnection = guardedState.mutex.isLocked() && !extension.hasFlowLock();
+      (0, import_log4.log)("should cancel invitation flow", {
+        isLockedByAnotherConnection,
+        invitationType: import_services3.Invitation.Type.DELEGATED,
+        triedPeers: triedPeersIds.size
       }, {
-        F: __dxlog_file7,
-        L: 224,
+        F: __dxlog_file9,
+        L: 205,
         S: this,
         C: (f, a) => f(...a)
       });
-      stream.complete();
-    });
+      if (isLockedByAnotherConnection) {
+        return false;
+      }
+      return invitation.type !== import_services3.Invitation.Type.DELEGATED || triedPeersIds.size >= MAX_DELEGATED_INVITATION_HOST_TRIES;
+    };
+    let admitted = false;
     const createExtension = () => {
-      let connectionCount = 0;
-      const extension = new InvitationGuestExtension({
-        onOpen: (extensionCtx) => {
-          extensionCtx.onDispose(async () => {
+      const extension = new InvitationGuestExtension(guardedState.mutex, {
+        onStateUpdate: (newState) => {
+          guardedState.set(extension, newState);
+        },
+        onOpen: (connectionCtx, extensionCtx) => {
+          triedPeersIds.add(extensionCtx.remotePeerId);
+          if (admitted) {
+            extensionCtx.close();
+            return;
+          }
+          connectionCtx.onDispose(async () => {
             (0, import_log4.log)("extension disposed", {
-              currentState
+              admitted,
+              currentState: guardedState.current.state
             }, {
-              F: __dxlog_file7,
-              L: 234,
+              F: __dxlog_file9,
+              L: 233,
               S: this,
               C: (f, a) => f(...a)
             });
             if (!admitted) {
-              stream.error(new Error("Remote peer disconnected."));
+              guardedState.error(extension, new import_context4.ContextDisposedError());
+              if (shouldCancelInvitationFlow(extension)) {
+                await ctx.dispose();
+              }
             }
           });
-          (0, import_async7.scheduleTask)(ctx, async () => {
+          (0, import_async7.scheduleTask)(connectionCtx, async () => {
             const traceId = import_keys5.PublicKey.random().toHex();
             try {
               import_log4.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.begin({
                 id: traceId
               }), {
-                F: __dxlog_file7,
-                L: 243,
+                F: __dxlog_file9,
+                L: 245,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              if (++connectionCount > 1) {
-                throw new Error(`multiple connections detected: ${connectionCount}`);
-              }
-              (0, import_async7.scheduleTask)(ctx, () => ctx.raise(new import_async7.TimeoutError(timeout)), timeout);
+              (0, import_async7.scheduleTask)(connectionCtx, () => {
+                guardedState.set(extension, import_services3.Invitation.State.TIMEOUT);
+                extensionCtx.close();
+              }, timeout);
               (0, import_log4.log)("connected", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 251,
+                F: __dxlog_file9,
+                L: 256,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              setState({
-                state: import_services3.Invitation.State.CONNECTED
-              });
+              guardedState.set(extension, import_services3.Invitation.State.CONNECTED);
               (0, import_log4.log)("introduce", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 255,
+                F: __dxlog_file9,
+                L: 260,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              const introductionResponse = await extension.rpc.InvitationHostService.introduce(protocol.createIntroduction());
+              const introductionResponse = await extension.rpc.InvitationHostService.introduce({
+                invitationId: invitation.invitationId,
+                ...protocol.createIntroduction()
+              });
               (0, import_log4.log)("introduce response", {
                 ...protocol.toJSON(),
                 response: introductionResponse
               }, {
-                F: __dxlog_file7,
-                L: 259,
+                F: __dxlog_file9,
+                L: 265,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2166,20 +2331,20 @@ var InvitationsHandler = class {
               if (isAuthenticationRequired(invitation)) {
                 switch (invitation.authMethod) {
                   case import_services3.Invitation.AuthMethod.SHARED_SECRET:
-                    await this._handleGuestOtpAuth(extension, setState, authenticated, {
+                    await this._handleGuestOtpAuth(extension, (state) => guardedState.set(extension, state), otpEnteredTrigger, {
                       timeout
                     });
                     break;
                   case import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY:
-                    await this._handleGuestKpkAuth(extension, setState, invitation, introductionResponse);
+                    await this._handleGuestKpkAuth(extension, (state) => guardedState.set(extension, state), invitation, introductionResponse);
                     break;
                 }
               }
               (0, import_log4.log)("request admission", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 275,
+                F: __dxlog_file9,
+                L: 291,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2190,21 +2355,21 @@ var InvitationsHandler = class {
               (0, import_log4.log)("admitted by host", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 286,
+                F: __dxlog_file9,
+                L: 302,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              setState({
+              await guardedState.complete({
+                ...guardedState.current,
                 ...result,
-                target: invitation.target,
                 state: import_services3.Invitation.State.SUCCESS
               });
               import_log4.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
-                F: __dxlog_file7,
-                L: 288,
+                F: __dxlog_file9,
+                L: 308,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2213,34 +2378,31 @@ var InvitationsHandler = class {
                 (0, import_log4.log)("timeout", {
                   ...protocol.toJSON()
                 }, {
-                  F: __dxlog_file7,
-                  L: 291,
+                  F: __dxlog_file9,
+                  L: 311,
                   S: this,
                   C: (f, a) => f(...a)
                 });
-                setState({
-                  state: import_services3.Invitation.State.TIMEOUT
-                });
+                guardedState.set(extension, import_services3.Invitation.State.TIMEOUT);
               } else {
                 (0, import_log4.log)("auth failed", err, {
-                  F: __dxlog_file7,
-                  L: 294,
+                  F: __dxlog_file9,
+                  L: 314,
                   S: this,
                   C: (f, a) => f(...a)
                 });
-                stream.error(err);
+                guardedState.error(extension, err);
               }
+              extensionCtx.close(err);
               import_log4.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.error({
                 id: traceId,
                 error: err
               }), {
-                F: __dxlog_file7,
-                L: 297,
+                F: __dxlog_file9,
+                L: 318,
                 S: this,
                 C: (f, a) => f(...a)
               });
-            } finally {
-              await ctx.dispose();
             }
           });
         },
@@ -2252,22 +2414,20 @@ var InvitationsHandler = class {
             (0, import_log4.log)("timeout", {
               ...protocol.toJSON()
             }, {
-              F: __dxlog_file7,
-              L: 308,
+              F: __dxlog_file9,
+              L: 327,
               S: this,
               C: (f, a) => f(...a)
             });
-            setState({
-              state: import_services3.Invitation.State.TIMEOUT
-            });
+            guardedState.set(extension, import_services3.Invitation.State.TIMEOUT);
           } else {
             (0, import_log4.log)("auth failed", err, {
-              F: __dxlog_file7,
-              L: 311,
+              F: __dxlog_file9,
+              L: 330,
               S: this,
               C: (f, a) => f(...a)
             });
-            stream.error(err);
+            guardedState.error(extension, err);
           }
         }
       });
@@ -2277,68 +2437,140 @@ var InvitationsHandler = class {
       const error = protocol.checkInvitation(invitation);
       if (error) {
         stream.error(error);
+        await ctx.dispose();
       } else {
         (0, import_invariant5.invariant)(invitation.swarmKey, void 0, {
-          F: __dxlog_file7,
-          L: 325,
+          F: __dxlog_file9,
+          L: 345,
           S: this,
           A: [
             "invitation.swarmKey",
             ""
           ]
         });
-        const topic = invitation.swarmKey;
-        const swarmConnection = await this._networkManager.joinSwarm({
-          topic,
-          peerId: import_keys5.PublicKey.random(),
-          protocolProvider: (0, import_network_manager.createTeleportProtocolFactory)(async (teleport) => {
-            teleport.addExtension("dxos.halo.invitations", createExtension());
-          }),
-          topology: new import_network_manager.StarTopology(topic),
-          label: "invitation guest"
-        });
-        ctx.onDispose(() => swarmConnection.close());
-        setState({
-          state: import_services3.Invitation.State.CONNECTING
-        });
+        await this._joinSwarm(ctx, invitation, import_invitations2.Options.Role.GUEST, createExtension);
+        guardedState.set(null, import_services3.Invitation.State.CONNECTING);
       }
     });
-    const observable = new import_client_protocol2.AuthenticatingInvitation({
-      initialInvitation: invitation,
-      subscriber: stream.observable,
-      onCancel: async () => {
-        setState({
-          state: import_services3.Invitation.State.CANCELLED
-        });
-        await ctx.dispose();
+  }
+  async _joinSwarm(ctx, invitation, role, extensionFactory) {
+    let label;
+    if (role === import_invitations2.Options.Role.GUEST) {
+      label = "invitation guest";
+    } else if (invitation.kind === import_services3.Invitation.Kind.DEVICE) {
+      label = "invitation host for device";
+    } else {
+      label = `invitation host for space ${invitation.spaceKey?.truncate()}`;
+    }
+    const swarmConnection = await this._networkManager.joinSwarm({
+      topic: invitation.swarmKey,
+      peerId: import_keys5.PublicKey.random(),
+      protocolProvider: (0, import_network_manager.createTeleportProtocolFactory)(async (teleport) => {
+        teleport.addExtension("dxos.halo.invitations", extensionFactory());
+      }, this._defaultTeleportParams),
+      topology: new InvitationTopology(role),
+      label
+    });
+    ctx.onDispose(() => swarmConnection.close());
+    return swarmConnection;
+  }
+  /**
+  * A utility object for serializing invitation state changes by multiple concurrent
+  * invitation flow connections.
+  */
+  _createGuardedState(ctx, invitation, stream) {
+    const mutex = new import_async7.Mutex();
+    let lastActiveExtension = null;
+    let currentInvitation = {
+      ...invitation
+    };
+    const isStateChangeAllowed = (extension) => {
+      if (ctx.disposed || extension !== null && mutex.isLocked() && !extension.hasFlowLock()) {
+        return false;
+      }
+      return extension == null || lastActiveExtension !== extension || this._isNotTerminal(currentInvitation.state);
+    };
+    return {
+      mutex,
+      get current() {
+        return currentInvitation;
       },
-      onAuthenticate: async (code) => {
-        authenticated.wake(code);
+      // disposing context prevents any further state updates
+      complete: (newState) => {
+        currentInvitation = {
+          ...currentInvitation,
+          ...newState
+        };
+        stream.next(currentInvitation);
+        return ctx.dispose();
+      },
+      set: (extension, newState) => {
+        if (isStateChangeAllowed(extension)) {
+          this._logStateUpdate(currentInvitation, extension, newState);
+          currentInvitation = {
+            ...currentInvitation,
+            state: newState
+          };
+          stream.next(currentInvitation);
+          lastActiveExtension = extension;
+          return true;
+        }
+        return false;
+      },
+      error: (extension, error) => {
+        if (isStateChangeAllowed(extension)) {
+          this._logStateUpdate(currentInvitation, extension, import_services3.Invitation.State.ERROR);
+          currentInvitation = {
+            ...currentInvitation,
+            state: import_services3.Invitation.State.ERROR
+          };
+          stream.next(currentInvitation);
+          stream.error(error);
+          lastActiveExtension = extension;
+          return true;
+        }
+        return false;
       }
+    };
+  }
+  _logStateUpdate(invitation, actor, newState) {
+    (0, import_log4.log)("invitation state update", {
+      actor: actor?.constructor.name,
+      newState: stateToString(newState),
+      oldState: stateToString(invitation.state)
+    }, {
+      F: __dxlog_file9,
+      L: 438,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    return observable;
+  }
+  _isNotTerminal(currentState) {
+    return ![
+      import_services3.Invitation.State.SUCCESS,
+      import_services3.Invitation.State.ERROR,
+      import_services3.Invitation.State.CANCELLED,
+      import_services3.Invitation.State.TIMEOUT,
+      import_services3.Invitation.State.EXPIRED
+    ].includes(currentState);
   }
   async _handleGuestOtpAuth(extension, setState, authenticated, options) {
     for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
       (0, import_log4.log)("guest waiting for authentication code...", void 0, {
-        F: __dxlog_file7,
-        L: 365,
+        F: __dxlog_file9,
+        L: 462,
         S: this,
         C: (f, a) => f(...a)
       });
-      setState({
-        state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
-      });
+      setState(import_services3.Invitation.State.READY_FOR_AUTHENTICATION);
       const authCode = await authenticated.wait(options);
       (0, import_log4.log)("sending authentication request", void 0, {
-        F: __dxlog_file7,
-        L: 369,
+        F: __dxlog_file9,
+        L: 466,
         S: this,
         C: (f, a) => f(...a)
       });
-      setState({
-        state: import_services3.Invitation.State.AUTHENTICATING
-      });
+      setState(import_services3.Invitation.State.AUTHENTICATING);
       const response = await extension.rpc.InvitationHostService.authenticate({
         authCode
       });
@@ -2352,8 +2584,8 @@ var InvitationsHandler = class {
           (0, import_log4.log)("retrying invalid code", {
             attempt
           }, {
-            F: __dxlog_file7,
-            L: 380,
+            F: __dxlog_file9,
+            L: 477,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2370,14 +2602,12 @@ var InvitationsHandler = class {
       throw new Error("challenge missing in the introduction");
     }
     (0, import_log4.log)("sending authentication request", void 0, {
-      F: __dxlog_file7,
-      L: 399,
+      F: __dxlog_file9,
+      L: 496,
       S: this,
       C: (f, a) => f(...a)
     });
-    setState({
-      state: import_services3.Invitation.State.AUTHENTICATING
-    });
+    setState(import_services3.Invitation.State.AUTHENTICATING);
     const signature = (0, import_crypto.sign)(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
     const response = await extension.rpc.InvitationHostService.authenticate({
       signedChallenge: signature
@@ -2423,8 +2653,8 @@ var InvitationsServiceImpl = class {
     return new import_codec_protobuf8.Stream(({ next, ctx }) => {
       this._invitationsManager.invitationCreated.on(ctx, (invitation) => {
         next({
-          action: import_services5.QueryInvitationsResponse.Action.ADDED,
-          type: import_services5.QueryInvitationsResponse.Type.CREATED,
+          action: import_services6.QueryInvitationsResponse.Action.ADDED,
+          type: import_services6.QueryInvitationsResponse.Type.CREATED,
           invitations: [
             invitation
           ]
@@ -2432,8 +2662,8 @@ var InvitationsServiceImpl = class {
       });
       this._invitationsManager.invitationAccepted.on(ctx, (invitation) => {
         next({
-          action: import_services5.QueryInvitationsResponse.Action.ADDED,
-          type: import_services5.QueryInvitationsResponse.Type.ACCEPTED,
+          action: import_services6.QueryInvitationsResponse.Action.ADDED,
+          type: import_services6.QueryInvitationsResponse.Type.ACCEPTED,
           invitations: [
             invitation
           ]
@@ -2441,8 +2671,8 @@ var InvitationsServiceImpl = class {
       });
       this._invitationsManager.removedCreated.on(ctx, (invitation) => {
         next({
-          action: import_services5.QueryInvitationsResponse.Action.REMOVED,
-          type: import_services5.QueryInvitationsResponse.Type.CREATED,
+          action: import_services6.QueryInvitationsResponse.Action.REMOVED,
+          type: import_services6.QueryInvitationsResponse.Type.CREATED,
           invitations: [
             invitation
           ]
@@ -2450,8 +2680,8 @@ var InvitationsServiceImpl = class {
       });
       this._invitationsManager.removedAccepted.on(ctx, (invitation) => {
         next({
-          action: import_services5.QueryInvitationsResponse.Action.REMOVED,
-          type: import_services5.QueryInvitationsResponse.Type.ACCEPTED,
+          action: import_services6.QueryInvitationsResponse.Action.REMOVED,
+          type: import_services6.QueryInvitationsResponse.Type.ACCEPTED,
           invitations: [
             invitation
           ]
@@ -2459,35 +2689,35 @@ var InvitationsServiceImpl = class {
       });
       this._invitationsManager.saved.on(ctx, (invitation) => {
         next({
-          action: import_services5.QueryInvitationsResponse.Action.SAVED,
-          type: import_services5.QueryInvitationsResponse.Type.CREATED,
+          action: import_services6.QueryInvitationsResponse.Action.SAVED,
+          type: import_services6.QueryInvitationsResponse.Type.CREATED,
           invitations: [
             invitation
           ]
         });
       });
       next({
-        action: import_services5.QueryInvitationsResponse.Action.ADDED,
-        type: import_services5.QueryInvitationsResponse.Type.CREATED,
+        action: import_services6.QueryInvitationsResponse.Action.ADDED,
+        type: import_services6.QueryInvitationsResponse.Type.CREATED,
         invitations: this._invitationsManager.getCreatedInvitations(),
         existing: true
       });
       next({
-        action: import_services5.QueryInvitationsResponse.Action.ADDED,
-        type: import_services5.QueryInvitationsResponse.Type.ACCEPTED,
+        action: import_services6.QueryInvitationsResponse.Action.ADDED,
+        type: import_services6.QueryInvitationsResponse.Type.ACCEPTED,
         invitations: this._invitationsManager.getAcceptedInvitations(),
         existing: true
       });
       this._invitationsManager.onPersistentInvitationsLoaded(ctx, () => {
         next({
-          action: import_services5.QueryInvitationsResponse.Action.LOAD_COMPLETE,
-          type: import_services5.QueryInvitationsResponse.Type.CREATED
+          action: import_services6.QueryInvitationsResponse.Action.LOAD_COMPLETE,
+          type: import_services6.QueryInvitationsResponse.Type.CREATED
         });
       });
     });
   }
 };
-var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
+var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -2503,33 +2733,33 @@ var SpaceInvitationProtocol = class {
   }
   getInvitationContext() {
     return {
-      kind: import_services6.Invitation.Kind.SPACE,
+      kind: import_services7.Invitation.Kind.SPACE,
       spaceKey: this._spaceKey
     };
   }
   async admit(invitation, request, guestProfile) {
-    (0, import_invariant7.invariant)(this._spaceKey, void 0, {
-      F: __dxlog_file8,
-      L: 55,
+    (0, import_invariant9.invariant)(this._spaceKey, void 0, {
+      F: __dxlog_file10,
+      L: 56,
       S: this,
       A: [
         "this._spaceKey",
         ""
       ]
     });
-    const space = await this._spaceManager.spaces.get(this._spaceKey);
-    (0, import_invariant7.invariant)(space, void 0, {
-      F: __dxlog_file8,
-      L: 57,
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    (0, import_invariant9.invariant)(space, void 0, {
+      F: __dxlog_file10,
+      L: 58,
       S: this,
       A: [
         "space",
         ""
       ]
     });
-    (0, import_invariant7.invariant)(request.space, void 0, {
-      F: __dxlog_file8,
-      L: 59,
+    (0, import_invariant9.invariant)(request.space, void 0, {
+      F: __dxlog_file10,
+      L: 60,
       S: this,
       A: [
         "request.space",
@@ -2537,19 +2767,19 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { identityKey, deviceKey } = request.space;
-    (0, import_log6.log)("writing guest credentials", {
+    (0, import_log8.log)("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
-      F: __dxlog_file8,
-      L: 62,
+      F: __dxlog_file10,
+      L: 63,
       S: this,
       C: (f, a) => f(...a)
     });
-    const credentials = await (0, import_credentials7.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile, invitation.delegationCredentialId);
-    (0, import_invariant7.invariant)(credentials[0].credential, void 0, {
-      F: __dxlog_file8,
-      L: 74,
+    const credentials = await (0, import_credentials7.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, invitation.role ?? import_credentials8.SpaceMember.Role.ADMIN, space.inner.spaceState.membershipChainHeads, guestProfile, invitation.delegationCredentialId);
+    (0, import_invariant9.invariant)(credentials[0].credential, void 0, {
+      F: __dxlog_file10,
+      L: 77,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2557,9 +2787,9 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const spaceMemberCredential = credentials[0].credential.credential;
-    (0, import_invariant7.invariant)((0, import_credentials7.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file8,
-      L: 76,
+    (0, import_invariant9.invariant)((0, import_credentials7.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file10,
+      L: 79,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2574,58 +2804,111 @@ var SpaceInvitationProtocol = class {
       }
     };
   }
-  async delegate(invitation) {
-    (0, import_invariant7.invariant)(this._spaceKey, void 0, {
-      F: __dxlog_file8,
-      L: 89,
+  async delegate(invitation) {
+    (0, import_invariant9.invariant)(this._spaceKey, void 0, {
+      F: __dxlog_file10,
+      L: 92,
+      S: this,
+      A: [
+        "this._spaceKey",
+        ""
+      ]
+    });
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    (0, import_invariant9.invariant)(space, void 0, {
+      F: __dxlog_file10,
+      L: 94,
+      S: this,
+      A: [
+        "space",
+        ""
+      ]
+    });
+    if (invitation.authMethod === import_services7.Invitation.AuthMethod.KNOWN_PUBLIC_KEY) {
+      (0, import_invariant9.invariant)(invitation.guestKeypair?.publicKey, void 0, {
+        F: __dxlog_file10,
+        L: 96,
+        S: this,
+        A: [
+          "invitation.guestKeypair?.publicKey",
+          ""
+        ]
+      });
+    }
+    (0, import_log8.log)("writing delegate space invitation", {
+      host: this._signingContext.deviceKey,
+      id: invitation.invitationId
+    }, {
+      F: __dxlog_file10,
+      L: 99,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const credential = await (0, import_credentials7.createDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, {
+      invitationId: invitation.invitationId,
+      authMethod: invitation.authMethod,
+      swarmKey: invitation.swarmKey,
+      role: invitation.role ?? import_credentials8.SpaceMember.Role.ADMIN,
+      expiresOn: invitation.lifetime ? new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime) : void 0,
+      multiUse: invitation.multiUse ?? false,
+      guestKey: invitation.authMethod === import_services7.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
+    });
+    (0, import_invariant9.invariant)(credential.credential, void 0, {
+      F: __dxlog_file10,
+      L: 119,
+      S: this,
+      A: [
+        "credential.credential",
+        ""
+      ]
+    });
+    await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, [
+      credential
+    ]);
+    return credential.credential.credential.id;
+  }
+  async cancelDelegation(invitation) {
+    (0, import_invariant9.invariant)(this._spaceKey, void 0, {
+      F: __dxlog_file10,
+      L: 125,
       S: this,
       A: [
         "this._spaceKey",
         ""
       ]
     });
-    const space = await this._spaceManager.spaces.get(this._spaceKey);
-    (0, import_invariant7.invariant)(space, void 0, {
-      F: __dxlog_file8,
-      L: 91,
+    (0, import_invariant9.invariant)(invitation.type === import_services7.Invitation.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
+      F: __dxlog_file10,
+      L: 126,
+      S: this,
+      A: [
+        "invitation.type === Invitation.Type.DELEGATED && invitation.delegationCredentialId",
+        ""
+      ]
+    });
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    (0, import_invariant9.invariant)(space, void 0, {
+      F: __dxlog_file10,
+      L: 128,
       S: this,
       A: [
         "space",
         ""
       ]
     });
-    if (invitation.authMethod === import_services6.Invitation.AuthMethod.KNOWN_PUBLIC_KEY) {
-      (0, import_invariant7.invariant)(invitation.guestKeypair?.publicKey, void 0, {
-        F: __dxlog_file8,
-        L: 93,
-        S: this,
-        A: [
-          "invitation.guestKeypair?.publicKey",
-          ""
-        ]
-      });
-    }
-    (0, import_log6.log)("writing delegate space invitation", {
+    (0, import_log8.log)("cancelling delegated space invitation", {
       host: this._signingContext.deviceKey,
       id: invitation.invitationId
     }, {
-      F: __dxlog_file8,
-      L: 96,
+      F: __dxlog_file10,
+      L: 130,
       S: this,
       C: (f, a) => f(...a)
     });
-    const credential = await (0, import_credentials7.createDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, {
-      invitationId: invitation.invitationId,
-      authMethod: invitation.authMethod,
-      swarmKey: invitation.swarmKey,
-      role: import_credentials8.SpaceMember.Role.ADMIN,
-      expiresOn: invitation.lifetime ? new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime) : void 0,
-      multiUse: invitation.multiUse ?? false,
-      guestKey: invitation.authMethod === import_services6.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
-    });
-    (0, import_invariant7.invariant)(credential.credential, void 0, {
-      F: __dxlog_file8,
-      L: 116,
+    const credential = await (0, import_credentials7.createCancelDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
+    (0, import_invariant9.invariant)(credential.credential, void 0, {
+      F: __dxlog_file10,
+      L: 137,
       S: this,
       A: [
         "credential.credential",
@@ -2635,11 +2918,10 @@ var SpaceInvitationProtocol = class {
     await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, [
       credential
     ]);
-    return credential.credential.credential.id;
   }
   checkInvitation(invitation) {
     if (invitation.spaceKey && this._spaceManager.spaces.has(invitation.spaceKey)) {
-      return new import_protocols6.AlreadyJoinedError("Already joined space.");
+      return new import_protocols7.AlreadyJoinedError("Already joined space.");
     }
   }
   createIntroduction() {
@@ -2660,9 +2942,9 @@ var SpaceInvitationProtocol = class {
     };
   }
   async accept(response) {
-    (0, import_invariant7.invariant)(response.space, void 0, {
-      F: __dxlog_file8,
-      L: 149,
+    (0, import_invariant9.invariant)(response.space, void 0, {
+      F: __dxlog_file10,
+      L: 169,
       S: this,
       A: [
         "response.space",
@@ -2671,18 +2953,18 @@ var SpaceInvitationProtocol = class {
     });
     const { credential, controlTimeframe, dataTimeframe } = response.space;
     const assertion = (0, import_credentials7.getCredentialAssertion)(credential);
-    (0, import_invariant7.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
-      F: __dxlog_file8,
-      L: 152,
+    (0, import_invariant9.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
+      F: __dxlog_file10,
+      L: 172,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
         "'Invalid credential'"
       ]
     });
-    (0, import_invariant7.invariant)(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
-      F: __dxlog_file8,
-      L: 153,
+    (0, import_invariant9.invariant)(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
+      F: __dxlog_file10,
+      L: 173,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -2690,7 +2972,7 @@ var SpaceInvitationProtocol = class {
       ]
     });
     if (this._spaceManager.spaces.has(assertion.spaceKey)) {
-      throw new import_protocols6.AlreadyJoinedError("Already joined space.");
+      throw new import_protocols7.AlreadyJoinedError("Already joined space.");
     }
     await this._spaceManager.acceptSpace({
       spaceKey: assertion.spaceKey,
@@ -2704,7 +2986,7 @@ var SpaceInvitationProtocol = class {
     };
   }
 };
-var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
+var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
 var InvitationsManager = class {
   constructor(_invitationsHandler, _getHandler, _metadataStore) {
     this._invitationsHandler = _invitationsHandler;
@@ -2712,12 +2994,12 @@ var InvitationsManager = class {
     this._metadataStore = _metadataStore;
     this._createInvitations = /* @__PURE__ */ new Map();
     this._acceptInvitations = /* @__PURE__ */ new Map();
-    this.invitationCreated = new import_async9.Event();
-    this.invitationAccepted = new import_async9.Event();
-    this.removedCreated = new import_async9.Event();
-    this.removedAccepted = new import_async9.Event();
-    this.saved = new import_async9.Event();
-    this._persistentInvitationsLoadedEvent = new import_async9.Event();
+    this.invitationCreated = new import_async10.Event();
+    this.invitationAccepted = new import_async10.Event();
+    this.removedCreated = new import_async10.Event();
+    this.removedAccepted = new import_async10.Event();
+    this.saved = new import_async10.Event();
+    this._persistentInvitationsLoadedEvent = new import_async10.Event();
     this._persistentInvitationsLoaded = false;
   }
   async createInvitation(options) {
@@ -2742,9 +3024,9 @@ var InvitationsManager = class {
     try {
       await this._persistIfRequired(handler, stream, invitation);
     } catch (err) {
-      import_log7.log.catch(err, void 0, {
-        F: __dxlog_file9,
-        L: 76,
+      import_log9.log.catch(err, void 0, {
+        F: __dxlog_file11,
+        L: 77,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2765,9 +3047,9 @@ var InvitationsManager = class {
       const persistentInvitations = this._metadataStore.getInvitations();
       const freshInvitations = persistentInvitations.filter((invitation) => !(0, import_echo_pipeline.hasInvitationExpired)(invitation));
       const loadTasks = freshInvitations.map((persistentInvitation) => {
-        (0, import_invariant8.invariant)(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
-          F: __dxlog_file9,
-          L: 97,
+        (0, import_invariant10.invariant)(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
+          F: __dxlog_file11,
+          L: 98,
           S: this,
           A: [
             "!this._createInvitations.get(persistentInvitation.invitationId)",
@@ -2784,9 +3066,9 @@ var InvitationsManager = class {
         invitations: cInvitations.map((invitation) => invitation.get())
       };
     } catch (err) {
-      import_log7.log.catch(err, void 0, {
-        F: __dxlog_file9,
-        L: 104,
+      import_log9.log.catch(err, void 0, {
+        F: __dxlog_file11,
+        L: 105,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2805,7 +3087,8 @@ var InvitationsManager = class {
       return existingInvitation;
     }
     const handler = this._getHandler(options);
-    const invitation = this._invitationsHandler.acceptInvitation(handler, options, request.deviceProfile);
+    const { ctx, invitation, stream, otpEnteredTrigger } = this._createObservableAcceptingInvitation(handler, options);
+    this._invitationsHandler.acceptInvitation(ctx, stream, handler, options, otpEnteredTrigger, request.deviceProfile);
     this._acceptInvitations.set(invitation.get().invitationId, invitation);
     this.invitationAccepted.emit(invitation.get());
     this._onInvitationComplete(invitation, () => {
@@ -2815,15 +3098,15 @@ var InvitationsManager = class {
     return invitation;
   }
   async authenticate({ invitationId, authCode }) {
-    (0, import_log7.log)("authenticating...", void 0, {
-      F: __dxlog_file9,
-      L: 133,
+    (0, import_log9.log)("authenticating...", void 0, {
+      F: __dxlog_file11,
+      L: 135,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_invariant8.invariant)(invitationId, void 0, {
-      F: __dxlog_file9,
-      L: 134,
+    (0, import_invariant10.invariant)(invitationId, void 0, {
+      F: __dxlog_file11,
+      L: 136,
       S: this,
       A: [
         "invitationId",
@@ -2832,11 +3115,11 @@ var InvitationsManager = class {
     });
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
-      import_log7.log.warn("invalid invitation", {
+      import_log9.log.warn("invalid invitation", {
         invitationId
       }, {
-        F: __dxlog_file9,
-        L: 137,
+        F: __dxlog_file11,
+        L: 139,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2845,17 +3128,17 @@ var InvitationsManager = class {
     }
   }
   async cancelInvitation({ invitationId }) {
-    (0, import_log7.log)("cancelInvitation...", {
+    (0, import_log9.log)("cancelInvitation...", {
       invitationId
     }, {
-      F: __dxlog_file9,
-      L: 144,
+      F: __dxlog_file11,
+      L: 146,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_invariant8.invariant)(invitationId, void 0, {
-      F: __dxlog_file9,
-      L: 145,
+    (0, import_invariant10.invariant)(invitationId, void 0, {
+      F: __dxlog_file11,
+      L: 147,
       S: this,
       A: [
         "invitationId",
@@ -2867,6 +3150,10 @@ var InvitationsManager = class {
       if (created.get().persistent) {
         await this._metadataStore.removeInvitation(invitationId);
       }
+      if (created.get().type === import_services8.Invitation.Type.DELEGATED) {
+        const handler = this._getHandler(created.get());
+        await handler.cancelDelegation(created.get());
+      }
       await created.cancel();
       this._createInvitations.delete(invitationId);
       this.removedCreated.emit(created.get());
@@ -2897,8 +3184,8 @@ var InvitationsManager = class {
     }
   }
   _createInvitation(protocol, options) {
-    const { invitationId = import_keys7.PublicKey.random().toHex(), type = import_services7.Invitation.Type.INTERACTIVE, authMethod = import_services7.Invitation.AuthMethod.SHARED_SECRET, state = import_services7.Invitation.State.INIT, timeout = import_client_protocol3.INVITATION_TIMEOUT, swarmKey = import_keys7.PublicKey.random(), persistent = options?.authMethod !== import_services7.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
-    const authCode = options?.authCode ?? (authMethod === import_services7.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials9.generatePasscode)(import_client_protocol3.AUTHENTICATION_CODE_LENGTH) : void 0);
+    const { invitationId = import_keys8.PublicKey.random().toHex(), type = import_services8.Invitation.Type.INTERACTIVE, authMethod = import_services8.Invitation.AuthMethod.SHARED_SECRET, state = import_services8.Invitation.State.INIT, timeout = import_client_protocol3.INVITATION_TIMEOUT, swarmKey = import_keys8.PublicKey.random(), persistent = options?.authMethod !== import_services8.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, role = import_credentials10.SpaceMember.Role.ADMIN, lifetime = 86400, multiUse = false } = options ?? {};
+    const authCode = options?.authCode ?? (authMethod === import_services8.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials9.generatePasscode)(import_client_protocol3.AUTHENTICATION_CODE_LENGTH) : void 0);
     return {
       invitationId,
       type,
@@ -2907,29 +3194,30 @@ var InvitationsManager = class {
       swarmKey,
       authCode,
       timeout,
-      persistent: persistent && type !== import_services7.Invitation.Type.DELEGATED,
-      guestKeypair: guestKeypair ?? (authMethod === import_services7.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
+      persistent: persistent && type !== import_services8.Invitation.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === import_services8.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
       created,
       lifetime,
+      role,
       multiUse,
       delegationCredentialId: options?.delegationCredentialId,
       ...protocol.getInvitationContext()
     };
   }
   _createObservableInvitation(handler, invitation) {
-    const stream = new import_async9.PushStream();
-    const ctx = new import_context6.Context({
+    const stream = new import_async10.PushStream();
+    const ctx = new import_context8.Context({
       onError: (err) => {
         stream.error(err);
         void ctx.dispose();
       }
     });
     ctx.onDispose(() => {
-      (0, import_log7.log)("complete", {
+      (0, import_log9.log)("complete", {
         ...handler.toJSON()
       }, {
-        F: __dxlog_file9,
-        L: 228,
+        F: __dxlog_file11,
+        L: 236,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2941,7 +3229,7 @@ var InvitationsManager = class {
       onCancel: async () => {
         stream.next({
           ...invitation,
-          state: import_services7.Invitation.State.CANCELLED
+          state: import_services8.Invitation.State.CANCELLED
         });
         await ctx.dispose();
       }
@@ -2952,8 +3240,73 @@ var InvitationsManager = class {
       observableInvitation
     };
   }
+  _createObservableAcceptingInvitation(handler, initialState) {
+    const otpEnteredTrigger = new import_async10.Trigger();
+    const stream = new import_async10.PushStream();
+    const ctx = new import_context8.Context({
+      onError: (err) => {
+        if (err instanceof import_async10.TimeoutError) {
+          (0, import_log9.log)("timeout", {
+            ...handler.toJSON()
+          }, {
+            F: __dxlog_file11,
+            L: 256,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          stream.next({
+            ...initialState,
+            state: import_services8.Invitation.State.TIMEOUT
+          });
+        } else {
+          import_log9.log.warn("auth failed", err, {
+            F: __dxlog_file11,
+            L: 259,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          stream.next({
+            ...initialState,
+            state: import_services8.Invitation.State.ERROR
+          });
+        }
+        void ctx.dispose();
+      }
+    });
+    ctx.onDispose(() => {
+      (0, import_log9.log)("complete", {
+        ...handler.toJSON()
+      }, {
+        F: __dxlog_file11,
+        L: 266,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      stream.complete();
+    });
+    const invitation = new import_client_protocol3.AuthenticatingInvitation({
+      initialInvitation: initialState,
+      subscriber: stream.observable,
+      onCancel: async () => {
+        stream.next({
+          ...initialState,
+          state: import_services8.Invitation.State.CANCELLED
+        });
+        await ctx.dispose();
+      },
+      onAuthenticate: async (code) => {
+        otpEnteredTrigger.wake(code);
+      }
+    });
+    return {
+      ctx,
+      invitation,
+      stream,
+      otpEnteredTrigger
+    };
+  }
   async _persistIfRequired(handler, changeStream, invitation) {
-    if (invitation.type === import_services7.Invitation.Type.DELEGATED && invitation.delegationCredentialId == null) {
+    if (invitation.type === import_services8.Invitation.Type.DELEGATED && invitation.delegationCredentialId == null) {
       const delegationCredentialId = await handler.delegate(invitation);
       changeStream.next({
         ...invitation,
@@ -2968,9 +3321,9 @@ var InvitationsManager = class {
     try {
       await this._metadataStore.removeInvitation(invitation.invitationId);
     } catch (err) {
-      import_log7.log.catch(err, void 0, {
-        F: __dxlog_file9,
-        L: 260,
+      import_log9.log.catch(err, void 0, {
+        F: __dxlog_file11,
+        L: 302,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3062,11 +3415,11 @@ var AutomergeSpaceState = class {
     this._onNewRoot = _onNewRoot;
     this.rootUrl = void 0;
     this.lastEpoch = void 0;
-    this.onNewEpoch = new import_async11.Event();
+    this.onNewEpoch = new import_async12.Event();
     this._isProcessingRootDocs = false;
   }
   async processCredential(credential) {
-    if (!(0, import_credentials11.checkCredentialType)(credential, "dxos.halo.credentials.Epoch")) {
+    if (!(0, import_credentials13.checkCredentialType)(credential, "dxos.halo.credentials.Epoch")) {
       return;
     }
     this.lastEpoch = credential;
@@ -3091,18 +3444,18 @@ var AutomergeSpaceState = class {
     await this.onNewEpoch.waitForCondition(() => !!this.lastEpoch);
   }
 };
-var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
+var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
 var WRITER_NOT_SET_ERROR_CODE = "WRITER_NOT_SET";
 var NotarizationPlugin = class {
   constructor() {
-    this._ctx = new import_context8.Context();
-    this._extensionOpened = new import_async12.Event();
+    this._ctx = new import_context10.Context();
+    this._extensionOpened = new import_async13.Event();
     this._extensions = /* @__PURE__ */ new Set();
-    this._processedCredentials = new import_util5.ComplexSet(import_keys9.PublicKey.hash);
-    this._processCredentialsTriggers = new import_util5.ComplexMap(import_keys9.PublicKey.hash);
+    this._processedCredentials = new import_util7.ComplexSet(import_keys10.PublicKey.hash);
+    this._processCredentialsTriggers = new import_util7.ComplexMap(import_keys10.PublicKey.hash);
   }
   get hasWriter() {
     return !!this._writer;
@@ -3116,16 +3469,16 @@ var NotarizationPlugin = class {
   * Request credentials to be notarized.
   */
   async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
-    (0, import_log9.log)("notarize", {
+    (0, import_log11.log)("notarize", {
       credentials
     }, {
-      F: __dxlog_file10,
+      F: __dxlog_file12,
       L: 90,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_invariant10.invariant)(credentials.every((credential) => credential.id), "Credentials must have an id", {
-      F: __dxlog_file10,
+    (0, import_invariant12.invariant)(credentials.every((credential) => credential.id), "Credentials must have an id", {
+      F: __dxlog_file12,
       L: 91,
       S: this,
       A: [
@@ -3133,13 +3486,13 @@ var NotarizationPlugin = class {
         "'Credentials must have an id'"
       ]
     });
-    const errors = new import_async12.Trigger();
+    const errors = new import_async13.Trigger();
     const ctx = this._ctx.derive({
       onError: (err) => {
-        import_log9.log.warn("Notarization error", {
+        import_log11.log.warn("Notarization error", {
           err
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 99,
           S: this,
           C: (f, a) => f(...a)
@@ -3150,23 +3503,23 @@ var NotarizationPlugin = class {
     });
     opCtx?.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
-      (0, import_async12.scheduleTask)(ctx, () => {
-        import_log9.log.warn("Notarization timeout", {
+      (0, import_async13.scheduleTask)(ctx, () => {
+        import_log11.log.warn("Notarization timeout", {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 111,
           S: this,
           C: (f, a) => f(...a)
         });
         void ctx.dispose();
-        errors.throw(new import_async12.TimeoutError(timeout, "Notarization timed out"));
+        errors.throw(new import_async13.TimeoutError(timeout, "Notarization timed out"));
       }, timeout);
     }
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
     const peersTried = /* @__PURE__ */ new Set();
-    const notarizeTask = new import_async12.DeferredTask(ctx, async () => {
+    const notarizeTask = new import_async13.DeferredTask(ctx, async () => {
       try {
         if (this._extensions.size === 0) {
           return;
@@ -3175,24 +3528,24 @@ var NotarizationPlugin = class {
           ...this._extensions
         ].find((peer2) => !peersTried.has(peer2));
         if (!peer) {
-          import_log9.log.info("Exhausted all peers to notarize with", {
+          import_log11.log.info("Exhausted all peers to notarize with", {
             retryIn: retryTimeout
           }, {
-            F: __dxlog_file10,
+            F: __dxlog_file12,
             L: 136,
             S: this,
             C: (f, a) => f(...a)
           });
           peersTried.clear();
-          (0, import_async12.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
+          (0, import_async13.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
           return;
         }
         peersTried.add(peer);
-        (0, import_log9.log)("try notarizing", {
+        (0, import_log11.log)("try notarizing", {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 143,
           S: this,
           C: (f, a) => f(...a)
@@ -3200,17 +3553,17 @@ var NotarizationPlugin = class {
         await peer.rpc.NotarizationService.notarize({
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
-        (0, import_log9.log)("success", void 0, {
-          F: __dxlog_file10,
+        (0, import_log11.log)("success", void 0, {
+          F: __dxlog_file12,
           L: 147,
           S: this,
           C: (f, a) => f(...a)
         });
-        await (0, import_async12.sleep)(successDelay);
+        await (0, import_async13.sleep)(successDelay);
       } catch (err) {
         if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
-          import_log9.log.info("error notarizing (recoverable)", err, {
-            F: __dxlog_file10,
+          import_log11.log.info("error notarizing (recoverable)", err, {
+            F: __dxlog_file12,
             L: 151,
             S: this,
             C: (f, a) => f(...a)
@@ -3223,12 +3576,12 @@ var NotarizationPlugin = class {
     this._extensionOpened.on(ctx, () => notarizeTask.schedule());
     try {
       await Promise.race([
-        (0, import_context8.rejectOnDispose)(ctx),
+        (0, import_context10.rejectOnDispose)(ctx),
         allNotarized,
         errors.wait()
       ]);
-      (0, import_log9.log)("done", void 0, {
-        F: __dxlog_file10,
+      (0, import_log11.log)("done", void 0, {
+        F: __dxlog_file12,
         L: 162,
         S: this,
         C: (f, a) => f(...a)
@@ -3249,8 +3602,8 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    (0, import_invariant10.invariant)(!this._writer, "Writer already set.", {
-      F: __dxlog_file10,
+    (0, import_invariant12.invariant)(!this._writer, "Writer already set.", {
+      F: __dxlog_file12,
       L: 181,
       S: this,
       A: [
@@ -3264,7 +3617,7 @@ var NotarizationPlugin = class {
     if (this._processedCredentials.has(id)) {
       return;
     }
-    await (0, import_util5.entry)(this._processCredentialsTriggers, id).orInsert(new import_async12.Trigger()).value.wait();
+    await (0, import_util7.entry)(this._processCredentialsTriggers, id).orInsert(new import_async13.Trigger()).value.wait();
   }
   /**
   * Requests from other peers to notarize credentials.
@@ -3274,8 +3627,8 @@ var NotarizationPlugin = class {
       throw new Error(WRITER_NOT_SET_ERROR_CODE);
     }
     for (const credential of request.credentials ?? []) {
-      (0, import_invariant10.invariant)(credential.id, "Credential must have an id", {
-        F: __dxlog_file10,
+      (0, import_invariant12.invariant)(credential.id, "Credential must have an id", {
+        F: __dxlog_file12,
         L: 200,
         S: this,
         A: [
@@ -3292,10 +3645,10 @@ var NotarizationPlugin = class {
   createExtension() {
     const extension = new NotarizationTeleportExtension({
       onOpen: async () => {
-        (0, import_log9.log)("extension opened", {
+        (0, import_log11.log)("extension opened", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 211,
           S: this,
           C: (f, a) => f(...a)
@@ -3304,10 +3657,10 @@ var NotarizationPlugin = class {
         this._extensionOpened.emit();
       },
       onClose: async () => {
-        (0, import_log9.log)("extension closed", {
+        (0, import_log11.log)("extension closed", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 216,
           S: this,
           C: (f, a) => f(...a)
@@ -3319,14 +3672,14 @@ var NotarizationPlugin = class {
     return extension;
   }
 };
-var NotarizationTeleportExtension = class extends import_teleport2.RpcExtension {
+var NotarizationTeleportExtension = class extends import_teleport3.RpcExtension {
   constructor(_params) {
     super({
       requested: {
-        NotarizationService: import_protocols8.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: import_protocols9.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
       },
       exposed: {
-        NotarizationService: import_protocols8.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: import_protocols9.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
       }
     });
     this._params = _params;
@@ -3359,16 +3712,16 @@ function _ts_decorate4(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
+var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
 var DataSpace = class {
   constructor(params) {
-    this._ctx = new import_context7.Context();
+    this._ctx = new import_context9.Context();
     this._notarizationPlugin = new NotarizationPlugin();
     this._cache = void 0;
     this._automergeSpaceState = new AutomergeSpaceState((rootUrl) => this._onNewAutomergeRoot(rootUrl));
-    this._state = import_services8.SpaceState.CLOSED;
+    this._state = import_services9.SpaceState.CLOSED;
     this.error = void 0;
-    this.stateUpdate = new import_async10.Event();
+    this.stateUpdate = new import_async11.Event();
     this.metrics = {};
     this._inner = params.inner;
     this._inner.stateUpdate.on(this._ctx, () => this.stateUpdate.emit());
@@ -3381,17 +3734,17 @@ var DataSpace = class {
     this._callbacks = params.callbacks ?? {};
     this._echoHost = params.echoHost;
     this.authVerifier = new TrustedKeySetAuthVerifier({
-      trustedKeysProvider: () => new import_util4.ComplexSet(import_keys8.PublicKey.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => !member.removed).map((member) => member.key)),
+      trustedKeysProvider: () => new import_util6.ComplexSet(import_keys9.PublicKey.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => member.role !== import_credentials11.SpaceMember.Role.REMOVED).map((member) => member.key)),
       update: this._inner.stateUpdate,
       authTimeout: import_client_protocol4.AUTH_TIMEOUT
     });
     this._cache = params.cache;
     this._state = params.initialState;
-    (0, import_log8.log)("new state", {
-      state: import_services8.SpaceState[this._state]
+    (0, import_log10.log)("new state", {
+      state: import_services9.SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 135,
+      F: __dxlog_file13,
+      L: 137,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3435,13 +3788,13 @@ var DataSpace = class {
     await this._notarizationPlugin.open();
     await this._inner.spaceState.addCredentialProcessor(this._notarizationPlugin);
     await this._inner.spaceState.addCredentialProcessor(this._automergeSpaceState);
-    await this._inner.open(new import_context7.Context());
-    this._state = import_services8.SpaceState.CONTROL_ONLY;
-    (0, import_log8.log)("new state", {
-      state: import_services8.SpaceState[this._state]
+    await this._inner.open(new import_context9.Context());
+    this._state = import_services9.SpaceState.CONTROL_ONLY;
+    (0, import_log10.log)("new state", {
+      state: import_services9.SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 193,
+      F: __dxlog_file13,
+      L: 195,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3454,17 +3807,17 @@ var DataSpace = class {
   }
   async _close() {
     await this._callbacks.beforeClose?.();
-    this._state = import_services8.SpaceState.CLOSED;
-    (0, import_log8.log)("new state", {
-      state: import_services8.SpaceState[this._state]
+    this._state = import_services9.SpaceState.CLOSED;
+    (0, import_log10.log)("new state", {
+      state: import_services9.SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 207,
+      F: __dxlog_file13,
+      L: 209,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._ctx.dispose();
-    this._ctx = new import_context7.Context();
+    this._ctx = new import_context9.Context();
     await this.authVerifier.close();
     await this._inner.close();
     await this._inner.spaceState.removeCredentialProcessor(this._automergeSpaceState);
@@ -3483,32 +3836,32 @@ var DataSpace = class {
   * Initialize the data pipeline in a separate task.
   */
   initializeDataPipelineAsync() {
-    (0, import_async10.scheduleTask)(this._ctx, async () => {
+    (0, import_async11.scheduleTask)(this._ctx, async () => {
       try {
         this.metrics.pipelineInitBegin = /* @__PURE__ */ new Date();
         await this.initializeDataPipeline();
       } catch (err) {
-        if (err instanceof import_protocols7.CancelledError || err instanceof import_context7.ContextDisposedError) {
-          (0, import_log8.log)("data pipeline initialization cancelled", err, {
-            F: __dxlog_file11,
-            L: 240,
+        if (err instanceof import_protocols8.CancelledError || err instanceof import_context9.ContextDisposedError) {
+          (0, import_log10.log)("data pipeline initialization cancelled", err, {
+            F: __dxlog_file13,
+            L: 242,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
-        import_log8.log.error("Error initializing data pipeline", err, {
-          F: __dxlog_file11,
-          L: 244,
+        import_log10.log.error("Error initializing data pipeline", err, {
+          F: __dxlog_file13,
+          L: 246,
           S: this,
           C: (f, a) => f(...a)
         });
-        this._state = import_services8.SpaceState.ERROR;
-        (0, import_log8.log)("new state", {
-          state: import_services8.SpaceState[this._state]
+        this._state = import_services9.SpaceState.ERROR;
+        (0, import_log10.log)("new state", {
+          state: import_services9.SpaceState[this._state]
         }, {
-          F: __dxlog_file11,
-          L: 246,
+          F: __dxlog_file13,
+          L: 248,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3520,35 +3873,35 @@ var DataSpace = class {
     });
   }
   async initializeDataPipeline() {
-    if (this._state !== import_services8.SpaceState.CONTROL_ONLY) {
-      throw new import_protocols7.SystemError("Invalid operation");
+    if (this._state !== import_services9.SpaceState.CONTROL_ONLY) {
+      throw new import_protocols8.SystemError("Invalid operation");
     }
-    this._state = import_services8.SpaceState.INITIALIZING;
-    (0, import_log8.log)("new state", {
-      state: import_services8.SpaceState[this._state]
+    this._state = import_services9.SpaceState.INITIALIZING;
+    (0, import_log10.log)("new state", {
+      state: import_services9.SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 262,
+      F: __dxlog_file13,
+      L: 264,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._initializeAndReadControlPipeline();
-    await (0, import_async10.sleep)(1);
+    await (0, import_async11.sleep)(1);
     this._automergeSpaceState.startProcessingRootDocs();
-    await (0, import_context7.cancelWithContext)(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
-    (0, import_log8.log)("data pipeline ready", void 0, {
-      F: __dxlog_file11,
-      L: 274,
+    await (0, import_context9.cancelWithContext)(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
+    (0, import_log10.log)("data pipeline ready", void 0, {
+      F: __dxlog_file13,
+      L: 276,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._callbacks.beforeReady?.();
-    this._state = import_services8.SpaceState.READY;
-    (0, import_log8.log)("new state", {
-      state: import_services8.SpaceState[this._state]
+    this._state = import_services9.SpaceState.READY;
+    (0, import_log10.log)("new state", {
+      state: import_services9.SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 278,
+      F: __dxlog_file13,
+      L: 280,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3562,9 +3915,9 @@ var DataSpace = class {
     });
     this.metrics.controlPipelineReady = /* @__PURE__ */ new Date();
     await this._createWritableFeeds();
-    (0, import_log8.log)("writable feeds created", void 0, {
-      F: __dxlog_file11,
-      L: 294,
+    (0, import_log10.log)("writable feeds created", void 0, {
+      F: __dxlog_file13,
+      L: 296,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3591,7 +3944,7 @@ var DataSpace = class {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials10.AdmittedFeed.Designation.CONTROL
+          designation: import_credentials12.AdmittedFeed.Designation.CONTROL
         }
       }));
     }
@@ -3608,7 +3961,7 @@ var DataSpace = class {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials10.AdmittedFeed.Designation.DATA
+          designation: import_credentials12.AdmittedFeed.Designation.DATA
         }
       }));
     }
@@ -3622,12 +3975,12 @@ var DataSpace = class {
     }
   }
   _onNewAutomergeRoot(rootUrl) {
-    (0, import_log8.log)("loading automerge root doc for space", {
+    (0, import_log10.log)("loading automerge root doc for space", {
       space: this.key,
       rootUrl
     }, {
-      F: __dxlog_file11,
-      L: 360,
+      F: __dxlog_file13,
+      L: 362,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3636,12 +3989,12 @@ var DataSpace = class {
     queueMicrotask(async () => {
       try {
         await (0, import_debug3.warnAfterTimeout)(5e3, "Automerge root doc load timeout (DataSpace)", async () => {
-          await (0, import_context7.cancelWithContext)(this._ctx, handle.whenReady());
+          await (0, import_context9.cancelWithContext)(this._ctx, handle.whenReady());
         });
         if (this._ctx.disposed) {
           return;
         }
-        const doc = handle.docSync() ?? (0, import_invariant9.failedInvariant)();
+        const doc = handle.docSync() ?? (0, import_invariant11.failedInvariant)();
         if (!doc.access?.spaceKey) {
           handle.change((doc2) => {
             doc2.access = {
@@ -3650,16 +4003,16 @@ var DataSpace = class {
           });
         }
       } catch (err) {
-        if (err instanceof import_context7.ContextDisposedError) {
+        if (err instanceof import_context9.ContextDisposedError) {
           return;
         }
-        import_log8.log.warn("error loading automerge root doc", {
+        import_log10.log.warn("error loading automerge root doc", {
           space: this.key,
           rootUrl,
           err
         }, {
-          F: __dxlog_file11,
-          L: 383,
+          F: __dxlog_file13,
+          L: 385,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3685,7 +4038,7 @@ var DataSpace = class {
     let epoch;
     switch (options?.migration) {
       case void 0:
-      case import_services8.CreateEpochRequest.Migration.NONE:
+      case import_services9.CreateEpochRequest.Migration.NONE:
         {
           epoch = {
             previousId: this._automergeSpaceState.lastEpoch?.id,
@@ -3695,7 +4048,7 @@ var DataSpace = class {
           };
         }
         break;
-      case import_services8.CreateEpochRequest.Migration.INIT_AUTOMERGE:
+      case import_services9.CreateEpochRequest.Migration.INIT_AUTOMERGE:
         {
           const document = this._echoHost.automergeRepo.create();
           epoch = {
@@ -3706,15 +4059,15 @@ var DataSpace = class {
           };
         }
         break;
-      case import_services8.CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY:
+      case import_services9.CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY:
         {
           const currentRootUrl = this._automergeSpaceState.rootUrl;
           const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
-          await (0, import_context7.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
+          await (0, import_context9.cancelWithContext)(this._ctx, (0, import_async11.asyncTimeout)(rootHandle.whenReady(), 1e4));
           const newRoot = this._echoHost.automergeRepo.create(rootHandle.docSync());
-          (0, import_invariant9.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
-            F: __dxlog_file11,
-            L: 433,
+          (0, import_invariant11.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
+            F: __dxlog_file13,
+            L: 435,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -3729,23 +4082,23 @@ var DataSpace = class {
           };
         }
         break;
-      case import_services8.CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT:
+      case import_services9.CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT:
         {
-          import_log8.log.info("Fragmenting", void 0, {
-            F: __dxlog_file11,
-            L: 445,
+          import_log10.log.info("Fragmenting", void 0, {
+            F: __dxlog_file13,
+            L: 447,
             S: this,
             C: (f, a) => f(...a)
           });
           const currentRootUrl = this._automergeSpaceState.rootUrl;
           const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
-          await (0, import_context7.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
+          await (0, import_context9.cancelWithContext)(this._ctx, (0, import_async11.asyncTimeout)(rootHandle.whenReady(), 1e4));
           const objects = Object.entries(rootHandle.docSync().objects);
           const properties = objects.find(([_, value]) => value.system.type?.itemId === import_echo_schema.TYPE_PROPERTIES);
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
-          (0, import_invariant9.invariant)(properties, "Properties not found", {
-            F: __dxlog_file11,
-            L: 455,
+          (0, import_invariant11.invariant)(properties, "Properties not found", {
+            F: __dxlog_file13,
+            L: 457,
             S: this,
             A: [
               "properties",
@@ -3759,9 +4112,9 @@ var DataSpace = class {
             ])
           };
           const newRoot = this._echoHost.automergeRepo.create(newSpaceDoc);
-          (0, import_invariant9.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
-            F: __dxlog_file11,
-            L: 460,
+          (0, import_invariant11.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
+            F: __dxlog_file13,
+            L: 462,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -3775,7 +4128,7 @@ var DataSpace = class {
           otherObjects.forEach(([key, value]) => {
             const handle = docLoader.createDocumentForObject(key);
             handle.change((doc) => {
-              (0, import_util4.assignDeep)(doc, [
+              (0, import_util6.assignDeep)(doc, [
                 "objects",
                 key
               ], value);
@@ -3812,25 +4165,25 @@ var DataSpace = class {
     ]));
   }
   async activate() {
-    if (this._state !== import_services8.SpaceState.INACTIVE) {
+    if (this._state !== import_services9.SpaceState.INACTIVE) {
       return;
     }
-    await this._metadataStore.setSpaceState(this.key, import_services8.SpaceState.ACTIVE);
+    await this._metadataStore.setSpaceState(this.key, import_services9.SpaceState.ACTIVE);
     await this._open();
     this.initializeDataPipelineAsync();
   }
   async deactivate() {
-    if (this._state === import_services8.SpaceState.INACTIVE) {
+    if (this._state === import_services9.SpaceState.INACTIVE) {
       return;
     }
-    await this._metadataStore.setSpaceState(this.key, import_services8.SpaceState.INACTIVE);
+    await this._metadataStore.setSpaceState(this.key, import_services9.SpaceState.INACTIVE);
     await this._close();
-    this._state = import_services8.SpaceState.INACTIVE;
-    (0, import_log8.log)("new state", {
-      state: import_services8.SpaceState[this._state]
+    this._state = import_services9.SpaceState.INACTIVE;
+    (0, import_log10.log)("new state", {
+      state: import_services9.SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 526,
+      F: __dxlog_file13,
+      L: 528,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3845,7 +4198,7 @@ _ts_decorate4([
 ], DataSpace.prototype, "key", null);
 _ts_decorate4([
   import_tracing4.trace.info({
-    enum: import_services8.SpaceState
+    enum: import_services9.SpaceState
   })
 ], DataSpace.prototype, "state", null);
 _ts_decorate4([
@@ -3854,10 +4207,10 @@ _ts_decorate4([
   })
 ], DataSpace.prototype, "_automergeInfo", null);
 _ts_decorate4([
-  import_async10.synchronized
+  import_async11.synchronized
 ], DataSpace.prototype, "open", null);
 _ts_decorate4([
-  import_async10.synchronized
+  import_async11.synchronized
 ], DataSpace.prototype, "close", null);
 _ts_decorate4([
   import_tracing4.trace.span({
@@ -3873,18 +4226,18 @@ _ts_decorate4([
   (0, import_debug3.timed)(1e4)
 ], DataSpace.prototype, "_createWritableFeeds", null);
 _ts_decorate4([
-  import_async10.synchronized
+  import_async11.synchronized
 ], DataSpace.prototype, "activate", null);
 _ts_decorate4([
-  import_async10.synchronized
+  import_async11.synchronized
 ], DataSpace.prototype, "deactivate", null);
 DataSpace = _ts_decorate4([
-  (0, import_async10.trackLeaks)("open", "close"),
+  (0, import_async11.trackLeaks)("open", "close"),
   import_tracing4.trace.resource()
 ], DataSpace);
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
-    await (0, import_credentials13.createCredential)({
+    await (0, import_credentials15.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: space.key,
@@ -3893,14 +4246,14 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key
       }
     }),
-    await (0, import_credentials13.createCredential)({
+    await (0, import_credentials15.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: signingContext.identityKey,
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey: space.key,
-        role: import_credentials14.SpaceMember.Role.ADMIN,
+        role: import_credentials16.SpaceMember.Role.OWNER,
         profile: signingContext.getProfile(),
         genesisFeedKey: space.controlFeedKey ?? (0, import_debug4.failUndefined)()
       }
@@ -3912,7 +4265,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials14.AdmittedFeed.Designation.CONTROL
+        designation: import_credentials16.AdmittedFeed.Designation.CONTROL
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -3922,7 +4275,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials14.AdmittedFeed.Designation.DATA
+        designation: import_credentials16.AdmittedFeed.Designation.DATA
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -3956,7 +4309,7 @@ function _ts_decorate5(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
+var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
 var PRESENCE_ANNOUNCE_INTERVAL = 1e4;
 var PRESENCE_OFFLINE_TIMEOUT = 2e4;
 var DataSpaceManager = class {
@@ -3968,11 +4321,11 @@ var DataSpaceManager = class {
     this._feedStore = _feedStore;
     this._echoHost = _echoHost;
     this._invitationsManager = _invitationsManager;
-    this._ctx = new import_context9.Context();
-    this.updated = new import_async13.Event();
-    this._spaces = new import_util6.ComplexMap(import_keys10.PublicKey.hash);
+    this._ctx = new import_context11.Context();
+    this.updated = new import_async14.Event();
+    this._spaces = new import_util8.ComplexMap(import_keys11.PublicKey.hash);
     this._isOpen = false;
-    this._instanceId = import_keys10.PublicKey.random().toHex();
+    this._instanceId = import_keys11.PublicKey.random().toHex();
     const { spaceMemberPresenceAnnounceInterval = PRESENCE_ANNOUNCE_INTERVAL, spaceMemberPresenceOfflineTimeout = PRESENCE_OFFLINE_TIMEOUT } = params ?? {};
     this._spaceMemberPresenceAnnounceInterval = spaceMemberPresenceAnnounceInterval;
     this._spaceMemberPresenceOfflineTimeout = spaceMemberPresenceOfflineTimeout;
@@ -3982,45 +4335,45 @@ var DataSpaceManager = class {
     return this._spaces;
   }
   async open() {
-    (0, import_log10.log)("open", void 0, {
-      F: __dxlog_file12,
+    (0, import_log12.log)("open", void 0, {
+      F: __dxlog_file14,
       L: 102,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log10.log.trace("dxos.echo.data-space-manager.open", import_protocols9.trace.begin({
+    import_log12.log.trace("dxos.echo.data-space-manager.open", import_protocols10.trace.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file12,
+      F: __dxlog_file14,
       L: 103,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_log10.log)("metadata loaded", {
+    (0, import_log12.log)("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file14,
       L: 104,
       S: this,
       C: (f, a) => f(...a)
     });
-    await (0, import_util6.forEachAsync)(this._metadataStore.spaces, async (spaceMetadata) => {
+    await (0, import_util8.forEachAsync)(this._metadataStore.spaces, async (spaceMetadata) => {
       try {
-        (0, import_log10.log)("load space", {
+        (0, import_log12.log)("load space", {
           spaceMetadata
         }, {
-          F: __dxlog_file12,
+          F: __dxlog_file14,
           L: 108,
           S: this,
           C: (f, a) => f(...a)
         });
         await this._constructSpace(spaceMetadata);
       } catch (err) {
-        import_log10.log.error("Error loading space", {
+        import_log12.log.error("Error loading space", {
           spaceMetadata,
           err
         }, {
-          F: __dxlog_file12,
+          F: __dxlog_file14,
           L: 111,
           S: this,
           C: (f, a) => f(...a)
@@ -4030,22 +4383,22 @@ var DataSpaceManager = class {
     this._isOpen = true;
     this.updated.emit();
     for (const space of this._spaces.values()) {
-      if (space.state !== import_services9.SpaceState.INACTIVE) {
+      if (space.state !== import_services10.SpaceState.INACTIVE) {
         space.initializeDataPipelineAsync();
       }
     }
-    import_log10.log.trace("dxos.echo.data-space-manager.open", import_protocols9.trace.end({
+    import_log12.log.trace("dxos.echo.data-space-manager.open", import_protocols10.trace.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file12,
+      F: __dxlog_file14,
       L: 124,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async close() {
-    (0, import_log10.log)("close", void 0, {
-      F: __dxlog_file12,
+    (0, import_log12.log)("close", void 0, {
+      F: __dxlog_file14,
       L: 129,
       S: this,
       C: (f, a) => f(...a)
@@ -4060,8 +4413,8 @@ var DataSpaceManager = class {
   * Creates a new space writing the genesis credentials to the control feed.
   */
   async createSpace() {
-    (0, import_invariant11.invariant)(this._isOpen, "Not open.", {
-      F: __dxlog_file12,
+    (0, import_invariant13.invariant)(this._isOpen, "Not open.", {
+      F: __dxlog_file14,
       L: 142,
       S: this,
       A: [
@@ -4077,12 +4430,12 @@ var DataSpaceManager = class {
       genesisFeedKey: controlFeedKey,
       controlFeedKey,
       dataFeedKey,
-      state: import_services9.SpaceState.ACTIVE
+      state: import_services10.SpaceState.ACTIVE
     };
-    (0, import_log10.log)("creating space...", {
+    (0, import_log12.log)("creating space...", {
       spaceKey
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file14,
       L: 154,
       S: this,
       C: (f, a) => f(...a)
@@ -4092,8 +4445,8 @@ var DataSpaceManager = class {
     const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRootUrl);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    (0, import_invariant11.invariant)((0, import_credentials12.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file12,
+    (0, import_invariant13.invariant)((0, import_credentials14.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file14,
       L: 163,
       S: this,
       A: [
@@ -4108,16 +4461,16 @@ var DataSpaceManager = class {
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
-    (0, import_log10.log)("accept space", {
+    (0, import_log12.log)("accept space", {
       opts
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file14,
       L: 175,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_invariant11.invariant)(this._isOpen, "Not open.", {
-      F: __dxlog_file12,
+    (0, import_invariant13.invariant)(this._isOpen, "Not open.", {
+      F: __dxlog_file14,
       L: 176,
       S: this,
       A: [
@@ -4125,8 +4478,8 @@ var DataSpaceManager = class {
         "'Not open.'"
       ]
     });
-    (0, import_invariant11.invariant)(!this._spaces.has(opts.spaceKey), "Space already exists.", {
-      F: __dxlog_file12,
+    (0, import_invariant13.invariant)(!this._spaces.has(opts.spaceKey), "Space already exists.", {
+      F: __dxlog_file14,
       L: 177,
       S: this,
       A: [
@@ -4152,16 +4505,16 @@ var DataSpaceManager = class {
   * TODO(dmaretskyi): Consider removing.
   */
   async waitUntilSpaceReady(spaceKey) {
-    await (0, import_context9.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
+    await (0, import_context11.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
-      return !!space && space.state === import_services9.SpaceState.READY;
+      return !!space && space.state === import_services10.SpaceState.READY;
     }));
   }
   async _constructSpace(metadata) {
-    (0, import_log10.log)("construct space", {
+    (0, import_log12.log)("construct space", {
       metadata
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file14,
       L: 210,
       S: this,
       C: (f, a) => f(...a)
@@ -4187,7 +4540,7 @@ var DataSpaceManager = class {
       swarmIdentity: {
         peerKey: this._signingContext.deviceKey,
         credentialProvider: createAuthProvider(this._signingContext.credentialSigner),
-        credentialAuthenticator: (0, import_util6.deferFunction)(() => dataSpace.authVerifier.verifier)
+        credentialAuthenticator: (0, import_util8.deferFunction)(() => dataSpace.authVerifier.verifier)
       },
       onAuthorizedConnection: (session) => {
         session.addExtension("dxos.mesh.teleport.gossip", gossip.createExtension({
@@ -4198,8 +4551,8 @@ var DataSpaceManager = class {
         session.addExtension("dxos.mesh.teleport.automerge", this._echoHost.createReplicationExtension());
       },
       onAuthFailure: () => {
-        import_log10.log.warn("auth failure", void 0, {
-          F: __dxlog_file12,
+        import_log12.log.warn("auth failure", void 0, {
+          F: __dxlog_file14,
           L: 247,
           S: this,
           C: (f, a) => f(...a)
@@ -4214,7 +4567,7 @@ var DataSpaceManager = class {
     dataFeed && await space.setDataFeed(dataFeed);
     const dataSpace = new DataSpace({
       inner: space,
-      initialState: metadata.state === import_services9.SpaceState.INACTIVE ? import_services9.SpaceState.INACTIVE : import_services9.SpaceState.CLOSED,
+      initialState: metadata.state === import_services10.SpaceState.INACTIVE ? import_services10.SpaceState.INACTIVE : import_services10.SpaceState.CLOSED,
       metadataStore: this._metadataStore,
       gossip,
       presence,
@@ -4224,21 +4577,21 @@ var DataSpaceManager = class {
       signingContext: this._signingContext,
       callbacks: {
         beforeReady: async () => {
-          (0, import_log10.log)("before space ready", {
+          (0, import_log12.log)("before space ready", {
             space: space.key
           }, {
-            F: __dxlog_file12,
+            F: __dxlog_file14,
             L: 269,
             S: this,
             C: (f, a) => f(...a)
           });
         },
         afterReady: async () => {
-          (0, import_log10.log)("after space ready", {
+          (0, import_log12.log)("after space ready", {
             space: space.key,
             open: this._isOpen
           }, {
-            F: __dxlog_file12,
+            F: __dxlog_file14,
             L: 272,
             S: this,
             C: (f, a) => f(...a)
@@ -4251,10 +4604,10 @@ var DataSpaceManager = class {
           }
         },
         beforeClose: async () => {
-          (0, import_log10.log)("before space close", {
+          (0, import_log12.log)("before space close", {
             space: space.key
           }, {
-            F: __dxlog_file12,
+            F: __dxlog_file14,
             L: 279,
             S: this,
             C: (f, a) => f(...a)
@@ -4263,7 +4616,7 @@ var DataSpaceManager = class {
       },
       cache: metadata.cache
     });
-    if (metadata.state !== import_services9.SpaceState.INACTIVE) {
+    if (metadata.state !== import_services10.SpaceState.INACTIVE) {
       await dataSpace.open();
     }
     if (metadata.controlTimeframe) {
@@ -4273,7 +4626,7 @@ var DataSpaceManager = class {
     return dataSpace;
   }
   async _handleInvitationStatusChange(dataSpace, delegatedInvitation, isActive) {
-    if (dataSpace?.state !== import_services9.SpaceState.READY) {
+    if (dataSpace?.state !== import_services10.SpaceState.READY) {
       return;
     }
     if (isActive) {
@@ -4290,8 +4643,8 @@ var DataSpaceManager = class {
   async _createDelegatedInvitations(space, invitations) {
     const tasks = invitations.map(([credentialId, invitation]) => {
       return this._invitationsManager.createInvitation({
-        type: import_services9.Invitation.Type.DELEGATED,
-        kind: import_services9.Invitation.Kind.SPACE,
+        type: import_services10.Invitation.Type.DELEGATED,
+        kind: import_services10.Invitation.Kind.SPACE,
         spaceKey: space.key,
         authMethod: invitation.authMethod,
         invitationId: invitation.invitationId,
@@ -4309,21 +4662,21 @@ var DataSpaceManager = class {
   }
 };
 _ts_decorate5([
-  import_async13.synchronized
+  import_async14.synchronized
 ], DataSpaceManager.prototype, "open", null);
 _ts_decorate5([
-  import_async13.synchronized
+  import_async14.synchronized
 ], DataSpaceManager.prototype, "close", null);
 _ts_decorate5([
-  import_async13.synchronized
+  import_async14.synchronized
 ], DataSpaceManager.prototype, "createSpace", null);
 _ts_decorate5([
-  import_async13.synchronized
+  import_async14.synchronized
 ], DataSpaceManager.prototype, "acceptSpace", null);
 DataSpaceManager = _ts_decorate5([
-  (0, import_async13.trackLeaks)("open", "close")
+  (0, import_async14.trackLeaks)("open", "close")
 ], DataSpaceManager);
-var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
+var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _getDataSpaceManager) {
     this._identityManager = _identityManager;
@@ -4340,30 +4693,33 @@ var SpacesServiceImpl = class {
   }
   async updateSpace({ spaceKey, state }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
     if (state) {
       switch (state) {
-        case import_services10.SpaceState.ACTIVE:
+        case import_services11.SpaceState.ACTIVE:
           await space.activate();
           break;
-        case import_services10.SpaceState.INACTIVE:
+        case import_services11.SpaceState.INACTIVE:
           await space.deactivate();
           break;
         default:
-          throw new import_protocols10.ApiError("Invalid space state");
+          throw new import_protocols11.ApiError("Invalid space state");
       }
     }
   }
+  async updateMemberRole(_) {
+    throw new Error("not implemented");
+  }
   querySpaces() {
     return new import_codec_protobuf10.Stream(({ next, ctx }) => {
-      const scheduler = new import_async14.UpdateScheduler(ctx, async () => {
+      const scheduler = new import_async15.UpdateScheduler(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space));
-        (0, import_log11.log)("update", {
+        (0, import_log13.log)("update", {
           spaces
         }, {
-          F: __dxlog_file13,
-          L: 77,
+          F: __dxlog_file15,
+          L: 82,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4373,9 +4729,9 @@ var SpacesServiceImpl = class {
       }, {
         maxFrequency: process.env.NODE_ENV === "test" ? void 0 : 2
       });
-      (0, import_async14.scheduleTask)(ctx, async () => {
+      (0, import_async15.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const subscriptions = new import_async14.EventSubscriptions();
+        const subscriptions = new import_async15.EventSubscriptions();
         ctx.onDispose(() => subscriptions.clear());
         const subscribeSpaces = () => {
           subscriptions.clear();
@@ -4402,14 +4758,14 @@ var SpacesServiceImpl = class {
   }
   async postMessage({ spaceKey, channel, message }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
     await space.postMessage(getChannelId(channel), message);
   }
   subscribeMessages({ spaceKey, channel }) {
     return new import_codec_protobuf10.Stream(({ ctx, next }) => {
-      (0, import_async14.scheduleTask)(ctx, async () => {
+      (0, import_async15.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
+        const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
         const handle = space.listen(getChannelId(channel), (message) => {
           next(message);
         });
@@ -4419,14 +4775,14 @@ var SpacesServiceImpl = class {
   }
   queryCredentials({ spaceKey, noTail }) {
     return new import_codec_protobuf10.Stream(({ ctx, next, close }) => {
-      const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
+      const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
       const processor = {
         processCredential: async (credential) => {
           next(credential);
         }
       };
       ctx.onDispose(() => space.spaceState.removeCredentialProcessor(processor));
-      (0, import_async14.scheduleTask)(ctx, async () => {
+      (0, import_async15.scheduleTask)(ctx, async () => {
         await space.spaceState.addCredentialProcessor(processor);
         if (noTail) {
           close();
@@ -4435,7 +4791,7 @@ var SpacesServiceImpl = class {
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
-    const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
+    const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
     for (const credential of credentials ?? []) {
       if (credential.proof) {
         await space.controlPipeline.writer.write({
@@ -4444,18 +4800,18 @@ var SpacesServiceImpl = class {
           }
         });
       } else {
-        (0, import_invariant12.invariant)(!credential.id, "Id on unsigned credentials is not allowed", {
-          F: __dxlog_file13,
-          L: 164,
+        (0, import_invariant14.invariant)(!credential.id, "Id on unsigned credentials is not allowed", {
+          F: __dxlog_file15,
+          L: 169,
           S: this,
           A: [
             "!credential.id",
             "'Id on unsigned credentials is not allowed'"
           ]
         });
-        (0, import_invariant12.invariant)(this._identityManager.identity, "Identity is not available", {
-          F: __dxlog_file13,
-          L: 165,
+        (0, import_invariant14.invariant)(this._identityManager.identity, "Identity is not available", {
+          F: __dxlog_file15,
+          L: 170,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -4463,9 +4819,9 @@ var SpacesServiceImpl = class {
           ]
         });
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
-        (0, import_invariant12.invariant)(credential.issuer.equals(signer.getIssuer()), void 0, {
-          F: __dxlog_file13,
-          L: 167,
+        (0, import_invariant14.invariant)(credential.issuer.equals(signer.getIssuer()), void 0, {
+          F: __dxlog_file15,
+          L: 172,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -4486,7 +4842,7 @@ var SpacesServiceImpl = class {
   }
   async createEpoch({ spaceKey, migration }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
     await space.createEpoch({
       migration
     });
@@ -4495,7 +4851,7 @@ var SpacesServiceImpl = class {
     return {
       spaceKey: space.key,
       state: space.state,
-      error: space.error ? (0, import_protocols10.encodeError)(space.error) : void 0,
+      error: space.error ? (0, import_protocols11.encodeError)(space.error) : void 0,
       pipeline: {
         currentEpoch: space.automergeSpaceState.lastEpoch,
         appliedEpoch: space.automergeSpaceState.lastEpoch,
@@ -4520,7 +4876,7 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.removed ? import_services10.SpaceMember.PresenceState.REMOVED : isMe || peers.length > 0 ? import_services10.SpaceMember.PresenceState.ONLINE : import_services10.SpaceMember.PresenceState.OFFLINE,
+          presence: member.role === import_credentials17.SpaceMember.Role.REMOVED ? import_services11.SpaceMember.PresenceState.REMOVED : isMe || peers.length > 0 ? import_services11.SpaceMember.PresenceState.ONLINE : import_services11.SpaceMember.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4541,8 +4897,8 @@ function _ts_decorate6(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
-var ServiceContext = class extends import_context10.Resource {
+var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
+var ServiceContext = class extends import_context12.Resource {
   constructor(storage, level, networkManager, signalManager, _runtimeParams) {
     super();
     this.storage = storage;
@@ -4550,9 +4906,9 @@ var ServiceContext = class extends import_context10.Resource {
     this.networkManager = networkManager;
     this.signalManager = signalManager;
     this._runtimeParams = _runtimeParams;
-    this.initialized = new import_async15.Trigger();
+    this.initialized = new import_async16.Trigger();
     this._handlerFactories = /* @__PURE__ */ new Map();
-    this._instanceId = import_keys11.PublicKey.random().toHex();
+    this._instanceId = import_keys12.PublicKey.random().toHex();
     this.metadataStore = new import_echo_pipeline4.MetadataStore(storage.createDirectory("metadata"));
     this.snapshotStore = new import_echo_pipeline4.SnapshotStore(storage.createDirectory("snapshots"));
     this.blobStore = new import_teleport_extension_object_sync.BlobStore(storage.createDirectory("blobs"));
@@ -4579,23 +4935,23 @@ var ServiceContext = class extends import_context10.Resource {
       kv: this.level,
       storage: this.storage
     });
-    this.invitations = new InvitationsHandler(this.networkManager);
+    this.invitations = new InvitationsHandler(this.networkManager, _runtimeParams?.invitationConnectionDefaultParams);
     this.invitationsManager = new InvitationsManager(this.invitations, (invitation) => this.getInvitationHandler(invitation), this.metadataStore);
-    this._handlerFactories.set(import_services11.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? (0, import_debug6.failUndefined)(), this._acceptIdentity.bind(this)));
+    this._handlerFactories.set(import_services12.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? (0, import_debug6.failUndefined)(), this._acceptIdentity.bind(this)));
   }
   async _open(ctx) {
     await this._checkStorageVersion();
-    (0, import_log12.log)("opening...", void 0, {
-      F: __dxlog_file14,
-      L: 151,
+    (0, import_log14.log)("opening...", void 0, {
+      F: __dxlog_file16,
+      L: 152,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log12.log.trace("dxos.sdk.service-context.open", import_protocols11.trace.begin({
+    import_log14.log.trace("dxos.sdk.service-context.open", import_protocols12.trace.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file14,
-      L: 152,
+      F: __dxlog_file16,
+      L: 153,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4609,33 +4965,33 @@ var ServiceContext = class extends import_context10.Resource {
       await this._initialize(ctx);
     }
     const loadedInvitations = await this.invitationsManager.loadPersistentInvitations();
-    (0, import_log12.log)("loaded persistent invitations", {
+    (0, import_log14.log)("loaded persistent invitations", {
       count: loadedInvitations.invitations?.length
     }, {
-      F: __dxlog_file14,
-      L: 165,
+      F: __dxlog_file16,
+      L: 166,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log12.log.trace("dxos.sdk.service-context.open", import_protocols11.trace.end({
+    import_log14.log.trace("dxos.sdk.service-context.open", import_protocols12.trace.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file14,
-      L: 167,
+      F: __dxlog_file16,
+      L: 168,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_log12.log)("opened", void 0, {
-      F: __dxlog_file14,
-      L: 168,
+    (0, import_log14.log)("opened", void 0, {
+      F: __dxlog_file16,
+      L: 169,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async _close(ctx) {
-    (0, import_log12.log)("closing...", void 0, {
-      F: __dxlog_file14,
-      L: 172,
+    (0, import_log14.log)("closing...", void 0, {
+      F: __dxlog_file16,
+      L: 173,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4650,23 +5006,23 @@ var ServiceContext = class extends import_context10.Resource {
     await this.echoHost.close(ctx);
     await this.networkManager.close();
     await this.signalManager.close();
-    (0, import_log12.log)("closed", void 0, {
-      F: __dxlog_file14,
-      L: 184,
+    (0, import_log14.log)("closed", void 0, {
+      F: __dxlog_file16,
+      L: 185,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async createIdentity(params = {}) {
     const identity = await this.identityManager.createIdentity(params);
-    await this._initialize(new import_context10.Context());
+    await this._initialize(new import_context12.Context());
     return identity;
   }
   getInvitationHandler(invitation) {
     const factory = this._handlerFactories.get(invitation.kind);
-    (0, import_invariant13.invariant)(factory, `Unknown invitation kind: ${invitation.kind}`, {
-      F: __dxlog_file14,
-      L: 195,
+    (0, import_invariant15.invariant)(factory, `Unknown invitation kind: ${invitation.kind}`, {
+      F: __dxlog_file16,
+      L: 196,
       S: this,
       A: [
         "factory",
@@ -4685,20 +5041,20 @@ var ServiceContext = class extends import_context10.Resource {
   }
   async _acceptIdentity(params) {
     const identity = await this.identityManager.acceptIdentity(params);
-    await this._initialize(new import_context10.Context());
+    await this._initialize(new import_context12.Context());
     return identity;
   }
   async _checkStorageVersion() {
     await this.metadataStore.load();
-    if (this.metadataStore.version !== import_protocols11.STORAGE_VERSION) {
-      throw new import_protocols11.InvalidStorageVersionError(import_protocols11.STORAGE_VERSION, this.metadataStore.version);
+    if (this.metadataStore.version !== import_protocols12.STORAGE_VERSION) {
+      throw new import_protocols12.InvalidStorageVersionError(import_protocols12.STORAGE_VERSION, this.metadataStore.version);
     }
   }
   // Called when identity is created.
   async _initialize(ctx) {
-    (0, import_log12.log)("initializing spaces...", void 0, {
-      F: __dxlog_file14,
-      L: 226,
+    (0, import_log14.log)("initializing spaces...", void 0, {
+      F: __dxlog_file16,
+      L: 227,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4718,10 +5074,10 @@ var ServiceContext = class extends import_context10.Resource {
     };
     this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.keyring, signingContext, this.feedStore, this.echoHost, this.invitationsManager, this._runtimeParams);
     await this.dataSpaceManager.open();
-    this._handlerFactories.set(import_services11.Invitation.Kind.SPACE, (invitation) => {
-      (0, import_invariant13.invariant)(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
-        F: __dxlog_file14,
-        L: 251,
+    this._handlerFactories.set(import_services12.Invitation.Kind.SPACE, (invitation) => {
+      (0, import_invariant15.invariant)(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
+        F: __dxlog_file16,
+        L: 252,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -4733,7 +5089,7 @@ var ServiceContext = class extends import_context10.Resource {
     this.initialized.wake();
     this._deviceSpaceSync = {
       processCredential: async (credential) => {
-        const assertion = (0, import_credentials15.getCredentialAssertion)(credential);
+        const assertion = (0, import_credentials18.getCredentialAssertion)(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
         }
@@ -4741,33 +5097,33 @@ var ServiceContext = class extends import_context10.Resource {
           return;
         }
         if (!this.dataSpaceManager) {
-          (0, import_log12.log)("dataSpaceManager not initialized yet, ignoring space admission", {
+          (0, import_log14.log)("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file14,
-            L: 267,
+            F: __dxlog_file16,
+            L: 268,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
         if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
-          (0, import_log12.log)("space already exists, ignoring space admission", {
+          (0, import_log14.log)("space already exists, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file14,
-            L: 271,
+            F: __dxlog_file16,
+            L: 272,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
         try {
-          (0, import_log12.log)("accepting space recorded in halo", {
+          (0, import_log14.log)("accepting space recorded in halo", {
             details: assertion
           }, {
-            F: __dxlog_file14,
-            L: 276,
+            F: __dxlog_file16,
+            L: 277,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4776,9 +5132,9 @@ var ServiceContext = class extends import_context10.Resource {
             genesisFeedKey: assertion.genesisFeedKey
           });
         } catch (err) {
-          import_log12.log.catch(err, void 0, {
-            F: __dxlog_file14,
-            L: 282,
+          import_log14.log.catch(err, void 0, {
+            F: __dxlog_file16,
+            L: 283,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4795,7 +5151,7 @@ _ts_decorate6([
   import_tracing5.trace.span()
 ], ServiceContext.prototype, "_initialize", null);
 ServiceContext = _ts_decorate6([
-  (0, import_util7.safeInstanceof)("dxos.client-services.ServiceContext"),
+  (0, import_util9.safeInstanceof)("dxos.client-services.ServiceContext"),
   import_tracing5.trace.resource()
 ], ServiceContext);
 var ServiceRegistry = class {
@@ -4820,26 +5176,26 @@ var ServiceRegistry = class {
     delete this._handlers[name];
   }
 };
-var DXOS_VERSION = "0.5.1-main.d514f85";
+var DXOS_VERSION = "0.5.1-main.e46fa49";
 var getPlatform = () => {
   if (process.browser) {
     if (typeof window !== "undefined") {
       const { userAgent } = window.navigator;
       return {
-        type: import_services13.Platform.PLATFORM_TYPE.BROWSER,
+        type: import_services14.Platform.PLATFORM_TYPE.BROWSER,
         userAgent,
         uptime: Math.floor((Date.now() - window.performance.timeOrigin) / 1e3)
       };
     } else {
       return {
-        type: import_services13.Platform.PLATFORM_TYPE.SHARED_WORKER,
+        type: import_services14.Platform.PLATFORM_TYPE.SHARED_WORKER,
         uptime: Math.floor((Date.now() - performance.timeOrigin) / 1e3)
       };
     }
   } else {
     const { platform: platform2, version, arch } = process;
     return {
-      type: import_services13.Platform.PLATFORM_TYPE.NODE,
+      type: import_services14.Platform.PLATFORM_TYPE.NODE,
       platform: platform2,
       arch,
       runtime: version,
@@ -4848,7 +5204,7 @@ var getPlatform = () => {
     };
   }
 };
-var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts";
+var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts";
 var DEFAULT_TIMEOUT = 1e3;
 var createDiagnostics = async (clientServices, serviceContext, config) => {
   const diagnostics = {
@@ -4857,68 +5213,60 @@ var createDiagnostics = async (clientServices, serviceContext, config) => {
     client: {
       version: DXOS_VERSION,
       storage: {
-        version: import_protocols12.STORAGE_VERSION
+        version: import_protocols13.STORAGE_VERSION
       }
     },
     trace: import_tracing6.TRACE_PROCESSOR.getDiagnostics()
   };
-  {
-    (0, import_invariant14.invariant)(clientServices.LoggingService, "SystemService is not available.", {
-      F: __dxlog_file15,
-      L: 108,
-      S: void 0,
-      A: [
-        "clientServices.LoggingService",
-        "'SystemService is not available.'"
-      ]
-    });
-    diagnostics.metrics = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.LoggingService.queryMetrics({}), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0);
-  }
-  if (typeof navigator !== "undefined" && navigator.storage) {
-    const map = /* @__PURE__ */ new Map();
-    const dir = await navigator.storage.getDirectory();
-    for await (const filename of dir?.keys()) {
-      const idx = filename.indexOf("-", filename.indexOf("-") + 1);
-      if (idx === -1) {
-        continue;
+  await Promise.all([
+    (async () => {
+      (0, import_invariant16.invariant)(clientServices.LoggingService, "SystemService is not available.", {
+        F: __dxlog_file17,
+        L: 110,
+        S: void 0,
+        A: [
+          "clientServices.LoggingService",
+          "'SystemService is not available.'"
+        ]
+      });
+      diagnostics.metrics = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.LoggingService.queryMetrics({}), {
+        timeout: DEFAULT_TIMEOUT
+      }).catch(() => void 0);
+    })(),
+    (async () => {
+      diagnostics.storage = await (0, import_async17.asyncTimeout)(getStorageDiagnostics(), DEFAULT_TIMEOUT).catch(() => void 0);
+    })(),
+    async () => {
+      const identity = serviceContext.identityManager.identity;
+      if (identity) {
+        diagnostics.identity = {
+          identityKey: identity.identityKey,
+          spaceKey: identity.space.key,
+          profile: identity.profileDocument
+        };
+        const { devices } = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.DevicesService.queryDevices(), {
+          timeout: DEFAULT_TIMEOUT
+        }).catch(() => void 0) ?? {};
+        diagnostics.devices = devices;
+        if (serviceContext.dataSpaceManager) {
+          diagnostics.spaces = await Promise.all(Array.from(serviceContext.dataSpaceManager.spaces.values()).map((space) => getSpaceStats(space)) ?? []);
+        }
+        const { feeds = [] } = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.DevtoolsHost.subscribeToFeeds({}), {
+          timeout: DEFAULT_TIMEOUT
+        }).catch(() => void 0) ?? {};
+        diagnostics.feeds = feeds.map(({ feedKey, bytes, length }) => ({
+          feedKey,
+          bytes,
+          length
+        }));
+        const status = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.NetworkService.queryStatus(), {
+          timeout: DEFAULT_TIMEOUT
+        }).catch(() => void 0);
+        diagnostics.networkStatus = status;
+        diagnostics.swarms = serviceContext.networkManager.connectionLog?.swarms;
       }
-      map.set(filename.slice(0, idx), (map.get(filename.slice(0, idx)) ?? 0) + 1);
-    }
-    diagnostics.storage = Array.from(map.entries()).sort((a, b) => b[1] - a[1]).map(([file, count]) => ({
-      file,
-      count
-    }));
-  }
-  const identity = serviceContext.identityManager.identity;
-  if (identity) {
-    diagnostics.identity = {
-      identityKey: identity.identityKey,
-      spaceKey: identity.space.key,
-      profile: identity.profileDocument
-    };
-    const { devices } = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.DevicesService.queryDevices(), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0) ?? {};
-    diagnostics.devices = devices;
-    if (serviceContext.dataSpaceManager) {
-      diagnostics.spaces = await Promise.all(Array.from(serviceContext.dataSpaceManager.spaces.values()).map((space) => getSpaceStats(space)) ?? []);
     }
-    const { feeds = [] } = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.DevtoolsHost.subscribeToFeeds({}), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0) ?? {};
-    diagnostics.feeds = feeds.map(({ feedKey, bytes, length }) => ({
-      feedKey,
-      bytes,
-      length
-    }));
-    const status = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.NetworkService.queryStatus(), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0);
-    diagnostics.networkStatus = status;
-    diagnostics.swarms = serviceContext.networkManager.connectionLog?.swarms;
-  }
+  ]);
   diagnostics.config = config.values;
   return diagnostics;
 };
@@ -4926,7 +5274,7 @@ var getSpaceStats = async (space) => {
   const stats = {
     key: space.key,
     metrics: space.metrics,
-    epochs: space.inner.spaceState.credentials.filter((0, import_credentials16.credentialTypeFilter)("dxos.halo.credentials.Epoch")).map((credential) => ({
+    epochs: space.inner.spaceState.credentials.filter((0, import_credentials19.credentialTypeFilter)("dxos.halo.credentials.Epoch")).map((credential) => ({
       ...credential.subject.assertion,
       id: credential.id
     })),
@@ -4937,7 +5285,7 @@ var getSpaceStats = async (space) => {
           displayName: member.assertion.profile?.displayName
         }
       },
-      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services12.SpaceMember.PresenceState.ONLINE : import_services12.SpaceMember.PresenceState.OFFLINE
+      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services13.SpaceMember.PresenceState.ONLINE : import_services13.SpaceMember.PresenceState.OFFLINE
     })),
     pipeline: {
       // TODO(burdon): Pick properties from credentials if needed.
@@ -4955,6 +5303,24 @@ var getSpaceStats = async (space) => {
   }
   return stats;
 };
+var getStorageDiagnostics = async () => {
+  if (typeof navigator === "undefined" || !navigator.storage) {
+    return void 0;
+  }
+  const map = /* @__PURE__ */ new Map();
+  const dir = await navigator.storage.getDirectory();
+  for await (const filename of dir?.keys()) {
+    const idx = filename.indexOf("-", filename.indexOf("-") + 1);
+    if (idx === -1) {
+      continue;
+    }
+    map.set(filename.slice(0, idx), (map.get(filename.slice(0, idx)) ?? 0) + 1);
+  }
+  return Array.from(map.entries()).sort((a, b) => b[1] - a[1]).map(([file, count]) => ({
+    file,
+    count
+  }));
+};
 var createCollectDiagnosticsBroadcastSender = () => {
   return {
     broadcastDiagnosticsRequest: async () => void 0
@@ -4968,7 +5334,7 @@ var createCollectDiagnosticsBroadcastHandler = (_) => {
     }
   };
 };
-var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
+var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
     this._identityManager = _identityManager;
@@ -4985,8 +5351,8 @@ var DevicesServiceImpl = class {
             devices: []
           });
         } else {
-          (0, import_invariant16.invariant)(this._identityManager.identity?.presence, "presence not present", {
-            F: __dxlog_file16,
+          (0, import_invariant18.invariant)(this._identityManager.identity?.presence, "presence not present", {
+            F: __dxlog_file18,
             L: 32,
             S: this,
             A: [
@@ -5001,9 +5367,9 @@ var DevicesServiceImpl = class {
               const peerState = peers.find((peer) => peer.identityKey.equals(key));
               return {
                 deviceKey: key,
-                kind: this._identityManager.identity?.deviceKey.equals(key) ? import_services16.DeviceKind.CURRENT : import_services16.DeviceKind.TRUSTED,
+                kind: this._identityManager.identity?.deviceKey.equals(key) ? import_services17.DeviceKind.CURRENT : import_services17.DeviceKind.TRUSTED,
                 profile,
-                presence: isMe ? import_services16.Device.PresenceState.ONLINE : peerState ? import_services16.Device.PresenceState.ONLINE : import_services16.Device.PresenceState.OFFLINE
+                presence: isMe ? import_services17.Device.PresenceState.ONLINE : peerState ? import_services17.Device.PresenceState.ONLINE : import_services17.Device.PresenceState.OFFLINE
               };
             })
           });
@@ -5027,7 +5393,7 @@ var DevicesServiceImpl = class {
           presenceSubscribed = true;
         }
       };
-      const subscriptions = new import_async17.EventSubscriptions();
+      const subscriptions = new import_async19.EventSubscriptions();
       if (this._identityManager.identity) {
         subscribeIdentity();
         subscribePresence();
@@ -5054,7 +5420,7 @@ function _ts_decorate7(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/node.ts";
+var __dxlog_file19 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/node.ts";
 var Lock = class {
   constructor({ lockKey: lockPath, onAcquire, onRelease }) {
     this._lockPath = lockPath;
@@ -5065,16 +5431,16 @@ var Lock = class {
     return this._lockPath;
   }
   async acquire() {
-    (0, import_log14.log)("acquiring lock...", void 0, {
-      F: __dxlog_file17,
+    (0, import_log16.log)("acquiring lock...", void 0, {
+      F: __dxlog_file19,
       L: 32,
       S: this,
       C: (f, a) => f(...a)
     });
     this._fileHandle = await import_lock_file.LockFile.acquire(this._lockPath);
     await this._onAcquire?.();
-    (0, import_log14.log)("acquired lock", void 0, {
-      F: __dxlog_file17,
+    (0, import_log16.log)("acquired lock", void 0, {
+      F: __dxlog_file19,
       L: 37,
       S: this,
       C: (f, a) => f(...a)
@@ -5082,8 +5448,8 @@ var Lock = class {
   }
   async release() {
     await this._onRelease?.();
-    (0, import_invariant17.invariant)(this._fileHandle, "Lock is not acquired", {
-      F: __dxlog_file17,
+    (0, import_invariant19.invariant)(this._fileHandle, "Lock is not acquired", {
+      F: __dxlog_file19,
       L: 42,
       S: this,
       A: [
@@ -5095,36 +5461,36 @@ var Lock = class {
   }
 };
 _ts_decorate7([
-  import_log14.logInfo
+  import_log16.logInfo
 ], Lock.prototype, "lockKey", null);
 var isLocked = (lockPath) => import_lock_file.LockFile.isLocked(lockPath);
 var LoggingServiceImpl = class {
   constructor() {
-    this._logs = new import_async18.Event();
+    this._logs = new import_async20.Event();
     this._started = Date.now();
-    this._sessionId = import_keys13.PublicKey.random().toHex();
+    this._sessionId = import_keys14.PublicKey.random().toHex();
     this._logProcessor = (_config, entry2) => {
       this._logs.emit(entry2);
     };
   }
   async open() {
-    import_log15.log.runtimeConfig.processors.push(this._logProcessor);
+    import_log17.log.runtimeConfig.processors.push(this._logProcessor);
   }
   async close() {
-    const index = import_log15.log.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
-    import_log15.log.runtimeConfig.processors.splice(index, 1);
+    const index = import_log17.log.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
+    import_log17.log.runtimeConfig.processors.splice(index, 1);
   }
   async controlMetrics({ reset, record }) {
     if (reset) {
-      import_util10.tracer.clear();
+      import_util12.tracer.clear();
     }
     if (record === true) {
-      import_util10.tracer.start();
+      import_util12.tracer.start();
     } else if (record === false) {
-      import_util10.tracer.stop();
+      import_util12.tracer.stop();
     }
     return {
-      recording: import_util10.tracer.recording
+      recording: import_util12.tracer.recording
     };
   }
   /**
@@ -5132,10 +5498,10 @@ var LoggingServiceImpl = class {
   */
   queryMetrics({ interval = 5e3 }) {
     const getNumericalValues = (key) => {
-      const events = import_util10.tracer.get(key) ?? [];
+      const events = import_util12.tracer.get(key) ?? [];
       return {
         key,
-        stats: (0, import_util10.numericalValues)(events, "duration")
+        stats: (0, import_util12.numericalValues)(events, "duration")
       };
     };
     return new import_codec_protobuf13.Stream(({ next }) => {
@@ -5173,7 +5539,7 @@ var LoggingServiceImpl = class {
         }
         const record = {
           ...entry2,
-          context: (0, import_util10.jsonify)((0, import_log15.getContextFromEntry)(entry2)),
+          context: (0, import_util12.jsonify)((0, import_log17.getContextFromEntry)(entry2)),
           timestamp: /* @__PURE__ */ new Date(),
           meta: {
             // TODO(dmaretskyi): Fix proto.
@@ -5182,7 +5548,7 @@ var LoggingServiceImpl = class {
             scope: {
               hostSessionId: this._sessionId,
               uptimeSeconds: (Date.now() - this._started) / 1e3,
-              name: (0, import_util10.getDebugName)(entry2.meta?.S)
+              name: (0, import_util12.getDebugName)(entry2.meta?.S)
             }
           }
         };
@@ -5199,16 +5565,16 @@ var LoggingServiceImpl = class {
 };
 var matchFilter = (filter, level, path2, options) => {
   switch (options) {
-    case import_services17.QueryLogsRequest.MatchingOptions.INCLUSIVE:
+    case import_services18.QueryLogsRequest.MatchingOptions.INCLUSIVE:
       return level >= filter.level && (!filter.pattern || path2.includes(filter.pattern));
-    case import_services17.QueryLogsRequest.MatchingOptions.EXPLICIT:
+    case import_services18.QueryLogsRequest.MatchingOptions.EXPLICIT:
       return level === filter.level && (!filter.pattern || path2.includes(filter.pattern));
   }
 };
 var shouldLog = (entry2, request) => {
-  const options = request.options ?? import_services17.QueryLogsRequest.MatchingOptions.INCLUSIVE;
+  const options = request.options ?? import_services18.QueryLogsRequest.MatchingOptions.INCLUSIVE;
   if (request.filters === void 0) {
-    return options === import_services17.QueryLogsRequest.MatchingOptions.INCLUSIVE;
+    return options === import_services18.QueryLogsRequest.MatchingOptions.INCLUSIVE;
   } else {
     return request.filters.some((filter) => matchFilter(filter, entry2.level, entry2.meta?.F ?? "", options));
   }
@@ -5245,7 +5611,7 @@ var NetworkServiceImpl = class {
   }
 };
 var getRootPath = (config) => {
-  const { dataRoot = (0, import_util11.isNode)() ? import_client_protocol6.DX_DATA : "dxos/storage" } = config ?? {};
+  const { dataRoot = (0, import_util13.isNode)() ? import_client_protocol6.DX_DATA : "dxos/storage" } = config ?? {};
   return `${dataRoot}/`;
 };
 var isPersistent = (config) => {
@@ -5256,16 +5622,16 @@ var StorageDriver = import_config2.Runtime.Client.Storage.StorageDriver;
 var createStorageObjects = (config) => {
   const { persistent = false, keyStore, dataStore } = config ?? {};
   if (persistent && dataStore === StorageDriver.RAM) {
-    throw new import_protocols14.InvalidConfigError("RAM storage cannot be used in persistent mode.");
+    throw new import_protocols15.InvalidConfigError("RAM storage cannot be used in persistent mode.");
   }
   if (!persistent && dataStore !== void 0 && dataStore !== StorageDriver.RAM) {
-    throw new import_protocols14.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+    throw new import_protocols15.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
   }
   if (persistent && keyStore === StorageDriver.RAM) {
-    throw new import_protocols14.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+    throw new import_protocols15.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
   }
   if (!persistent && keyStore !== StorageDriver.RAM && keyStore !== void 0) {
-    throw new import_protocols14.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+    throw new import_protocols15.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
   }
   return {
     storage: (0, import_random_access_storage.createStorage)({
@@ -5296,8 +5662,8 @@ var toStorageType = (type) => {
 };
 var createLevel = async (config) => {
   const persistent = isPersistent(config);
-  const storagePath = persistent ? import_node_path.default.join(getRootPath(config), "level") : `/tmp/dxos-${import_keys14.PublicKey.random().toHex()}`;
-  const level = new import_level.Level(storagePath);
+  const storagePath = persistent ? import_node_path.default.join(getRootPath(config), "level") : `/tmp/dxos-${import_keys15.PublicKey.random().toHex()}`;
+  const level = (0, import_kv_store.createLevel)(storagePath);
   await level.open();
   return level;
 };
@@ -5320,9 +5686,9 @@ var SystemServiceImpl = class {
     const diagnostics = await this._getDiagnostics();
     return {
       timestamp: /* @__PURE__ */ new Date(),
-      diagnostics: JSON.parse(JSON.stringify(diagnostics, (0, import_util12.jsonKeyReplacer)({
-        truncate: keys === import_services18.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE,
-        humanize: keys === import_services18.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE
+      diagnostics: JSON.parse(JSON.stringify(diagnostics, (0, import_util14.jsonKeyReplacer)({
+        truncate: keys === import_services19.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE,
+        humanize: keys === import_services19.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE
       })))
     };
   }
@@ -5363,7 +5729,7 @@ function _ts_decorate8(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
+var __dxlog_file20 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
 var ClientServicesHost = class {
   constructor({
     config,
@@ -5377,7 +5743,7 @@ var ClientServicesHost = class {
     runtimeParams
   } = {}) {
     this._tracingService = import_tracing8.TRACE_PROCESSOR.createTraceSender();
-    this._statusUpdate = new import_async16.Event();
+    this._statusUpdate = new import_async18.Event();
     this._opening = false;
     this._open = false;
     this._storage = storage;
@@ -5396,7 +5762,7 @@ var ClientServicesHost = class {
         lockKey,
         onAcquire: () => {
           if (!this._opening) {
-            void this.open(new import_context11.Context());
+            void this.open(new import_context13.Context());
           }
         },
         onRelease: () => this.close()
@@ -5405,14 +5771,14 @@ var ClientServicesHost = class {
     this._systemService = new SystemServiceImpl({
       config: () => this._config,
       statusUpdate: this._statusUpdate,
-      getCurrentStatus: () => this.isOpen ? import_services15.SystemStatus.ACTIVE : import_services15.SystemStatus.INACTIVE,
+      getCurrentStatus: () => this.isOpen ? import_services16.SystemStatus.ACTIVE : import_services16.SystemStatus.INACTIVE,
       getDiagnostics: () => {
         return createDiagnostics(this._serviceRegistry.services, this._serviceContext, this._config);
       },
       onUpdateStatus: async (status) => {
-        if (!this.isOpen && status === import_services15.SystemStatus.ACTIVE) {
+        if (!this.isOpen && status === import_services16.SystemStatus.ACTIVE) {
           await this._resourceLock?.acquire();
-        } else if (this.isOpen && status === import_services15.SystemStatus.INACTIVE) {
+        } else if (this.isOpen && status === import_services16.SystemStatus.INACTIVE) {
           await this._resourceLock?.release();
         }
       },
@@ -5451,25 +5817,25 @@ var ClientServicesHost = class {
   * Can only be called once.
   */
   initialize({ config, ...options }) {
-    (0, import_invariant15.invariant)(!this._open, "service host is open", {
-      F: __dxlog_file18,
-      L: 190,
+    (0, import_invariant17.invariant)(!this._open, "service host is open", {
+      F: __dxlog_file20,
+      L: 189,
       S: this,
       A: [
         "!this._open",
         "'service host is open'"
       ]
     });
-    (0, import_log13.log)("initializing...", void 0, {
-      F: __dxlog_file18,
-      L: 191,
+    (0, import_log15.log)("initializing...", void 0, {
+      F: __dxlog_file20,
+      L: 190,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
-      (0, import_invariant15.invariant)(!this._config, "config already set", {
-        F: __dxlog_file18,
-        L: 194,
+      (0, import_invariant17.invariant)(!this._config, "config already set", {
+        F: __dxlog_file20,
+        L: 193,
         S: this,
         A: [
           "!this._config",
@@ -5482,9 +5848,9 @@ var ClientServicesHost = class {
       }
     }
     if (!options.signalManager) {
-      import_log13.log.warn("running signaling without telemetry metadata.", void 0, {
-        F: __dxlog_file18,
-        L: 202,
+      import_log15.log.warn("running signaling without telemetry metadata.", void 0, {
+        F: __dxlog_file20,
+        L: 201,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -5493,9 +5859,9 @@ var ClientServicesHost = class {
       iceServers: this._config?.get("runtime.services.ice")
     }), signalManager = new import_messaging.WebsocketSignalManager(this._config?.get("runtime.services.signaling") ?? []) } = options;
     this._signalManager = signalManager;
-    (0, import_invariant15.invariant)(!this._networkManager, "network manager already set", {
-      F: __dxlog_file18,
-      L: 213,
+    (0, import_invariant17.invariant)(!this._networkManager, "network manager already set", {
+      F: __dxlog_file20,
+      L: 212,
       S: this,
       A: [
         "!this._networkManager",
@@ -5507,9 +5873,9 @@ var ClientServicesHost = class {
       transportFactory,
       signalManager
     });
-    (0, import_log13.log)("initialized", void 0, {
-      F: __dxlog_file18,
-      L: 220,
+    (0, import_log15.log)("initialized", void 0, {
+      F: __dxlog_file20,
+      L: 219,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5518,45 +5884,45 @@ var ClientServicesHost = class {
     if (this._open) {
       return;
     }
-    const traceId = import_keys12.PublicKey.random().toHex();
-    import_log13.log.trace("dxos.client-services.host.open", import_protocols13.trace.begin({
+    const traceId = import_keys13.PublicKey.random().toHex();
+    import_log15.log.trace("dxos.client-services.host.open", import_protocols14.trace.begin({
       id: traceId
     }), {
-      F: __dxlog_file18,
-      L: 231,
+      F: __dxlog_file20,
+      L: 230,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_invariant15.invariant)(this._config, "config not set", {
-      F: __dxlog_file18,
-      L: 233,
+    (0, import_invariant17.invariant)(this._config, "config not set", {
+      F: __dxlog_file20,
+      L: 232,
       S: this,
       A: [
         "this._config",
         "'config not set'"
       ]
     });
-    (0, import_invariant15.invariant)(this._storage, "storage not set", {
-      F: __dxlog_file18,
-      L: 234,
+    (0, import_invariant17.invariant)(this._storage, "storage not set", {
+      F: __dxlog_file20,
+      L: 233,
       S: this,
       A: [
         "this._storage",
         "'storage not set'"
       ]
     });
-    (0, import_invariant15.invariant)(this._signalManager, "signal manager not set", {
-      F: __dxlog_file18,
-      L: 235,
+    (0, import_invariant17.invariant)(this._signalManager, "signal manager not set", {
+      F: __dxlog_file20,
+      L: 234,
       S: this,
       A: [
         "this._signalManager",
         "'signal manager not set'"
       ]
     });
-    (0, import_invariant15.invariant)(this._networkManager, "network manager not set", {
-      F: __dxlog_file18,
-      L: 236,
+    (0, import_invariant17.invariant)(this._networkManager, "network manager not set", {
+      F: __dxlog_file20,
+      L: 235,
       S: this,
       A: [
         "this._networkManager",
@@ -5564,11 +5930,11 @@ var ClientServicesHost = class {
       ]
     });
     this._opening = true;
-    (0, import_log13.log)("opening...", {
+    (0, import_log15.log)("opening...", {
       lockKey: this._resourceLock?.lockKey
     }, {
-      F: __dxlog_file18,
-      L: 239,
+      F: __dxlog_file20,
+      L: 238,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5616,19 +5982,19 @@ var ClientServicesHost = class {
     this._open = true;
     this._statusUpdate.emit();
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    (0, import_log13.log)("opened", {
+    (0, import_log15.log)("opened", {
       deviceKey
     }, {
-      F: __dxlog_file18,
-      L: 315,
+      F: __dxlog_file20,
+      L: 314,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log13.log.trace("dxos.client-services.host.open", import_protocols13.trace.end({
+    import_log15.log.trace("dxos.client-services.host.open", import_protocols14.trace.end({
       id: traceId
     }), {
-      F: __dxlog_file18,
-      L: 316,
+      F: __dxlog_file20,
+      L: 315,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5638,11 +6004,11 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    (0, import_log13.log)("closing...", {
+    (0, import_log15.log)("closing...", {
       deviceKey
     }, {
-      F: __dxlog_file18,
-      L: 327,
+      F: __dxlog_file20,
+      L: 326,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5656,44 +6022,44 @@ var ClientServicesHost = class {
     await this._level?.close();
     this._open = false;
     this._statusUpdate.emit();
-    (0, import_log13.log)("closed", {
+    (0, import_log15.log)("closed", {
       deviceKey
     }, {
-      F: __dxlog_file18,
-      L: 336,
+      F: __dxlog_file20,
+      L: 335,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async reset() {
-    const traceId = import_keys12.PublicKey.random().toHex();
-    import_log13.log.trace("dxos.sdk.client-services-host.reset", import_protocols13.trace.begin({
+    const traceId = import_keys13.PublicKey.random().toHex();
+    import_log15.log.trace("dxos.sdk.client-services-host.reset", import_protocols14.trace.begin({
       id: traceId
     }), {
-      F: __dxlog_file18,
-      L: 341,
+      F: __dxlog_file20,
+      L: 340,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_log13.log)("resetting...", void 0, {
-      F: __dxlog_file18,
-      L: 343,
+    import_log15.log.info("resetting...", void 0, {
+      F: __dxlog_file20,
+      L: 342,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._serviceContext?.close();
     await this._storage.reset();
-    (0, import_log13.log)("reset", void 0, {
-      F: __dxlog_file18,
-      L: 346,
+    import_log15.log.info("reset", void 0, {
+      F: __dxlog_file20,
+      L: 345,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log13.log.trace("dxos.sdk.client-services-host.reset", import_protocols13.trace.end({
+    import_log15.log.trace("dxos.sdk.client-services-host.reset", import_protocols14.trace.end({
       id: traceId
     }), {
-      F: __dxlog_file18,
-      L: 347,
+      F: __dxlog_file20,
+      L: 346,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5704,9 +6070,9 @@ var ClientServicesHost = class {
     await this._serviceContext.initialized.wait();
     const space = await this._serviceContext.dataSpaceManager.createSpace();
     const automergeIndex = space.automergeSpaceState.rootUrl;
-    (0, import_invariant15.invariant)(automergeIndex, void 0, {
-      F: __dxlog_file18,
-      L: 359,
+    (0, import_invariant17.invariant)(automergeIndex, void 0, {
+      F: __dxlog_file20,
+      L: 358,
       S: this,
       A: [
         "automergeIndex",
@@ -5717,7 +6083,7 @@ var ClientServicesHost = class {
     await document.whenReady();
     const properties = {
       system: {
-        type: (0, import_echo_pipeline5.encodeReference)((0, import_echo_schema2.getTypeReference)(import_client_protocol5.Properties))
+        type: (0, import_echo_protocol.encodeReference)((0, import_echo_schema2.getTypeReference)(import_client_protocol5.Properties))
       },
       data: {
         [import_client_protocol5.defaultKey]: identity.identityKey.toHex()
@@ -5726,9 +6092,9 @@ var ClientServicesHost = class {
         keys: []
       }
     };
-    const propertiesId = import_keys12.PublicKey.random().toHex();
+    const propertiesId = import_keys13.PublicKey.random().toHex();
     document.change((doc) => {
-      (0, import_util9.assignDeep)(doc, [
+      (0, import_util11.assignDeep)(doc, [
         "objects",
         propertiesId
       ], properties);
@@ -5744,24 +6110,27 @@ _ts_decorate8([
   import_tracing8.trace.info()
 ], ClientServicesHost.prototype, "_open", void 0);
 _ts_decorate8([
-  import_async16.synchronized,
+  import_async18.synchronized,
   import_tracing8.trace.span()
 ], ClientServicesHost.prototype, "open", null);
 _ts_decorate8([
-  import_async16.synchronized,
+  import_async18.synchronized,
   import_tracing8.trace.span()
 ], ClientServicesHost.prototype, "close", null);
 ClientServicesHost = _ts_decorate8([
   import_tracing8.trace.resource()
 ], ClientServicesHost);
 var ClientServicesProviderResource = Symbol.for("dxos.resource.ClientServices");
+var GET_DIAGNOSTICS_RPC_TIMEOUT = 1e4;
 var DiagnosticsCollector = class {
   static {
     this.broadcastSender = createCollectDiagnosticsBroadcastSender();
   }
   static async collect(config = findConfigs(), services = findSystemServiceProvider(), options = {}) {
     const serviceDiagnostics = await services?.services?.SystemService?.getDiagnostics({
-      keys: options.humanize ? import_services14.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE : options.truncate ? import_services14.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE : void 0
+      keys: options.humanize ? import_services15.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE : options.truncate ? import_services15.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE : void 0
+    }, {
+      timeout: GET_DIAGNOSTICS_RPC_TIMEOUT
     });
     const clientDiagnostics = {
       config,
@@ -5774,17 +6143,17 @@ var DiagnosticsCollector = class {
       client: clientDiagnostics,
       broadcast: await this.broadcastSender.broadcastDiagnosticsRequest()
     };
-    return JSON.parse(JSON.stringify(diagnostics, (0, import_util8.jsonKeyReplacer)(options)));
+    return JSON.parse(JSON.stringify(diagnostics, (0, import_util10.jsonKeyReplacer)(options)));
   }
 };
 var findSystemServiceProvider = () => {
-  const serviceProviders = import_tracing7.TRACE_PROCESSOR.findByAnnotation(ClientServicesProviderResource);
+  const serviceProviders = import_tracing7.TRACE_PROCESSOR.findResourcesByAnnotation(ClientServicesProviderResource);
   const providerResource = serviceProviders.find((r) => r.instance.deref()?.services?.SystemService != null);
   return providerResource?.instance?.deref() ?? null;
 };
 var findConfigs = () => {
-  const configs = import_tracing7.TRACE_PROCESSOR.findByAnnotation(import_config.ConfigResource);
-  return configs.map((r) => r.instance.deref()).filter(import_util8.nonNullable);
+  const configs = import_tracing7.TRACE_PROCESSOR.findResourcesByAnnotation(import_config.ConfigResource);
+  return configs.map((r) => r.instance.deref()).filter(import_util10.nonNullable);
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -5826,4 +6195,4 @@ var findConfigs = () => {
   subscribeToSpaces,
   subscribeToSwarmInfo
 });
-//# sourceMappingURL=chunk-GGYOXDXO.cjs.map
+//# sourceMappingURL=chunk-42RIUNTR.cjs.map