@dxos/client-services 0.5.1-next.2ad6c47 → 0.5.1-next.5a770e3

package/dist/lib/browser/{chunk-CMVTOS5E.mjs → chunk-MKFJAPSD.mjs}

@@ -1196,13 +1196,16 @@ var DeviceInvitationProtocol = class {
       kind: Invitation.Kind.DEVICE
     };
   }
-  async delegate(invitation) {
+  async delegate() {
+    throw new Error("delegation not supported");
+  }
+  async cancelDelegation() {
     throw new Error("delegation not supported");
   }
   async admit(_, request) {
     invariant4(request.device, void 0, {
       F: __dxlog_file5,
-      L: 42,
+      L: 46,
       S: this,
       A: [
         "request.device",
@@ -1248,7 +1251,7 @@ var DeviceInvitationProtocol = class {
   async accept(response, request) {
     invariant4(response.device, void 0, {
       F: __dxlog_file5,
-      L: 87,
+      L: 91,
       S: this,
       A: [
         "response.device",
@@ -1258,7 +1261,7 @@ var DeviceInvitationProtocol = class {
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
     invariant4(request.device, void 0, {
       F: __dxlog_file5,
-      L: 90,
+      L: 94,
       S: this,
       A: [
         "request.device",
@@ -1283,34 +1286,53 @@ var DeviceInvitationProtocol = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-import { PushStream, scheduleTask as scheduleTask2, TimeoutError, Trigger as Trigger3 } from "@dxos/async";
-import { AuthenticatingInvitation, INVITATION_TIMEOUT } from "@dxos/client-protocol";
-import { Context as Context5 } from "@dxos/context";
+import { Mutex, scheduleTask as scheduleTask3, TimeoutError } from "@dxos/async";
+import { INVITATION_TIMEOUT } from "@dxos/client-protocol";
+import { ContextDisposedError as ContextDisposedError2 } from "@dxos/context";
 import { createKeyPair, sign } from "@dxos/crypto";
-import { invariant as invariant6 } from "@dxos/invariant";
-import { PublicKey as PublicKey6 } from "@dxos/keys";
-import { log as log5 } from "@dxos/log";
-import { createTeleportProtocolFactory, StarTopology } from "@dxos/network-manager";
-import { InvalidInvitationExtensionRoleError as InvalidInvitationExtensionRoleError2, trace as trace4 } from "@dxos/protocols";
-import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
+import { invariant as invariant8 } from "@dxos/invariant";
+import { PublicKey as PublicKey7 } from "@dxos/keys";
+import { log as log7 } from "@dxos/log";
+import { createTeleportProtocolFactory } from "@dxos/network-manager";
+import { InvalidInvitationExtensionRoleError as InvalidInvitationExtensionRoleError3, trace as trace4 } from "@dxos/protocols";
+import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
 import { AuthenticationResponse as AuthenticationResponse2 } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { Options as Options4 } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { ComplexSet as ComplexSet3 } from "@dxos/util";
 
-// packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts
+// packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts
 import { Trigger as Trigger2 } from "@dxos/async";
-import { cancelWithContext, Context as Context4 } from "@dxos/context";
-import { randomBytes, verify } from "@dxos/crypto";
+import { cancelWithContext as cancelWithContext2, Context as Context4 } from "@dxos/context";
 import { invariant as invariant5 } from "@dxos/invariant";
-import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log as log4 } from "@dxos/log";
-import { InvalidInvitationExtensionRoleError, schema as schema2, trace as trace3 } from "@dxos/protocols";
-import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
-import { AuthenticationResponse, Options } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { InvalidInvitationExtensionRoleError, schema as schema2 } from "@dxos/protocols";
+import { Options } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { RpcExtension } from "@dxos/teleport";
-var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts";
+
+// packages/sdk/client-services/src/packlets/invitations/utils.ts
+import { cancelWithContext, ContextDisposedError } from "@dxos/context";
+import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
+var stateToString = (state) => {
+  return Object.entries(Invitation2.State).find(([key, val]) => val === state)?.[0] ?? "unknown";
+};
+var tryAcquireBeforeContextDisposed = async (ctx, mutex) => {
+  let guard;
+  return cancelWithContext(ctx, (async () => {
+    guard = await mutex.acquire();
+    if (ctx.disposed) {
+      guard.release();
+      guard = void 0;
+      throw new ContextDisposedError();
+    }
+    return guard;
+  })());
+};
+
+// packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts
+var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts";
 var OPTIONS_TIMEOUT = 1e4;
-var MAX_OTP_ATTEMPTS = 3;
-var InvitationHostExtension = class extends RpcExtension {
-  constructor(_callbacks) {
+var InvitationGuestExtension = class extends RpcExtension {
+  constructor(_invitationFlowMutex, _callbacks) {
     super({
       requested: {
         InvitationHostService: schema2.getService("dxos.halo.invitations.InvitationHostService")
@@ -1319,15 +1341,152 @@ var InvitationHostExtension = class extends RpcExtension {
         InvitationHostService: schema2.getService("dxos.halo.invitations.InvitationHostService")
       }
     });
+    this._invitationFlowMutex = _invitationFlowMutex;
     this._callbacks = _callbacks;
     this._ctx = new Context4();
     this._remoteOptionsTrigger = new Trigger2();
+    this._invitationFlowLock = null;
+  }
+  hasFlowLock() {
+    return this._invitationFlowLock != null;
+  }
+  async getHandlers() {
+    return {
+      InvitationHostService: {
+        options: async (options) => {
+          invariant5(!this._remoteOptions, "Remote options already set.", {
+            F: __dxlog_file6,
+            L: 63,
+            S: this,
+            A: [
+              "!this._remoteOptions",
+              "'Remote options already set.'"
+            ]
+          });
+          this._remoteOptions = options;
+          this._remoteOptionsTrigger.wake();
+        },
+        introduce: () => {
+          throw new Error("Method not allowed.");
+        },
+        authenticate: () => {
+          throw new Error("Method not allowed.");
+        },
+        admit: () => {
+          throw new Error("Method not allowed.");
+        }
+      }
+    };
+  }
+  async onOpen(context) {
+    await super.onOpen(context);
+    try {
+      log4("guest acquire lock", void 0, {
+        F: __dxlog_file6,
+        L: 84,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
+      log4("guest lock acquired", void 0, {
+        F: __dxlog_file6,
+        L: 86,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await cancelWithContext2(this._ctx, this.rpc.InvitationHostService.options({
+        role: Options.Role.GUEST
+      }));
+      log4("options sent", void 0, {
+        F: __dxlog_file6,
+        L: 88,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await cancelWithContext2(this._ctx, this._remoteOptionsTrigger.wait({
+        timeout: OPTIONS_TIMEOUT
+      }));
+      log4("options received", void 0, {
+        F: __dxlog_file6,
+        L: 90,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      if (this._remoteOptions?.role !== Options.Role.HOST) {
+        throw new InvalidInvitationExtensionRoleError(void 0, {
+          expected: Options.Role.HOST,
+          remoteOptions: this._remoteOptions,
+          remotePeerId: context.remotePeerId
+        });
+      }
+      this._callbacks.onOpen(this._ctx, context);
+    } catch (err) {
+      if (this._invitationFlowLock != null) {
+        this._callbacks.onError(err);
+      }
+      if (!this._ctx.disposed) {
+        context.close(err);
+      }
+    }
+  }
+  async onClose() {
+    await this._destroy();
+  }
+  async onAbort() {
+    await this._destroy();
+  }
+  async _destroy() {
+    await this._ctx.dispose();
+    if (this._invitationFlowLock != null) {
+      this._invitationFlowLock.release();
+      this._invitationFlowLock = null;
+      log4("invitation flow lock released", void 0, {
+        F: __dxlog_file6,
+        L: 123,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/invitation-host-extension.ts
+import { Trigger as Trigger3, scheduleTask as scheduleTask2 } from "@dxos/async";
+import { cancelWithContext as cancelWithContext3, Context as Context5 } from "@dxos/context";
+import { randomBytes, verify } from "@dxos/crypto";
+import { invariant as invariant6, InvariantViolation } from "@dxos/invariant";
+import { PublicKey as PublicKey5 } from "@dxos/keys";
+import { log as log5 } from "@dxos/log";
+import { InvalidInvitationExtensionRoleError as InvalidInvitationExtensionRoleError2, schema as schema3, trace as trace3 } from "@dxos/protocols";
+import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
+import { AuthenticationResponse, Options as Options2 } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
+var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-host-extension.ts";
+var OPTIONS_TIMEOUT2 = 1e4;
+var MAX_OTP_ATTEMPTS = 3;
+var InvitationHostExtension = class extends RpcExtension2 {
+  constructor(_invitationFlowMutex, _callbacks) {
+    super({
+      requested: {
+        InvitationHostService: schema3.getService("dxos.halo.invitations.InvitationHostService")
+      },
+      exposed: {
+        InvitationHostService: schema3.getService("dxos.halo.invitations.InvitationHostService")
+      }
+    });
+    this._invitationFlowMutex = _invitationFlowMutex;
+    this._callbacks = _callbacks;
+    this._ctx = new Context5();
+    this._remoteOptionsTrigger = new Trigger3();
     this._challenge = void 0;
-    this.invitation = void 0;
     this.guestProfile = void 0;
     this.authenticationPassed = false;
     this.authenticationRetry = 0;
-    this.completedTrigger = new Trigger2();
+    this.completedTrigger = new Trigger3();
+    this._invitationFlowLock = null;
+  }
+  hasFlowLock() {
+    return this._invitationFlowLock != null;
   }
   async getHandlers() {
     return {
@@ -1335,9 +1494,9 @@ var InvitationHostExtension = class extends RpcExtension {
       // Perhaps in the future we will have more complex logic here.
       InvitationHostService: {
         options: async (options) => {
-          invariant5(!this._remoteOptions, "Remote options already set.", {
-            F: __dxlog_file6,
-            L: 90,
+          invariant6(!this._remoteOptions, "Remote options already set.", {
+            F: __dxlog_file7,
+            L: 101,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1350,90 +1509,86 @@ var InvitationHostExtension = class extends RpcExtension {
         introduce: async (request) => {
           const { profile, invitationId } = request;
           const traceId = PublicKey5.random().toHex();
-          log4.trace("dxos.sdk.invitation-handler.host.introduce", trace3.begin({
+          log5.trace("dxos.sdk.invitation-handler.host.introduce", trace3.begin({
             id: traceId
           }), {
-            F: __dxlog_file6,
-            L: 99,
+            F: __dxlog_file7,
+            L: 110,
             S: this,
             C: (f, a) => f(...a)
           });
-          const invitation = await this._callbacks.resolveInvitation(request);
-          if (!invitation) {
-            log4.warn("invitation not found", {
-              invitationId
+          const invitation = this._requireActiveInvitation();
+          this._assertInvitationState(Invitation3.State.CONNECTED);
+          if (invitationId !== invitation?.invitationId) {
+            log5.warn("incorrect invitationId", {
+              expected: invitation.invitationId,
+              actual: invitationId
             }, {
-              F: __dxlog_file6,
-              L: 103,
+              F: __dxlog_file7,
+              L: 116,
               S: this,
               C: (f, a) => f(...a)
             });
-            this._callbacks.onError(new Error("Invitation not found."));
+            this._callbacks.onError(new Error("Incorrect invitationId."));
+            scheduleTask2(this._ctx, () => this.close());
             return {
-              authMethod: Invitation2.AuthMethod.NONE
+              authMethod: Invitation3.AuthMethod.NONE
             };
           }
-          this.invitation = invitation;
-          log4("guest introduced itself", {
+          log5("guest introduced themselves", {
             guestProfile: profile
           }, {
-            F: __dxlog_file6,
-            L: 112,
+            F: __dxlog_file7,
+            L: 125,
             S: this,
             C: (f, a) => f(...a)
           });
           this.guestProfile = profile;
-          this._callbacks.onStateUpdate({
-            ...this.invitation,
-            state: Invitation2.State.READY_FOR_AUTHENTICATION
-          });
-          this._challenge = this.invitation.authMethod === Invitation2.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : void 0;
-          log4.trace("dxos.sdk.invitation-handler.host.introduce", trace3.end({
+          this._callbacks.onStateUpdate(Invitation3.State.READY_FOR_AUTHENTICATION);
+          this._challenge = invitation.authMethod === Invitation3.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : void 0;
+          log5.trace("dxos.sdk.invitation-handler.host.introduce", trace3.end({
             id: traceId
           }), {
-            F: __dxlog_file6,
-            L: 122,
+            F: __dxlog_file7,
+            L: 132,
             S: this,
             C: (f, a) => f(...a)
           });
           return {
-            authMethod: this.invitation.authMethod,
+            authMethod: invitation.authMethod,
             challenge: this._challenge
           };
         },
         authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = PublicKey5.random().toHex();
-          log4.trace("dxos.sdk.invitation-handler.host.authenticate", trace3.begin({
+          log5.trace("dxos.sdk.invitation-handler.host.authenticate", trace3.begin({
             id: traceId
           }), {
-            F: __dxlog_file6,
-            L: 131,
+            F: __dxlog_file7,
+            L: 141,
             S: this,
             C: (f, a) => f(...a)
           });
-          log4("received authentication request", {
+          const invitation = this._requireActiveInvitation();
+          log5("received authentication request", {
             authCode: code
           }, {
-            F: __dxlog_file6,
-            L: 132,
+            F: __dxlog_file7,
+            L: 144,
             S: this,
             C: (f, a) => f(...a)
           });
           let status = AuthenticationResponse.Status.OK;
-          invariant5(this.invitation, "Invitation is not set.", {
-            F: __dxlog_file6,
-            L: 135,
-            S: this,
-            A: [
-              "this.invitation",
-              "'Invitation is not set.'"
-            ]
-          });
-          switch (this.invitation.authMethod) {
-            case Invitation2.AuthMethod.NONE: {
-              log4("authentication not required", void 0, {
-                F: __dxlog_file6,
-                L: 138,
+          this._assertInvitationState([
+            Invitation3.State.AUTHENTICATING,
+            Invitation3.State.READY_FOR_AUTHENTICATION
+          ]);
+          this._callbacks.onStateUpdate(Invitation3.State.AUTHENTICATING);
+          switch (invitation.authMethod) {
+            case Invitation3.AuthMethod.NONE: {
+              log5("authentication not required", void 0, {
+                F: __dxlog_file7,
+                L: 152,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1441,11 +1596,11 @@ var InvitationHostExtension = class extends RpcExtension {
                 status: AuthenticationResponse.Status.OK
               };
             }
-            case Invitation2.AuthMethod.SHARED_SECRET: {
-              if (this.invitation.authCode) {
+            case Invitation3.AuthMethod.SHARED_SECRET: {
+              if (invitation.authCode) {
                 if (this.authenticationRetry++ > MAX_OTP_ATTEMPTS) {
                   status = AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
-                } else if (code !== this.invitation.authCode) {
+                } else if (code !== invitation.authCode) {
                   status = AuthenticationResponse.Status.INVALID_OTP;
                 } else {
                   this.authenticationPassed = true;
@@ -1453,12 +1608,12 @@ var InvitationHostExtension = class extends RpcExtension {
               }
               break;
             }
-            case Invitation2.AuthMethod.KNOWN_PUBLIC_KEY: {
-              if (!this.invitation.guestKeypair) {
+            case Invitation3.AuthMethod.KNOWN_PUBLIC_KEY: {
+              if (!invitation.guestKeypair) {
                 status = AuthenticationResponse.Status.INTERNAL_ERROR;
                 break;
               }
-              const isSignatureValid = this._challenge && verify(this._challenge, Buffer.from(signedChallenge ?? []), this.invitation.guestKeypair.publicKey.asBuffer());
+              const isSignatureValid = this._challenge && verify(this._challenge, Buffer.from(signedChallenge ?? []), invitation.guestKeypair.publicKey.asBuffer());
               if (isSignatureValid) {
                 this.authenticationPassed = true;
               } else {
@@ -1467,11 +1622,11 @@ var InvitationHostExtension = class extends RpcExtension {
               break;
             }
             default: {
-              log4.error("invalid authentication method", {
-                authMethod: this.invitation.authMethod
+              log5.error("invalid authentication method", {
+                authMethod: invitation.authMethod
               }, {
-                F: __dxlog_file6,
-                L: 176,
+                F: __dxlog_file7,
+                L: 190,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1479,14 +1634,24 @@ var InvitationHostExtension = class extends RpcExtension {
               break;
             }
           }
-          log4.trace("dxos.sdk.invitation-handler.host.authenticate", trace3.end({
+          if (![
+            AuthenticationResponse.Status.OK,
+            AuthenticationResponse.Status.INVALID_OTP
+          ].includes(status)) {
+            this._callbacks.onError(new Error(`Authentication failed, with status=${status}`));
+            scheduleTask2(this._ctx, () => this.close());
+            return {
+              status
+            };
+          }
+          log5.trace("dxos.sdk.invitation-handler.host.authenticate", trace3.end({
             id: traceId,
             data: {
               status
             }
           }), {
-            F: __dxlog_file6,
-            L: 182,
+            F: __dxlog_file7,
+            L: 202,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1496,33 +1661,28 @@ var InvitationHostExtension = class extends RpcExtension {
         },
         admit: async (request) => {
           const traceId = PublicKey5.random().toHex();
-          log4.trace("dxos.sdk.invitation-handler.host.admit", trace3.begin({
+          log5.trace("dxos.sdk.invitation-handler.host.admit", trace3.begin({
             id: traceId
           }), {
-            F: __dxlog_file6,
-            L: 188,
+            F: __dxlog_file7,
+            L: 208,
             S: this,
             C: (f, a) => f(...a)
           });
+          const invitation = this._requireActiveInvitation();
           try {
-            invariant5(this.invitation, "Invitation is not set.", {
-              F: __dxlog_file6,
-              L: 191,
-              S: this,
-              A: [
-                "this.invitation",
-                "'Invitation is not set.'"
-              ]
-            });
-            if (isAuthenticationRequired(this.invitation) && !this.authenticationPassed) {
-              throw new Error("Not authenticated");
+            if (isAuthenticationRequired(invitation)) {
+              this._assertInvitationState(Invitation3.State.AUTHENTICATING);
+              if (!this.authenticationPassed) {
+                throw new Error("Not authenticated");
+              }
             }
             const response = await this._callbacks.admit(request);
-            log4.trace("dxos.sdk.invitation-handler.host.admit", trace3.end({
+            log5.trace("dxos.sdk.invitation-handler.host.admit", trace3.end({
               id: traceId
             }), {
-              F: __dxlog_file6,
-              L: 199,
+              F: __dxlog_file7,
+              L: 222,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1538,149 +1698,204 @@ var InvitationHostExtension = class extends RpcExtension {
   async onOpen(context) {
     await super.onOpen(context);
     try {
+      log5("host acquire lock", void 0, {
+        F: __dxlog_file7,
+        L: 237,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
+      log5("host lock acquired", void 0, {
+        F: __dxlog_file7,
+        L: 239,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      const lastState = this._requireActiveInvitation().state;
+      this._callbacks.onStateUpdate(Invitation3.State.CONNECTING);
       await this.rpc.InvitationHostService.options({
-        role: Options.Role.HOST
+        role: Options2.Role.HOST
       });
-      await cancelWithContext(this._ctx, this._remoteOptionsTrigger.wait({
-        timeout: OPTIONS_TIMEOUT
+      log5("options sent", void 0, {
+        F: __dxlog_file7,
+        L: 243,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await cancelWithContext3(this._ctx, this._remoteOptionsTrigger.wait({
+        timeout: OPTIONS_TIMEOUT2
       }));
-      if (this._remoteOptions?.role !== Options.Role.GUEST) {
-        throw new InvalidInvitationExtensionRoleError(void 0, {
-          expected: Options.Role.GUEST,
-          remoteOptions: this._remoteOptions
+      log5("options received", void 0, {
+        F: __dxlog_file7,
+        L: 245,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      if (this._remoteOptions?.role !== Options2.Role.GUEST) {
+        this._callbacks.onStateUpdate(lastState);
+        throw new InvalidInvitationExtensionRoleError2(void 0, {
+          expected: Options2.Role.GUEST,
+          remoteOptions: this._remoteOptions,
+          remotePeerId: context.remotePeerId
         });
       }
-      this._callbacks.onOpen();
+      this._callbacks.onStateUpdate(Invitation3.State.CONNECTED);
+      this._callbacks.onOpen(this._ctx, context);
     } catch (err) {
-      this._callbacks.onError(err);
+      if (this._invitationFlowLock != null) {
+        this._callbacks.onError(err);
+      }
+      if (!this._ctx.disposed) {
+        context.close(err);
+      }
     }
   }
-  async onClose() {
-    await this._ctx.dispose();
+  _requireActiveInvitation() {
+    const invitation = this._callbacks.activeInvitation;
+    if (invitation == null) {
+      scheduleTask2(this._ctx, () => this.close());
+      throw new Error("Active invitation not found");
+    }
+    return invitation;
   }
-};
-var InvitationGuestExtension = class extends RpcExtension {
-  constructor(_callbacks) {
-    super({
-      requested: {
-        InvitationHostService: schema2.getService("dxos.halo.invitations.InvitationHostService")
-      },
-      exposed: {
-        InvitationHostService: schema2.getService("dxos.halo.invitations.InvitationHostService")
-      }
-    });
-    this._callbacks = _callbacks;
-    this._ctx = new Context4();
-    this._remoteOptionsTrigger = new Trigger2();
+  _assertInvitationState(stateOrMany) {
+    const invitation = this._requireActiveInvitation();
+    const validStates = Array.isArray(stateOrMany) ? stateOrMany : [
+      stateOrMany
+    ];
+    if (!validStates.includes(invitation.state)) {
+      scheduleTask2(this._ctx, () => this.close());
+      throw new InvariantViolation(`Expected ${stateToString(invitation.state)} to be one of [${validStates.map(stateToString).join(", ")}]`);
+    }
   }
-  async getHandlers() {
-    return {
-      InvitationHostService: {
-        options: async (options) => {
-          invariant5(!this._remoteOptions, "Remote options already set.", {
-            F: __dxlog_file6,
-            L: 266,
-            S: this,
-            A: [
-              "!this._remoteOptions",
-              "'Remote options already set.'"
-            ]
-          });
-          this._remoteOptions = options;
-          this._remoteOptionsTrigger.wake();
-        },
-        introduce: () => {
-          throw new Error("Method not allowed.");
-        },
-        authenticate: () => {
-          throw new Error("Method not allowed.");
-        },
-        admit: () => {
-          throw new Error("Method not allowed.");
-        }
-      }
-    };
+  async onClose() {
+    await this._destroy();
   }
-  async onOpen(context) {
-    await super.onOpen(context);
-    try {
-      log4("begin options", void 0, {
-        F: __dxlog_file6,
-        L: 287,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      await cancelWithContext(this._ctx, this.rpc.InvitationHostService.options({
-        role: Options.Role.GUEST
-      }));
-      await cancelWithContext(this._ctx, this._remoteOptionsTrigger.wait({
-        timeout: OPTIONS_TIMEOUT
-      }));
-      log4("end options", void 0, {
-        F: __dxlog_file6,
-        L: 290,
+  async onAbort() {
+    await this._destroy();
+  }
+  async _destroy() {
+    await this._ctx.dispose();
+    if (this._invitationFlowLock != null) {
+      this._invitationFlowLock?.release();
+      this._invitationFlowLock = null;
+      log5("invitation flow lock released", void 0, {
+        F: __dxlog_file7,
+        L: 300,
         S: this,
         C: (f, a) => f(...a)
       });
-      if (this._remoteOptions?.role !== Options.Role.HOST) {
-        throw new InvalidInvitationExtensionRoleError(void 0, {
-          expected: Options.Role.HOST,
-          remoteOptions: this._remoteOptions
-        });
-      }
-      this._callbacks.onOpen(this._ctx);
-    } catch (err) {
-      log4("openError", err, {
-        F: __dxlog_file6,
-        L: 300,
+    }
+  }
+};
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== Invitation3.AuthMethod.NONE;
+
+// packages/sdk/client-services/src/packlets/invitations/invitation-topology.ts
+import { invariant as invariant7 } from "@dxos/invariant";
+import { PublicKey as PublicKey6 } from "@dxos/keys";
+import { log as log6 } from "@dxos/log";
+import { Options as Options3 } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { ComplexSet as ComplexSet2 } from "@dxos/util";
+var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-topology.ts";
+var InvitationTopology = class {
+  constructor(_role) {
+    this._role = _role;
+    this._seenPeers = new ComplexSet2(PublicKey6.hash);
+  }
+  init(controller) {
+    invariant7(!this._controller, "Already initialized.", {
+      F: __dxlog_file8,
+      L: 42,
+      S: this,
+      A: [
+        "!this._controller",
+        "'Already initialized.'"
+      ]
+    });
+    this._controller = controller;
+  }
+  update() {
+    invariant7(this._controller, "Not initialized.", {
+      F: __dxlog_file8,
+      L: 47,
+      S: this,
+      A: [
+        "this._controller",
+        "'Not initialized.'"
+      ]
+    });
+    const { ownPeerId, candidates, connected, allPeers } = this._controller.getState();
+    if (this._role === Options3.Role.GUEST) {
+      return;
+    }
+    if (connected.length > 0) {
+      connected.forEach((c) => this._seenPeers.add(c));
+      return;
+    }
+    const firstUnknownPeer = candidates.find((peerId) => !this._seenPeers.has(peerId));
+    this._seenPeers = new ComplexSet2(PublicKey6.hash, allPeers.filter((peerId) => this._seenPeers.has(peerId)));
+    if (firstUnknownPeer != null) {
+      log6("invitation connect", {
+        ownPeerId,
+        remotePeerId: firstUnknownPeer
+      }, {
+        F: __dxlog_file8,
+        L: 69,
         S: this,
         C: (f, a) => f(...a)
       });
-      this._callbacks.onError(err);
+      this._controller.connect(firstUnknownPeer);
+      this._seenPeers.add(firstUnknownPeer);
     }
   }
-  async onClose() {
-    log4("onClose", void 0, {
-      F: __dxlog_file6,
-      L: 306,
+  async onOffer(peer) {
+    invariant7(this._controller, "Not initialized.", {
+      F: __dxlog_file8,
+      L: 76,
       S: this,
-      C: (f, a) => f(...a)
+      A: [
+        "this._controller",
+        "'Not initialized.'"
+      ]
     });
-    await this._ctx.dispose();
+    return !this._seenPeers.has(peer);
+  }
+  async destroy() {
+    this._seenPeers.clear();
+  }
+  toString() {
+    return `InvitationTopology(${this._role === Options3.Role.GUEST ? "guest" : "host"})`;
   }
 };
-var isAuthenticationRequired = (invitation) => invitation.authMethod !== Invitation2.AuthMethod.NONE;
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts";
+var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts";
+var MAX_DELEGATED_INVITATION_HOST_TRIES = 3;
 var InvitationsHandler = class {
   /**
   * @internal
   */
-  constructor(_networkManager) {
+  constructor(_networkManager, _defaultTeleportParams) {
     this._networkManager = _networkManager;
+    this._defaultTeleportParams = _defaultTeleportParams;
   }
   handleInvitationFlow(ctx, stream, protocol, invitation) {
+    const guardedState = this._createGuardedState(ctx, invitation, stream);
     const createExtension = () => {
-      const extension = new InvitationHostExtension({
-        onStateUpdate: (invitation2) => {
-          stream.next({
-            ...invitation2,
-            state: Invitation3.State.READY_FOR_AUTHENTICATION
-          });
+      const extension = new InvitationHostExtension(guardedState.mutex, {
+        get activeInvitation() {
+          return ctx.disposed ? null : guardedState.current;
         },
-        resolveInvitation: async ({ invitationId }) => {
-          if (invitationId && invitationId !== invitation.invitationId) {
-            return void 0;
-          }
-          return invitation;
+        onStateUpdate: (newState) => {
+          guardedState.set(extension, newState);
+          return guardedState.current;
         },
         admit: async (admissionRequest) => {
           try {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
-            invariant6(deviceKey, void 0, {
-              F: __dxlog_file7,
-              L: 87,
+            invariant8(deviceKey, void 0, {
+              F: __dxlog_file9,
+              L: 90,
               S: this,
               A: [
                 "deviceKey",
@@ -1691,123 +1906,128 @@ var InvitationsHandler = class {
             extension.completedTrigger.wake(deviceKey);
             return admissionResponse;
           } catch (err) {
-            stream.error(err);
+            guardedState.error(extension, err);
             throw err;
           }
         },
-        onOpen: () => {
-          scheduleTask2(ctx, async () => {
-            const traceId = PublicKey6.random().toHex();
+        onOpen: (connectionCtx, extensionsCtx) => {
+          let admitted = false;
+          connectionCtx.onDispose(() => {
+            if (!admitted) {
+              guardedState.error(extension, new ContextDisposedError2());
+            }
+          });
+          scheduleTask3(connectionCtx, async () => {
+            const traceId = PublicKey7.random().toHex();
             try {
-              log5.trace("dxos.sdk.invitations-handler.host.onOpen", trace4.begin({
+              log7.trace("dxos.sdk.invitations-handler.host.onOpen", trace4.begin({
                 id: traceId
               }), {
-                F: __dxlog_file7,
-                L: 105,
+                F: __dxlog_file9,
+                L: 115,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              log5("connected", {
+              log7("connected", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 106,
+                F: __dxlog_file9,
+                L: 116,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              stream.next({
-                ...invitation,
-                state: Invitation3.State.CONNECTED
-              });
               const deviceKey = await extension.completedTrigger.wait({
                 timeout: invitation.timeout
               });
-              log5("admitted guest", {
+              log7("admitted guest", {
                 guest: deviceKey,
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 109,
+                F: __dxlog_file9,
+                L: 118,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              stream.next({
-                ...invitation,
-                state: Invitation3.State.SUCCESS
-              });
-              log5.trace("dxos.sdk.invitations-handler.host.onOpen", trace4.end({
+              guardedState.set(extension, Invitation4.State.SUCCESS);
+              log7.trace("dxos.sdk.invitations-handler.host.onOpen", trace4.end({
                 id: traceId
               }), {
-                F: __dxlog_file7,
-                L: 111,
-                S: this,
-                C: (f, a) => f(...a)
-              });
-            } catch (err) {
-              if (err instanceof TimeoutError) {
-                log5("timeout", {
-                  ...protocol.toJSON()
-                }, {
-                  F: __dxlog_file7,
-                  L: 114,
-                  S: this,
-                  C: (f, a) => f(...a)
-                });
-                stream.next({
-                  ...invitation,
-                  state: Invitation3.State.TIMEOUT
-                });
-              } else {
-                log5.error("failed", err, {
-                  F: __dxlog_file7,
-                  L: 117,
-                  S: this,
-                  C: (f, a) => f(...a)
-                });
-                stream.error(err);
-              }
-              log5.trace("dxos.sdk.invitations-handler.host.onOpen", trace4.error({
-                id: traceId,
-                error: err
-              }), {
-                F: __dxlog_file7,
+                F: __dxlog_file9,
                 L: 120,
                 S: this,
                 C: (f, a) => f(...a)
               });
-            } finally {
+              admitted = true;
               if (!invitation.multiUse) {
-                await swarmConnection.close();
                 await ctx.dispose();
               }
+            } catch (err) {
+              if (err instanceof TimeoutError) {
+                if (guardedState.set(extension, Invitation4.State.TIMEOUT)) {
+                  log7("timeout", {
+                    ...protocol.toJSON()
+                  }, {
+                    F: __dxlog_file9,
+                    L: 129,
+                    S: this,
+                    C: (f, a) => f(...a)
+                  });
+                }
+              } else {
+                if (guardedState.error(extension, err)) {
+                  log7.error("failed", err, {
+                    F: __dxlog_file9,
+                    L: 133,
+                    S: this,
+                    C: (f, a) => f(...a)
+                  });
+                }
+              }
+              log7.trace("dxos.sdk.invitations-handler.host.onOpen", trace4.error({
+                id: traceId,
+                error: err
+              }), {
+                F: __dxlog_file9,
+                L: 136,
+                S: this,
+                C: (f, a) => f(...a)
+              });
+              extensionsCtx.close(err);
             }
           });
         },
         onError: (err) => {
-          if (err instanceof InvalidInvitationExtensionRoleError2) {
-            return;
-          }
-          if (err instanceof TimeoutError) {
-            log5("timeout", {
-              ...protocol.toJSON()
+          if (err instanceof InvalidInvitationExtensionRoleError3) {
+            log7("invalid role", {
+              ...err.context
             }, {
-              F: __dxlog_file7,
-              L: 135,
+              F: __dxlog_file9,
+              L: 144,
               S: this,
               C: (f, a) => f(...a)
             });
-            stream.next({
-              ...invitation,
-              state: Invitation3.State.TIMEOUT
-            });
+            return;
+          }
+          if (err instanceof TimeoutError) {
+            if (guardedState.set(extension, Invitation4.State.TIMEOUT)) {
+              log7("timeout", {
+                err
+              }, {
+                F: __dxlog_file9,
+                L: 149,
+                S: this,
+                C: (f, a) => f(...a)
+              });
+            }
           } else {
-            log5.error("failed", err, {
-              F: __dxlog_file7,
-              L: 138,
-              S: this,
-              C: (f, a) => f(...a)
-            });
-            stream.error(err);
+            if (guardedState.error(extension, err)) {
+              log7.error("failed", err, {
+                F: __dxlog_file9,
+                L: 153,
+                S: this,
+                C: (f, a) => f(...a)
+              });
+            }
           }
         }
       });
@@ -1815,58 +2035,32 @@ var InvitationsHandler = class {
     };
     if (invitation.lifetime && invitation.created) {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
-        log5.warn("invitation has already expired", void 0, {
-          F: __dxlog_file7,
-          L: 149,
+        log7.warn("invitation has already expired", void 0, {
+          F: __dxlog_file9,
+          L: 164,
           S: this,
           C: (f, a) => f(...a)
         });
       } else {
-        scheduleTask2(ctx, async () => {
+        scheduleTask3(ctx, async () => {
           await swarmConnection.close();
-          stream.next({
-            ...invitation,
-            state: Invitation3.State.EXPIRED
-          });
+          guardedState.set(null, Invitation4.State.EXPIRED);
           await ctx.dispose();
         }, invitation.created.getTime() + invitation.lifetime * 1e3 - Date.now());
       }
     }
     let swarmConnection;
-    const invitationLabel = "invitation host for " + (invitation.kind === Invitation3.Kind.DEVICE ? "device" : `space ${invitation.spaceKey?.truncate()}`);
-    scheduleTask2(ctx, async () => {
-      const topic = invitation.swarmKey;
-      swarmConnection = await this._networkManager.joinSwarm({
-        topic,
-        peerId: topic,
-        protocolProvider: createTeleportProtocolFactory(async (teleport) => {
-          teleport.addExtension("dxos.halo.invitations", createExtension());
-        }),
-        topology: new StarTopology(topic),
-        label: invitationLabel
-      });
-      ctx.onDispose(() => swarmConnection.close());
-      stream.next({
-        ...invitation,
-        state: Invitation3.State.CONNECTING
-      });
+    scheduleTask3(ctx, async () => {
+      swarmConnection = await this._joinSwarm(ctx, invitation, Options4.Role.HOST, createExtension);
+      guardedState.set(null, Invitation4.State.CONNECTING);
     });
   }
-  acceptInvitation(protocol, invitation, deviceProfile) {
+  acceptInvitation(ctx, stream, protocol, invitation, otpEnteredTrigger, deviceProfile) {
     const { timeout = INVITATION_TIMEOUT } = invitation;
-    invariant6(protocol, void 0, {
-      F: __dxlog_file7,
-      L: 191,
-      S: this,
-      A: [
-        "protocol",
-        ""
-      ]
-    });
     if (deviceProfile) {
-      invariant6(invitation.kind === Invitation3.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
-        F: __dxlog_file7,
-        L: 194,
+      invariant8(invitation.kind === Invitation4.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
+        F: __dxlog_file9,
+        L: 197,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -1874,142 +2068,117 @@ var InvitationsHandler = class {
         ]
       });
     }
-    const authenticated = new Trigger3();
-    let admitted = false;
-    let currentState;
-    const stream = new PushStream();
-    const setState = (newData) => {
-      invariant6(newData.state !== void 0, void 0, {
-        F: __dxlog_file7,
-        L: 205,
-        S: this,
-        A: [
-          "newData.state !== undefined",
-          ""
-        ]
-      });
-      currentState = newData.state;
-      stream.next({
-        ...invitation,
-        ...newData
-      });
-    };
-    const ctx = new Context5({
-      onError: (err) => {
-        if (err instanceof TimeoutError) {
-          log5("timeout", {
-            ...protocol.toJSON()
-          }, {
-            F: __dxlog_file7,
-            L: 213,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          setState({
-            state: Invitation3.State.TIMEOUT
-          });
-        } else {
-          log5.warn("auth failed", err, {
-            F: __dxlog_file7,
-            L: 216,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          stream.error(err);
-        }
-        void ctx.dispose();
-      }
-    });
-    ctx.onDispose(() => {
-      log5("complete", {
-        ...protocol.toJSON()
+    const triedPeersIds = new ComplexSet3(PublicKey7.hash);
+    const guardedState = this._createGuardedState(ctx, invitation, stream);
+    const shouldCancelInvitationFlow = (extension) => {
+      const isLockedByAnotherConnection = guardedState.mutex.isLocked() && !extension.hasFlowLock();
+      log7("should cancel invitation flow", {
+        isLockedByAnotherConnection,
+        invitationType: Invitation4.Type.DELEGATED,
+        triedPeers: triedPeersIds.size
       }, {
-        F: __dxlog_file7,
-        L: 224,
+        F: __dxlog_file9,
+        L: 205,
         S: this,
         C: (f, a) => f(...a)
       });
-      stream.complete();
-    });
+      if (isLockedByAnotherConnection) {
+        return false;
+      }
+      return invitation.type !== Invitation4.Type.DELEGATED || triedPeersIds.size >= MAX_DELEGATED_INVITATION_HOST_TRIES;
+    };
+    let admitted = false;
     const createExtension = () => {
-      let connectionCount = 0;
-      const extension = new InvitationGuestExtension({
-        onOpen: (extensionCtx) => {
-          extensionCtx.onDispose(async () => {
-            log5("extension disposed", {
-              currentState
+      const extension = new InvitationGuestExtension(guardedState.mutex, {
+        onStateUpdate: (newState) => {
+          guardedState.set(extension, newState);
+        },
+        onOpen: (connectionCtx, extensionCtx) => {
+          triedPeersIds.add(extensionCtx.remotePeerId);
+          if (admitted) {
+            extensionCtx.close();
+            return;
+          }
+          connectionCtx.onDispose(async () => {
+            log7("extension disposed", {
+              admitted,
+              currentState: guardedState.current.state
             }, {
-              F: __dxlog_file7,
-              L: 234,
+              F: __dxlog_file9,
+              L: 233,
               S: this,
               C: (f, a) => f(...a)
             });
             if (!admitted) {
-              stream.error(new Error("Remote peer disconnected."));
+              guardedState.error(extension, new ContextDisposedError2());
+              if (shouldCancelInvitationFlow(extension)) {
+                await ctx.dispose();
+              }
             }
           });
-          scheduleTask2(ctx, async () => {
-            const traceId = PublicKey6.random().toHex();
+          scheduleTask3(connectionCtx, async () => {
+            const traceId = PublicKey7.random().toHex();
             try {
-              log5.trace("dxos.sdk.invitations-handler.guest.onOpen", trace4.begin({
+              log7.trace("dxos.sdk.invitations-handler.guest.onOpen", trace4.begin({
                 id: traceId
               }), {
-                F: __dxlog_file7,
-                L: 243,
+                F: __dxlog_file9,
+                L: 245,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              if (++connectionCount > 1) {
-                throw new Error(`multiple connections detected: ${connectionCount}`);
-              }
-              scheduleTask2(ctx, () => ctx.raise(new TimeoutError(timeout)), timeout);
-              log5("connected", {
+              scheduleTask3(connectionCtx, () => {
+                guardedState.set(extension, Invitation4.State.TIMEOUT);
+                extensionCtx.close();
+              }, timeout);
+              log7("connected", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 251,
+                F: __dxlog_file9,
+                L: 256,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              setState({
-                state: Invitation3.State.CONNECTED
-              });
-              log5("introduce", {
+              guardedState.set(extension, Invitation4.State.CONNECTED);
+              log7("introduce", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 255,
+                F: __dxlog_file9,
+                L: 260,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              const introductionResponse = await extension.rpc.InvitationHostService.introduce(protocol.createIntroduction());
-              log5("introduce response", {
+              const introductionResponse = await extension.rpc.InvitationHostService.introduce({
+                invitationId: invitation.invitationId,
+                ...protocol.createIntroduction()
+              });
+              log7("introduce response", {
                 ...protocol.toJSON(),
                 response: introductionResponse
               }, {
-                F: __dxlog_file7,
-                L: 259,
+                F: __dxlog_file9,
+                L: 265,
                 S: this,
                 C: (f, a) => f(...a)
               });
               invitation.authMethod = introductionResponse.authMethod;
               if (isAuthenticationRequired(invitation)) {
                 switch (invitation.authMethod) {
-                  case Invitation3.AuthMethod.SHARED_SECRET:
-                    await this._handleGuestOtpAuth(extension, setState, authenticated, {
+                  case Invitation4.AuthMethod.SHARED_SECRET:
+                    await this._handleGuestOtpAuth(extension, (state) => guardedState.set(extension, state), otpEnteredTrigger, {
                       timeout
                     });
                     break;
-                  case Invitation3.AuthMethod.KNOWN_PUBLIC_KEY:
-                    await this._handleGuestKpkAuth(extension, setState, invitation, introductionResponse);
+                  case Invitation4.AuthMethod.KNOWN_PUBLIC_KEY:
+                    await this._handleGuestKpkAuth(extension, (state) => guardedState.set(extension, state), invitation, introductionResponse);
                     break;
                 }
               }
-              log5("request admission", {
+              log7("request admission", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 275,
+                F: __dxlog_file9,
+                L: 291,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2017,158 +2186,225 @@ var InvitationsHandler = class {
               const admissionResponse = await extension.rpc.InvitationHostService.admit(admissionRequest);
               admitted = true;
               const result = await protocol.accept(admissionResponse, admissionRequest);
-              log5("admitted by host", {
+              log7("admitted by host", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file7,
-                L: 286,
+                F: __dxlog_file9,
+                L: 302,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              setState({
+              await guardedState.complete({
+                ...guardedState.current,
                 ...result,
-                target: invitation.target,
-                state: Invitation3.State.SUCCESS
+                state: Invitation4.State.SUCCESS
               });
-              log5.trace("dxos.sdk.invitations-handler.guest.onOpen", trace4.end({
+              log7.trace("dxos.sdk.invitations-handler.guest.onOpen", trace4.end({
                 id: traceId
               }), {
-                F: __dxlog_file7,
-                L: 288,
+                F: __dxlog_file9,
+                L: 308,
                 S: this,
                 C: (f, a) => f(...a)
               });
             } catch (err) {
               if (err instanceof TimeoutError) {
-                log5("timeout", {
+                log7("timeout", {
                   ...protocol.toJSON()
                 }, {
-                  F: __dxlog_file7,
-                  L: 291,
+                  F: __dxlog_file9,
+                  L: 311,
                   S: this,
                   C: (f, a) => f(...a)
                 });
-                setState({
-                  state: Invitation3.State.TIMEOUT
-                });
+                guardedState.set(extension, Invitation4.State.TIMEOUT);
               } else {
-                log5("auth failed", err, {
-                  F: __dxlog_file7,
-                  L: 294,
+                log7("auth failed", err, {
+                  F: __dxlog_file9,
+                  L: 314,
                   S: this,
                   C: (f, a) => f(...a)
                 });
-                stream.error(err);
+                guardedState.error(extension, err);
               }
-              log5.trace("dxos.sdk.invitations-handler.guest.onOpen", trace4.error({
+              extensionCtx.close(err);
+              log7.trace("dxos.sdk.invitations-handler.guest.onOpen", trace4.error({
                 id: traceId,
                 error: err
               }), {
-                F: __dxlog_file7,
-                L: 297,
+                F: __dxlog_file9,
+                L: 318,
                 S: this,
                 C: (f, a) => f(...a)
               });
-            } finally {
-              await ctx.dispose();
             }
           });
         },
         onError: (err) => {
-          if (err instanceof InvalidInvitationExtensionRoleError2) {
+          if (err instanceof InvalidInvitationExtensionRoleError3) {
             return;
           }
           if (err instanceof TimeoutError) {
-            log5("timeout", {
+            log7("timeout", {
               ...protocol.toJSON()
             }, {
-              F: __dxlog_file7,
-              L: 308,
+              F: __dxlog_file9,
+              L: 327,
               S: this,
               C: (f, a) => f(...a)
             });
-            setState({
-              state: Invitation3.State.TIMEOUT
-            });
+            guardedState.set(extension, Invitation4.State.TIMEOUT);
           } else {
-            log5("auth failed", err, {
-              F: __dxlog_file7,
-              L: 311,
+            log7("auth failed", err, {
+              F: __dxlog_file9,
+              L: 330,
               S: this,
               C: (f, a) => f(...a)
             });
-            stream.error(err);
+            guardedState.error(extension, err);
           }
         }
       });
       return extension;
     };
-    scheduleTask2(ctx, async () => {
+    scheduleTask3(ctx, async () => {
       const error = protocol.checkInvitation(invitation);
       if (error) {
         stream.error(error);
+        await ctx.dispose();
       } else {
-        invariant6(invitation.swarmKey, void 0, {
-          F: __dxlog_file7,
-          L: 325,
+        invariant8(invitation.swarmKey, void 0, {
+          F: __dxlog_file9,
+          L: 345,
           S: this,
           A: [
             "invitation.swarmKey",
             ""
           ]
         });
-        const topic = invitation.swarmKey;
-        const swarmConnection = await this._networkManager.joinSwarm({
-          topic,
-          peerId: PublicKey6.random(),
-          protocolProvider: createTeleportProtocolFactory(async (teleport) => {
-            teleport.addExtension("dxos.halo.invitations", createExtension());
-          }),
-          topology: new StarTopology(topic),
-          label: "invitation guest"
-        });
-        ctx.onDispose(() => swarmConnection.close());
-        setState({
-          state: Invitation3.State.CONNECTING
-        });
+        await this._joinSwarm(ctx, invitation, Options4.Role.GUEST, createExtension);
+        guardedState.set(null, Invitation4.State.CONNECTING);
       }
     });
-    const observable = new AuthenticatingInvitation({
-      initialInvitation: invitation,
-      subscriber: stream.observable,
-      onCancel: async () => {
-        setState({
-          state: Invitation3.State.CANCELLED
-        });
-        await ctx.dispose();
+  }
+  async _joinSwarm(ctx, invitation, role, extensionFactory) {
+    let label;
+    if (role === Options4.Role.GUEST) {
+      label = "invitation guest";
+    } else if (invitation.kind === Invitation4.Kind.DEVICE) {
+      label = "invitation host for device";
+    } else {
+      label = `invitation host for space ${invitation.spaceKey?.truncate()}`;
+    }
+    const swarmConnection = await this._networkManager.joinSwarm({
+      topic: invitation.swarmKey,
+      peerId: PublicKey7.random(),
+      protocolProvider: createTeleportProtocolFactory(async (teleport) => {
+        teleport.addExtension("dxos.halo.invitations", extensionFactory());
+      }, this._defaultTeleportParams),
+      topology: new InvitationTopology(role),
+      label
+    });
+    ctx.onDispose(() => swarmConnection.close());
+    return swarmConnection;
+  }
+  /**
+  * A utility object for serializing invitation state changes by multiple concurrent
+  * invitation flow connections.
+  */
+  _createGuardedState(ctx, invitation, stream) {
+    const mutex = new Mutex();
+    let lastActiveExtension = null;
+    let currentInvitation = {
+      ...invitation
+    };
+    const isStateChangeAllowed = (extension) => {
+      if (ctx.disposed || extension !== null && mutex.isLocked() && !extension.hasFlowLock()) {
+        return false;
+      }
+      return extension == null || lastActiveExtension !== extension || this._isNotTerminal(currentInvitation.state);
+    };
+    return {
+      mutex,
+      get current() {
+        return currentInvitation;
       },
-      onAuthenticate: async (code) => {
-        authenticated.wake(code);
+      // disposing context prevents any further state updates
+      complete: (newState) => {
+        currentInvitation = {
+          ...currentInvitation,
+          ...newState
+        };
+        stream.next(currentInvitation);
+        return ctx.dispose();
+      },
+      set: (extension, newState) => {
+        if (isStateChangeAllowed(extension)) {
+          this._logStateUpdate(currentInvitation, extension, newState);
+          currentInvitation = {
+            ...currentInvitation,
+            state: newState
+          };
+          stream.next(currentInvitation);
+          lastActiveExtension = extension;
+          return true;
+        }
+        return false;
+      },
+      error: (extension, error) => {
+        if (isStateChangeAllowed(extension)) {
+          this._logStateUpdate(currentInvitation, extension, Invitation4.State.ERROR);
+          currentInvitation = {
+            ...currentInvitation,
+            state: Invitation4.State.ERROR
+          };
+          stream.next(currentInvitation);
+          stream.error(error);
+          lastActiveExtension = extension;
+          return true;
+        }
+        return false;
       }
+    };
+  }
+  _logStateUpdate(invitation, actor, newState) {
+    log7("invitation state update", {
+      actor: actor?.constructor.name,
+      newState: stateToString(newState),
+      oldState: stateToString(invitation.state)
+    }, {
+      F: __dxlog_file9,
+      L: 438,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    return observable;
+  }
+  _isNotTerminal(currentState) {
+    return ![
+      Invitation4.State.SUCCESS,
+      Invitation4.State.ERROR,
+      Invitation4.State.CANCELLED,
+      Invitation4.State.TIMEOUT,
+      Invitation4.State.EXPIRED
+    ].includes(currentState);
   }
   async _handleGuestOtpAuth(extension, setState, authenticated, options) {
     for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-      log5("guest waiting for authentication code...", void 0, {
-        F: __dxlog_file7,
-        L: 365,
+      log7("guest waiting for authentication code...", void 0, {
+        F: __dxlog_file9,
+        L: 462,
         S: this,
         C: (f, a) => f(...a)
       });
-      setState({
-        state: Invitation3.State.READY_FOR_AUTHENTICATION
-      });
+      setState(Invitation4.State.READY_FOR_AUTHENTICATION);
       const authCode = await authenticated.wait(options);
-      log5("sending authentication request", void 0, {
-        F: __dxlog_file7,
-        L: 369,
+      log7("sending authentication request", void 0, {
+        F: __dxlog_file9,
+        L: 466,
         S: this,
         C: (f, a) => f(...a)
       });
-      setState({
-        state: Invitation3.State.AUTHENTICATING
-      });
+      setState(Invitation4.State.AUTHENTICATING);
       const response = await extension.rpc.InvitationHostService.authenticate({
         authCode
       });
@@ -2179,11 +2415,11 @@ var InvitationsHandler = class {
         if (attempt === MAX_OTP_ATTEMPTS) {
           throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
         } else {
-          log5("retrying invalid code", {
+          log7("retrying invalid code", {
             attempt
           }, {
-            F: __dxlog_file7,
-            L: 380,
+            F: __dxlog_file9,
+            L: 477,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2199,15 +2435,13 @@ var InvitationsHandler = class {
     if (introductionResponse.challenge == null) {
       throw new Error("challenge missing in the introduction");
     }
-    log5("sending authentication request", void 0, {
-      F: __dxlog_file7,
-      L: 399,
+    log7("sending authentication request", void 0, {
+      F: __dxlog_file9,
+      L: 496,
       S: this,
       C: (f, a) => f(...a)
     });
-    setState({
-      state: Invitation3.State.AUTHENTICATING
-    });
+    setState(Invitation4.State.AUTHENTICATING);
     const signature = sign(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
     const response = await extension.rpc.InvitationHostService.authenticate({
       signedChallenge: signature
@@ -2220,7 +2454,7 @@ var InvitationsHandler = class {
 var createAdmissionKeypair = () => {
   const keypair = createKeyPair();
   return {
-    publicKey: PublicKey6.from(keypair.publicKey),
+    publicKey: PublicKey7.from(keypair.publicKey),
     privateKey: keypair.secretKey
   };
 };
@@ -2323,14 +2557,14 @@ var InvitationsServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts
-import { createAdmissionCredentials, createDelegatedSpaceInvitationCredential, getCredentialAssertion } from "@dxos/credentials";
+import { createAdmissionCredentials, createCancelDelegatedSpaceInvitationCredential, createDelegatedSpaceInvitationCredential, getCredentialAssertion } from "@dxos/credentials";
 import { writeMessages as writeMessages2 } from "@dxos/feed-store";
-import { invariant as invariant7 } from "@dxos/invariant";
-import { log as log6 } from "@dxos/log";
+import { invariant as invariant9 } from "@dxos/invariant";
+import { log as log8 } from "@dxos/log";
 import { AlreadyJoinedError as AlreadyJoinedError2 } from "@dxos/protocols";
-import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
+import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
 import { SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
-var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
+var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -2346,33 +2580,33 @@ var SpaceInvitationProtocol = class {
   }
   getInvitationContext() {
     return {
-      kind: Invitation4.Kind.SPACE,
+      kind: Invitation5.Kind.SPACE,
       spaceKey: this._spaceKey
     };
   }
   async admit(invitation, request, guestProfile) {
-    invariant7(this._spaceKey, void 0, {
-      F: __dxlog_file8,
-      L: 55,
+    invariant9(this._spaceKey, void 0, {
+      F: __dxlog_file10,
+      L: 56,
       S: this,
       A: [
         "this._spaceKey",
         ""
       ]
     });
-    const space = await this._spaceManager.spaces.get(this._spaceKey);
-    invariant7(space, void 0, {
-      F: __dxlog_file8,
-      L: 57,
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    invariant9(space, void 0, {
+      F: __dxlog_file10,
+      L: 58,
       S: this,
       A: [
         "space",
         ""
       ]
     });
-    invariant7(request.space, void 0, {
-      F: __dxlog_file8,
-      L: 59,
+    invariant9(request.space, void 0, {
+      F: __dxlog_file10,
+      L: 60,
       S: this,
       A: [
         "request.space",
@@ -2380,19 +2614,19 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { identityKey, deviceKey } = request.space;
-    log6("writing guest credentials", {
+    log8("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
-      F: __dxlog_file8,
-      L: 62,
+      F: __dxlog_file10,
+      L: 63,
       S: this,
       C: (f, a) => f(...a)
     });
-    const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile, invitation.delegationCredentialId);
-    invariant7(credentials[0].credential, void 0, {
-      F: __dxlog_file8,
-      L: 74,
+    const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, invitation.role ?? SpaceMember.Role.ADMIN, space.inner.spaceState.membershipChainHeads, guestProfile, invitation.delegationCredentialId);
+    invariant9(credentials[0].credential, void 0, {
+      F: __dxlog_file10,
+      L: 77,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2400,9 +2634,9 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const spaceMemberCredential = credentials[0].credential.credential;
-    invariant7(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file8,
-      L: 76,
+    invariant9(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file10,
+      L: 79,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2418,29 +2652,29 @@ var SpaceInvitationProtocol = class {
     };
   }
   async delegate(invitation) {
-    invariant7(this._spaceKey, void 0, {
-      F: __dxlog_file8,
-      L: 89,
+    invariant9(this._spaceKey, void 0, {
+      F: __dxlog_file10,
+      L: 92,
       S: this,
       A: [
         "this._spaceKey",
         ""
       ]
     });
-    const space = await this._spaceManager.spaces.get(this._spaceKey);
-    invariant7(space, void 0, {
-      F: __dxlog_file8,
-      L: 91,
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    invariant9(space, void 0, {
+      F: __dxlog_file10,
+      L: 94,
       S: this,
       A: [
         "space",
         ""
       ]
     });
-    if (invitation.authMethod === Invitation4.AuthMethod.KNOWN_PUBLIC_KEY) {
-      invariant7(invitation.guestKeypair?.publicKey, void 0, {
-        F: __dxlog_file8,
-        L: 93,
+    if (invitation.authMethod === Invitation5.AuthMethod.KNOWN_PUBLIC_KEY) {
+      invariant9(invitation.guestKeypair?.publicKey, void 0, {
+        F: __dxlog_file10,
+        L: 96,
         S: this,
         A: [
           "invitation.guestKeypair?.publicKey",
@@ -2448,12 +2682,12 @@ var SpaceInvitationProtocol = class {
         ]
       });
     }
-    log6("writing delegate space invitation", {
+    log8("writing delegate space invitation", {
       host: this._signingContext.deviceKey,
       id: invitation.invitationId
     }, {
-      F: __dxlog_file8,
-      L: 96,
+      F: __dxlog_file10,
+      L: 99,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2461,14 +2695,14 @@ var SpaceInvitationProtocol = class {
       invitationId: invitation.invitationId,
       authMethod: invitation.authMethod,
       swarmKey: invitation.swarmKey,
-      role: SpaceMember.Role.ADMIN,
+      role: invitation.role ?? SpaceMember.Role.ADMIN,
       expiresOn: invitation.lifetime ? new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime) : void 0,
       multiUse: invitation.multiUse ?? false,
-      guestKey: invitation.authMethod === Invitation4.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
+      guestKey: invitation.authMethod === Invitation5.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
     });
-    invariant7(credential.credential, void 0, {
-      F: __dxlog_file8,
-      L: 116,
+    invariant9(credential.credential, void 0, {
+      F: __dxlog_file10,
+      L: 119,
       S: this,
       A: [
         "credential.credential",
@@ -2480,6 +2714,58 @@ var SpaceInvitationProtocol = class {
     ]);
     return credential.credential.credential.id;
   }
+  async cancelDelegation(invitation) {
+    invariant9(this._spaceKey, void 0, {
+      F: __dxlog_file10,
+      L: 125,
+      S: this,
+      A: [
+        "this._spaceKey",
+        ""
+      ]
+    });
+    invariant9(invitation.type === Invitation5.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
+      F: __dxlog_file10,
+      L: 126,
+      S: this,
+      A: [
+        "invitation.type === Invitation.Type.DELEGATED && invitation.delegationCredentialId",
+        ""
+      ]
+    });
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    invariant9(space, void 0, {
+      F: __dxlog_file10,
+      L: 128,
+      S: this,
+      A: [
+        "space",
+        ""
+      ]
+    });
+    log8("cancelling delegated space invitation", {
+      host: this._signingContext.deviceKey,
+      id: invitation.invitationId
+    }, {
+      F: __dxlog_file10,
+      L: 130,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const credential = await createCancelDelegatedSpaceInvitationCredential(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
+    invariant9(credential.credential, void 0, {
+      F: __dxlog_file10,
+      L: 137,
+      S: this,
+      A: [
+        "credential.credential",
+        ""
+      ]
+    });
+    await writeMessages2(space.inner.controlPipeline.writer, [
+      credential
+    ]);
+  }
   checkInvitation(invitation) {
     if (invitation.spaceKey && this._spaceManager.spaces.has(invitation.spaceKey)) {
       return new AlreadyJoinedError2("Already joined space.");
@@ -2503,9 +2789,9 @@ var SpaceInvitationProtocol = class {
     };
   }
   async accept(response) {
-    invariant7(response.space, void 0, {
-      F: __dxlog_file8,
-      L: 149,
+    invariant9(response.space, void 0, {
+      F: __dxlog_file10,
+      L: 169,
       S: this,
       A: [
         "response.space",
@@ -2514,18 +2800,18 @@ var SpaceInvitationProtocol = class {
     });
     const { credential, controlTimeframe, dataTimeframe } = response.space;
     const assertion = getCredentialAssertion(credential);
-    invariant7(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
-      F: __dxlog_file8,
-      L: 152,
+    invariant9(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
+      F: __dxlog_file10,
+      L: 172,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
         "'Invalid credential'"
       ]
     });
-    invariant7(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
-      F: __dxlog_file8,
-      L: 153,
+    invariant9(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
+      F: __dxlog_file10,
+      L: 173,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -2549,16 +2835,17 @@ var SpaceInvitationProtocol = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts
-import { Event as Event3, PushStream as PushStream2 } from "@dxos/async";
-import { AUTHENTICATION_CODE_LENGTH, CancellableInvitation, INVITATION_TIMEOUT as INVITATION_TIMEOUT2 } from "@dxos/client-protocol";
+import { Event as Event3, PushStream, TimeoutError as TimeoutError2, Trigger as Trigger4 } from "@dxos/async";
+import { AuthenticatingInvitation, AUTHENTICATION_CODE_LENGTH, CancellableInvitation, INVITATION_TIMEOUT as INVITATION_TIMEOUT2 } from "@dxos/client-protocol";
 import { Context as Context6 } from "@dxos/context";
 import { generatePasscode } from "@dxos/credentials";
 import { hasInvitationExpired } from "@dxos/echo-pipeline";
-import { invariant as invariant8 } from "@dxos/invariant";
-import { PublicKey as PublicKey7 } from "@dxos/keys";
-import { log as log7 } from "@dxos/log";
-import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
-var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
+import { invariant as invariant10 } from "@dxos/invariant";
+import { PublicKey as PublicKey8 } from "@dxos/keys";
+import { log as log9 } from "@dxos/log";
+import { Invitation as Invitation6 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
+var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
 var InvitationsManager = class {
   constructor(_invitationsHandler, _getHandler, _metadataStore) {
     this._invitationsHandler = _invitationsHandler;
@@ -2596,9 +2883,9 @@ var InvitationsManager = class {
     try {
       await this._persistIfRequired(handler, stream, invitation);
     } catch (err) {
-      log7.catch(err, void 0, {
-        F: __dxlog_file9,
-        L: 76,
+      log9.catch(err, void 0, {
+        F: __dxlog_file11,
+        L: 77,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2619,9 +2906,9 @@ var InvitationsManager = class {
       const persistentInvitations = this._metadataStore.getInvitations();
       const freshInvitations = persistentInvitations.filter((invitation) => !hasInvitationExpired(invitation));
       const loadTasks = freshInvitations.map((persistentInvitation) => {
-        invariant8(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
-          F: __dxlog_file9,
-          L: 97,
+        invariant10(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
+          F: __dxlog_file11,
+          L: 98,
           S: this,
           A: [
             "!this._createInvitations.get(persistentInvitation.invitationId)",
@@ -2638,9 +2925,9 @@ var InvitationsManager = class {
         invitations: cInvitations.map((invitation) => invitation.get())
       };
     } catch (err) {
-      log7.catch(err, void 0, {
-        F: __dxlog_file9,
-        L: 104,
+      log9.catch(err, void 0, {
+        F: __dxlog_file11,
+        L: 105,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2659,7 +2946,8 @@ var InvitationsManager = class {
       return existingInvitation;
     }
     const handler = this._getHandler(options);
-    const invitation = this._invitationsHandler.acceptInvitation(handler, options, request.deviceProfile);
+    const { ctx, invitation, stream, otpEnteredTrigger } = this._createObservableAcceptingInvitation(handler, options);
+    this._invitationsHandler.acceptInvitation(ctx, stream, handler, options, otpEnteredTrigger, request.deviceProfile);
     this._acceptInvitations.set(invitation.get().invitationId, invitation);
     this.invitationAccepted.emit(invitation.get());
     this._onInvitationComplete(invitation, () => {
@@ -2669,15 +2957,15 @@ var InvitationsManager = class {
     return invitation;
   }
   async authenticate({ invitationId, authCode }) {
-    log7("authenticating...", void 0, {
-      F: __dxlog_file9,
-      L: 133,
+    log9("authenticating...", void 0, {
+      F: __dxlog_file11,
+      L: 135,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant8(invitationId, void 0, {
-      F: __dxlog_file9,
-      L: 134,
+    invariant10(invitationId, void 0, {
+      F: __dxlog_file11,
+      L: 136,
       S: this,
       A: [
         "invitationId",
@@ -2686,11 +2974,11 @@ var InvitationsManager = class {
     });
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
-      log7.warn("invalid invitation", {
+      log9.warn("invalid invitation", {
         invitationId
       }, {
-        F: __dxlog_file9,
-        L: 137,
+        F: __dxlog_file11,
+        L: 139,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2699,17 +2987,17 @@ var InvitationsManager = class {
     }
   }
   async cancelInvitation({ invitationId }) {
-    log7("cancelInvitation...", {
+    log9("cancelInvitation...", {
       invitationId
     }, {
-      F: __dxlog_file9,
-      L: 144,
+      F: __dxlog_file11,
+      L: 146,
       S: this,
       C: (f, a) => f(...a)
-    });
-    invariant8(invitationId, void 0, {
-      F: __dxlog_file9,
-      L: 145,
+    });
+    invariant10(invitationId, void 0, {
+      F: __dxlog_file11,
+      L: 147,
       S: this,
       A: [
         "invitationId",
@@ -2721,6 +3009,10 @@ var InvitationsManager = class {
       if (created.get().persistent) {
         await this._metadataStore.removeInvitation(invitationId);
       }
+      if (created.get().type === Invitation6.Type.DELEGATED) {
+        const handler = this._getHandler(created.get());
+        await handler.cancelDelegation(created.get());
+      }
       await created.cancel();
       this._createInvitations.delete(invitationId);
       this.removedCreated.emit(created.get());
@@ -2751,8 +3043,8 @@ var InvitationsManager = class {
     }
   }
   _createInvitation(protocol, options) {
-    const { invitationId = PublicKey7.random().toHex(), type = Invitation5.Type.INTERACTIVE, authMethod = Invitation5.AuthMethod.SHARED_SECRET, state = Invitation5.State.INIT, timeout = INVITATION_TIMEOUT2, swarmKey = PublicKey7.random(), persistent = options?.authMethod !== Invitation5.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
-    const authCode = options?.authCode ?? (authMethod === Invitation5.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0);
+    const { invitationId = PublicKey8.random().toHex(), type = Invitation6.Type.INTERACTIVE, authMethod = Invitation6.AuthMethod.SHARED_SECRET, state = Invitation6.State.INIT, timeout = INVITATION_TIMEOUT2, swarmKey = PublicKey8.random(), persistent = options?.authMethod !== Invitation6.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, role = SpaceMember2.Role.ADMIN, lifetime = 86400, multiUse = false } = options ?? {};
+    const authCode = options?.authCode ?? (authMethod === Invitation6.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0);
     return {
       invitationId,
       type,
@@ -2761,17 +3053,18 @@ var InvitationsManager = class {
       swarmKey,
       authCode,
       timeout,
-      persistent: persistent && type !== Invitation5.Type.DELEGATED,
-      guestKeypair: guestKeypair ?? (authMethod === Invitation5.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
+      persistent: persistent && type !== Invitation6.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === Invitation6.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
       created,
       lifetime,
+      role,
       multiUse,
       delegationCredentialId: options?.delegationCredentialId,
       ...protocol.getInvitationContext()
     };
   }
   _createObservableInvitation(handler, invitation) {
-    const stream = new PushStream2();
+    const stream = new PushStream();
     const ctx = new Context6({
       onError: (err) => {
         stream.error(err);
@@ -2779,11 +3072,11 @@ var InvitationsManager = class {
       }
     });
     ctx.onDispose(() => {
-      log7("complete", {
+      log9("complete", {
         ...handler.toJSON()
       }, {
-        F: __dxlog_file9,
-        L: 228,
+        F: __dxlog_file11,
+        L: 236,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2795,7 +3088,7 @@ var InvitationsManager = class {
       onCancel: async () => {
         stream.next({
           ...invitation,
-          state: Invitation5.State.CANCELLED
+          state: Invitation6.State.CANCELLED
         });
         await ctx.dispose();
       }
@@ -2806,8 +3099,73 @@ var InvitationsManager = class {
       observableInvitation
     };
   }
+  _createObservableAcceptingInvitation(handler, initialState) {
+    const otpEnteredTrigger = new Trigger4();
+    const stream = new PushStream();
+    const ctx = new Context6({
+      onError: (err) => {
+        if (err instanceof TimeoutError2) {
+          log9("timeout", {
+            ...handler.toJSON()
+          }, {
+            F: __dxlog_file11,
+            L: 256,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          stream.next({
+            ...initialState,
+            state: Invitation6.State.TIMEOUT
+          });
+        } else {
+          log9.warn("auth failed", err, {
+            F: __dxlog_file11,
+            L: 259,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          stream.next({
+            ...initialState,
+            state: Invitation6.State.ERROR
+          });
+        }
+        void ctx.dispose();
+      }
+    });
+    ctx.onDispose(() => {
+      log9("complete", {
+        ...handler.toJSON()
+      }, {
+        F: __dxlog_file11,
+        L: 266,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      stream.complete();
+    });
+    const invitation = new AuthenticatingInvitation({
+      initialInvitation: initialState,
+      subscriber: stream.observable,
+      onCancel: async () => {
+        stream.next({
+          ...initialState,
+          state: Invitation6.State.CANCELLED
+        });
+        await ctx.dispose();
+      },
+      onAuthenticate: async (code) => {
+        otpEnteredTrigger.wake(code);
+      }
+    });
+    return {
+      ctx,
+      invitation,
+      stream,
+      otpEnteredTrigger
+    };
+  }
   async _persistIfRequired(handler, changeStream, invitation) {
-    if (invitation.type === Invitation5.Type.DELEGATED && invitation.delegationCredentialId == null) {
+    if (invitation.type === Invitation6.Type.DELEGATED && invitation.delegationCredentialId == null) {
       const delegationCredentialId = await handler.delegate(invitation);
       changeStream.next({
         ...invitation,
@@ -2822,9 +3180,9 @@ var InvitationsManager = class {
     try {
       await this._metadataStore.removeInvitation(invitation.invitationId);
     } catch (err) {
-      log7.catch(err, void 0, {
-        F: __dxlog_file9,
-        L: 260,
+      log9.catch(err, void 0, {
+        F: __dxlog_file11,
+        L: 302,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2919,22 +3277,23 @@ ClientRpcServer = _ts_decorate3([
 ], ClientRpcServer);
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-import { Event as Event6, asyncTimeout, scheduleTask as scheduleTask4, sleep as sleep2, synchronized, trackLeaks } from "@dxos/async";
+import { Event as Event6, asyncTimeout, scheduleTask as scheduleTask5, sleep as sleep2, synchronized, trackLeaks } from "@dxos/async";
 import { AUTH_TIMEOUT as AUTH_TIMEOUT2 } from "@dxos/client-protocol";
-import { cancelWithContext as cancelWithContext2, Context as Context8, ContextDisposedError } from "@dxos/context";
+import { cancelWithContext as cancelWithContext4, Context as Context8, ContextDisposedError as ContextDisposedError3 } from "@dxos/context";
 import { timed, warnAfterTimeout } from "@dxos/debug";
 import { createMappedFeedWriter } from "@dxos/echo-pipeline";
 import { AutomergeDocumentLoaderImpl } from "@dxos/echo-pipeline";
 import { TYPE_PROPERTIES } from "@dxos/echo-schema";
-import { failedInvariant, invariant as invariant10 } from "@dxos/invariant";
-import { PublicKey as PublicKey9 } from "@dxos/keys";
-import { log as log9 } from "@dxos/log";
+import { failedInvariant, invariant as invariant12 } from "@dxos/invariant";
+import { PublicKey as PublicKey10 } from "@dxos/keys";
+import { log as log11 } from "@dxos/log";
 import { CancelledError, SystemError } from "@dxos/protocols";
 import { SpaceState, CreateEpochRequest } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { AdmittedFeed as AdmittedFeed3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe2 } from "@dxos/timeframe";
 import { trace as trace6 } from "@dxos/tracing";
-import { ComplexSet as ComplexSet3, assignDeep } from "@dxos/util";
+import { ComplexSet as ComplexSet5, assignDeep } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/automerge-space-state.ts
 import { Event as Event4 } from "@dxos/async";
@@ -2975,15 +3334,15 @@ var AutomergeSpaceState = class {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
-import { DeferredTask, Event as Event5, scheduleTask as scheduleTask3, sleep, TimeoutError as TimeoutError2, Trigger as Trigger4 } from "@dxos/async";
+import { DeferredTask, Event as Event5, scheduleTask as scheduleTask4, sleep, TimeoutError as TimeoutError3, Trigger as Trigger5 } from "@dxos/async";
 import { Context as Context7, rejectOnDispose } from "@dxos/context";
-import { invariant as invariant9 } from "@dxos/invariant";
-import { PublicKey as PublicKey8 } from "@dxos/keys";
-import { log as log8 } from "@dxos/log";
-import { schema as schema3 } from "@dxos/protocols";
-import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
-import { ComplexMap as ComplexMap2, ComplexSet as ComplexSet2, entry } from "@dxos/util";
-var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
+import { invariant as invariant11 } from "@dxos/invariant";
+import { PublicKey as PublicKey9 } from "@dxos/keys";
+import { log as log10 } from "@dxos/log";
+import { schema as schema4 } from "@dxos/protocols";
+import { RpcExtension as RpcExtension3 } from "@dxos/teleport";
+import { ComplexMap as ComplexMap2, ComplexSet as ComplexSet4, entry } from "@dxos/util";
+var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
@@ -2993,8 +3352,8 @@ var NotarizationPlugin = class {
     this._ctx = new Context7();
     this._extensionOpened = new Event5();
     this._extensions = /* @__PURE__ */ new Set();
-    this._processedCredentials = new ComplexSet2(PublicKey8.hash);
-    this._processCredentialsTriggers = new ComplexMap2(PublicKey8.hash);
+    this._processedCredentials = new ComplexSet4(PublicKey9.hash);
+    this._processCredentialsTriggers = new ComplexMap2(PublicKey9.hash);
   }
   get hasWriter() {
     return !!this._writer;
@@ -3008,16 +3367,16 @@ var NotarizationPlugin = class {
   * Request credentials to be notarized.
   */
   async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
-    log8("notarize", {
+    log10("notarize", {
       credentials
     }, {
-      F: __dxlog_file10,
+      F: __dxlog_file12,
       L: 90,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant9(credentials.every((credential) => credential.id), "Credentials must have an id", {
-      F: __dxlog_file10,
+    invariant11(credentials.every((credential) => credential.id), "Credentials must have an id", {
+      F: __dxlog_file12,
       L: 91,
       S: this,
       A: [
@@ -3025,13 +3384,13 @@ var NotarizationPlugin = class {
         "'Credentials must have an id'"
       ]
     });
-    const errors = new Trigger4();
+    const errors = new Trigger5();
     const ctx = this._ctx.derive({
       onError: (err) => {
-        log8.warn("Notarization error", {
+        log10.warn("Notarization error", {
           err
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 99,
           S: this,
           C: (f, a) => f(...a)
@@ -3042,18 +3401,18 @@ var NotarizationPlugin = class {
     });
     opCtx?.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
-      scheduleTask3(ctx, () => {
-        log8.warn("Notarization timeout", {
+      scheduleTask4(ctx, () => {
+        log10.warn("Notarization timeout", {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 111,
           S: this,
           C: (f, a) => f(...a)
         });
         void ctx.dispose();
-        errors.throw(new TimeoutError2(timeout, "Notarization timed out"));
+        errors.throw(new TimeoutError3(timeout, "Notarization timed out"));
       }, timeout);
     }
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
@@ -3067,24 +3426,24 @@ var NotarizationPlugin = class {
           ...this._extensions
         ].find((peer2) => !peersTried.has(peer2));
         if (!peer) {
-          log8.info("Exhausted all peers to notarize with", {
+          log10.info("Exhausted all peers to notarize with", {
             retryIn: retryTimeout
           }, {
-            F: __dxlog_file10,
+            F: __dxlog_file12,
             L: 136,
             S: this,
             C: (f, a) => f(...a)
           });
           peersTried.clear();
-          scheduleTask3(ctx, () => notarizeTask.schedule(), retryTimeout);
+          scheduleTask4(ctx, () => notarizeTask.schedule(), retryTimeout);
           return;
         }
         peersTried.add(peer);
-        log8("try notarizing", {
+        log10("try notarizing", {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 143,
           S: this,
           C: (f, a) => f(...a)
@@ -3092,8 +3451,8 @@ var NotarizationPlugin = class {
         await peer.rpc.NotarizationService.notarize({
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
-        log8("success", void 0, {
-          F: __dxlog_file10,
+        log10("success", void 0, {
+          F: __dxlog_file12,
           L: 147,
           S: this,
           C: (f, a) => f(...a)
@@ -3101,8 +3460,8 @@ var NotarizationPlugin = class {
         await sleep(successDelay);
       } catch (err) {
         if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
-          log8.info("error notarizing (recoverable)", err, {
-            F: __dxlog_file10,
+          log10.info("error notarizing (recoverable)", err, {
+            F: __dxlog_file12,
             L: 151,
             S: this,
             C: (f, a) => f(...a)
@@ -3119,8 +3478,8 @@ var NotarizationPlugin = class {
         allNotarized,
         errors.wait()
       ]);
-      log8("done", void 0, {
-        F: __dxlog_file10,
+      log10("done", void 0, {
+        F: __dxlog_file12,
         L: 162,
         S: this,
         C: (f, a) => f(...a)
@@ -3141,8 +3500,8 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    invariant9(!this._writer, "Writer already set.", {
-      F: __dxlog_file10,
+    invariant11(!this._writer, "Writer already set.", {
+      F: __dxlog_file12,
       L: 181,
       S: this,
       A: [
@@ -3156,7 +3515,7 @@ var NotarizationPlugin = class {
     if (this._processedCredentials.has(id)) {
       return;
     }
-    await entry(this._processCredentialsTriggers, id).orInsert(new Trigger4()).value.wait();
+    await entry(this._processCredentialsTriggers, id).orInsert(new Trigger5()).value.wait();
   }
   /**
   * Requests from other peers to notarize credentials.
@@ -3166,8 +3525,8 @@ var NotarizationPlugin = class {
       throw new Error(WRITER_NOT_SET_ERROR_CODE);
     }
     for (const credential of request.credentials ?? []) {
-      invariant9(credential.id, "Credential must have an id", {
-        F: __dxlog_file10,
+      invariant11(credential.id, "Credential must have an id", {
+        F: __dxlog_file12,
         L: 200,
         S: this,
         A: [
@@ -3184,10 +3543,10 @@ var NotarizationPlugin = class {
   createExtension() {
     const extension = new NotarizationTeleportExtension({
       onOpen: async () => {
-        log8("extension opened", {
+        log10("extension opened", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 211,
           S: this,
           C: (f, a) => f(...a)
@@ -3196,10 +3555,10 @@ var NotarizationPlugin = class {
         this._extensionOpened.emit();
       },
       onClose: async () => {
-        log8("extension closed", {
+        log10("extension closed", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file10,
+          F: __dxlog_file12,
           L: 216,
           S: this,
           C: (f, a) => f(...a)
@@ -3211,14 +3570,14 @@ var NotarizationPlugin = class {
     return extension;
   }
 };
-var NotarizationTeleportExtension = class extends RpcExtension2 {
+var NotarizationTeleportExtension = class extends RpcExtension3 {
   constructor(_params) {
     super({
       requested: {
-        NotarizationService: schema3.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: schema4.getService("dxos.mesh.teleport.notarization.NotarizationService")
       },
       exposed: {
-        NotarizationService: schema3.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: schema4.getService("dxos.mesh.teleport.notarization.NotarizationService")
       }
     });
     this._params = _params;
@@ -3253,7 +3612,7 @@ function _ts_decorate4(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
+var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
 var DataSpace = class {
   constructor(params) {
     this._ctx = new Context8();
@@ -3277,19 +3636,19 @@ var DataSpace = class {
     this._metadataStore = params.metadataStore;
     this._signingContext = params.signingContext;
     this._callbacks = params.callbacks ?? {};
-    this._automergeHost = params.automergeHost;
+    this._echoHost = params.echoHost;
     this.authVerifier = new TrustedKeySetAuthVerifier({
-      trustedKeysProvider: () => new ComplexSet3(PublicKey9.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => !member.removed).map((member) => member.key)),
+      trustedKeysProvider: () => new ComplexSet5(PublicKey10.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => member.role !== SpaceMember3.Role.REMOVED).map((member) => member.key)),
       update: this._inner.stateUpdate,
       authTimeout: AUTH_TIMEOUT2
     });
     this._cache = params.cache;
     this._state = params.initialState;
-    log9("new state", {
+    log11("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 140,
+      F: __dxlog_file13,
+      L: 137,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3335,11 +3694,11 @@ var DataSpace = class {
     await this._inner.spaceState.addCredentialProcessor(this._automergeSpaceState);
     await this._inner.open(new Context8());
     this._state = SpaceState.CONTROL_ONLY;
-    log9("new state", {
+    log11("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 198,
+      F: __dxlog_file13,
+      L: 195,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3353,11 +3712,11 @@ var DataSpace = class {
   async _close() {
     await this._callbacks.beforeClose?.();
     this._state = SpaceState.CLOSED;
-    log9("new state", {
+    log11("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 212,
+      F: __dxlog_file13,
+      L: 209,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3381,32 +3740,32 @@ var DataSpace = class {
   * Initialize the data pipeline in a separate task.
   */
   initializeDataPipelineAsync() {
-    scheduleTask4(this._ctx, async () => {
+    scheduleTask5(this._ctx, async () => {
       try {
         this.metrics.pipelineInitBegin = /* @__PURE__ */ new Date();
         await this.initializeDataPipeline();
       } catch (err) {
-        if (err instanceof CancelledError || err instanceof ContextDisposedError) {
-          log9("data pipeline initialization cancelled", err, {
-            F: __dxlog_file11,
-            L: 245,
+        if (err instanceof CancelledError || err instanceof ContextDisposedError3) {
+          log11("data pipeline initialization cancelled", err, {
+            F: __dxlog_file13,
+            L: 242,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
-        log9.error("Error initializing data pipeline", err, {
-          F: __dxlog_file11,
-          L: 249,
+        log11.error("Error initializing data pipeline", err, {
+          F: __dxlog_file13,
+          L: 246,
           S: this,
           C: (f, a) => f(...a)
         });
         this._state = SpaceState.ERROR;
-        log9("new state", {
+        log11("new state", {
           state: SpaceState[this._state]
         }, {
-          F: __dxlog_file11,
-          L: 251,
+          F: __dxlog_file13,
+          L: 248,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3422,31 +3781,31 @@ var DataSpace = class {
       throw new SystemError("Invalid operation");
     }
     this._state = SpaceState.INITIALIZING;
-    log9("new state", {
+    log11("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 267,
+      F: __dxlog_file13,
+      L: 264,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._initializeAndReadControlPipeline();
     await sleep2(1);
     this._automergeSpaceState.startProcessingRootDocs();
-    await cancelWithContext2(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
-    log9("data pipeline ready", void 0, {
-      F: __dxlog_file11,
-      L: 279,
+    await cancelWithContext4(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
+    log11("data pipeline ready", void 0, {
+      F: __dxlog_file13,
+      L: 276,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._callbacks.beforeReady?.();
     this._state = SpaceState.READY;
-    log9("new state", {
+    log11("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 283,
+      F: __dxlog_file13,
+      L: 280,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3460,9 +3819,9 @@ var DataSpace = class {
     });
     this.metrics.controlPipelineReady = /* @__PURE__ */ new Date();
     await this._createWritableFeeds();
-    log9("writable feeds created", void 0, {
-      F: __dxlog_file11,
-      L: 299,
+    log11("writable feeds created", void 0, {
+      F: __dxlog_file13,
+      L: 296,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3520,21 +3879,21 @@ var DataSpace = class {
     }
   }
   _onNewAutomergeRoot(rootUrl) {
-    log9("loading automerge root doc for space", {
+    log11("loading automerge root doc for space", {
       space: this.key,
       rootUrl
     }, {
-      F: __dxlog_file11,
-      L: 365,
+      F: __dxlog_file13,
+      L: 362,
       S: this,
       C: (f, a) => f(...a)
     });
-    this._automergeHost._requestedDocs.add(rootUrl);
-    const handle = this._automergeHost.repo.find(rootUrl);
+    this._echoHost.replicateDocument(rootUrl);
+    const handle = this._echoHost.automergeRepo.find(rootUrl);
     queueMicrotask(async () => {
       try {
         await warnAfterTimeout(5e3, "Automerge root doc load timeout (DataSpace)", async () => {
-          await cancelWithContext2(this._ctx, handle.whenReady());
+          await cancelWithContext4(this._ctx, handle.whenReady());
         });
         if (this._ctx.disposed) {
           return;
@@ -3548,16 +3907,16 @@ var DataSpace = class {
           });
         }
       } catch (err) {
-        if (err instanceof ContextDisposedError) {
+        if (err instanceof ContextDisposedError3) {
           return;
         }
-        log9.warn("error loading automerge root doc", {
+        log11.warn("error loading automerge root doc", {
           space: this.key,
           rootUrl,
           err
         }, {
-          F: __dxlog_file11,
-          L: 388,
+          F: __dxlog_file13,
+          L: 385,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3595,7 +3954,7 @@ var DataSpace = class {
         break;
       case CreateEpochRequest.Migration.INIT_AUTOMERGE:
         {
-          const document = this._automergeHost.repo.create();
+          const document = this._echoHost.automergeRepo.create();
           epoch = {
             previousId: this._automergeSpaceState.lastEpoch?.id,
             number: (this._automergeSpaceState.lastEpoch?.subject.assertion.number ?? -1) + 1,
@@ -3607,12 +3966,12 @@ var DataSpace = class {
       case CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY:
         {
           const currentRootUrl = this._automergeSpaceState.rootUrl;
-          const rootHandle = this._automergeHost.repo.find(currentRootUrl);
-          await cancelWithContext2(this._ctx, asyncTimeout(rootHandle.whenReady(), 1e4));
-          const newRoot = this._automergeHost.repo.create(rootHandle.docSync());
-          invariant10(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
-            F: __dxlog_file11,
-            L: 438,
+          const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
+          await cancelWithContext4(this._ctx, asyncTimeout(rootHandle.whenReady(), 1e4));
+          const newRoot = this._echoHost.automergeRepo.create(rootHandle.docSync());
+          invariant12(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
+            F: __dxlog_file13,
+            L: 435,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -3629,21 +3988,21 @@ var DataSpace = class {
         break;
       case CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT:
         {
-          log9.info("Fragmenting", void 0, {
-            F: __dxlog_file11,
-            L: 450,
+          log11.info("Fragmenting", void 0, {
+            F: __dxlog_file13,
+            L: 447,
             S: this,
             C: (f, a) => f(...a)
           });
           const currentRootUrl = this._automergeSpaceState.rootUrl;
-          const rootHandle = this._automergeHost.repo.find(currentRootUrl);
-          await cancelWithContext2(this._ctx, asyncTimeout(rootHandle.whenReady(), 1e4));
+          const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
+          await cancelWithContext4(this._ctx, asyncTimeout(rootHandle.whenReady(), 1e4));
           const objects = Object.entries(rootHandle.docSync().objects);
           const properties = objects.find(([_, value]) => value.system.type?.itemId === TYPE_PROPERTIES);
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
-          invariant10(properties, "Properties not found", {
-            F: __dxlog_file11,
-            L: 460,
+          invariant12(properties, "Properties not found", {
+            F: __dxlog_file13,
+            L: 457,
             S: this,
             A: [
               "properties",
@@ -3656,17 +4015,17 @@ var DataSpace = class {
               properties
             ])
           };
-          const newRoot = this._automergeHost.repo.create(newSpaceDoc);
-          invariant10(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
-            F: __dxlog_file11,
-            L: 465,
+          const newRoot = this._echoHost.automergeRepo.create(newSpaceDoc);
+          invariant12(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
+            F: __dxlog_file13,
+            L: 462,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
               ""
             ]
           });
-          const docLoader = new AutomergeDocumentLoaderImpl(this.key, this._automergeHost.repo);
+          const docLoader = new AutomergeDocumentLoaderImpl(this.key, this._echoHost.automergeRepo);
           await docLoader.loadSpaceRootDocHandle(this._ctx, {
             rootUrl: newRoot.url
           });
@@ -3724,11 +4083,11 @@ var DataSpace = class {
     await this._metadataStore.setSpaceState(this.key, SpaceState.INACTIVE);
     await this._close();
     this._state = SpaceState.INACTIVE;
-    log9("new state", {
+    log11("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file11,
-      L: 531,
+      F: __dxlog_file13,
+      L: 528,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3783,20 +4142,20 @@ DataSpace = _ts_decorate4([
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
 import { Event as Event7, synchronized as synchronized2, trackLeaks as trackLeaks2 } from "@dxos/async";
-import { Context as Context9, cancelWithContext as cancelWithContext3 } from "@dxos/context";
+import { Context as Context9, cancelWithContext as cancelWithContext5 } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
-import { invariant as invariant11 } from "@dxos/invariant";
-import { PublicKey as PublicKey10 } from "@dxos/keys";
-import { log as log10 } from "@dxos/log";
+import { invariant as invariant13 } from "@dxos/invariant";
+import { PublicKey as PublicKey11 } from "@dxos/keys";
+import { log as log12 } from "@dxos/log";
 import { trace as trace7 } from "@dxos/protocols";
-import { Invitation as Invitation6, SpaceState as SpaceState2 } from "@dxos/protocols/proto/dxos/client/services";
+import { Invitation as Invitation7, SpaceState as SpaceState2 } from "@dxos/protocols/proto/dxos/client/services";
 import { Gossip as Gossip2, Presence as Presence2 } from "@dxos/teleport-extension-gossip";
 import { ComplexMap as ComplexMap3, deferFunction as deferFunction2, forEachAsync } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/genesis.ts
 import { createCredential } from "@dxos/credentials";
 import { failUndefined } from "@dxos/debug";
-import { AdmittedFeed as AdmittedFeed4, SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { AdmittedFeed as AdmittedFeed4, SpaceMember as SpaceMember4 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe3 } from "@dxos/timeframe";
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
@@ -3816,7 +4175,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey: space.key,
-        role: SpaceMember2.Role.ADMIN,
+        role: SpaceMember4.Role.OWNER,
         profile: signingContext.getProfile(),
         genesisFeedKey: space.controlFeedKey ?? failUndefined()
       }
@@ -3874,23 +4233,23 @@ function _ts_decorate5(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
+var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
 var PRESENCE_ANNOUNCE_INTERVAL = 1e4;
 var PRESENCE_OFFLINE_TIMEOUT = 2e4;
 var DataSpaceManager = class {
-  constructor(_spaceManager, _metadataStore, _keyring, _signingContext, _feedStore, _automergeHost, _invitationsManager, params) {
+  constructor(_spaceManager, _metadataStore, _keyring, _signingContext, _feedStore, _echoHost, _invitationsManager, params) {
     this._spaceManager = _spaceManager;
     this._metadataStore = _metadataStore;
     this._keyring = _keyring;
     this._signingContext = _signingContext;
     this._feedStore = _feedStore;
-    this._automergeHost = _automergeHost;
+    this._echoHost = _echoHost;
     this._invitationsManager = _invitationsManager;
     this._ctx = new Context9();
     this.updated = new Event7();
-    this._spaces = new ComplexMap3(PublicKey10.hash);
+    this._spaces = new ComplexMap3(PublicKey11.hash);
     this._isOpen = false;
-    this._instanceId = PublicKey10.random().toHex();
+    this._instanceId = PublicKey11.random().toHex();
     const { spaceMemberPresenceAnnounceInterval = PRESENCE_ANNOUNCE_INTERVAL, spaceMemberPresenceOfflineTimeout = PRESENCE_OFFLINE_TIMEOUT } = params ?? {};
     this._spaceMemberPresenceAnnounceInterval = spaceMemberPresenceAnnounceInterval;
     this._spaceMemberPresenceOfflineTimeout = spaceMemberPresenceOfflineTimeout;
@@ -3900,46 +4259,46 @@ var DataSpaceManager = class {
     return this._spaces;
   }
   async open() {
-    log10("open", void 0, {
-      F: __dxlog_file12,
-      L: 101,
+    log12("open", void 0, {
+      F: __dxlog_file14,
+      L: 102,
       S: this,
       C: (f, a) => f(...a)
     });
-    log10.trace("dxos.echo.data-space-manager.open", trace7.begin({
+    log12.trace("dxos.echo.data-space-manager.open", trace7.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file12,
-      L: 102,
+      F: __dxlog_file14,
+      L: 103,
       S: this,
       C: (f, a) => f(...a)
     });
-    log10("metadata loaded", {
+    log12("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
-      F: __dxlog_file12,
-      L: 103,
+      F: __dxlog_file14,
+      L: 104,
       S: this,
       C: (f, a) => f(...a)
     });
     await forEachAsync(this._metadataStore.spaces, async (spaceMetadata) => {
       try {
-        log10("load space", {
+        log12("load space", {
           spaceMetadata
         }, {
-          F: __dxlog_file12,
-          L: 107,
+          F: __dxlog_file14,
+          L: 108,
           S: this,
           C: (f, a) => f(...a)
         });
         await this._constructSpace(spaceMetadata);
       } catch (err) {
-        log10.error("Error loading space", {
+        log12.error("Error loading space", {
           spaceMetadata,
           err
         }, {
-          F: __dxlog_file12,
-          L: 110,
+          F: __dxlog_file14,
+          L: 111,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3952,19 +4311,19 @@ var DataSpaceManager = class {
         space.initializeDataPipelineAsync();
       }
     }
-    log10.trace("dxos.echo.data-space-manager.open", trace7.end({
+    log12.trace("dxos.echo.data-space-manager.open", trace7.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file12,
-      L: 123,
+      F: __dxlog_file14,
+      L: 124,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async close() {
-    log10("close", void 0, {
-      F: __dxlog_file12,
-      L: 128,
+    log12("close", void 0, {
+      F: __dxlog_file14,
+      L: 129,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3978,9 +4337,9 @@ var DataSpaceManager = class {
   * Creates a new space writing the genesis credentials to the control feed.
   */
   async createSpace() {
-    invariant11(this._isOpen, "Not open.", {
-      F: __dxlog_file12,
-      L: 141,
+    invariant13(this._isOpen, "Not open.", {
+      F: __dxlog_file14,
+      L: 142,
       S: this,
       A: [
         "this._isOpen",
@@ -3997,27 +4356,22 @@ var DataSpaceManager = class {
       dataFeedKey,
       state: SpaceState2.ACTIVE
     };
-    log10("creating space...", {
+    log12("creating space...", {
       spaceKey
     }, {
-      F: __dxlog_file12,
-      L: 153,
+      F: __dxlog_file14,
+      L: 154,
       S: this,
       C: (f, a) => f(...a)
     });
-    const automergeRoot = this._automergeHost.repo.create();
-    automergeRoot.change((doc) => {
-      doc.access = {
-        spaceKey: spaceKey.toHex()
-      };
-    });
+    const automergeRootUrl = await this._echoHost.createSpaceRoot(spaceKey);
     const space = await this._constructSpace(metadata);
-    const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRoot.url);
+    const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRootUrl);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    invariant11(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file12,
-      L: 166,
+    invariant13(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file14,
+      L: 163,
       S: this,
       A: [
         "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -4031,26 +4385,26 @@ var DataSpaceManager = class {
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
-    log10("accept space", {
+    log12("accept space", {
       opts
     }, {
-      F: __dxlog_file12,
-      L: 178,
+      F: __dxlog_file14,
+      L: 175,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant11(this._isOpen, "Not open.", {
-      F: __dxlog_file12,
-      L: 179,
+    invariant13(this._isOpen, "Not open.", {
+      F: __dxlog_file14,
+      L: 176,
       S: this,
       A: [
         "this._isOpen",
         "'Not open.'"
       ]
     });
-    invariant11(!this._spaces.has(opts.spaceKey), "Space already exists.", {
-      F: __dxlog_file12,
-      L: 180,
+    invariant13(!this._spaces.has(opts.spaceKey), "Space already exists.", {
+      F: __dxlog_file14,
+      L: 177,
       S: this,
       A: [
         "!this._spaces.has(opts.spaceKey)",
@@ -4075,17 +4429,17 @@ var DataSpaceManager = class {
   * TODO(dmaretskyi): Consider removing.
   */
   async waitUntilSpaceReady(spaceKey) {
-    await cancelWithContext3(this._ctx, this.updated.waitForCondition(() => {
+    await cancelWithContext5(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
       return !!space && space.state === SpaceState2.READY;
     }));
   }
   async _constructSpace(metadata) {
-    log10("construct space", {
+    log12("construct space", {
       metadata
     }, {
-      F: __dxlog_file12,
-      L: 213,
+      F: __dxlog_file14,
+      L: 210,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4117,13 +4471,13 @@ var DataSpaceManager = class {
           remotePeerId: session.remotePeerId
         }));
         session.addExtension("dxos.mesh.teleport.notarization", dataSpace.notarizationPlugin.createExtension());
-        this._automergeHost.authorizeDevice(space.key, session.remotePeerId);
-        session.addExtension("dxos.mesh.teleport.automerge", this._automergeHost.createExtension());
+        this._echoHost.authorizeDevice(space.key, session.remotePeerId);
+        session.addExtension("dxos.mesh.teleport.automerge", this._echoHost.createReplicationExtension());
       },
       onAuthFailure: () => {
-        log10.warn("auth failure", void 0, {
-          F: __dxlog_file12,
-          L: 250,
+        log12.warn("auth failure", void 0, {
+          F: __dxlog_file14,
+          L: 247,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4143,25 +4497,26 @@ var DataSpaceManager = class {
       presence,
       keyring: this._keyring,
       feedStore: this._feedStore,
+      echoHost: this._echoHost,
       signingContext: this._signingContext,
       callbacks: {
         beforeReady: async () => {
-          log10("before space ready", {
+          log12("before space ready", {
             space: space.key
           }, {
-            F: __dxlog_file12,
-            L: 271,
+            F: __dxlog_file14,
+            L: 269,
             S: this,
             C: (f, a) => f(...a)
           });
         },
         afterReady: async () => {
-          log10("after space ready", {
+          log12("after space ready", {
             space: space.key,
             open: this._isOpen
           }, {
-            F: __dxlog_file12,
-            L: 274,
+            F: __dxlog_file14,
+            L: 272,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4173,18 +4528,17 @@ var DataSpaceManager = class {
           }
         },
         beforeClose: async () => {
-          log10("before space close", {
+          log12("before space close", {
             space: space.key
           }, {
-            F: __dxlog_file12,
-            L: 281,
+            F: __dxlog_file14,
+            L: 279,
             S: this,
             C: (f, a) => f(...a)
           });
         }
       },
-      cache: metadata.cache,
-      automergeHost: this._automergeHost
+      cache: metadata.cache
     });
     if (metadata.state !== SpaceState2.INACTIVE) {
       await dataSpace.open();
@@ -4213,8 +4567,8 @@ var DataSpaceManager = class {
   async _createDelegatedInvitations(space, invitations) {
     const tasks = invitations.map(([credentialId, invitation]) => {
       return this._invitationsManager.createInvitation({
-        type: Invitation6.Type.DELEGATED,
-        kind: Invitation6.Kind.SPACE,
+        type: Invitation7.Type.DELEGATED,
+        kind: Invitation7.Kind.SPACE,
         spaceKey: space.key,
         authMethod: invitation.authMethod,
         invitationId: invitation.invitationId,
@@ -4248,14 +4602,15 @@ DataSpaceManager = _ts_decorate5([
 ], DataSpaceManager);
 
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
-import { EventSubscriptions as EventSubscriptions2, UpdateScheduler, scheduleTask as scheduleTask5 } from "@dxos/async";
+import { EventSubscriptions as EventSubscriptions2, UpdateScheduler, scheduleTask as scheduleTask6 } from "@dxos/async";
 import { Stream as Stream10 } from "@dxos/codec-protobuf";
 import { raise as raise2 } from "@dxos/debug";
-import { invariant as invariant12 } from "@dxos/invariant";
-import { log as log11 } from "@dxos/log";
+import { invariant as invariant14 } from "@dxos/invariant";
+import { log as log13 } from "@dxos/log";
 import { ApiError, SpaceNotFoundError, encodeError } from "@dxos/protocols";
-import { SpaceMember as SpaceMember3, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
-var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
+import { SpaceMember as SpaceMember5, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as HaloSpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _getDataSpaceManager) {
     this._identityManager = _identityManager;
@@ -4286,16 +4641,19 @@ var SpacesServiceImpl = class {
       }
     }
   }
+  async updateMemberRole(_) {
+    throw new Error("not implemented");
+  }
   querySpaces() {
     return new Stream10(({ next, ctx }) => {
       const scheduler = new UpdateScheduler(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space));
-        log11("update", {
+        log13("update", {
           spaces
         }, {
-          F: __dxlog_file13,
-          L: 77,
+          F: __dxlog_file15,
+          L: 82,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4305,7 +4663,7 @@ var SpacesServiceImpl = class {
       }, {
         maxFrequency: false ? void 0 : 2
       });
-      scheduleTask5(ctx, async () => {
+      scheduleTask6(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const subscriptions = new EventSubscriptions2();
         ctx.onDispose(() => subscriptions.clear());
@@ -4339,7 +4697,7 @@ var SpacesServiceImpl = class {
   }
   subscribeMessages({ spaceKey, channel }) {
     return new Stream10(({ ctx, next }) => {
-      scheduleTask5(ctx, async () => {
+      scheduleTask6(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
         const handle = space.listen(getChannelId(channel), (message) => {
@@ -4358,7 +4716,7 @@ var SpacesServiceImpl = class {
         }
       };
       ctx.onDispose(() => space.spaceState.removeCredentialProcessor(processor));
-      scheduleTask5(ctx, async () => {
+      scheduleTask6(ctx, async () => {
         await space.spaceState.addCredentialProcessor(processor);
         if (noTail) {
           close();
@@ -4376,18 +4734,18 @@ var SpacesServiceImpl = class {
           }
         });
       } else {
-        invariant12(!credential.id, "Id on unsigned credentials is not allowed", {
-          F: __dxlog_file13,
-          L: 164,
+        invariant14(!credential.id, "Id on unsigned credentials is not allowed", {
+          F: __dxlog_file15,
+          L: 169,
           S: this,
           A: [
             "!credential.id",
             "'Id on unsigned credentials is not allowed'"
           ]
         });
-        invariant12(this._identityManager.identity, "Identity is not available", {
-          F: __dxlog_file13,
-          L: 165,
+        invariant14(this._identityManager.identity, "Identity is not available", {
+          F: __dxlog_file15,
+          L: 170,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -4395,9 +4753,9 @@ var SpacesServiceImpl = class {
           ]
         });
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
-        invariant12(credential.issuer.equals(signer.getIssuer()), void 0, {
-          F: __dxlog_file13,
-          L: 167,
+        invariant14(credential.issuer.equals(signer.getIssuer()), void 0, {
+          F: __dxlog_file15,
+          L: 172,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -4452,7 +4810,7 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.removed ? SpaceMember3.PresenceState.REMOVED : isMe || peers.length > 0 ? SpaceMember3.PresenceState.ONLINE : SpaceMember3.PresenceState.OFFLINE,
+          presence: member.role === HaloSpaceMember.Role.REMOVED ? SpaceMember5.PresenceState.REMOVED : isMe || peers.length > 0 ? SpaceMember5.PresenceState.ONLINE : SpaceMember5.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4465,53 +4823,22 @@ var SpacesServiceImpl = class {
 var getChannelId = (channel) => `user-channel/${channel}`;
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-import { Trigger as Trigger5 } from "@dxos/async";
+import { Trigger as Trigger6 } from "@dxos/async";
 import { Context as Context10, Resource } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
 import { failUndefined as failUndefined2 } from "@dxos/debug";
-import { AutomergeHost, MetadataStore, SnapshotStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
+import { EchoHost } from "@dxos/echo-db";
+import { MetadataStore, SnapshotStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
 import { FeedFactory, FeedStore } from "@dxos/feed-store";
-import { IndexMetadataStore, IndexStore, Indexer, createStorageCallbacks } from "@dxos/indexing";
-import { invariant as invariant13 } from "@dxos/invariant";
+import { invariant as invariant15 } from "@dxos/invariant";
 import { Keyring } from "@dxos/keyring";
-import { PublicKey as PublicKey11 } from "@dxos/keys";
-import { log as log12 } from "@dxos/log";
+import { PublicKey as PublicKey12 } from "@dxos/keys";
+import { log as log14 } from "@dxos/log";
 import { InvalidStorageVersionError, STORAGE_VERSION, trace as trace8 } from "@dxos/protocols";
-import { Invitation as Invitation7 } from "@dxos/protocols/proto/dxos/client/services";
+import { Invitation as Invitation8 } from "@dxos/protocols/proto/dxos/client/services";
 import { BlobStore } from "@dxos/teleport-extension-object-sync";
 import { trace as Trace2 } from "@dxos/tracing";
 import { safeInstanceof } from "@dxos/util";
-
-// packages/sdk/client-services/src/packlets/indexing/util.ts
-import { getHeads } from "@dxos/automerge/automerge";
-import { idCodec } from "@dxos/protocols";
-var createSelectedDocumentsIterator = (automergeHost) => (
-  /**
-  * Get object data blobs from Automerge Repo by ids.
-  * @param ids
-  */
-  // TODO(mykola): Unload automerge handles after usage.
-  async function* loadDocuments(ids) {
-    for (const id of ids) {
-      const { documentId, objectId } = idCodec.decode(id);
-      const handle = automergeHost.repo.handles[documentId] ?? automergeHost.repo.find(documentId);
-      if (!handle.isReady()) {
-        await handle.whenReady();
-      }
-      const doc = handle.docSync();
-      const hash = getHeads(doc).join("");
-      yield doc.objects?.[objectId] ? [
-        {
-          id,
-          object: doc.objects[objectId],
-          currentHash: hash
-        }
-      ] : [];
-    }
-  }
-);
-
-// packages/sdk/client-services/src/packlets/services/service-context.ts
 function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -4522,7 +4849,7 @@ function _ts_decorate6(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
+var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
 var ServiceContext = class extends Resource {
   constructor(storage, level, networkManager, signalManager, _runtimeParams) {
     super();
@@ -4531,9 +4858,9 @@ var ServiceContext = class extends Resource {
     this.networkManager = networkManager;
     this.signalManager = signalManager;
     this._runtimeParams = _runtimeParams;
-    this.initialized = new Trigger5();
+    this.initialized = new Trigger6();
     this._handlerFactories = /* @__PURE__ */ new Map();
-    this._instanceId = PublicKey11.random().toHex();
+    this._instanceId = PublicKey12.random().toHex();
     this.metadataStore = new MetadataStore(storage.createDirectory("metadata"));
     this.snapshotStore = new SnapshotStore(storage.createDirectory("snapshots"));
     this.blobStore = new BlobStore(storage.createDirectory("blobs"));
@@ -4556,48 +4883,33 @@ var ServiceContext = class extends Resource {
       snapshotStore: this.snapshotStore
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager, this._runtimeParams);
-    this.indexMetadata = new IndexMetadataStore({
-      db: level.sublevel("index-metadata")
-    });
-    this.automergeHost = new AutomergeHost({
-      directory: storage.createDirectory("automerge"),
-      db: level.sublevel("automerge"),
-      storageCallbacks: createStorageCallbacks({
-        host: () => this.automergeHost,
-        metadata: this.indexMetadata
-      })
-    });
-    this.indexer = new Indexer({
-      db: this.level,
-      indexStore: new IndexStore({
-        db: level.sublevel("index-storage")
-      }),
-      metadataStore: this.indexMetadata,
-      loadDocuments: createSelectedDocumentsIterator(this.automergeHost)
+    this.echoHost = new EchoHost({
+      kv: this.level,
+      storage: this.storage
     });
-    this.invitations = new InvitationsHandler(this.networkManager);
+    this.invitations = new InvitationsHandler(this.networkManager, _runtimeParams?.invitationConnectionDefaultParams);
     this.invitationsManager = new InvitationsManager(this.invitations, (invitation) => this.getInvitationHandler(invitation), this.metadataStore);
-    this._handlerFactories.set(Invitation7.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? failUndefined2(), this._acceptIdentity.bind(this)));
+    this._handlerFactories.set(Invitation8.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? failUndefined2(), this._acceptIdentity.bind(this)));
   }
   async _open(ctx) {
     await this._checkStorageVersion();
-    log12("opening...", void 0, {
-      F: __dxlog_file14,
-      L: 164,
+    log14("opening...", void 0, {
+      F: __dxlog_file16,
+      L: 152,
       S: this,
       C: (f, a) => f(...a)
     });
-    log12.trace("dxos.sdk.service-context.open", trace8.begin({
+    log14.trace("dxos.sdk.service-context.open", trace8.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file14,
-      L: 165,
+      F: __dxlog_file16,
+      L: 153,
       S: this,
       C: (f, a) => f(...a)
     });
     await this.signalManager.open();
     await this.networkManager.open();
-    await this.automergeHost.open();
+    await this.echoHost.open(ctx);
     await this.metadataStore.load();
     await this.spaceManager.open();
     await this.identityManager.open(ctx);
@@ -4605,51 +4917,50 @@ var ServiceContext = class extends Resource {
       await this._initialize(ctx);
     }
     const loadedInvitations = await this.invitationsManager.loadPersistentInvitations();
-    log12("loaded persistent invitations", {
+    log14("loaded persistent invitations", {
       count: loadedInvitations.invitations?.length
     }, {
-      F: __dxlog_file14,
-      L: 178,
+      F: __dxlog_file16,
+      L: 166,
       S: this,
       C: (f, a) => f(...a)
     });
-    log12.trace("dxos.sdk.service-context.open", trace8.end({
+    log14.trace("dxos.sdk.service-context.open", trace8.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file14,
-      L: 180,
+      F: __dxlog_file16,
+      L: 168,
       S: this,
       C: (f, a) => f(...a)
     });
-    log12("opened", void 0, {
-      F: __dxlog_file14,
-      L: 181,
+    log14("opened", void 0, {
+      F: __dxlog_file16,
+      L: 169,
       S: this,
       C: (f, a) => f(...a)
     });
   }
-  async _close() {
-    log12("closing...", void 0, {
-      F: __dxlog_file14,
-      L: 185,
+  async _close(ctx) {
+    log14("closing...", void 0, {
+      F: __dxlog_file16,
+      L: 173,
       S: this,
       C: (f, a) => f(...a)
     });
     if (this._deviceSpaceSync && this.identityManager.identity) {
       await this.identityManager.identity.space.spaceState.removeCredentialProcessor(this._deviceSpaceSync);
     }
-    await this.automergeHost.close();
     await this.dataSpaceManager?.close();
     await this.identityManager.close();
     await this.spaceManager.close();
     await this.feedStore.close();
+    await this.metadataStore.close();
+    await this.echoHost.close(ctx);
     await this.networkManager.close();
     await this.signalManager.close();
-    await this.metadataStore.close();
-    await this.indexer.destroy();
-    log12("closed", void 0, {
-      F: __dxlog_file14,
-      L: 198,
+    log14("closed", void 0, {
+      F: __dxlog_file16,
+      L: 185,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4661,9 +4972,9 @@ var ServiceContext = class extends Resource {
   }
   getInvitationHandler(invitation) {
     const factory = this._handlerFactories.get(invitation.kind);
-    invariant13(factory, `Unknown invitation kind: ${invitation.kind}`, {
-      F: __dxlog_file14,
-      L: 209,
+    invariant15(factory, `Unknown invitation kind: ${invitation.kind}`, {
+      F: __dxlog_file16,
+      L: 196,
       S: this,
       A: [
         "factory",
@@ -4693,9 +5004,9 @@ var ServiceContext = class extends Resource {
   }
   // Called when identity is created.
   async _initialize(ctx) {
-    log12("initializing spaces...", void 0, {
-      F: __dxlog_file14,
-      L: 240,
+    log14("initializing spaces...", void 0, {
+      F: __dxlog_file16,
+      L: 227,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4713,12 +5024,12 @@ var ServiceContext = class extends Resource {
         });
       }
     };
-    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.keyring, signingContext, this.feedStore, this.automergeHost, this.invitationsManager, this._runtimeParams);
+    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.keyring, signingContext, this.feedStore, this.echoHost, this.invitationsManager, this._runtimeParams);
     await this.dataSpaceManager.open();
-    this._handlerFactories.set(Invitation7.Kind.SPACE, (invitation) => {
-      invariant13(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
-        F: __dxlog_file14,
-        L: 265,
+    this._handlerFactories.set(Invitation8.Kind.SPACE, (invitation) => {
+      invariant15(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
+        F: __dxlog_file16,
+        L: 252,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -4738,33 +5049,33 @@ var ServiceContext = class extends Resource {
           return;
         }
         if (!this.dataSpaceManager) {
-          log12("dataSpaceManager not initialized yet, ignoring space admission", {
+          log14("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file14,
-            L: 281,
+            F: __dxlog_file16,
+            L: 268,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
         if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
-          log12("space already exists, ignoring space admission", {
+          log14("space already exists, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file14,
-            L: 285,
+            F: __dxlog_file16,
+            L: 272,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
         try {
-          log12("accepting space recorded in halo", {
+          log14("accepting space recorded in halo", {
             details: assertion
           }, {
-            F: __dxlog_file14,
-            L: 290,
+            F: __dxlog_file16,
+            L: 277,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4773,9 +5084,9 @@ var ServiceContext = class extends Resource {
             genesisFeedKey: assertion.genesisFeedKey
           });
         } catch (err) {
-          log12.catch(err, void 0, {
-            F: __dxlog_file14,
-            L: 296,
+          log14.catch(err, void 0, {
+            F: __dxlog_file16,
+            L: 283,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4821,15 +5132,16 @@ var ServiceRegistry = class {
 };
 
 // packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts
+import { asyncTimeout as asyncTimeout2 } from "@dxos/async";
 import { getFirstStreamValue } from "@dxos/codec-protobuf";
 import { credentialTypeFilter } from "@dxos/credentials";
-import { invariant as invariant14 } from "@dxos/invariant";
+import { invariant as invariant16 } from "@dxos/invariant";
 import { STORAGE_VERSION as STORAGE_VERSION2 } from "@dxos/protocols";
-import { SpaceMember as SpaceMember4 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember6 } from "@dxos/protocols/proto/dxos/client/services";
 import { TRACE_PROCESSOR } from "@dxos/tracing";
 
 // packages/sdk/client-services/src/version.ts
-var DXOS_VERSION = "0.5.1-next.2ad6c47";
+var DXOS_VERSION = "0.5.1-next.5a770e3";
 
 // packages/sdk/client-services/src/packlets/services/platform.ts
 import { Platform } from "@dxos/protocols/proto/dxos/client/services";
@@ -4862,7 +5174,7 @@ var getPlatform = () => {
 };
 
 // packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts
-var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts";
+var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts";
 var DEFAULT_TIMEOUT = 1e3;
 var createDiagnostics = async (clientServices, serviceContext, config) => {
   const diagnostics = {
@@ -4876,63 +5188,55 @@ var createDiagnostics = async (clientServices, serviceContext, config) => {
     },
     trace: TRACE_PROCESSOR.getDiagnostics()
   };
-  {
-    invariant14(clientServices.LoggingService, "SystemService is not available.", {
-      F: __dxlog_file15,
-      L: 108,
-      S: void 0,
-      A: [
-        "clientServices.LoggingService",
-        "'SystemService is not available.'"
-      ]
-    });
-    diagnostics.metrics = await getFirstStreamValue(clientServices.LoggingService.queryMetrics({}), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0);
-  }
-  if (typeof navigator !== "undefined" && navigator.storage) {
-    const map = /* @__PURE__ */ new Map();
-    const dir = await navigator.storage.getDirectory();
-    for await (const filename of dir?.keys()) {
-      const idx = filename.indexOf("-", filename.indexOf("-") + 1);
-      if (idx === -1) {
-        continue;
+  await Promise.all([
+    (async () => {
+      invariant16(clientServices.LoggingService, "SystemService is not available.", {
+        F: __dxlog_file17,
+        L: 110,
+        S: void 0,
+        A: [
+          "clientServices.LoggingService",
+          "'SystemService is not available.'"
+        ]
+      });
+      diagnostics.metrics = await getFirstStreamValue(clientServices.LoggingService.queryMetrics({}), {
+        timeout: DEFAULT_TIMEOUT
+      }).catch(() => void 0);
+    })(),
+    (async () => {
+      diagnostics.storage = await asyncTimeout2(getStorageDiagnostics(), DEFAULT_TIMEOUT).catch(() => void 0);
+    })(),
+    async () => {
+      const identity = serviceContext.identityManager.identity;
+      if (identity) {
+        diagnostics.identity = {
+          identityKey: identity.identityKey,
+          spaceKey: identity.space.key,
+          profile: identity.profileDocument
+        };
+        const { devices } = await getFirstStreamValue(clientServices.DevicesService.queryDevices(), {
+          timeout: DEFAULT_TIMEOUT
+        }).catch(() => void 0) ?? {};
+        diagnostics.devices = devices;
+        if (serviceContext.dataSpaceManager) {
+          diagnostics.spaces = await Promise.all(Array.from(serviceContext.dataSpaceManager.spaces.values()).map((space) => getSpaceStats(space)) ?? []);
+        }
+        const { feeds = [] } = await getFirstStreamValue(clientServices.DevtoolsHost.subscribeToFeeds({}), {
+          timeout: DEFAULT_TIMEOUT
+        }).catch(() => void 0) ?? {};
+        diagnostics.feeds = feeds.map(({ feedKey, bytes, length }) => ({
+          feedKey,
+          bytes,
+          length
+        }));
+        const status = await getFirstStreamValue(clientServices.NetworkService.queryStatus(), {
+          timeout: DEFAULT_TIMEOUT
+        }).catch(() => void 0);
+        diagnostics.networkStatus = status;
+        diagnostics.swarms = serviceContext.networkManager.connectionLog?.swarms;
       }
-      map.set(filename.slice(0, idx), (map.get(filename.slice(0, idx)) ?? 0) + 1);
-    }
-    diagnostics.storage = Array.from(map.entries()).sort((a, b) => b[1] - a[1]).map(([file, count]) => ({
-      file,
-      count
-    }));
-  }
-  const identity = serviceContext.identityManager.identity;
-  if (identity) {
-    diagnostics.identity = {
-      identityKey: identity.identityKey,
-      spaceKey: identity.space.key,
-      profile: identity.profileDocument
-    };
-    const { devices } = await getFirstStreamValue(clientServices.DevicesService.queryDevices(), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0) ?? {};
-    diagnostics.devices = devices;
-    if (serviceContext.dataSpaceManager) {
-      diagnostics.spaces = await Promise.all(Array.from(serviceContext.dataSpaceManager.spaces.values()).map((space) => getSpaceStats(space)) ?? []);
     }
-    const { feeds = [] } = await getFirstStreamValue(clientServices.DevtoolsHost.subscribeToFeeds({}), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0) ?? {};
-    diagnostics.feeds = feeds.map(({ feedKey, bytes, length }) => ({
-      feedKey,
-      bytes,
-      length
-    }));
-    const status = await getFirstStreamValue(clientServices.NetworkService.queryStatus(), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0);
-    diagnostics.networkStatus = status;
-    diagnostics.swarms = serviceContext.networkManager.connectionLog?.swarms;
-  }
+  ]);
   diagnostics.config = config.values;
   return diagnostics;
 };
@@ -4951,7 +5255,7 @@ var getSpaceStats = async (space) => {
           displayName: member.assertion.profile?.displayName
         }
       },
-      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember4.PresenceState.ONLINE : SpaceMember4.PresenceState.OFFLINE
+      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember6.PresenceState.ONLINE : SpaceMember6.PresenceState.OFFLINE
     })),
     pipeline: {
       // TODO(burdon): Pick properties from credentials if needed.
@@ -4969,11 +5273,29 @@ var getSpaceStats = async (space) => {
   }
   return stats;
 };
+var getStorageDiagnostics = async () => {
+  if (typeof navigator === "undefined" || !navigator.storage) {
+    return void 0;
+  }
+  const map = /* @__PURE__ */ new Map();
+  const dir = await navigator.storage.getDirectory();
+  for await (const filename of dir?.keys()) {
+    const idx = filename.indexOf("-", filename.indexOf("-") + 1);
+    if (idx === -1) {
+      continue;
+    }
+    map.set(filename.slice(0, idx), (map.get(filename.slice(0, idx)) ?? 0) + 1);
+  }
+  return Array.from(map.entries()).sort((a, b) => b[1] - a[1]).map(([file, count]) => ({
+    file,
+    count
+  }));
+};
 
 // packages/sdk/client-services/src/packlets/diagnostics/browser-diagnostics-broadcast.ts
-import { Trigger as Trigger6 } from "@dxos/async";
-import { log as log13 } from "@dxos/log";
-var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/browser-diagnostics-broadcast.ts";
+import { Trigger as Trigger7 } from "@dxos/async";
+import { log as log15 } from "@dxos/log";
+var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/browser-diagnostics-broadcast.ts";
 var CHANNEL_NAME = "dxos.diagnostics.broadcast";
 var MessageType;
 (function(MessageType2) {
@@ -4988,7 +5310,7 @@ var createCollectDiagnosticsBroadcastSender = () => {
       let expectedResponse = "probe-ack";
       let channel;
       try {
-        const trigger = new Trigger6();
+        const trigger = new Trigger7();
         channel = new BroadcastChannel(CHANNEL_NAME);
         channel.onmessage = (msg) => {
           if (expectedResponse === msg.data.type) {
@@ -5041,8 +5363,8 @@ var createCollectDiagnosticsBroadcastHandler = (systemService) => {
             });
           }
         } catch (error) {
-          log13.catch(error, void 0, {
-            F: __dxlog_file16,
+          log15.catch(error, void 0, {
+            F: __dxlog_file18,
             L: 77,
             S: void 0,
             C: (f, a) => f(...a)
@@ -5073,12 +5395,11 @@ import { jsonKeyReplacer as jsonKeyReplacer2, nonNullable } from "@dxos/util";
 import { Event as Event9, synchronized as synchronized3 } from "@dxos/async";
 import { clientServiceBundle, defaultKey, Properties } from "@dxos/client-protocol";
 import { Context as Context11 } from "@dxos/context";
-import { DataServiceImpl, encodeReference } from "@dxos/echo-pipeline";
+import { encodeReference } from "@dxos/echo-protocol";
 import { getTypeReference } from "@dxos/echo-schema";
-import { QueryServiceImpl } from "@dxos/indexing";
-import { invariant as invariant16 } from "@dxos/invariant";
-import { PublicKey as PublicKey14 } from "@dxos/keys";
-import { log as log16 } from "@dxos/log";
+import { invariant as invariant18 } from "@dxos/invariant";
+import { PublicKey as PublicKey15 } from "@dxos/keys";
+import { log as log18 } from "@dxos/log";
 import { WebsocketSignalManager } from "@dxos/messaging";
 import { NetworkManager, createSimplePeerTransportFactory } from "@dxos/network-manager";
 import { trace as trace9 } from "@dxos/protocols";
@@ -5090,9 +5411,9 @@ import { WebsocketRpcClient } from "@dxos/websocket-rpc";
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
 import { EventSubscriptions as EventSubscriptions3 } from "@dxos/async";
 import { Stream as Stream11 } from "@dxos/codec-protobuf";
-import { invariant as invariant15 } from "@dxos/invariant";
+import { invariant as invariant17 } from "@dxos/invariant";
 import { Device as Device2, DeviceKind as DeviceKind2 } from "@dxos/protocols/proto/dxos/client/services";
-var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
+var __dxlog_file19 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
     this._identityManager = _identityManager;
@@ -5109,8 +5430,8 @@ var DevicesServiceImpl = class {
             devices: []
           });
         } else {
-          invariant15(this._identityManager.identity?.presence, "presence not present", {
-            F: __dxlog_file17,
+          invariant17(this._identityManager.identity?.presence, "presence not present", {
+            F: __dxlog_file19,
             L: 32,
             S: this,
             A: [
@@ -5170,9 +5491,9 @@ var DevicesServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/locks/browser.ts
-import { asyncTimeout as asyncTimeout2, Trigger as Trigger7 } from "@dxos/async";
+import { asyncTimeout as asyncTimeout3, Trigger as Trigger8 } from "@dxos/async";
 import { RESOURCE_LOCK_TIMEOUT } from "@dxos/client-protocol";
-import { log as log14, logInfo } from "@dxos/log";
+import { log as log16, logInfo } from "@dxos/log";
 function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -5183,7 +5504,7 @@ function _ts_decorate7(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/browser.ts";
+var __dxlog_file20 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/browser.ts";
 var Message;
 (function(Message2) {
   Message2["ACQUIRING"] = "acquiring";
@@ -5191,7 +5512,7 @@ var Message;
 var Lock = class {
   constructor({ lockKey, onAcquire, onRelease }) {
     this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
-    this._releaseTrigger = new Trigger7();
+    this._releaseTrigger = new Trigger8();
     this._lockKey = lockKey;
     this._onAcquire = onAcquire;
     this._onRelease = onRelease;
@@ -5205,29 +5526,29 @@ var Lock = class {
       message: "acquiring"
     });
     try {
-      log14("aquiring lock...", void 0, {
-        F: __dxlog_file18,
+      log16("aquiring lock...", void 0, {
+        F: __dxlog_file20,
         L: 42,
         S: this,
         C: (f, a) => f(...a)
       });
-      await asyncTimeout2(this._requestLock(), RESOURCE_LOCK_TIMEOUT);
-      log14("acquired lock", void 0, {
-        F: __dxlog_file18,
+      await asyncTimeout3(this._requestLock(), RESOURCE_LOCK_TIMEOUT);
+      log16("acquired lock", void 0, {
+        F: __dxlog_file20,
         L: 44,
         S: this,
         C: (f, a) => f(...a)
       });
     } catch {
-      log14("stealing lock...", void 0, {
-        F: __dxlog_file18,
+      log16("stealing lock...", void 0, {
+        F: __dxlog_file20,
         L: 46,
         S: this,
         C: (f, a) => f(...a)
       });
       await this._requestLock(true);
-      log14("stolen lock", void 0, {
-        F: __dxlog_file18,
+      log16("stolen lock", void 0, {
+        F: __dxlog_file20,
         L: 48,
         S: this,
         C: (f, a) => f(...a)
@@ -5243,31 +5564,31 @@ var Lock = class {
     }
   }
   async _requestLock(steal = false) {
-    log14("requesting lock...", {
+    log16("requesting lock...", {
       steal
     }, {
-      F: __dxlog_file18,
+      F: __dxlog_file20,
       L: 63,
       S: this,
       C: (f, a) => f(...a)
     });
-    const acquired = new Trigger7();
+    const acquired = new Trigger8();
     void navigator.locks.request(this._lockKey, {
       steal
     }, async () => {
       await this._onAcquire?.();
       acquired.wake();
-      this._releaseTrigger = new Trigger7();
+      this._releaseTrigger = new Trigger8();
       await this._releaseTrigger.wait();
-      log14("releasing lock...", void 0, {
-        F: __dxlog_file18,
+      log16("releasing lock...", void 0, {
+        F: __dxlog_file20,
         L: 72,
         S: this,
         C: (f, a) => f(...a)
       });
       await this._onRelease?.();
-      log14("released lock", void 0, {
-        F: __dxlog_file18,
+      log16("released lock", void 0, {
+        F: __dxlog_file20,
         L: 74,
         S: this,
         C: (f, a) => f(...a)
@@ -5276,10 +5597,10 @@ var Lock = class {
       await this._onRelease?.();
     });
     await acquired.wait();
-    log14("recieved lock", {
+    log16("recieved lock", {
       steal
     }, {
-      F: __dxlog_file18,
+      F: __dxlog_file20,
       L: 81,
       S: this,
       C: (f, a) => f(...a)
@@ -5296,25 +5617,25 @@ var isLocked = (lockPath) => {
 // packages/sdk/client-services/src/packlets/logging/logging-service.ts
 import { Event as Event8 } from "@dxos/async";
 import { Stream as Stream12 } from "@dxos/codec-protobuf";
-import { PublicKey as PublicKey12 } from "@dxos/keys";
-import { getContextFromEntry, log as log15 } from "@dxos/log";
+import { PublicKey as PublicKey13 } from "@dxos/keys";
+import { getContextFromEntry, log as log17 } from "@dxos/log";
 import { QueryLogsRequest } from "@dxos/protocols/proto/dxos/client/services";
 import { getDebugName, jsonify, numericalValues, tracer } from "@dxos/util";
 var LoggingServiceImpl = class {
   constructor() {
     this._logs = new Event8();
     this._started = Date.now();
-    this._sessionId = PublicKey12.random().toHex();
+    this._sessionId = PublicKey13.random().toHex();
     this._logProcessor = (_config, entry2) => {
       this._logs.emit(entry2);
     };
   }
   async open() {
-    log15.runtimeConfig.processors.push(this._logProcessor);
+    log17.runtimeConfig.processors.push(this._logProcessor);
   }
   async close() {
-    const index = log15.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
-    log15.runtimeConfig.processors.splice(index, 1);
+    const index = log17.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
+    log17.runtimeConfig.processors.splice(index, 1);
   }
   async controlMetrics({ reset, record }) {
     if (reset) {
@@ -5513,13 +5834,13 @@ var toStorageType = (type) => {
 };
 
 // packages/sdk/client-services/src/packlets/storage/level.ts
-import { Level } from "level";
 import path from "@dxos/node-std/path";
-import { PublicKey as PublicKey13 } from "@dxos/keys";
+import { PublicKey as PublicKey14 } from "@dxos/keys";
+import { createLevel as createKV } from "@dxos/kv-store";
 var createLevel = async (config) => {
   const persistent = isPersistent(config);
-  const storagePath = persistent ? path.join(getRootPath(config), "level") : `/tmp/dxos-${PublicKey13.random().toHex()}`;
-  const level = new Level(storagePath);
+  const storagePath = persistent ? path.join(getRootPath(config), "level") : `/tmp/dxos-${PublicKey14.random().toHex()}`;
+  const level = createKV(storagePath);
   await level.open();
   return level;
 };
@@ -5592,7 +5913,7 @@ function _ts_decorate8(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file19 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
+var __dxlog_file21 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
 var ClientServicesHost = class {
   constructor({
     config,
@@ -5680,25 +6001,25 @@ var ClientServicesHost = class {
   * Can only be called once.
   */
   initialize({ config, ...options }) {
-    invariant16(!this._open, "service host is open", {
-      F: __dxlog_file19,
-      L: 198,
+    invariant18(!this._open, "service host is open", {
+      F: __dxlog_file21,
+      L: 189,
       S: this,
       A: [
         "!this._open",
         "'service host is open'"
       ]
     });
-    log16("initializing...", void 0, {
-      F: __dxlog_file19,
-      L: 199,
+    log18("initializing...", void 0, {
+      F: __dxlog_file21,
+      L: 190,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
-      invariant16(!this._config, "config already set", {
-        F: __dxlog_file19,
-        L: 202,
+      invariant18(!this._config, "config already set", {
+        F: __dxlog_file21,
+        L: 193,
         S: this,
         A: [
           "!this._config",
@@ -5711,9 +6032,9 @@ var ClientServicesHost = class {
       }
     }
     if (!options.signalManager) {
-      log16.warn("running signaling without telemetry metadata.", void 0, {
-        F: __dxlog_file19,
-        L: 210,
+      log18.warn("running signaling without telemetry metadata.", void 0, {
+        F: __dxlog_file21,
+        L: 201,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -5722,9 +6043,9 @@ var ClientServicesHost = class {
       iceServers: this._config?.get("runtime.services.ice")
     }), signalManager = new WebsocketSignalManager(this._config?.get("runtime.services.signaling") ?? []) } = options;
     this._signalManager = signalManager;
-    invariant16(!this._networkManager, "network manager already set", {
-      F: __dxlog_file19,
-      L: 221,
+    invariant18(!this._networkManager, "network manager already set", {
+      F: __dxlog_file21,
+      L: 212,
       S: this,
       A: [
         "!this._networkManager",
@@ -5736,9 +6057,9 @@ var ClientServicesHost = class {
       transportFactory,
       signalManager
     });
-    log16("initialized", void 0, {
-      F: __dxlog_file19,
-      L: 228,
+    log18("initialized", void 0, {
+      F: __dxlog_file21,
+      L: 219,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5747,45 +6068,45 @@ var ClientServicesHost = class {
     if (this._open) {
       return;
     }
-    const traceId = PublicKey14.random().toHex();
-    log16.trace("dxos.client-services.host.open", trace9.begin({
+    const traceId = PublicKey15.random().toHex();
+    log18.trace("dxos.client-services.host.open", trace9.begin({
       id: traceId
     }), {
-      F: __dxlog_file19,
-      L: 239,
+      F: __dxlog_file21,
+      L: 230,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant16(this._config, "config not set", {
-      F: __dxlog_file19,
-      L: 241,
+    invariant18(this._config, "config not set", {
+      F: __dxlog_file21,
+      L: 232,
       S: this,
       A: [
         "this._config",
         "'config not set'"
       ]
     });
-    invariant16(this._storage, "storage not set", {
-      F: __dxlog_file19,
-      L: 242,
+    invariant18(this._storage, "storage not set", {
+      F: __dxlog_file21,
+      L: 233,
       S: this,
       A: [
         "this._storage",
         "'storage not set'"
       ]
     });
-    invariant16(this._signalManager, "signal manager not set", {
-      F: __dxlog_file19,
-      L: 243,
+    invariant18(this._signalManager, "signal manager not set", {
+      F: __dxlog_file21,
+      L: 234,
       S: this,
       A: [
         "this._signalManager",
         "'signal manager not set'"
       ]
     });
-    invariant16(this._networkManager, "network manager not set", {
-      F: __dxlog_file19,
-      L: 244,
+    invariant18(this._networkManager, "network manager not set", {
+      F: __dxlog_file21,
+      L: 235,
       S: this,
       A: [
         "this._networkManager",
@@ -5793,26 +6114,21 @@ var ClientServicesHost = class {
       ]
     });
     this._opening = true;
-    log16("opening...", {
+    log18("opening...", {
       lockKey: this._resourceLock?.lockKey
     }, {
-      F: __dxlog_file19,
-      L: 247,
+      F: __dxlog_file21,
+      L: 238,
       S: this,
       C: (f, a) => f(...a)
     });
+    await this._resourceLock?.acquire();
     if (!this._level) {
       this._level = await createLevel(this._config.get("runtime.client.storage", {}));
     }
     await this._level.open();
-    await this._resourceLock?.acquire();
     await this._loggingService.open();
     this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._runtimeParams);
-    this._queryService = new QueryServiceImpl({
-      indexer: this._serviceContext.indexer,
-      automergeHost: this._serviceContext.automergeHost
-    });
-    await this._queryService.open(ctx);
     this._serviceRegistry.setServices({
       SystemService: this._systemService,
       IdentityService: new IdentityServiceImpl((params) => this._createIdentity(params), this._serviceContext.identityManager, this._serviceContext.keyring, (profile) => this._serviceContext.broadcastProfileUpdate(profile)),
@@ -5822,8 +6138,8 @@ var ClientServicesHost = class {
         await this._serviceContext.initialized.wait();
         return this._serviceContext.dataSpaceManager;
       }),
-      DataService: new DataServiceImpl(this._serviceContext.automergeHost),
-      QueryService: this._queryService,
+      DataService: this._serviceContext.echoHost.dataService,
+      QueryService: this._serviceContext.echoHost.queryService,
       NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager, this._serviceContext.signalManager),
       LoggingService: this._loggingService,
       TracingService: this._tracingService,
@@ -5850,19 +6166,19 @@ var ClientServicesHost = class {
     this._open = true;
     this._statusUpdate.emit();
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    log16("opened", {
+    log18("opened", {
       deviceKey
     }, {
-      F: __dxlog_file19,
-      L: 330,
+      F: __dxlog_file21,
+      L: 314,
       S: this,
       C: (f, a) => f(...a)
     });
-    log16.trace("dxos.client-services.host.open", trace9.end({
+    log18.trace("dxos.client-services.host.open", trace9.end({
       id: traceId
     }), {
-      F: __dxlog_file19,
-      L: 331,
+      F: __dxlog_file21,
+      L: 315,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5872,11 +6188,11 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    log16("closing...", {
+    log18("closing...", {
       deviceKey
     }, {
-      F: __dxlog_file19,
-      L: 342,
+      F: __dxlog_file21,
+      L: 326,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5886,49 +6202,48 @@ var ClientServicesHost = class {
       SystemService: this._systemService
     });
     await this._loggingService.close();
-    await this._queryService.close();
     await this._serviceContext.close();
     await this._level?.close();
     this._open = false;
     this._statusUpdate.emit();
-    log16("closed", {
+    log18("closed", {
       deviceKey
     }, {
-      F: __dxlog_file19,
-      L: 352,
+      F: __dxlog_file21,
+      L: 335,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async reset() {
-    const traceId = PublicKey14.random().toHex();
-    log16.trace("dxos.sdk.client-services-host.reset", trace9.begin({
+    const traceId = PublicKey15.random().toHex();
+    log18.trace("dxos.sdk.client-services-host.reset", trace9.begin({
       id: traceId
     }), {
-      F: __dxlog_file19,
-      L: 357,
+      F: __dxlog_file21,
+      L: 340,
       S: this,
       C: (f, a) => f(...a)
     });
-    log16("resetting...", void 0, {
-      F: __dxlog_file19,
-      L: 359,
+    log18.info("resetting...", void 0, {
+      F: __dxlog_file21,
+      L: 342,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._serviceContext?.close();
     await this._storage.reset();
-    log16("reset", void 0, {
-      F: __dxlog_file19,
-      L: 362,
+    log18.info("reset", void 0, {
+      F: __dxlog_file21,
+      L: 345,
       S: this,
       C: (f, a) => f(...a)
     });
-    log16.trace("dxos.sdk.client-services-host.reset", trace9.end({
+    log18.trace("dxos.sdk.client-services-host.reset", trace9.end({
       id: traceId
     }), {
-      F: __dxlog_file19,
-      L: 363,
+      F: __dxlog_file21,
+      L: 346,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5939,16 +6254,16 @@ var ClientServicesHost = class {
     await this._serviceContext.initialized.wait();
     const space = await this._serviceContext.dataSpaceManager.createSpace();
     const automergeIndex = space.automergeSpaceState.rootUrl;
-    invariant16(automergeIndex, void 0, {
-      F: __dxlog_file19,
-      L: 375,
+    invariant18(automergeIndex, void 0, {
+      F: __dxlog_file21,
+      L: 358,
       S: this,
       A: [
         "automergeIndex",
         ""
       ]
     });
-    const document = await this._serviceContext.automergeHost.repo.find(automergeIndex);
+    const document = await this._serviceContext.echoHost.automergeRepo.find(automergeIndex);
     await document.whenReady();
     const properties = {
       system: {
@@ -5961,14 +6276,14 @@ var ClientServicesHost = class {
         keys: []
       }
     };
-    const propertiesId = PublicKey14.random().toHex();
+    const propertiesId = PublicKey15.random().toHex();
     document.change((doc) => {
       assignDeep2(doc, [
         "objects",
         propertiesId
       ], properties);
     });
-    await this._serviceContext.automergeHost.repo.flush();
+    await this._serviceContext.echoHost.flush();
     return identity;
   }
 };
@@ -5991,11 +6306,12 @@ ClientServicesHost = _ts_decorate8([
 ], ClientServicesHost);
 
 // packages/sdk/client-services/src/packlets/services/util.ts
-import { PublicKey as PublicKey15 } from "@dxos/keys";
+import { PublicKey as PublicKey16 } from "@dxos/keys";
 import { humanize } from "@dxos/util";
 var ClientServicesProviderResource = Symbol.for("dxos.resource.ClientServices");
 
 // packages/sdk/client-services/src/packlets/diagnostics/diagnostics-collector.ts
+var GET_DIAGNOSTICS_RPC_TIMEOUT = 1e4;
 var DiagnosticsCollector = class {
   static {
     this.broadcastSender = createCollectDiagnosticsBroadcastSender();
@@ -6003,6 +6319,8 @@ var DiagnosticsCollector = class {
   static async collect(config = findConfigs(), services = findSystemServiceProvider(), options = {}) {
     const serviceDiagnostics = await services?.services?.SystemService?.getDiagnostics({
       keys: options.humanize ? GetDiagnosticsRequest2.KEY_OPTION.HUMANIZE : options.truncate ? GetDiagnosticsRequest2.KEY_OPTION.TRUNCATE : void 0
+    }, {
+      timeout: GET_DIAGNOSTICS_RPC_TIMEOUT
     });
     const clientDiagnostics = {
       config,
@@ -6019,12 +6337,12 @@ var DiagnosticsCollector = class {
   }
 };
 var findSystemServiceProvider = () => {
-  const serviceProviders = TRACE_PROCESSOR3.findByAnnotation(ClientServicesProviderResource);
+  const serviceProviders = TRACE_PROCESSOR3.findResourcesByAnnotation(ClientServicesProviderResource);
   const providerResource = serviceProviders.find((r) => r.instance.deref()?.services?.SystemService != null);
   return providerResource?.instance?.deref() ?? null;
 };
 var findConfigs = () => {
-  const configs = TRACE_PROCESSOR3.findByAnnotation(ConfigResource);
+  const configs = TRACE_PROCESSOR3.findResourcesByAnnotation(ConfigResource);
   return configs.map((r) => r.instance.deref()).filter(nonNullable);
 };
 
@@ -6068,4 +6386,4 @@ export {
   ClientServicesHost,
   ClientServicesProviderResource
 };
-//# sourceMappingURL=chunk-CMVTOS5E.mjs.map
+//# sourceMappingURL=chunk-MKFJAPSD.mjs.map