@dxos/client-services 0.5.3-main.3d65399 → 0.5.3-main.423e628

package/dist/lib/node/{chunk-2P53YFFE.cjs → chunk-F5PNMVIG.cjs}

@@ -26,8 +26,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var chunk_2P53YFFE_exports = {};
-__export(chunk_2P53YFFE_exports, {
+var chunk_F5PNMVIG_exports = {};
+__export(chunk_F5PNMVIG_exports, {
   ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   ClientServicesProviderResource: () => ClientServicesProviderResource,
@@ -56,6 +56,7 @@ __export(chunk_2P53YFFE_exports, {
   createDiagnostics: () => createDiagnostics,
   createLevel: () => createLevel,
   createStorageObjects: () => createStorageObjects,
+  findPropertiesObject: () => findPropertiesObject,
   getNetworkPeers: () => getNetworkPeers,
   isLocked: () => isLocked,
   subscribeToFeedBlocks: () => subscribeToFeedBlocks,
@@ -66,7 +67,7 @@ __export(chunk_2P53YFFE_exports, {
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo
 });
-module.exports = __toCommonJS(chunk_2P53YFFE_exports);
+module.exports = __toCommonJS(chunk_F5PNMVIG_exports);
 var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_feed_store = require("@dxos/feed-store");
@@ -182,7 +183,6 @@ var import_client_protocol4 = require("@dxos/client-protocol");
 var import_context9 = require("@dxos/context");
 var import_debug3 = require("@dxos/debug");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
-var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_echo_schema = require("@dxos/echo-schema");
 var import_invariant11 = require("@dxos/invariant");
 var import_keys9 = require("@dxos/keys");
@@ -190,12 +190,11 @@ var import_log10 = require("@dxos/log");
 var import_protocols8 = require("@dxos/protocols");
 var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 var import_credentials11 = require("@dxos/protocols/proto/dxos/halo/credentials");
-var import_credentials12 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe2 = require("@dxos/timeframe");
 var import_tracing4 = require("@dxos/tracing");
 var import_util6 = require("@dxos/util");
 var import_async12 = require("@dxos/async");
-var import_credentials13 = require("@dxos/credentials");
+var import_credentials12 = require("@dxos/credentials");
 var import_async13 = require("@dxos/async");
 var import_context10 = require("@dxos/context");
 var import_invariant12 = require("@dxos/invariant");
@@ -206,13 +205,16 @@ var import_teleport3 = require("@dxos/teleport");
 var import_util7 = require("@dxos/util");
 var import_async14 = require("@dxos/async");
 var import_context11 = require("@dxos/context");
-var import_credentials14 = require("@dxos/credentials");
+var import_credentials13 = require("@dxos/credentials");
+var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_invariant13 = require("@dxos/invariant");
 var import_keys11 = require("@dxos/keys");
 var import_log12 = require("@dxos/log");
 var import_protocols10 = require("@dxos/protocols");
 var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
+var import_credentials14 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_teleport_extension_gossip2 = require("@dxos/teleport-extension-gossip");
+var import_tracing5 = require("@dxos/tracing");
 var import_util8 = require("@dxos/util");
 var import_credentials15 = require("@dxos/credentials");
 var import_debug4 = require("@dxos/debug");
@@ -220,19 +222,20 @@ var import_credentials16 = require("@dxos/protocols/proto/dxos/halo/credentials"
 var import_timeframe3 = require("@dxos/timeframe");
 var import_async15 = require("@dxos/async");
 var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_credentials17 = require("@dxos/credentials");
 var import_debug5 = require("@dxos/debug");
+var import_feed_store4 = require("@dxos/feed-store");
 var import_invariant14 = require("@dxos/invariant");
 var import_log13 = require("@dxos/log");
 var import_protocols11 = require("@dxos/protocols");
 var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials17 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_async16 = require("@dxos/async");
 var import_context12 = require("@dxos/context");
 var import_credentials18 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
 var import_echo_db = require("@dxos/echo-db");
 var import_echo_pipeline4 = require("@dxos/echo-pipeline");
-var import_feed_store4 = require("@dxos/feed-store");
+var import_feed_store5 = require("@dxos/feed-store");
 var import_invariant15 = require("@dxos/invariant");
 var import_keyring = require("@dxos/keyring");
 var import_keys12 = require("@dxos/keys");
@@ -240,7 +243,7 @@ var import_log14 = require("@dxos/log");
 var import_protocols12 = require("@dxos/protocols");
 var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_object_sync = require("@dxos/teleport-extension-object-sync");
-var import_tracing5 = require("@dxos/tracing");
+var import_tracing6 = require("@dxos/tracing");
 var import_util9 = require("@dxos/util");
 var import_async17 = require("@dxos/async");
 var import_codec_protobuf11 = require("@dxos/codec-protobuf");
@@ -248,11 +251,11 @@ var import_credentials19 = require("@dxos/credentials");
 var import_invariant16 = require("@dxos/invariant");
 var import_protocols13 = require("@dxos/protocols");
 var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
-var import_tracing6 = require("@dxos/tracing");
+var import_tracing7 = require("@dxos/tracing");
 var import_services14 = require("@dxos/protocols/proto/dxos/client/services");
 var import_config = require("@dxos/config");
 var import_services15 = require("@dxos/protocols/proto/dxos/client/services");
-var import_tracing7 = require("@dxos/tracing");
+var import_tracing8 = require("@dxos/tracing");
 var import_util10 = require("@dxos/util");
 var import_async18 = require("@dxos/async");
 var import_client_protocol5 = require("@dxos/client-protocol");
@@ -266,7 +269,7 @@ var import_messaging = require("@dxos/messaging");
 var import_network_manager2 = require("@dxos/network-manager");
 var import_protocols14 = require("@dxos/protocols");
 var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
-var import_tracing8 = require("@dxos/tracing");
+var import_tracing9 = require("@dxos/tracing");
 var import_util11 = require("@dxos/util");
 var import_websocket_rpc = require("@dxos/websocket-rpc");
 var import_async19 = require("@dxos/async");
@@ -1316,6 +1319,8 @@ var IdentityManager = class {
       },
       memberKey: identityKey,
       onDelegatedInvitationStatusChange: async () => {
+      },
+      onMemberRolesChanged: async () => {
       }
     });
   }
@@ -1408,6 +1413,9 @@ var DeviceInvitationProtocol = class {
   toJSON() {
     return {};
   }
+  checkCanInviteNewMembers() {
+    return void 0;
+  }
   getInvitationContext() {
     return {
       kind: import_services2.Invitation.Kind.DEVICE
@@ -1422,7 +1430,7 @@ var DeviceInvitationProtocol = class {
   async admit(_, request) {
     (0, import_invariant4.invariant)(request.device, void 0, {
       F: __dxlog_file5,
-      L: 46,
+      L: 50,
       S: this,
       A: [
         "request.device",
@@ -1468,7 +1476,7 @@ var DeviceInvitationProtocol = class {
   async accept(response, request) {
     (0, import_invariant4.invariant)(response.device, void 0, {
       F: __dxlog_file5,
-      L: 91,
+      L: 95,
       S: this,
       A: [
         "response.device",
@@ -1478,7 +1486,7 @@ var DeviceInvitationProtocol = class {
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
     (0, import_invariant4.invariant)(request.device, void 0, {
       F: __dxlog_file5,
-      L: 94,
+      L: 98,
       S: this,
       A: [
         "request.device",
@@ -2731,6 +2739,19 @@ var SpaceInvitationProtocol = class {
       spaceKey: this._spaceKey
     };
   }
+  checkCanInviteNewMembers() {
+    if (this._spaceKey == null) {
+      return new import_protocols7.InvalidInvitationError("No spaceKey was provided for a space invitation.");
+    }
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    if (space == null) {
+      return new import_protocols7.SpaceNotFoundError(this._spaceKey);
+    }
+    if (!space?.inner.spaceState.hasMembershipManagementPermission(this._signingContext.identityKey)) {
+      return new import_protocols7.AuthorizationError("No member management permission.");
+    }
+    return void 0;
+  }
   getInvitationContext() {
     return {
       kind: import_services7.Invitation.Kind.SPACE,
@@ -2740,7 +2761,7 @@ var SpaceInvitationProtocol = class {
   async admit(invitation, request, guestProfile) {
     (0, import_invariant9.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 56,
+      L: 76,
       S: this,
       A: [
         "this._spaceKey",
@@ -2750,7 +2771,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant9.invariant)(space, void 0, {
       F: __dxlog_file10,
-      L: 58,
+      L: 78,
       S: this,
       A: [
         "space",
@@ -2759,7 +2780,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant9.invariant)(request.space, void 0, {
       F: __dxlog_file10,
-      L: 60,
+      L: 80,
       S: this,
       A: [
         "request.space",
@@ -2767,19 +2788,22 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { identityKey, deviceKey } = request.space;
+    if (space.inner.spaceState.getMemberRole(identityKey) !== import_credentials8.SpaceMember.Role.REMOVED) {
+      throw new import_protocols7.AlreadyJoinedError();
+    }
     (0, import_log8.log)("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
       F: __dxlog_file10,
-      L: 63,
+      L: 87,
       S: this,
       C: (f, a) => f(...a)
     });
     const credentials = await (0, import_credentials7.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, invitation.role ?? import_credentials8.SpaceMember.Role.ADMIN, space.inner.spaceState.membershipChainHeads, guestProfile, invitation.delegationCredentialId);
     (0, import_invariant9.invariant)(credentials[0].credential, void 0, {
       F: __dxlog_file10,
-      L: 77,
+      L: 101,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2789,7 +2813,7 @@ var SpaceInvitationProtocol = class {
     const spaceMemberCredential = credentials[0].credential.credential;
     (0, import_invariant9.invariant)((0, import_credentials7.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file10,
-      L: 79,
+      L: 103,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2807,7 +2831,7 @@ var SpaceInvitationProtocol = class {
   async delegate(invitation) {
     (0, import_invariant9.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 92,
+      L: 116,
       S: this,
       A: [
         "this._spaceKey",
@@ -2817,7 +2841,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant9.invariant)(space, void 0, {
       F: __dxlog_file10,
-      L: 94,
+      L: 118,
       S: this,
       A: [
         "space",
@@ -2827,7 +2851,7 @@ var SpaceInvitationProtocol = class {
     if (invitation.authMethod === import_services7.Invitation.AuthMethod.KNOWN_PUBLIC_KEY) {
       (0, import_invariant9.invariant)(invitation.guestKeypair?.publicKey, void 0, {
         F: __dxlog_file10,
-        L: 96,
+        L: 120,
         S: this,
         A: [
           "invitation.guestKeypair?.publicKey",
@@ -2840,7 +2864,7 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file10,
-      L: 99,
+      L: 123,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2855,7 +2879,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant9.invariant)(credential.credential, void 0, {
       F: __dxlog_file10,
-      L: 119,
+      L: 143,
       S: this,
       A: [
         "credential.credential",
@@ -2870,7 +2894,7 @@ var SpaceInvitationProtocol = class {
   async cancelDelegation(invitation) {
     (0, import_invariant9.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 125,
+      L: 149,
       S: this,
       A: [
         "this._spaceKey",
@@ -2879,7 +2903,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant9.invariant)(invitation.type === import_services7.Invitation.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
       F: __dxlog_file10,
-      L: 126,
+      L: 150,
       S: this,
       A: [
         "invitation.type === Invitation.Type.DELEGATED && invitation.delegationCredentialId",
@@ -2889,7 +2913,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant9.invariant)(space, void 0, {
       F: __dxlog_file10,
-      L: 128,
+      L: 152,
       S: this,
       A: [
         "space",
@@ -2901,14 +2925,14 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file10,
-      L: 130,
+      L: 154,
       S: this,
       C: (f, a) => f(...a)
     });
     const credential = await (0, import_credentials7.createCancelDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
     (0, import_invariant9.invariant)(credential.credential, void 0, {
       F: __dxlog_file10,
-      L: 137,
+      L: 161,
       S: this,
       A: [
         "credential.credential",
@@ -2920,7 +2944,10 @@ var SpaceInvitationProtocol = class {
     ]);
   }
   checkInvitation(invitation) {
-    if (invitation.spaceKey && this._spaceManager.spaces.has(invitation.spaceKey)) {
+    if (invitation.spaceKey == null) {
+      return new import_protocols7.InvalidInvitationError("No spaceKey was provided for a space invitation.");
+    }
+    if (this._spaceManager.spaces.has(invitation.spaceKey)) {
       return new import_protocols7.AlreadyJoinedError("Already joined space.");
     }
   }
@@ -2944,7 +2971,7 @@ var SpaceInvitationProtocol = class {
   async accept(response) {
     (0, import_invariant9.invariant)(response.space, void 0, {
       F: __dxlog_file10,
-      L: 169,
+      L: 196,
       S: this,
       A: [
         "response.space",
@@ -2955,7 +2982,7 @@ var SpaceInvitationProtocol = class {
     const assertion = (0, import_credentials7.getCredentialAssertion)(credential);
     (0, import_invariant9.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file10,
-      L: 172,
+      L: 199,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2964,7 +2991,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant9.invariant)(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
       F: __dxlog_file10,
-      L: 173,
+      L: 200,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -3010,6 +3037,10 @@ var InvitationsManager = class {
       }
     }
     const handler = this._getHandler(options);
+    const invitationError = handler.checkCanInviteNewMembers();
+    if (invitationError != null) {
+      throw invitationError;
+    }
     const invitation = this._createInvitation(handler, options);
     const { ctx, stream, observableInvitation } = this._createObservableInvitation(handler, invitation);
     this._createInvitations.set(invitation.invitationId, observableInvitation);
@@ -3026,7 +3057,7 @@ var InvitationsManager = class {
     } catch (err) {
       import_log9.log.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 77,
+        L: 82,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3049,7 +3080,7 @@ var InvitationsManager = class {
       const loadTasks = freshInvitations.map((persistentInvitation) => {
         (0, import_invariant10.invariant)(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
           F: __dxlog_file11,
-          L: 98,
+          L: 103,
           S: this,
           A: [
             "!this._createInvitations.get(persistentInvitation.invitationId)",
@@ -3068,7 +3099,7 @@ var InvitationsManager = class {
     } catch (err) {
       import_log9.log.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 105,
+        L: 110,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3100,13 +3131,13 @@ var InvitationsManager = class {
   async authenticate({ invitationId, authCode }) {
     (0, import_log9.log)("authenticating...", void 0, {
       F: __dxlog_file11,
-      L: 135,
+      L: 140,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant10.invariant)(invitationId, void 0, {
       F: __dxlog_file11,
-      L: 136,
+      L: 141,
       S: this,
       A: [
         "invitationId",
@@ -3119,7 +3150,7 @@ var InvitationsManager = class {
         invitationId
       }, {
         F: __dxlog_file11,
-        L: 139,
+        L: 144,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3132,13 +3163,13 @@ var InvitationsManager = class {
       invitationId
     }, {
       F: __dxlog_file11,
-      L: 146,
+      L: 151,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant10.invariant)(invitationId, void 0, {
       F: __dxlog_file11,
-      L: 147,
+      L: 152,
       S: this,
       A: [
         "invitationId",
@@ -3217,7 +3248,7 @@ var InvitationsManager = class {
         ...handler.toJSON()
       }, {
         F: __dxlog_file11,
-        L: 236,
+        L: 241,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3250,7 +3281,7 @@ var InvitationsManager = class {
             ...handler.toJSON()
           }, {
             F: __dxlog_file11,
-            L: 256,
+            L: 261,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3261,7 +3292,7 @@ var InvitationsManager = class {
         } else {
           import_log9.log.warn("auth failed", err, {
             F: __dxlog_file11,
-            L: 259,
+            L: 264,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3278,7 +3309,7 @@ var InvitationsManager = class {
         ...handler.toJSON()
       }, {
         F: __dxlog_file11,
-        L: 266,
+        L: 271,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3323,7 +3354,7 @@ var InvitationsManager = class {
     } catch (err) {
       import_log9.log.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 302,
+        L: 307,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3419,7 +3450,7 @@ var AutomergeSpaceState = class {
     this._isProcessingRootDocs = false;
   }
   async processCredential(credential) {
-    if (!(0, import_credentials13.checkCredentialType)(credential, "dxos.halo.credentials.Epoch")) {
+    if (!(0, import_credentials12.checkCredentialType)(credential, "dxos.halo.credentials.Epoch")) {
       return;
     }
     this.lastEpoch = credential;
@@ -3744,7 +3775,7 @@ var DataSpace = class {
       state: import_services9.SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 137,
+      L: 141,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3794,7 +3825,7 @@ var DataSpace = class {
       state: import_services9.SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 195,
+      L: 199,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3812,7 +3843,7 @@ var DataSpace = class {
       state: import_services9.SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 209,
+      L: 213,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3844,7 +3875,7 @@ var DataSpace = class {
         if (err instanceof import_protocols8.CancelledError || err instanceof import_context9.ContextDisposedError) {
           (0, import_log10.log)("data pipeline initialization cancelled", err, {
             F: __dxlog_file13,
-            L: 242,
+            L: 246,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3852,7 +3883,7 @@ var DataSpace = class {
         }
         import_log10.log.error("Error initializing data pipeline", err, {
           F: __dxlog_file13,
-          L: 246,
+          L: 250,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3861,7 +3892,7 @@ var DataSpace = class {
           state: import_services9.SpaceState[this._state]
         }, {
           F: __dxlog_file13,
-          L: 248,
+          L: 252,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3881,7 +3912,7 @@ var DataSpace = class {
       state: import_services9.SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 264,
+      L: 268,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3891,7 +3922,7 @@ var DataSpace = class {
     await (0, import_context9.cancelWithContext)(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
     (0, import_log10.log)("data pipeline ready", void 0, {
       F: __dxlog_file13,
-      L: 276,
+      L: 280,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3901,7 +3932,7 @@ var DataSpace = class {
       state: import_services9.SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 280,
+      L: 284,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3917,7 +3948,7 @@ var DataSpace = class {
     await this._createWritableFeeds();
     (0, import_log10.log)("writable feeds created", void 0, {
       F: __dxlog_file13,
-      L: 296,
+      L: 300,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3944,7 +3975,7 @@ var DataSpace = class {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials12.AdmittedFeed.Designation.CONTROL
+          designation: import_credentials11.AdmittedFeed.Designation.CONTROL
         }
       }));
     }
@@ -3961,7 +3992,7 @@ var DataSpace = class {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials12.AdmittedFeed.Designation.DATA
+          designation: import_credentials11.AdmittedFeed.Designation.DATA
         }
       }));
     }
@@ -3980,7 +4011,7 @@ var DataSpace = class {
       rootUrl
     }, {
       F: __dxlog_file13,
-      L: 362,
+      L: 366,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4012,7 +4043,7 @@ var DataSpace = class {
           err
         }, {
           F: __dxlog_file13,
-          L: 385,
+          L: 391,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4067,7 +4098,7 @@ var DataSpace = class {
           const newRoot = this._echoHost.automergeRepo.create(rootHandle.docSync());
           (0, import_invariant11.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file13,
-            L: 435,
+            L: 441,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -4086,7 +4117,7 @@ var DataSpace = class {
         {
           import_log10.log.info("Fragmenting", void 0, {
             F: __dxlog_file13,
-            L: 447,
+            L: 453,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4094,11 +4125,11 @@ var DataSpace = class {
           const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
           await (0, import_context9.cancelWithContext)(this._ctx, (0, import_async11.asyncTimeout)(rootHandle.whenReady(), 1e4));
           const objects = Object.entries(rootHandle.docSync().objects);
-          const properties = objects.find(([_, value]) => value.system.type?.itemId === import_echo_schema.TYPE_PROPERTIES);
+          const properties = findPropertiesObject(rootHandle.docSync());
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
           (0, import_invariant11.invariant)(properties, "Properties not found", {
             F: __dxlog_file13,
-            L: 457,
+            L: 463,
             S: this,
             A: [
               "properties",
@@ -4114,14 +4145,14 @@ var DataSpace = class {
           const newRoot = this._echoHost.automergeRepo.create(newSpaceDoc);
           (0, import_invariant11.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file13,
-            L: 462,
+            L: 468,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
               ""
             ]
           });
-          const docLoader = new import_echo_pipeline3.AutomergeDocumentLoaderImpl(this.key, this._echoHost.automergeRepo);
+          const docLoader = new import_echo_pipeline2.AutomergeDocumentLoaderImpl(this.key, this._echoHost.automergeRepo);
           await docLoader.loadSpaceRootDocHandle(this._ctx, {
             rootUrl: newRoot.url
           });
@@ -4183,7 +4214,7 @@ var DataSpace = class {
       state: import_services9.SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 528,
+      L: 534,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4235,6 +4266,18 @@ DataSpace = _ts_decorate4([
   (0, import_async11.trackLeaks)("open", "close"),
   import_tracing4.trace.resource()
 ], DataSpace);
+var findPropertiesObject = (spaceDoc) => {
+  for (const id in spaceDoc.objects ?? {}) {
+    const obj = spaceDoc.objects[id];
+    if (obj.system.type?.itemId === import_echo_schema.TYPE_PROPERTIES) {
+      return [
+        id,
+        obj
+      ];
+    }
+  }
+  return void 0;
+};
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
     await (0, import_credentials15.createCredential)({
@@ -4329,6 +4372,28 @@ var DataSpaceManager = class {
     const { spaceMemberPresenceAnnounceInterval = PRESENCE_ANNOUNCE_INTERVAL, spaceMemberPresenceOfflineTimeout = PRESENCE_OFFLINE_TIMEOUT } = params ?? {};
     this._spaceMemberPresenceAnnounceInterval = spaceMemberPresenceAnnounceInterval;
     this._spaceMemberPresenceOfflineTimeout = spaceMemberPresenceOfflineTimeout;
+    import_tracing5.trace.diagnostic({
+      id: "spaces",
+      name: "Spaces",
+      fetch: async () => {
+        return Array.from(this._spaces.values()).map((space) => {
+          const rootUrl = space.automergeSpaceState.rootUrl;
+          const rootHandle = rootUrl ? this._echoHost.automergeRepo.find(rootUrl) : void 0;
+          const rootDoc = rootHandle?.docSync();
+          const properties = rootDoc && findPropertiesObject(rootDoc);
+          return {
+            key: space.key.toHex(),
+            state: import_services10.SpaceState[space.state],
+            name: properties?.[1].data.name ?? null,
+            inlineObjects: rootDoc ? Object.keys(rootDoc.objects ?? {}).length : null,
+            linkedObjects: rootDoc ? Object.keys(rootDoc.links ?? {}).length : null,
+            credentials: space.inner.spaceState.credentials.length,
+            members: space.inner.spaceState.members.size,
+            rootUrl
+          };
+        });
+      }
+    });
   }
   // TODO(burdon): Remove.
   get spaces() {
@@ -4337,7 +4402,7 @@ var DataSpaceManager = class {
   async open() {
     (0, import_log12.log)("open", void 0, {
       F: __dxlog_file14,
-      L: 102,
+      L: 144,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4345,7 +4410,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 103,
+      L: 145,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4353,7 +4418,7 @@ var DataSpaceManager = class {
       spaces: this._metadataStore.spaces.length
     }, {
       F: __dxlog_file14,
-      L: 104,
+      L: 146,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4363,7 +4428,7 @@ var DataSpaceManager = class {
           spaceMetadata
         }, {
           F: __dxlog_file14,
-          L: 108,
+          L: 150,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4374,7 +4439,7 @@ var DataSpaceManager = class {
           err
         }, {
           F: __dxlog_file14,
-          L: 111,
+          L: 153,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4391,7 +4456,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 124,
+      L: 166,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4399,7 +4464,7 @@ var DataSpaceManager = class {
   async close() {
     (0, import_log12.log)("close", void 0, {
       F: __dxlog_file14,
-      L: 129,
+      L: 171,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4415,7 +4480,7 @@ var DataSpaceManager = class {
   async createSpace() {
     (0, import_invariant13.invariant)(this._isOpen, "Not open.", {
       F: __dxlog_file14,
-      L: 142,
+      L: 184,
       S: this,
       A: [
         "this._isOpen",
@@ -4436,7 +4501,7 @@ var DataSpaceManager = class {
       spaceKey
     }, {
       F: __dxlog_file14,
-      L: 154,
+      L: 196,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4445,9 +4510,9 @@ var DataSpaceManager = class {
     const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRootUrl);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    (0, import_invariant13.invariant)((0, import_credentials14.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+    (0, import_invariant13.invariant)((0, import_credentials13.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file14,
-      L: 163,
+      L: 205,
       S: this,
       A: [
         "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -4465,13 +4530,13 @@ var DataSpaceManager = class {
       opts
     }, {
       F: __dxlog_file14,
-      L: 175,
+      L: 217,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant13.invariant)(this._isOpen, "Not open.", {
       F: __dxlog_file14,
-      L: 176,
+      L: 218,
       S: this,
       A: [
         "this._isOpen",
@@ -4480,7 +4545,7 @@ var DataSpaceManager = class {
     });
     (0, import_invariant13.invariant)(!this._spaces.has(opts.spaceKey), "Space already exists.", {
       F: __dxlog_file14,
-      L: 177,
+      L: 219,
       S: this,
       A: [
         "!this._spaces.has(opts.spaceKey)",
@@ -4515,7 +4580,7 @@ var DataSpaceManager = class {
       metadata
     }, {
       F: __dxlog_file14,
-      L: 210,
+      L: 252,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4553,11 +4618,16 @@ var DataSpaceManager = class {
       onAuthFailure: () => {
         import_log12.log.warn("auth failure", void 0, {
           F: __dxlog_file14,
-          L: 247,
+          L: 289,
           S: this,
           C: (f, a) => f(...a)
         });
       },
+      onMemberRolesChanged: async (members) => {
+        if (dataSpace?.state === import_services10.SpaceState.READY) {
+          this._handleMemberRoleChanges(presence, space.protocol, members);
+        }
+      },
       memberKey: this._signingContext.identityKey,
       onDelegatedInvitationStatusChange: (invitation, isActive) => {
         return this._handleInvitationStatusChange(dataSpace, invitation, isActive);
@@ -4581,7 +4651,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file14,
-            L: 269,
+            L: 316,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4592,7 +4662,7 @@ var DataSpaceManager = class {
             open: this._isOpen
           }, {
             F: __dxlog_file14,
-            L: 272,
+            L: 319,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4600,6 +4670,9 @@ var DataSpaceManager = class {
             await this._createDelegatedInvitations(dataSpace, [
               ...space.spaceState.invitations.entries()
             ]);
+            this._handleMemberRoleChanges(presence, space.protocol, [
+              ...space.spaceState.members.values()
+            ]);
             this.updated.emit();
           }
         },
@@ -4608,7 +4681,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file14,
-            L: 279,
+            L: 327,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4616,6 +4689,11 @@ var DataSpaceManager = class {
       },
       cache: metadata.cache
     });
+    presence.newPeer.on((peerState) => {
+      if (dataSpace.state === import_services10.SpaceState.READY) {
+        this._handleNewPeerConnected(space, peerState);
+      }
+    });
     if (metadata.state !== import_services10.SpaceState.INACTIVE) {
       await dataSpace.open();
     }
@@ -4625,6 +4703,51 @@ var DataSpaceManager = class {
     this._spaces.set(metadata.key, dataSpace);
     return dataSpace;
   }
+  _handleMemberRoleChanges(presence, spaceProtocol, memberInfo) {
+    let closedSessions = 0;
+    for (const member of memberInfo) {
+      if (member.key.equals(presence.getLocalState().identityKey)) {
+        continue;
+      }
+      const peers = presence.getPeersByIdentityKey(member.key);
+      const sessions = peers.map((p) => p.peerId && spaceProtocol.sessions.get(p.peerId));
+      const sessionsToClose = sessions.filter((s) => {
+        return (s && member.role === import_credentials14.SpaceMember.Role.REMOVED !== (s.authStatus === import_echo_pipeline3.AuthStatus.FAILURE)) ?? false;
+      });
+      sessionsToClose.forEach((session) => {
+        void session.close().catch(import_log12.log.error);
+      });
+      closedSessions += sessionsToClose.length;
+    }
+    (0, import_log12.log)("processed member role changes", {
+      roleChangeCount: memberInfo.length,
+      peersOnline: presence.getPeersOnline().length,
+      closedSessions
+    }, {
+      F: __dxlog_file14,
+      L: 367,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    spaceProtocol.updateTopology();
+  }
+  _handleNewPeerConnected(space, peerState) {
+    const role = space.spaceState.getMemberRole(peerState.identityKey);
+    if (role === import_credentials14.SpaceMember.Role.REMOVED) {
+      const session = peerState.peerId && space.protocol.sessions.get(peerState.peerId);
+      if (session != null) {
+        (0, import_log12.log)("closing a session with a removed peer", {
+          peerId: peerState.peerId
+        }, {
+          F: __dxlog_file14,
+          L: 381,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        void session.close().catch(import_log12.log.error);
+      }
+    }
+  }
   async _handleInvitationStatusChange(dataSpace, delegatedInvitation, isActive) {
     if (dataSpace?.state !== import_services10.SpaceState.READY) {
       return;
@@ -4684,9 +4807,7 @@ var SpacesServiceImpl = class {
     this._getDataSpaceManager = _getDataSpaceManager;
   }
   async createSpace() {
-    if (!this._identityManager.identity) {
-      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
-    }
+    this._requireIdentity();
     const dataSpaceManager = await this._getDataSpaceManager();
     const space = await dataSpaceManager.createSpace();
     return this._serializeSpace(space);
@@ -4707,8 +4828,39 @@ var SpacesServiceImpl = class {
       }
     }
   }
-  async updateMemberRole(_) {
-    throw new Error("not implemented");
+  async updateMemberRole(request) {
+    const identity = this._requireIdentity();
+    const space = this._spaceManager.spaces.get(request.spaceKey);
+    if (space == null) {
+      throw new import_protocols11.SpaceNotFoundError(request.spaceKey);
+    }
+    if (!space.spaceState.hasMembershipManagementPermission(identity.identityKey)) {
+      throw new import_protocols11.AuthorizationError("No member management permission.", {
+        spaceKey: space.key,
+        role: space.spaceState.getMemberRole(identity.identityKey)
+      });
+    }
+    const credentials = await (0, import_credentials17.createAdmissionCredentials)(identity.getIdentityCredentialSigner(), request.memberKey, space.key, space.genesisFeedKey, request.newRole, space.spaceState.membershipChainHeads);
+    (0, import_invariant14.invariant)(credentials[0].credential, void 0, {
+      F: __dxlog_file15,
+      L: 95,
+      S: this,
+      A: [
+        "credentials[0].credential",
+        ""
+      ]
+    });
+    const spaceMemberCredential = credentials[0].credential.credential;
+    (0, import_invariant14.invariant)((0, import_credentials17.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file15,
+      L: 97,
+      S: this,
+      A: [
+        "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
+        ""
+      ]
+    });
+    await (0, import_feed_store4.writeMessages)(space.controlPipeline.writer, credentials);
   }
   querySpaces() {
     return new import_codec_protobuf10.Stream(({ next, ctx }) => {
@@ -4719,7 +4871,7 @@ var SpacesServiceImpl = class {
           spaces
         }, {
           F: __dxlog_file15,
-          L: 82,
+          L: 108,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4802,7 +4954,7 @@ var SpacesServiceImpl = class {
       } else {
         (0, import_invariant14.invariant)(!credential.id, "Id on unsigned credentials is not allowed", {
           F: __dxlog_file15,
-          L: 169,
+          L: 195,
           S: this,
           A: [
             "!credential.id",
@@ -4811,7 +4963,7 @@ var SpacesServiceImpl = class {
         });
         (0, import_invariant14.invariant)(this._identityManager.identity, "Identity is not available", {
           F: __dxlog_file15,
-          L: 170,
+          L: 196,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -4821,7 +4973,7 @@ var SpacesServiceImpl = class {
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
         (0, import_invariant14.invariant)(credential.issuer.equals(signer.getIssuer()), void 0, {
           F: __dxlog_file15,
-          L: 172,
+          L: 198,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -4876,7 +5028,8 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.role === import_credentials17.SpaceMember.Role.REMOVED ? import_services11.SpaceMember.PresenceState.REMOVED : isMe || peers.length > 0 ? import_services11.SpaceMember.PresenceState.ONLINE : import_services11.SpaceMember.PresenceState.OFFLINE,
+          role: member.role,
+          presence: peers.length > 0 ? import_services11.SpaceMember.PresenceState.ONLINE : import_services11.SpaceMember.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4885,6 +5038,12 @@ var SpacesServiceImpl = class {
       metrics: space.metrics
     };
   }
+  _requireIdentity() {
+    if (!this._identityManager.identity) {
+      throw new import_protocols11.IdentityNotInitializedError("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
+    }
+    return this._identityManager.identity;
+  }
 };
 var getChannelId = (channel) => `user-channel/${channel}`;
 function _ts_decorate6(decorators, target, key, desc) {
@@ -4913,8 +5072,8 @@ var ServiceContext = class extends import_context12.Resource {
     this.snapshotStore = new import_echo_pipeline4.SnapshotStore(storage.createDirectory("snapshots"));
     this.blobStore = new import_teleport_extension_object_sync.BlobStore(storage.createDirectory("blobs"));
     this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
-    this.feedStore = new import_feed_store4.FeedStore({
-      factory: new import_feed_store4.FeedFactory({
+    this.feedStore = new import_feed_store5.FeedStore({
+      factory: new import_feed_store5.FeedFactory({
         root: storage.createDirectory("feeds"),
         signer: this.keyring,
         hypercore: {
@@ -5145,14 +5304,14 @@ var ServiceContext = class extends import_context12.Resource {
   }
 };
 _ts_decorate6([
-  import_tracing5.trace.span()
+  import_tracing6.trace.span()
 ], ServiceContext.prototype, "_open", null);
 _ts_decorate6([
-  import_tracing5.trace.span()
+  import_tracing6.trace.span()
 ], ServiceContext.prototype, "_initialize", null);
 ServiceContext = _ts_decorate6([
   (0, import_util9.safeInstanceof)("dxos.client-services.ServiceContext"),
-  import_tracing5.trace.resource()
+  import_tracing6.trace.resource()
 ], ServiceContext);
 var ServiceRegistry = class {
   // prettier-ignore
@@ -5176,7 +5335,7 @@ var ServiceRegistry = class {
     delete this._handlers[name];
   }
 };
-var DXOS_VERSION = "0.5.3-main.3d65399";
+var DXOS_VERSION = "0.5.3-main.423e628";
 var getPlatform = () => {
   if (process.browser) {
     if (typeof window !== "undefined") {
@@ -5216,7 +5375,7 @@ var createDiagnostics = async (clientServices, serviceContext, config) => {
         version: import_protocols13.STORAGE_VERSION
       }
     },
-    trace: import_tracing6.TRACE_PROCESSOR.getDiagnostics()
+    trace: import_tracing7.TRACE_PROCESSOR.getDiagnostics()
   };
   await Promise.all([
     (async () => {
@@ -5279,6 +5438,7 @@ var getSpaceStats = async (space) => {
       id: credential.id
     })),
     members: Array.from(space.inner.spaceState.members.values()).map((member) => ({
+      role: member.role,
       identity: {
         identityKey: member.key,
         profile: {
@@ -5742,7 +5902,7 @@ var ClientServicesHost = class {
     callbacks,
     runtimeParams
   } = {}) {
-    this._tracingService = import_tracing8.TRACE_PROCESSOR.createTraceSender();
+    this._tracingService = import_tracing9.TRACE_PROCESSOR.createTraceSender();
     this._statusUpdate = new import_async18.Event();
     this._opening = false;
     this._open = false;
@@ -6104,21 +6264,21 @@ var ClientServicesHost = class {
   }
 };
 _ts_decorate8([
-  import_tracing8.trace.info()
+  import_tracing9.trace.info()
 ], ClientServicesHost.prototype, "_opening", void 0);
 _ts_decorate8([
-  import_tracing8.trace.info()
+  import_tracing9.trace.info()
 ], ClientServicesHost.prototype, "_open", void 0);
 _ts_decorate8([
   import_async18.synchronized,
-  import_tracing8.trace.span()
+  import_tracing9.trace.span()
 ], ClientServicesHost.prototype, "open", null);
 _ts_decorate8([
   import_async18.synchronized,
-  import_tracing8.trace.span()
+  import_tracing9.trace.span()
 ], ClientServicesHost.prototype, "close", null);
 ClientServicesHost = _ts_decorate8([
-  import_tracing8.trace.resource()
+  import_tracing9.trace.resource()
 ], ClientServicesHost);
 var ClientServicesProviderResource = Symbol.for("dxos.resource.ClientServices");
 var GET_DIAGNOSTICS_RPC_TIMEOUT = 1e4;
@@ -6134,7 +6294,7 @@ var DiagnosticsCollector = class {
     });
     const clientDiagnostics = {
       config,
-      trace: import_tracing7.TRACE_PROCESSOR.getDiagnostics()
+      trace: import_tracing8.TRACE_PROCESSOR.getDiagnostics()
     };
     const diagnostics = serviceDiagnostics != null ? {
       client: clientDiagnostics,
@@ -6147,12 +6307,12 @@ var DiagnosticsCollector = class {
   }
 };
 var findSystemServiceProvider = () => {
-  const serviceProviders = import_tracing7.TRACE_PROCESSOR.findResourcesByAnnotation(ClientServicesProviderResource);
+  const serviceProviders = import_tracing8.TRACE_PROCESSOR.findResourcesByAnnotation(ClientServicesProviderResource);
   const providerResource = serviceProviders.find((r) => r.instance.deref()?.services?.SystemService != null);
   return providerResource?.instance?.deref() ?? null;
 };
 var findConfigs = () => {
-  const configs = import_tracing7.TRACE_PROCESSOR.findResourcesByAnnotation(import_config.ConfigResource);
+  const configs = import_tracing8.TRACE_PROCESSOR.findResourcesByAnnotation(import_config.ConfigResource);
   return configs.map((r) => r.instance.deref()).filter(import_util10.nonNullable);
 };
 // Annotate the CommonJS export names for ESM import in node:
@@ -6185,6 +6345,7 @@ var findConfigs = () => {
   createDiagnostics,
   createLevel,
   createStorageObjects,
+  findPropertiesObject,
   getNetworkPeers,
   isLocked,
   subscribeToFeedBlocks,
@@ -6195,4 +6356,4 @@ var findConfigs = () => {
   subscribeToSpaces,
   subscribeToSwarmInfo
 });
-//# sourceMappingURL=chunk-2P53YFFE.cjs.map
+//# sourceMappingURL=chunk-F5PNMVIG.cjs.map