@dxos/client-services 0.5.3-main.5a4243f → 0.5.3-main.5eb30e6

package/dist/lib/browser/{chunk-25A3RELK.mjs → chunk-W6NTTNM6.mjs}

@@ -1088,6 +1088,8 @@ var IdentityManager = class {
       },
       memberKey: identityKey,
       onDelegatedInvitationStatusChange: async () => {
+      },
+      onMemberRolesChanged: async () => {
       }
     });
   }
@@ -1191,6 +1193,9 @@ var DeviceInvitationProtocol = class {
   toJSON() {
     return {};
   }
+  checkCanInviteNewMembers() {
+    return void 0;
+  }
   getInvitationContext() {
     return {
       kind: Invitation.Kind.DEVICE
@@ -1205,7 +1210,7 @@ var DeviceInvitationProtocol = class {
   async admit(_, request) {
     invariant4(request.device, void 0, {
       F: __dxlog_file5,
-      L: 46,
+      L: 50,
       S: this,
       A: [
         "request.device",
@@ -1251,7 +1256,7 @@ var DeviceInvitationProtocol = class {
   async accept(response, request) {
     invariant4(response.device, void 0, {
       F: __dxlog_file5,
-      L: 91,
+      L: 95,
       S: this,
       A: [
         "response.device",
@@ -1261,7 +1266,7 @@ var DeviceInvitationProtocol = class {
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
     invariant4(request.device, void 0, {
       F: __dxlog_file5,
-      L: 94,
+      L: 98,
       S: this,
       A: [
         "request.device",
@@ -2561,7 +2566,7 @@ import { createAdmissionCredentials, createCancelDelegatedSpaceInvitationCredent
 import { writeMessages as writeMessages2 } from "@dxos/feed-store";
 import { invariant as invariant9 } from "@dxos/invariant";
 import { log as log8 } from "@dxos/log";
-import { AlreadyJoinedError as AlreadyJoinedError2 } from "@dxos/protocols";
+import { AlreadyJoinedError as AlreadyJoinedError2, AuthorizationError, InvalidInvitationError, SpaceNotFoundError } from "@dxos/protocols";
 import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
 import { SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
 var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
@@ -2578,6 +2583,19 @@ var SpaceInvitationProtocol = class {
       spaceKey: this._spaceKey
     };
   }
+  checkCanInviteNewMembers() {
+    if (this._spaceKey == null) {
+      return new InvalidInvitationError("No spaceKey was provided for a space invitation.");
+    }
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    if (space == null) {
+      return new SpaceNotFoundError(this._spaceKey);
+    }
+    if (!space?.inner.spaceState.hasMembershipManagementPermission(this._signingContext.identityKey)) {
+      return new AuthorizationError("No member management permission.");
+    }
+    return void 0;
+  }
   getInvitationContext() {
     return {
       kind: Invitation5.Kind.SPACE,
@@ -2587,7 +2605,7 @@ var SpaceInvitationProtocol = class {
   async admit(invitation, request, guestProfile) {
     invariant9(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 56,
+      L: 76,
       S: this,
       A: [
         "this._spaceKey",
@@ -2597,7 +2615,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     invariant9(space, void 0, {
       F: __dxlog_file10,
-      L: 58,
+      L: 78,
       S: this,
       A: [
         "space",
@@ -2606,7 +2624,7 @@ var SpaceInvitationProtocol = class {
     });
     invariant9(request.space, void 0, {
       F: __dxlog_file10,
-      L: 60,
+      L: 80,
       S: this,
       A: [
         "request.space",
@@ -2614,19 +2632,22 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { identityKey, deviceKey } = request.space;
+    if (space.inner.spaceState.getMemberRole(identityKey) !== SpaceMember.Role.REMOVED) {
+      throw new AlreadyJoinedError2();
+    }
     log8("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
       F: __dxlog_file10,
-      L: 63,
+      L: 87,
       S: this,
       C: (f, a) => f(...a)
     });
     const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, invitation.role ?? SpaceMember.Role.ADMIN, space.inner.spaceState.membershipChainHeads, guestProfile, invitation.delegationCredentialId);
     invariant9(credentials[0].credential, void 0, {
       F: __dxlog_file10,
-      L: 77,
+      L: 101,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2636,7 +2657,7 @@ var SpaceInvitationProtocol = class {
     const spaceMemberCredential = credentials[0].credential.credential;
     invariant9(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file10,
-      L: 79,
+      L: 103,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2654,7 +2675,7 @@ var SpaceInvitationProtocol = class {
   async delegate(invitation) {
     invariant9(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 92,
+      L: 116,
       S: this,
       A: [
         "this._spaceKey",
@@ -2664,7 +2685,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     invariant9(space, void 0, {
       F: __dxlog_file10,
-      L: 94,
+      L: 118,
       S: this,
       A: [
         "space",
@@ -2674,7 +2695,7 @@ var SpaceInvitationProtocol = class {
     if (invitation.authMethod === Invitation5.AuthMethod.KNOWN_PUBLIC_KEY) {
       invariant9(invitation.guestKeypair?.publicKey, void 0, {
         F: __dxlog_file10,
-        L: 96,
+        L: 120,
         S: this,
         A: [
           "invitation.guestKeypair?.publicKey",
@@ -2687,7 +2708,7 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file10,
-      L: 99,
+      L: 123,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2702,7 +2723,7 @@ var SpaceInvitationProtocol = class {
     });
     invariant9(credential.credential, void 0, {
       F: __dxlog_file10,
-      L: 119,
+      L: 143,
       S: this,
       A: [
         "credential.credential",
@@ -2717,7 +2738,7 @@ var SpaceInvitationProtocol = class {
   async cancelDelegation(invitation) {
     invariant9(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 125,
+      L: 149,
       S: this,
       A: [
         "this._spaceKey",
@@ -2726,7 +2747,7 @@ var SpaceInvitationProtocol = class {
     });
     invariant9(invitation.type === Invitation5.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
       F: __dxlog_file10,
-      L: 126,
+      L: 150,
       S: this,
       A: [
         "invitation.type === Invitation.Type.DELEGATED && invitation.delegationCredentialId",
@@ -2736,7 +2757,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     invariant9(space, void 0, {
       F: __dxlog_file10,
-      L: 128,
+      L: 152,
       S: this,
       A: [
         "space",
@@ -2748,14 +2769,14 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file10,
-      L: 130,
+      L: 154,
       S: this,
       C: (f, a) => f(...a)
     });
     const credential = await createCancelDelegatedSpaceInvitationCredential(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
     invariant9(credential.credential, void 0, {
       F: __dxlog_file10,
-      L: 137,
+      L: 161,
       S: this,
       A: [
         "credential.credential",
@@ -2767,7 +2788,10 @@ var SpaceInvitationProtocol = class {
     ]);
   }
   checkInvitation(invitation) {
-    if (invitation.spaceKey && this._spaceManager.spaces.has(invitation.spaceKey)) {
+    if (invitation.spaceKey == null) {
+      return new InvalidInvitationError("No spaceKey was provided for a space invitation.");
+    }
+    if (this._spaceManager.spaces.has(invitation.spaceKey)) {
       return new AlreadyJoinedError2("Already joined space.");
     }
   }
@@ -2791,7 +2815,7 @@ var SpaceInvitationProtocol = class {
   async accept(response) {
     invariant9(response.space, void 0, {
       F: __dxlog_file10,
-      L: 169,
+      L: 196,
       S: this,
       A: [
         "response.space",
@@ -2802,7 +2826,7 @@ var SpaceInvitationProtocol = class {
     const assertion = getCredentialAssertion(credential);
     invariant9(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file10,
-      L: 172,
+      L: 199,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2811,7 +2835,7 @@ var SpaceInvitationProtocol = class {
     });
     invariant9(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
       F: __dxlog_file10,
-      L: 173,
+      L: 200,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -2869,6 +2893,10 @@ var InvitationsManager = class {
       }
     }
     const handler = this._getHandler(options);
+    const invitationError = handler.checkCanInviteNewMembers();
+    if (invitationError != null) {
+      throw invitationError;
+    }
     const invitation = this._createInvitation(handler, options);
     const { ctx, stream, observableInvitation } = this._createObservableInvitation(handler, invitation);
     this._createInvitations.set(invitation.invitationId, observableInvitation);
@@ -2885,7 +2913,7 @@ var InvitationsManager = class {
     } catch (err) {
       log9.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 77,
+        L: 82,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2908,7 +2936,7 @@ var InvitationsManager = class {
       const loadTasks = freshInvitations.map((persistentInvitation) => {
         invariant10(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
           F: __dxlog_file11,
-          L: 98,
+          L: 103,
           S: this,
           A: [
             "!this._createInvitations.get(persistentInvitation.invitationId)",
@@ -2927,7 +2955,7 @@ var InvitationsManager = class {
     } catch (err) {
       log9.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 105,
+        L: 110,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2959,13 +2987,13 @@ var InvitationsManager = class {
   async authenticate({ invitationId, authCode }) {
     log9("authenticating...", void 0, {
       F: __dxlog_file11,
-      L: 135,
+      L: 140,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant10(invitationId, void 0, {
       F: __dxlog_file11,
-      L: 136,
+      L: 141,
       S: this,
       A: [
         "invitationId",
@@ -2978,7 +3006,7 @@ var InvitationsManager = class {
         invitationId
       }, {
         F: __dxlog_file11,
-        L: 139,
+        L: 144,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2991,13 +3019,13 @@ var InvitationsManager = class {
       invitationId
     }, {
       F: __dxlog_file11,
-      L: 146,
+      L: 151,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant10(invitationId, void 0, {
       F: __dxlog_file11,
-      L: 147,
+      L: 152,
       S: this,
       A: [
         "invitationId",
@@ -3076,7 +3104,7 @@ var InvitationsManager = class {
         ...handler.toJSON()
       }, {
         F: __dxlog_file11,
-        L: 236,
+        L: 241,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3109,7 +3137,7 @@ var InvitationsManager = class {
             ...handler.toJSON()
           }, {
             F: __dxlog_file11,
-            L: 256,
+            L: 261,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3120,7 +3148,7 @@ var InvitationsManager = class {
         } else {
           log9.warn("auth failed", err, {
             F: __dxlog_file11,
-            L: 259,
+            L: 264,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3137,7 +3165,7 @@ var InvitationsManager = class {
         ...handler.toJSON()
       }, {
         F: __dxlog_file11,
-        L: 266,
+        L: 271,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3182,7 +3210,7 @@ var InvitationsManager = class {
     } catch (err) {
       log9.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 302,
+        L: 307,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3279,18 +3307,16 @@ ClientRpcServer = _ts_decorate3([
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
 import { Event as Event6, asyncTimeout, scheduleTask as scheduleTask5, sleep as sleep2, synchronized, trackLeaks } from "@dxos/async";
 import { AUTH_TIMEOUT as AUTH_TIMEOUT2 } from "@dxos/client-protocol";
-import { cancelWithContext as cancelWithContext4, Context as Context8, ContextDisposedError as ContextDisposedError3 } from "@dxos/context";
+import { Context as Context8, ContextDisposedError as ContextDisposedError3, cancelWithContext as cancelWithContext4 } from "@dxos/context";
 import { timed, warnAfterTimeout } from "@dxos/debug";
-import { createMappedFeedWriter } from "@dxos/echo-pipeline";
-import { AutomergeDocumentLoaderImpl } from "@dxos/echo-pipeline";
+import { AutomergeDocumentLoaderImpl, createMappedFeedWriter } from "@dxos/echo-pipeline";
 import { TYPE_PROPERTIES } from "@dxos/echo-schema";
 import { failedInvariant, invariant as invariant12 } from "@dxos/invariant";
 import { PublicKey as PublicKey10 } from "@dxos/keys";
 import { log as log11 } from "@dxos/log";
 import { CancelledError, SystemError } from "@dxos/protocols";
-import { SpaceState, CreateEpochRequest } from "@dxos/protocols/proto/dxos/client/services";
-import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { AdmittedFeed as AdmittedFeed3 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { CreateEpochRequest, SpaceState } from "@dxos/protocols/proto/dxos/client/services";
+import { AdmittedFeed as AdmittedFeed3, SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe2 } from "@dxos/timeframe";
 import { trace as trace6 } from "@dxos/tracing";
 import { ComplexSet as ComplexSet5, assignDeep } from "@dxos/util";
@@ -3648,7 +3674,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 137,
+      L: 141,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3698,7 +3724,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 195,
+      L: 199,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3716,7 +3742,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 209,
+      L: 213,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3748,7 +3774,7 @@ var DataSpace = class {
         if (err instanceof CancelledError || err instanceof ContextDisposedError3) {
           log11("data pipeline initialization cancelled", err, {
             F: __dxlog_file13,
-            L: 242,
+            L: 246,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3756,7 +3782,7 @@ var DataSpace = class {
         }
         log11.error("Error initializing data pipeline", err, {
           F: __dxlog_file13,
-          L: 246,
+          L: 250,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3765,7 +3791,7 @@ var DataSpace = class {
           state: SpaceState[this._state]
         }, {
           F: __dxlog_file13,
-          L: 248,
+          L: 252,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3785,7 +3811,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 264,
+      L: 268,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3795,7 +3821,7 @@ var DataSpace = class {
     await cancelWithContext4(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
     log11("data pipeline ready", void 0, {
       F: __dxlog_file13,
-      L: 276,
+      L: 280,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3805,7 +3831,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 280,
+      L: 284,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3821,7 +3847,7 @@ var DataSpace = class {
     await this._createWritableFeeds();
     log11("writable feeds created", void 0, {
       F: __dxlog_file13,
-      L: 296,
+      L: 300,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3884,7 +3910,7 @@ var DataSpace = class {
       rootUrl
     }, {
       F: __dxlog_file13,
-      L: 362,
+      L: 366,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3906,6 +3932,7 @@ var DataSpace = class {
             };
           });
         }
+        await this._echoHost.openSpaceRoot(handle.url);
       } catch (err) {
         if (err instanceof ContextDisposedError3) {
           return;
@@ -3916,7 +3943,7 @@ var DataSpace = class {
           err
         }, {
           F: __dxlog_file13,
-          L: 385,
+          L: 395,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3971,7 +3998,7 @@ var DataSpace = class {
           const newRoot = this._echoHost.automergeRepo.create(rootHandle.docSync());
           invariant12(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file13,
-            L: 435,
+            L: 445,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -3990,7 +4017,7 @@ var DataSpace = class {
         {
           log11.info("Fragmenting", void 0, {
             F: __dxlog_file13,
-            L: 447,
+            L: 457,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3998,11 +4025,11 @@ var DataSpace = class {
           const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
           await cancelWithContext4(this._ctx, asyncTimeout(rootHandle.whenReady(), 1e4));
           const objects = Object.entries(rootHandle.docSync().objects);
-          const properties = objects.find(([_, value]) => value.system.type?.itemId === TYPE_PROPERTIES);
+          const properties = findPropertiesObject(rootHandle.docSync());
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
           invariant12(properties, "Properties not found", {
             F: __dxlog_file13,
-            L: 457,
+            L: 467,
             S: this,
             A: [
               "properties",
@@ -4018,7 +4045,7 @@ var DataSpace = class {
           const newRoot = this._echoHost.automergeRepo.create(newSpaceDoc);
           invariant12(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file13,
-            L: 462,
+            L: 472,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -4087,7 +4114,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 528,
+      L: 538,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4139,17 +4166,32 @@ DataSpace = _ts_decorate4([
   trackLeaks("open", "close"),
   trace6.resource()
 ], DataSpace);
+var findPropertiesObject = (spaceDoc) => {
+  for (const id in spaceDoc.objects ?? {}) {
+    const obj = spaceDoc.objects[id];
+    if (obj.system.type?.itemId === TYPE_PROPERTIES) {
+      return [
+        id,
+        obj
+      ];
+    }
+  }
+  return void 0;
+};
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
 import { Event as Event7, synchronized as synchronized2, trackLeaks as trackLeaks2 } from "@dxos/async";
-import { Context as Context9, cancelWithContext as cancelWithContext5 } from "@dxos/context";
+import { cancelWithContext as cancelWithContext5, Context as Context9 } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
+import { AuthStatus } from "@dxos/echo-pipeline";
 import { invariant as invariant13 } from "@dxos/invariant";
 import { PublicKey as PublicKey11 } from "@dxos/keys";
 import { log as log12 } from "@dxos/log";
-import { trace as trace7 } from "@dxos/protocols";
+import { trace as Trace2 } from "@dxos/protocols";
 import { Invitation as Invitation7, SpaceState as SpaceState2 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember5 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Gossip as Gossip2, Presence as Presence2 } from "@dxos/teleport-extension-gossip";
+import { trace as trace7 } from "@dxos/tracing";
 import { ComplexMap as ComplexMap3, deferFunction as deferFunction2, forEachAsync } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/genesis.ts
@@ -4253,6 +4295,28 @@ var DataSpaceManager = class {
     const { spaceMemberPresenceAnnounceInterval = PRESENCE_ANNOUNCE_INTERVAL, spaceMemberPresenceOfflineTimeout = PRESENCE_OFFLINE_TIMEOUT } = params ?? {};
     this._spaceMemberPresenceAnnounceInterval = spaceMemberPresenceAnnounceInterval;
     this._spaceMemberPresenceOfflineTimeout = spaceMemberPresenceOfflineTimeout;
+    trace7.diagnostic({
+      id: "spaces",
+      name: "Spaces",
+      fetch: async () => {
+        return Array.from(this._spaces.values()).map((space) => {
+          const rootUrl = space.automergeSpaceState.rootUrl;
+          const rootHandle = rootUrl ? this._echoHost.automergeRepo.find(rootUrl) : void 0;
+          const rootDoc = rootHandle?.docSync();
+          const properties = rootDoc && findPropertiesObject(rootDoc);
+          return {
+            key: space.key.toHex(),
+            state: SpaceState2[space.state],
+            name: properties?.[1].data.name ?? null,
+            inlineObjects: rootDoc ? Object.keys(rootDoc.objects ?? {}).length : null,
+            linkedObjects: rootDoc ? Object.keys(rootDoc.links ?? {}).length : null,
+            credentials: space.inner.spaceState.credentials.length,
+            members: space.inner.spaceState.members.size,
+            rootUrl
+          };
+        });
+      }
+    });
   }
   // TODO(burdon): Remove.
   get spaces() {
@@ -4261,15 +4325,15 @@ var DataSpaceManager = class {
   async open() {
     log12("open", void 0, {
       F: __dxlog_file14,
-      L: 102,
+      L: 144,
       S: this,
       C: (f, a) => f(...a)
     });
-    log12.trace("dxos.echo.data-space-manager.open", trace7.begin({
+    log12.trace("dxos.echo.data-space-manager.open", Trace2.begin({
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 103,
+      L: 145,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4277,7 +4341,7 @@ var DataSpaceManager = class {
       spaces: this._metadataStore.spaces.length
     }, {
       F: __dxlog_file14,
-      L: 104,
+      L: 146,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4287,7 +4351,7 @@ var DataSpaceManager = class {
           spaceMetadata
         }, {
           F: __dxlog_file14,
-          L: 108,
+          L: 150,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4298,7 +4362,7 @@ var DataSpaceManager = class {
           err
         }, {
           F: __dxlog_file14,
-          L: 111,
+          L: 153,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4311,11 +4375,11 @@ var DataSpaceManager = class {
         space.initializeDataPipelineAsync();
       }
     }
-    log12.trace("dxos.echo.data-space-manager.open", trace7.end({
+    log12.trace("dxos.echo.data-space-manager.open", Trace2.end({
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 124,
+      L: 166,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4323,7 +4387,7 @@ var DataSpaceManager = class {
   async close() {
     log12("close", void 0, {
       F: __dxlog_file14,
-      L: 129,
+      L: 171,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4339,7 +4403,7 @@ var DataSpaceManager = class {
   async createSpace() {
     invariant13(this._isOpen, "Not open.", {
       F: __dxlog_file14,
-      L: 142,
+      L: 184,
       S: this,
       A: [
         "this._isOpen",
@@ -4360,18 +4424,18 @@ var DataSpaceManager = class {
       spaceKey
     }, {
       F: __dxlog_file14,
-      L: 154,
+      L: 196,
       S: this,
       C: (f, a) => f(...a)
     });
-    const automergeRootUrl = await this._echoHost.createSpaceRoot(spaceKey);
+    const root = await this._echoHost.createSpaceRoot(spaceKey);
     const space = await this._constructSpace(metadata);
-    const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRootUrl);
+    const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, root.url);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
     invariant13(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file14,
-      L: 163,
+      L: 205,
       S: this,
       A: [
         "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -4389,13 +4453,13 @@ var DataSpaceManager = class {
       opts
     }, {
       F: __dxlog_file14,
-      L: 175,
+      L: 217,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant13(this._isOpen, "Not open.", {
       F: __dxlog_file14,
-      L: 176,
+      L: 218,
       S: this,
       A: [
         "this._isOpen",
@@ -4404,7 +4468,7 @@ var DataSpaceManager = class {
     });
     invariant13(!this._spaces.has(opts.spaceKey), "Space already exists.", {
       F: __dxlog_file14,
-      L: 177,
+      L: 219,
       S: this,
       A: [
         "!this._spaces.has(opts.spaceKey)",
@@ -4439,7 +4503,7 @@ var DataSpaceManager = class {
       metadata
     }, {
       F: __dxlog_file14,
-      L: 210,
+      L: 252,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4477,11 +4541,16 @@ var DataSpaceManager = class {
       onAuthFailure: () => {
         log12.warn("auth failure", void 0, {
           F: __dxlog_file14,
-          L: 247,
+          L: 289,
           S: this,
           C: (f, a) => f(...a)
         });
       },
+      onMemberRolesChanged: async (members) => {
+        if (dataSpace?.state === SpaceState2.READY) {
+          this._handleMemberRoleChanges(presence, space.protocol, members);
+        }
+      },
       memberKey: this._signingContext.identityKey,
       onDelegatedInvitationStatusChange: (invitation, isActive) => {
         return this._handleInvitationStatusChange(dataSpace, invitation, isActive);
@@ -4505,7 +4574,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file14,
-            L: 269,
+            L: 316,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4516,7 +4585,7 @@ var DataSpaceManager = class {
             open: this._isOpen
           }, {
             F: __dxlog_file14,
-            L: 272,
+            L: 319,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4524,6 +4593,9 @@ var DataSpaceManager = class {
             await this._createDelegatedInvitations(dataSpace, [
               ...space.spaceState.invitations.entries()
             ]);
+            this._handleMemberRoleChanges(presence, space.protocol, [
+              ...space.spaceState.members.values()
+            ]);
             this.updated.emit();
           }
         },
@@ -4532,7 +4604,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file14,
-            L: 279,
+            L: 327,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4540,6 +4612,11 @@ var DataSpaceManager = class {
       },
       cache: metadata.cache
     });
+    presence.newPeer.on((peerState) => {
+      if (dataSpace.state === SpaceState2.READY) {
+        this._handleNewPeerConnected(space, peerState);
+      }
+    });
     if (metadata.state !== SpaceState2.INACTIVE) {
       await dataSpace.open();
     }
@@ -4549,6 +4626,51 @@ var DataSpaceManager = class {
     this._spaces.set(metadata.key, dataSpace);
     return dataSpace;
   }
+  _handleMemberRoleChanges(presence, spaceProtocol, memberInfo) {
+    let closedSessions = 0;
+    for (const member of memberInfo) {
+      if (member.key.equals(presence.getLocalState().identityKey)) {
+        continue;
+      }
+      const peers = presence.getPeersByIdentityKey(member.key);
+      const sessions = peers.map((p) => p.peerId && spaceProtocol.sessions.get(p.peerId));
+      const sessionsToClose = sessions.filter((s) => {
+        return (s && member.role === SpaceMember5.Role.REMOVED !== (s.authStatus === AuthStatus.FAILURE)) ?? false;
+      });
+      sessionsToClose.forEach((session) => {
+        void session.close().catch(log12.error);
+      });
+      closedSessions += sessionsToClose.length;
+    }
+    log12("processed member role changes", {
+      roleChangeCount: memberInfo.length,
+      peersOnline: presence.getPeersOnline().length,
+      closedSessions
+    }, {
+      F: __dxlog_file14,
+      L: 367,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    spaceProtocol.updateTopology();
+  }
+  _handleNewPeerConnected(space, peerState) {
+    const role = space.spaceState.getMemberRole(peerState.identityKey);
+    if (role === SpaceMember5.Role.REMOVED) {
+      const session = peerState.peerId && space.protocol.sessions.get(peerState.peerId);
+      if (session != null) {
+        log12("closing a session with a removed peer", {
+          peerId: peerState.peerId
+        }, {
+          F: __dxlog_file14,
+          L: 381,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        void session.close().catch(log12.error);
+      }
+    }
+  }
   async _handleInvitationStatusChange(dataSpace, delegatedInvitation, isActive) {
     if (dataSpace?.state !== SpaceState2.READY) {
       return;
@@ -4604,12 +4726,13 @@ DataSpaceManager = _ts_decorate5([
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
 import { EventSubscriptions as EventSubscriptions2, UpdateScheduler, scheduleTask as scheduleTask6 } from "@dxos/async";
 import { Stream as Stream10 } from "@dxos/codec-protobuf";
+import { createAdmissionCredentials as createAdmissionCredentials2, getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
 import { raise as raise2 } from "@dxos/debug";
+import { writeMessages as writeMessages3 } from "@dxos/feed-store";
 import { invariant as invariant14 } from "@dxos/invariant";
 import { log as log13 } from "@dxos/log";
-import { ApiError, SpaceNotFoundError, encodeError } from "@dxos/protocols";
-import { SpaceMember as SpaceMember5, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
-import { SpaceMember as HaloSpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { ApiError, SpaceNotFoundError as SpaceNotFoundError2, encodeError, IdentityNotInitializedError, AuthorizationError as AuthorizationError2 } from "@dxos/protocols";
+import { SpaceMember as SpaceMember6, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
 var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _getDataSpaceManager) {
@@ -4618,16 +4741,14 @@ var SpacesServiceImpl = class {
     this._getDataSpaceManager = _getDataSpaceManager;
   }
   async createSpace() {
-    if (!this._identityManager.identity) {
-      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
-    }
+    this._requireIdentity();
     const dataSpaceManager = await this._getDataSpaceManager();
     const space = await dataSpaceManager.createSpace();
     return this._serializeSpace(space);
   }
   async updateSpace({ spaceKey, state }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
     if (state) {
       switch (state) {
         case SpaceState3.ACTIVE:
@@ -4641,8 +4762,39 @@ var SpacesServiceImpl = class {
       }
     }
   }
-  async updateMemberRole(_) {
-    throw new Error("not implemented");
+  async updateMemberRole(request) {
+    const identity = this._requireIdentity();
+    const space = this._spaceManager.spaces.get(request.spaceKey);
+    if (space == null) {
+      throw new SpaceNotFoundError2(request.spaceKey);
+    }
+    if (!space.spaceState.hasMembershipManagementPermission(identity.identityKey)) {
+      throw new AuthorizationError2("No member management permission.", {
+        spaceKey: space.key,
+        role: space.spaceState.getMemberRole(identity.identityKey)
+      });
+    }
+    const credentials = await createAdmissionCredentials2(identity.getIdentityCredentialSigner(), request.memberKey, space.key, space.genesisFeedKey, request.newRole, space.spaceState.membershipChainHeads);
+    invariant14(credentials[0].credential, void 0, {
+      F: __dxlog_file15,
+      L: 95,
+      S: this,
+      A: [
+        "credentials[0].credential",
+        ""
+      ]
+    });
+    const spaceMemberCredential = credentials[0].credential.credential;
+    invariant14(getCredentialAssertion3(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file15,
+      L: 97,
+      S: this,
+      A: [
+        "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
+        ""
+      ]
+    });
+    await writeMessages3(space.controlPipeline.writer, credentials);
   }
   querySpaces() {
     return new Stream10(({ next, ctx }) => {
@@ -4653,7 +4805,7 @@ var SpacesServiceImpl = class {
           spaces
         }, {
           F: __dxlog_file15,
-          L: 82,
+          L: 108,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4692,14 +4844,14 @@ var SpacesServiceImpl = class {
   }
   async postMessage({ spaceKey, channel, message }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
     await space.postMessage(getChannelId(channel), message);
   }
   subscribeMessages({ spaceKey, channel }) {
     return new Stream10(({ ctx, next }) => {
       scheduleTask6(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+        const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
         const handle = space.listen(getChannelId(channel), (message) => {
           next(message);
         });
@@ -4709,7 +4861,7 @@ var SpacesServiceImpl = class {
   }
   queryCredentials({ spaceKey, noTail }) {
     return new Stream10(({ ctx, next, close }) => {
-      const space = this._spaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+      const space = this._spaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
       const processor = {
         processCredential: async (credential) => {
           next(credential);
@@ -4725,7 +4877,7 @@ var SpacesServiceImpl = class {
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
-    const space = this._spaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+    const space = this._spaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
     for (const credential of credentials ?? []) {
       if (credential.proof) {
         await space.controlPipeline.writer.write({
@@ -4736,7 +4888,7 @@ var SpacesServiceImpl = class {
       } else {
         invariant14(!credential.id, "Id on unsigned credentials is not allowed", {
           F: __dxlog_file15,
-          L: 169,
+          L: 195,
           S: this,
           A: [
             "!credential.id",
@@ -4745,7 +4897,7 @@ var SpacesServiceImpl = class {
         });
         invariant14(this._identityManager.identity, "Identity is not available", {
           F: __dxlog_file15,
-          L: 170,
+          L: 196,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -4755,7 +4907,7 @@ var SpacesServiceImpl = class {
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
         invariant14(credential.issuer.equals(signer.getIssuer()), void 0, {
           F: __dxlog_file15,
-          L: 172,
+          L: 198,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -4776,7 +4928,7 @@ var SpacesServiceImpl = class {
   }
   async createEpoch({ spaceKey, migration }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
     await space.createEpoch({
       migration
     });
@@ -4810,7 +4962,8 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.role === HaloSpaceMember.Role.REMOVED ? SpaceMember5.PresenceState.REMOVED : isMe || peers.length > 0 ? SpaceMember5.PresenceState.ONLINE : SpaceMember5.PresenceState.OFFLINE,
+          role: member.role,
+          presence: peers.length > 0 ? SpaceMember6.PresenceState.ONLINE : SpaceMember6.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4819,13 +4972,19 @@ var SpacesServiceImpl = class {
       metrics: space.metrics
     };
   }
+  _requireIdentity() {
+    if (!this._identityManager.identity) {
+      throw new IdentityNotInitializedError("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
+    }
+    return this._identityManager.identity;
+  }
 };
 var getChannelId = (channel) => `user-channel/${channel}`;
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
 import { Trigger as Trigger6 } from "@dxos/async";
 import { Context as Context10, Resource } from "@dxos/context";
-import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
+import { getCredentialAssertion as getCredentialAssertion4 } from "@dxos/credentials";
 import { failUndefined as failUndefined2 } from "@dxos/debug";
 import { EchoHost } from "@dxos/echo-db";
 import { MetadataStore, SnapshotStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
@@ -4837,7 +4996,7 @@ import { log as log14 } from "@dxos/log";
 import { InvalidStorageVersionError, STORAGE_VERSION, trace as trace8 } from "@dxos/protocols";
 import { Invitation as Invitation8 } from "@dxos/protocols/proto/dxos/client/services";
 import { BlobStore } from "@dxos/teleport-extension-object-sync";
-import { trace as Trace2 } from "@dxos/tracing";
+import { trace as Trace3 } from "@dxos/tracing";
 import { safeInstanceof } from "@dxos/util";
 function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -5041,7 +5200,7 @@ var ServiceContext = class extends Resource {
     this.initialized.wake();
     this._deviceSpaceSync = {
       processCredential: async (credential) => {
-        const assertion = getCredentialAssertion3(credential);
+        const assertion = getCredentialAssertion4(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
         }
@@ -5097,14 +5256,14 @@ var ServiceContext = class extends Resource {
   }
 };
 _ts_decorate6([
-  Trace2.span()
+  Trace3.span()
 ], ServiceContext.prototype, "_open", null);
 _ts_decorate6([
-  Trace2.span()
+  Trace3.span()
 ], ServiceContext.prototype, "_initialize", null);
 ServiceContext = _ts_decorate6([
   safeInstanceof("dxos.client-services.ServiceContext"),
-  Trace2.resource()
+  Trace3.resource()
 ], ServiceContext);
 
 // packages/sdk/client-services/src/packlets/services/service-registry.ts
@@ -5137,11 +5296,11 @@ import { getFirstStreamValue } from "@dxos/codec-protobuf";
 import { credentialTypeFilter } from "@dxos/credentials";
 import { invariant as invariant16 } from "@dxos/invariant";
 import { STORAGE_VERSION as STORAGE_VERSION2 } from "@dxos/protocols";
-import { SpaceMember as SpaceMember6 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember7 } from "@dxos/protocols/proto/dxos/client/services";
 import { TRACE_PROCESSOR } from "@dxos/tracing";
 
 // packages/sdk/client-services/src/version.ts
-var DXOS_VERSION = "0.5.3-main.5a4243f";
+var DXOS_VERSION = "0.5.3-main.5eb30e6";
 
 // packages/sdk/client-services/src/packlets/services/platform.ts
 import { Platform } from "@dxos/protocols/proto/dxos/client/services";
@@ -5249,13 +5408,14 @@ var getSpaceStats = async (space) => {
       id: credential.id
     })),
     members: Array.from(space.inner.spaceState.members.values()).map((member) => ({
+      role: member.role,
       identity: {
         identityKey: member.key,
         profile: {
           displayName: member.assertion.profile?.displayName
         }
       },
-      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember6.PresenceState.ONLINE : SpaceMember6.PresenceState.OFFLINE
+      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember7.PresenceState.ONLINE : SpaceMember7.PresenceState.OFFLINE
     })),
     pipeline: {
       // TODO(burdon): Pick properties from credentials if needed.
@@ -5404,7 +5564,7 @@ import { WebsocketSignalManager } from "@dxos/messaging";
 import { NetworkManager, createSimplePeerTransportFactory } from "@dxos/network-manager";
 import { trace as trace9 } from "@dxos/protocols";
 import { SystemStatus } from "@dxos/protocols/proto/dxos/client/services";
-import { TRACE_PROCESSOR as TRACE_PROCESSOR2, trace as Trace3 } from "@dxos/tracing";
+import { TRACE_PROCESSOR as TRACE_PROCESSOR2, trace as Trace4 } from "@dxos/tracing";
 import { assignDeep as assignDeep2 } from "@dxos/util";
 import { WebsocketRpcClient } from "@dxos/websocket-rpc";
 
@@ -6288,21 +6448,21 @@ var ClientServicesHost = class {
   }
 };
 _ts_decorate8([
-  Trace3.info()
+  Trace4.info()
 ], ClientServicesHost.prototype, "_opening", void 0);
 _ts_decorate8([
-  Trace3.info()
+  Trace4.info()
 ], ClientServicesHost.prototype, "_open", void 0);
 _ts_decorate8([
   synchronized3,
-  Trace3.span()
+  Trace4.span()
 ], ClientServicesHost.prototype, "open", null);
 _ts_decorate8([
   synchronized3,
-  Trace3.span()
+  Trace4.span()
 ], ClientServicesHost.prototype, "close", null);
 ClientServicesHost = _ts_decorate8([
-  Trace3.resource()
+  Trace4.resource()
 ], ClientServicesHost);
 
 // packages/sdk/client-services/src/packlets/services/util.ts
@@ -6371,6 +6531,7 @@ export {
   InvitationsManager,
   ClientRpcServer,
   DataSpace,
+  findPropertiesObject,
   DataSpaceManager,
   SpacesServiceImpl,
   ServiceContext,
@@ -6386,4 +6547,4 @@ export {
   ClientServicesHost,
   ClientServicesProviderResource
 };
-//# sourceMappingURL=chunk-25A3RELK.mjs.map
+//# sourceMappingURL=chunk-W6NTTNM6.mjs.map