@dxos/client-services 0.5.3-main.f752aaa → 0.5.3-next.2c59258

package/dist/lib/browser/{chunk-3ZUGGKNX.mjs → chunk-R3VORRTJ.mjs}

@@ -1088,6 +1088,8 @@ var IdentityManager = class {
       },
       memberKey: identityKey,
       onDelegatedInvitationStatusChange: async () => {
+      },
+      onMemberRolesChanged: async () => {
       }
     });
   }
@@ -1191,6 +1193,9 @@ var DeviceInvitationProtocol = class {
   toJSON() {
     return {};
   }
+  checkCanInviteNewMembers() {
+    return void 0;
+  }
   getInvitationContext() {
     return {
       kind: Invitation.Kind.DEVICE
@@ -1205,7 +1210,7 @@ var DeviceInvitationProtocol = class {
   async admit(_, request) {
     invariant4(request.device, void 0, {
       F: __dxlog_file5,
-      L: 46,
+      L: 50,
       S: this,
       A: [
         "request.device",
@@ -1251,7 +1256,7 @@ var DeviceInvitationProtocol = class {
   async accept(response, request) {
     invariant4(response.device, void 0, {
       F: __dxlog_file5,
-      L: 91,
+      L: 95,
       S: this,
       A: [
         "response.device",
@@ -1261,7 +1266,7 @@ var DeviceInvitationProtocol = class {
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
     invariant4(request.device, void 0, {
       F: __dxlog_file5,
-      L: 94,
+      L: 98,
       S: this,
       A: [
         "request.device",
@@ -2561,7 +2566,7 @@ import { createAdmissionCredentials, createCancelDelegatedSpaceInvitationCredent
 import { writeMessages as writeMessages2 } from "@dxos/feed-store";
 import { invariant as invariant9 } from "@dxos/invariant";
 import { log as log8 } from "@dxos/log";
-import { AlreadyJoinedError as AlreadyJoinedError2 } from "@dxos/protocols";
+import { AlreadyJoinedError as AlreadyJoinedError2, AuthorizationError, InvalidInvitationError, SpaceNotFoundError } from "@dxos/protocols";
 import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
 import { SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
 var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
@@ -2578,6 +2583,19 @@ var SpaceInvitationProtocol = class {
       spaceKey: this._spaceKey
     };
   }
+  checkCanInviteNewMembers() {
+    if (this._spaceKey == null) {
+      return new InvalidInvitationError("No spaceKey was provided for a space invitation.");
+    }
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    if (space == null) {
+      return new SpaceNotFoundError(this._spaceKey);
+    }
+    if (!space?.inner.spaceState.hasMembershipManagementPermission(this._signingContext.identityKey)) {
+      return new AuthorizationError("No member management permission.");
+    }
+    return void 0;
+  }
   getInvitationContext() {
     return {
       kind: Invitation5.Kind.SPACE,
@@ -2587,7 +2605,7 @@ var SpaceInvitationProtocol = class {
   async admit(invitation, request, guestProfile) {
     invariant9(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 56,
+      L: 76,
       S: this,
       A: [
         "this._spaceKey",
@@ -2597,7 +2615,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     invariant9(space, void 0, {
       F: __dxlog_file10,
-      L: 58,
+      L: 78,
       S: this,
       A: [
         "space",
@@ -2606,7 +2624,7 @@ var SpaceInvitationProtocol = class {
     });
     invariant9(request.space, void 0, {
       F: __dxlog_file10,
-      L: 60,
+      L: 80,
       S: this,
       A: [
         "request.space",
@@ -2614,19 +2632,22 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { identityKey, deviceKey } = request.space;
+    if (space.inner.spaceState.getMemberRole(identityKey) !== SpaceMember.Role.REMOVED) {
+      throw new AlreadyJoinedError2();
+    }
     log8("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
       F: __dxlog_file10,
-      L: 63,
+      L: 87,
       S: this,
       C: (f, a) => f(...a)
     });
     const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, invitation.role ?? SpaceMember.Role.ADMIN, space.inner.spaceState.membershipChainHeads, guestProfile, invitation.delegationCredentialId);
     invariant9(credentials[0].credential, void 0, {
       F: __dxlog_file10,
-      L: 77,
+      L: 101,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2636,7 +2657,7 @@ var SpaceInvitationProtocol = class {
     const spaceMemberCredential = credentials[0].credential.credential;
     invariant9(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file10,
-      L: 79,
+      L: 103,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2654,7 +2675,7 @@ var SpaceInvitationProtocol = class {
   async delegate(invitation) {
     invariant9(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 92,
+      L: 116,
       S: this,
       A: [
         "this._spaceKey",
@@ -2664,7 +2685,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     invariant9(space, void 0, {
       F: __dxlog_file10,
-      L: 94,
+      L: 118,
       S: this,
       A: [
         "space",
@@ -2674,7 +2695,7 @@ var SpaceInvitationProtocol = class {
     if (invitation.authMethod === Invitation5.AuthMethod.KNOWN_PUBLIC_KEY) {
       invariant9(invitation.guestKeypair?.publicKey, void 0, {
         F: __dxlog_file10,
-        L: 96,
+        L: 120,
         S: this,
         A: [
           "invitation.guestKeypair?.publicKey",
@@ -2687,7 +2708,7 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file10,
-      L: 99,
+      L: 123,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2702,7 +2723,7 @@ var SpaceInvitationProtocol = class {
     });
     invariant9(credential.credential, void 0, {
       F: __dxlog_file10,
-      L: 119,
+      L: 143,
       S: this,
       A: [
         "credential.credential",
@@ -2717,7 +2738,7 @@ var SpaceInvitationProtocol = class {
   async cancelDelegation(invitation) {
     invariant9(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 125,
+      L: 149,
       S: this,
       A: [
         "this._spaceKey",
@@ -2726,7 +2747,7 @@ var SpaceInvitationProtocol = class {
     });
     invariant9(invitation.type === Invitation5.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
       F: __dxlog_file10,
-      L: 126,
+      L: 150,
       S: this,
       A: [
         "invitation.type === Invitation.Type.DELEGATED && invitation.delegationCredentialId",
@@ -2736,7 +2757,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     invariant9(space, void 0, {
       F: __dxlog_file10,
-      L: 128,
+      L: 152,
       S: this,
       A: [
         "space",
@@ -2748,14 +2769,14 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file10,
-      L: 130,
+      L: 154,
       S: this,
       C: (f, a) => f(...a)
     });
     const credential = await createCancelDelegatedSpaceInvitationCredential(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
     invariant9(credential.credential, void 0, {
       F: __dxlog_file10,
-      L: 137,
+      L: 161,
       S: this,
       A: [
         "credential.credential",
@@ -2767,7 +2788,10 @@ var SpaceInvitationProtocol = class {
     ]);
   }
   checkInvitation(invitation) {
-    if (invitation.spaceKey && this._spaceManager.spaces.has(invitation.spaceKey)) {
+    if (invitation.spaceKey == null) {
+      return new InvalidInvitationError("No spaceKey was provided for a space invitation.");
+    }
+    if (this._spaceManager.spaces.has(invitation.spaceKey)) {
       return new AlreadyJoinedError2("Already joined space.");
     }
   }
@@ -2791,7 +2815,7 @@ var SpaceInvitationProtocol = class {
   async accept(response) {
     invariant9(response.space, void 0, {
       F: __dxlog_file10,
-      L: 169,
+      L: 196,
       S: this,
       A: [
         "response.space",
@@ -2802,7 +2826,7 @@ var SpaceInvitationProtocol = class {
     const assertion = getCredentialAssertion(credential);
     invariant9(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file10,
-      L: 172,
+      L: 199,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2811,7 +2835,7 @@ var SpaceInvitationProtocol = class {
     });
     invariant9(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
       F: __dxlog_file10,
-      L: 173,
+      L: 200,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -2869,6 +2893,10 @@ var InvitationsManager = class {
       }
     }
     const handler = this._getHandler(options);
+    const invitationError = handler.checkCanInviteNewMembers();
+    if (invitationError != null) {
+      throw invitationError;
+    }
     const invitation = this._createInvitation(handler, options);
     const { ctx, stream, observableInvitation } = this._createObservableInvitation(handler, invitation);
     this._createInvitations.set(invitation.invitationId, observableInvitation);
@@ -2885,7 +2913,7 @@ var InvitationsManager = class {
     } catch (err) {
       log9.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 77,
+        L: 82,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2908,7 +2936,7 @@ var InvitationsManager = class {
       const loadTasks = freshInvitations.map((persistentInvitation) => {
         invariant10(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
           F: __dxlog_file11,
-          L: 98,
+          L: 103,
           S: this,
           A: [
             "!this._createInvitations.get(persistentInvitation.invitationId)",
@@ -2927,7 +2955,7 @@ var InvitationsManager = class {
     } catch (err) {
       log9.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 105,
+        L: 110,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2959,13 +2987,13 @@ var InvitationsManager = class {
   async authenticate({ invitationId, authCode }) {
     log9("authenticating...", void 0, {
       F: __dxlog_file11,
-      L: 135,
+      L: 140,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant10(invitationId, void 0, {
       F: __dxlog_file11,
-      L: 136,
+      L: 141,
       S: this,
       A: [
         "invitationId",
@@ -2978,7 +3006,7 @@ var InvitationsManager = class {
         invitationId
       }, {
         F: __dxlog_file11,
-        L: 139,
+        L: 144,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2991,13 +3019,13 @@ var InvitationsManager = class {
       invitationId
     }, {
       F: __dxlog_file11,
-      L: 146,
+      L: 151,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant10(invitationId, void 0, {
       F: __dxlog_file11,
-      L: 147,
+      L: 152,
       S: this,
       A: [
         "invitationId",
@@ -3076,7 +3104,7 @@ var InvitationsManager = class {
         ...handler.toJSON()
       }, {
         F: __dxlog_file11,
-        L: 236,
+        L: 241,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3109,7 +3137,7 @@ var InvitationsManager = class {
             ...handler.toJSON()
           }, {
             F: __dxlog_file11,
-            L: 256,
+            L: 261,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3120,7 +3148,7 @@ var InvitationsManager = class {
         } else {
           log9.warn("auth failed", err, {
             F: __dxlog_file11,
-            L: 259,
+            L: 264,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3137,7 +3165,7 @@ var InvitationsManager = class {
         ...handler.toJSON()
       }, {
         F: __dxlog_file11,
-        L: 266,
+        L: 271,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3182,7 +3210,7 @@ var InvitationsManager = class {
     } catch (err) {
       log9.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 302,
+        L: 307,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3916,7 +3944,7 @@ var DataSpace = class {
           err
         }, {
           F: __dxlog_file13,
-          L: 385,
+          L: 387,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3971,7 +3999,7 @@ var DataSpace = class {
           const newRoot = this._echoHost.automergeRepo.create(rootHandle.docSync());
           invariant12(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file13,
-            L: 435,
+            L: 437,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -3990,7 +4018,7 @@ var DataSpace = class {
         {
           log11.info("Fragmenting", void 0, {
             F: __dxlog_file13,
-            L: 447,
+            L: 449,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4002,7 +4030,7 @@ var DataSpace = class {
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
           invariant12(properties, "Properties not found", {
             F: __dxlog_file13,
-            L: 457,
+            L: 459,
             S: this,
             A: [
               "properties",
@@ -4018,7 +4046,7 @@ var DataSpace = class {
           const newRoot = this._echoHost.automergeRepo.create(newSpaceDoc);
           invariant12(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file13,
-            L: 462,
+            L: 464,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -4087,7 +4115,7 @@ var DataSpace = class {
       state: SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 528,
+      L: 530,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4142,13 +4170,15 @@ DataSpace = _ts_decorate4([
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
 import { Event as Event7, synchronized as synchronized2, trackLeaks as trackLeaks2 } from "@dxos/async";
-import { Context as Context9, cancelWithContext as cancelWithContext5 } from "@dxos/context";
+import { cancelWithContext as cancelWithContext5, Context as Context9 } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
+import { AuthStatus } from "@dxos/echo-pipeline";
 import { invariant as invariant13 } from "@dxos/invariant";
 import { PublicKey as PublicKey11 } from "@dxos/keys";
 import { log as log12 } from "@dxos/log";
 import { trace as trace7 } from "@dxos/protocols";
 import { Invitation as Invitation7, SpaceState as SpaceState2 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember5 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Gossip as Gossip2, Presence as Presence2 } from "@dxos/teleport-extension-gossip";
 import { ComplexMap as ComplexMap3, deferFunction as deferFunction2, forEachAsync } from "@dxos/util";
 
@@ -4261,7 +4291,7 @@ var DataSpaceManager = class {
   async open() {
     log12("open", void 0, {
       F: __dxlog_file14,
-      L: 102,
+      L: 115,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4269,7 +4299,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 103,
+      L: 116,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4277,7 +4307,7 @@ var DataSpaceManager = class {
       spaces: this._metadataStore.spaces.length
     }, {
       F: __dxlog_file14,
-      L: 104,
+      L: 117,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4287,7 +4317,7 @@ var DataSpaceManager = class {
           spaceMetadata
         }, {
           F: __dxlog_file14,
-          L: 108,
+          L: 121,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4298,7 +4328,7 @@ var DataSpaceManager = class {
           err
         }, {
           F: __dxlog_file14,
-          L: 111,
+          L: 124,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4315,7 +4345,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 124,
+      L: 137,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4323,7 +4353,7 @@ var DataSpaceManager = class {
   async close() {
     log12("close", void 0, {
       F: __dxlog_file14,
-      L: 129,
+      L: 142,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4339,7 +4369,7 @@ var DataSpaceManager = class {
   async createSpace() {
     invariant13(this._isOpen, "Not open.", {
       F: __dxlog_file14,
-      L: 142,
+      L: 155,
       S: this,
       A: [
         "this._isOpen",
@@ -4360,7 +4390,7 @@ var DataSpaceManager = class {
       spaceKey
     }, {
       F: __dxlog_file14,
-      L: 154,
+      L: 167,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4371,7 +4401,7 @@ var DataSpaceManager = class {
     const memberCredential = credentials[1];
     invariant13(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file14,
-      L: 163,
+      L: 176,
       S: this,
       A: [
         "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -4389,13 +4419,13 @@ var DataSpaceManager = class {
       opts
     }, {
       F: __dxlog_file14,
-      L: 175,
+      L: 188,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant13(this._isOpen, "Not open.", {
       F: __dxlog_file14,
-      L: 176,
+      L: 189,
       S: this,
       A: [
         "this._isOpen",
@@ -4404,7 +4434,7 @@ var DataSpaceManager = class {
     });
     invariant13(!this._spaces.has(opts.spaceKey), "Space already exists.", {
       F: __dxlog_file14,
-      L: 177,
+      L: 190,
       S: this,
       A: [
         "!this._spaces.has(opts.spaceKey)",
@@ -4439,7 +4469,7 @@ var DataSpaceManager = class {
       metadata
     }, {
       F: __dxlog_file14,
-      L: 210,
+      L: 223,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4477,11 +4507,16 @@ var DataSpaceManager = class {
       onAuthFailure: () => {
         log12.warn("auth failure", void 0, {
           F: __dxlog_file14,
-          L: 247,
+          L: 260,
           S: this,
           C: (f, a) => f(...a)
         });
       },
+      onMemberRolesChanged: async (members) => {
+        if (dataSpace?.state === SpaceState2.READY) {
+          this._handleMemberRoleChanges(presence, space.protocol, members);
+        }
+      },
       memberKey: this._signingContext.identityKey,
       onDelegatedInvitationStatusChange: (invitation, isActive) => {
         return this._handleInvitationStatusChange(dataSpace, invitation, isActive);
@@ -4505,7 +4540,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file14,
-            L: 269,
+            L: 287,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4516,7 +4551,7 @@ var DataSpaceManager = class {
             open: this._isOpen
           }, {
             F: __dxlog_file14,
-            L: 272,
+            L: 290,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4524,6 +4559,9 @@ var DataSpaceManager = class {
             await this._createDelegatedInvitations(dataSpace, [
               ...space.spaceState.invitations.entries()
             ]);
+            this._handleMemberRoleChanges(presence, space.protocol, [
+              ...space.spaceState.members.values()
+            ]);
             this.updated.emit();
           }
         },
@@ -4532,7 +4570,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file14,
-            L: 279,
+            L: 298,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4540,6 +4578,11 @@ var DataSpaceManager = class {
       },
       cache: metadata.cache
     });
+    presence.newPeer.on((peerState) => {
+      if (dataSpace.state === SpaceState2.READY) {
+        this._handleNewPeerConnected(space, peerState);
+      }
+    });
     if (metadata.state !== SpaceState2.INACTIVE) {
       await dataSpace.open();
     }
@@ -4549,6 +4592,51 @@ var DataSpaceManager = class {
     this._spaces.set(metadata.key, dataSpace);
     return dataSpace;
   }
+  _handleMemberRoleChanges(presence, spaceProtocol, memberInfo) {
+    let closedSessions = 0;
+    for (const member of memberInfo) {
+      if (member.key.equals(presence.getLocalState().identityKey)) {
+        continue;
+      }
+      const peers = presence.getPeersByIdentityKey(member.key);
+      const sessions = peers.map((p) => p.peerId && spaceProtocol.sessions.get(p.peerId));
+      const sessionsToClose = sessions.filter((s) => {
+        return (s && member.role === SpaceMember5.Role.REMOVED !== (s.authStatus === AuthStatus.FAILURE)) ?? false;
+      });
+      sessionsToClose.forEach((session) => {
+        void session.close().catch(log12.error);
+      });
+      closedSessions += sessionsToClose.length;
+    }
+    log12("processed member role changes", {
+      roleChangeCount: memberInfo.length,
+      peersOnline: presence.getPeersOnline().length,
+      closedSessions
+    }, {
+      F: __dxlog_file14,
+      L: 338,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    spaceProtocol.updateTopology();
+  }
+  _handleNewPeerConnected(space, peerState) {
+    const role = space.spaceState.getMemberRole(peerState.identityKey);
+    if (role === SpaceMember5.Role.REMOVED) {
+      const session = peerState.peerId && space.protocol.sessions.get(peerState.peerId);
+      if (session != null) {
+        log12("closing a session with a removed peer", {
+          peerId: peerState.peerId
+        }, {
+          F: __dxlog_file14,
+          L: 352,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        void session.close().catch(log12.error);
+      }
+    }
+  }
   async _handleInvitationStatusChange(dataSpace, delegatedInvitation, isActive) {
     if (dataSpace?.state !== SpaceState2.READY) {
       return;
@@ -4604,12 +4692,13 @@ DataSpaceManager = _ts_decorate5([
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
 import { EventSubscriptions as EventSubscriptions2, UpdateScheduler, scheduleTask as scheduleTask6 } from "@dxos/async";
 import { Stream as Stream10 } from "@dxos/codec-protobuf";
+import { createAdmissionCredentials as createAdmissionCredentials2, getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
 import { raise as raise2 } from "@dxos/debug";
+import { writeMessages as writeMessages3 } from "@dxos/feed-store";
 import { invariant as invariant14 } from "@dxos/invariant";
 import { log as log13 } from "@dxos/log";
-import { ApiError, SpaceNotFoundError, encodeError } from "@dxos/protocols";
-import { SpaceMember as SpaceMember5, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
-import { SpaceMember as HaloSpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { ApiError, SpaceNotFoundError as SpaceNotFoundError2, encodeError, IdentityNotInitializedError, AuthorizationError as AuthorizationError2 } from "@dxos/protocols";
+import { SpaceMember as SpaceMember6, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
 var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _getDataSpaceManager) {
@@ -4618,16 +4707,14 @@ var SpacesServiceImpl = class {
     this._getDataSpaceManager = _getDataSpaceManager;
   }
   async createSpace() {
-    if (!this._identityManager.identity) {
-      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
-    }
+    this._requireIdentity();
     const dataSpaceManager = await this._getDataSpaceManager();
     const space = await dataSpaceManager.createSpace();
     return this._serializeSpace(space);
   }
   async updateSpace({ spaceKey, state }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
     if (state) {
       switch (state) {
         case SpaceState3.ACTIVE:
@@ -4641,8 +4728,39 @@ var SpacesServiceImpl = class {
       }
     }
   }
-  async updateMemberRole(_) {
-    throw new Error("not implemented");
+  async updateMemberRole(request) {
+    const identity = this._requireIdentity();
+    const space = this._spaceManager.spaces.get(request.spaceKey);
+    if (space == null) {
+      throw new SpaceNotFoundError2(request.spaceKey);
+    }
+    if (!space.spaceState.hasMembershipManagementPermission(identity.identityKey)) {
+      throw new AuthorizationError2("No member management permission.", {
+        spaceKey: space.key,
+        role: space.spaceState.getMemberRole(identity.identityKey)
+      });
+    }
+    const credentials = await createAdmissionCredentials2(identity.getIdentityCredentialSigner(), request.memberKey, space.key, space.genesisFeedKey, request.newRole, space.spaceState.membershipChainHeads);
+    invariant14(credentials[0].credential, void 0, {
+      F: __dxlog_file15,
+      L: 95,
+      S: this,
+      A: [
+        "credentials[0].credential",
+        ""
+      ]
+    });
+    const spaceMemberCredential = credentials[0].credential.credential;
+    invariant14(getCredentialAssertion3(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file15,
+      L: 97,
+      S: this,
+      A: [
+        "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
+        ""
+      ]
+    });
+    await writeMessages3(space.controlPipeline.writer, credentials);
   }
   querySpaces() {
     return new Stream10(({ next, ctx }) => {
@@ -4653,7 +4771,7 @@ var SpacesServiceImpl = class {
           spaces
         }, {
           F: __dxlog_file15,
-          L: 82,
+          L: 108,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4692,14 +4810,14 @@ var SpacesServiceImpl = class {
   }
   async postMessage({ spaceKey, channel, message }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
     await space.postMessage(getChannelId(channel), message);
   }
   subscribeMessages({ spaceKey, channel }) {
     return new Stream10(({ ctx, next }) => {
       scheduleTask6(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+        const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
         const handle = space.listen(getChannelId(channel), (message) => {
           next(message);
         });
@@ -4709,7 +4827,7 @@ var SpacesServiceImpl = class {
   }
   queryCredentials({ spaceKey, noTail }) {
     return new Stream10(({ ctx, next, close }) => {
-      const space = this._spaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+      const space = this._spaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
       const processor = {
         processCredential: async (credential) => {
           next(credential);
@@ -4725,7 +4843,7 @@ var SpacesServiceImpl = class {
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
-    const space = this._spaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+    const space = this._spaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
     for (const credential of credentials ?? []) {
       if (credential.proof) {
         await space.controlPipeline.writer.write({
@@ -4736,7 +4854,7 @@ var SpacesServiceImpl = class {
       } else {
         invariant14(!credential.id, "Id on unsigned credentials is not allowed", {
           F: __dxlog_file15,
-          L: 169,
+          L: 195,
           S: this,
           A: [
             "!credential.id",
@@ -4745,7 +4863,7 @@ var SpacesServiceImpl = class {
         });
         invariant14(this._identityManager.identity, "Identity is not available", {
           F: __dxlog_file15,
-          L: 170,
+          L: 196,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -4755,7 +4873,7 @@ var SpacesServiceImpl = class {
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
         invariant14(credential.issuer.equals(signer.getIssuer()), void 0, {
           F: __dxlog_file15,
-          L: 172,
+          L: 198,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -4776,7 +4894,7 @@ var SpacesServiceImpl = class {
   }
   async createEpoch({ spaceKey, migration }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
     await space.createEpoch({
       migration
     });
@@ -4810,7 +4928,8 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.role === HaloSpaceMember.Role.REMOVED ? SpaceMember5.PresenceState.REMOVED : isMe || peers.length > 0 ? SpaceMember5.PresenceState.ONLINE : SpaceMember5.PresenceState.OFFLINE,
+          role: member.role,
+          presence: peers.length > 0 ? SpaceMember6.PresenceState.ONLINE : SpaceMember6.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4819,13 +4938,19 @@ var SpacesServiceImpl = class {
       metrics: space.metrics
     };
   }
+  _requireIdentity() {
+    if (!this._identityManager.identity) {
+      throw new IdentityNotInitializedError("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
+    }
+    return this._identityManager.identity;
+  }
 };
 var getChannelId = (channel) => `user-channel/${channel}`;
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
 import { Trigger as Trigger6 } from "@dxos/async";
 import { Context as Context10, Resource } from "@dxos/context";
-import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
+import { getCredentialAssertion as getCredentialAssertion4 } from "@dxos/credentials";
 import { failUndefined as failUndefined2 } from "@dxos/debug";
 import { EchoHost } from "@dxos/echo-db";
 import { MetadataStore, SnapshotStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
@@ -5041,7 +5166,7 @@ var ServiceContext = class extends Resource {
     this.initialized.wake();
     this._deviceSpaceSync = {
       processCredential: async (credential) => {
-        const assertion = getCredentialAssertion3(credential);
+        const assertion = getCredentialAssertion4(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
         }
@@ -5137,11 +5262,11 @@ import { getFirstStreamValue } from "@dxos/codec-protobuf";
 import { credentialTypeFilter } from "@dxos/credentials";
 import { invariant as invariant16 } from "@dxos/invariant";
 import { STORAGE_VERSION as STORAGE_VERSION2 } from "@dxos/protocols";
-import { SpaceMember as SpaceMember6 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember7 } from "@dxos/protocols/proto/dxos/client/services";
 import { TRACE_PROCESSOR } from "@dxos/tracing";
 
 // packages/sdk/client-services/src/version.ts
-var DXOS_VERSION = "0.5.3-main.f752aaa";
+var DXOS_VERSION = "0.5.3-next.2c59258";
 
 // packages/sdk/client-services/src/packlets/services/platform.ts
 import { Platform } from "@dxos/protocols/proto/dxos/client/services";
@@ -5249,13 +5374,14 @@ var getSpaceStats = async (space) => {
       id: credential.id
     })),
     members: Array.from(space.inner.spaceState.members.values()).map((member) => ({
+      role: member.role,
       identity: {
         identityKey: member.key,
         profile: {
           displayName: member.assertion.profile?.displayName
         }
       },
-      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember6.PresenceState.ONLINE : SpaceMember6.PresenceState.OFFLINE
+      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember7.PresenceState.ONLINE : SpaceMember7.PresenceState.OFFLINE
     })),
     pipeline: {
       // TODO(burdon): Pick properties from credentials if needed.
@@ -6386,4 +6512,4 @@ export {
   ClientServicesHost,
   ClientServicesProviderResource
 };
-//# sourceMappingURL=chunk-3ZUGGKNX.mjs.map
+//# sourceMappingURL=chunk-R3VORRTJ.mjs.map