@dxos/client-services 0.5.3-main.f752aaa → 0.5.3-next.2c59258

package/dist/lib/node/{chunk-TQQUIYBW.cjs → chunk-VOYHS6QR.cjs}

@@ -26,8 +26,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var chunk_TQQUIYBW_exports = {};
-__export(chunk_TQQUIYBW_exports, {
+var chunk_VOYHS6QR_exports = {};
+__export(chunk_VOYHS6QR_exports, {
   ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   ClientServicesProviderResource: () => ClientServicesProviderResource,
@@ -66,7 +66,7 @@ __export(chunk_TQQUIYBW_exports, {
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo
 });
-module.exports = __toCommonJS(chunk_TQQUIYBW_exports);
+module.exports = __toCommonJS(chunk_VOYHS6QR_exports);
 var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_feed_store = require("@dxos/feed-store");
@@ -207,32 +207,35 @@ var import_util7 = require("@dxos/util");
 var import_async14 = require("@dxos/async");
 var import_context11 = require("@dxos/context");
 var import_credentials14 = require("@dxos/credentials");
+var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_invariant13 = require("@dxos/invariant");
 var import_keys11 = require("@dxos/keys");
 var import_log12 = require("@dxos/log");
 var import_protocols10 = require("@dxos/protocols");
 var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
+var import_credentials15 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_teleport_extension_gossip2 = require("@dxos/teleport-extension-gossip");
 var import_util8 = require("@dxos/util");
-var import_credentials15 = require("@dxos/credentials");
+var import_credentials16 = require("@dxos/credentials");
 var import_debug4 = require("@dxos/debug");
-var import_credentials16 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials17 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe3 = require("@dxos/timeframe");
 var import_async15 = require("@dxos/async");
 var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_credentials18 = require("@dxos/credentials");
 var import_debug5 = require("@dxos/debug");
+var import_feed_store4 = require("@dxos/feed-store");
 var import_invariant14 = require("@dxos/invariant");
 var import_log13 = require("@dxos/log");
 var import_protocols11 = require("@dxos/protocols");
 var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials17 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_async16 = require("@dxos/async");
 var import_context12 = require("@dxos/context");
-var import_credentials18 = require("@dxos/credentials");
+var import_credentials19 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
 var import_echo_db = require("@dxos/echo-db");
-var import_echo_pipeline4 = require("@dxos/echo-pipeline");
-var import_feed_store4 = require("@dxos/feed-store");
+var import_echo_pipeline5 = require("@dxos/echo-pipeline");
+var import_feed_store5 = require("@dxos/feed-store");
 var import_invariant15 = require("@dxos/invariant");
 var import_keyring = require("@dxos/keyring");
 var import_keys12 = require("@dxos/keys");
@@ -244,7 +247,7 @@ var import_tracing5 = require("@dxos/tracing");
 var import_util9 = require("@dxos/util");
 var import_async17 = require("@dxos/async");
 var import_codec_protobuf11 = require("@dxos/codec-protobuf");
-var import_credentials19 = require("@dxos/credentials");
+var import_credentials20 = require("@dxos/credentials");
 var import_invariant16 = require("@dxos/invariant");
 var import_protocols13 = require("@dxos/protocols");
 var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
@@ -1316,6 +1319,8 @@ var IdentityManager = class {
       },
       memberKey: identityKey,
       onDelegatedInvitationStatusChange: async () => {
+      },
+      onMemberRolesChanged: async () => {
       }
     });
   }
@@ -1408,6 +1413,9 @@ var DeviceInvitationProtocol = class {
   toJSON() {
     return {};
   }
+  checkCanInviteNewMembers() {
+    return void 0;
+  }
   getInvitationContext() {
     return {
       kind: import_services2.Invitation.Kind.DEVICE
@@ -1422,7 +1430,7 @@ var DeviceInvitationProtocol = class {
   async admit(_, request) {
     (0, import_invariant4.invariant)(request.device, void 0, {
       F: __dxlog_file5,
-      L: 46,
+      L: 50,
       S: this,
       A: [
         "request.device",
@@ -1468,7 +1476,7 @@ var DeviceInvitationProtocol = class {
   async accept(response, request) {
     (0, import_invariant4.invariant)(response.device, void 0, {
       F: __dxlog_file5,
-      L: 91,
+      L: 95,
       S: this,
       A: [
         "response.device",
@@ -1478,7 +1486,7 @@ var DeviceInvitationProtocol = class {
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
     (0, import_invariant4.invariant)(request.device, void 0, {
       F: __dxlog_file5,
-      L: 94,
+      L: 98,
       S: this,
       A: [
         "request.device",
@@ -2731,6 +2739,19 @@ var SpaceInvitationProtocol = class {
       spaceKey: this._spaceKey
     };
   }
+  checkCanInviteNewMembers() {
+    if (this._spaceKey == null) {
+      return new import_protocols7.InvalidInvitationError("No spaceKey was provided for a space invitation.");
+    }
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    if (space == null) {
+      return new import_protocols7.SpaceNotFoundError(this._spaceKey);
+    }
+    if (!space?.inner.spaceState.hasMembershipManagementPermission(this._signingContext.identityKey)) {
+      return new import_protocols7.AuthorizationError("No member management permission.");
+    }
+    return void 0;
+  }
   getInvitationContext() {
     return {
       kind: import_services7.Invitation.Kind.SPACE,
@@ -2740,7 +2761,7 @@ var SpaceInvitationProtocol = class {
   async admit(invitation, request, guestProfile) {
     (0, import_invariant9.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 56,
+      L: 76,
       S: this,
       A: [
         "this._spaceKey",
@@ -2750,7 +2771,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant9.invariant)(space, void 0, {
       F: __dxlog_file10,
-      L: 58,
+      L: 78,
       S: this,
       A: [
         "space",
@@ -2759,7 +2780,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant9.invariant)(request.space, void 0, {
       F: __dxlog_file10,
-      L: 60,
+      L: 80,
       S: this,
       A: [
         "request.space",
@@ -2767,19 +2788,22 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { identityKey, deviceKey } = request.space;
+    if (space.inner.spaceState.getMemberRole(identityKey) !== import_credentials8.SpaceMember.Role.REMOVED) {
+      throw new import_protocols7.AlreadyJoinedError();
+    }
     (0, import_log8.log)("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
       F: __dxlog_file10,
-      L: 63,
+      L: 87,
       S: this,
       C: (f, a) => f(...a)
     });
     const credentials = await (0, import_credentials7.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, invitation.role ?? import_credentials8.SpaceMember.Role.ADMIN, space.inner.spaceState.membershipChainHeads, guestProfile, invitation.delegationCredentialId);
     (0, import_invariant9.invariant)(credentials[0].credential, void 0, {
       F: __dxlog_file10,
-      L: 77,
+      L: 101,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2789,7 +2813,7 @@ var SpaceInvitationProtocol = class {
     const spaceMemberCredential = credentials[0].credential.credential;
     (0, import_invariant9.invariant)((0, import_credentials7.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file10,
-      L: 79,
+      L: 103,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2807,7 +2831,7 @@ var SpaceInvitationProtocol = class {
   async delegate(invitation) {
     (0, import_invariant9.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 92,
+      L: 116,
       S: this,
       A: [
         "this._spaceKey",
@@ -2817,7 +2841,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant9.invariant)(space, void 0, {
       F: __dxlog_file10,
-      L: 94,
+      L: 118,
       S: this,
       A: [
         "space",
@@ -2827,7 +2851,7 @@ var SpaceInvitationProtocol = class {
     if (invitation.authMethod === import_services7.Invitation.AuthMethod.KNOWN_PUBLIC_KEY) {
       (0, import_invariant9.invariant)(invitation.guestKeypair?.publicKey, void 0, {
         F: __dxlog_file10,
-        L: 96,
+        L: 120,
         S: this,
         A: [
           "invitation.guestKeypair?.publicKey",
@@ -2840,7 +2864,7 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file10,
-      L: 99,
+      L: 123,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2855,7 +2879,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant9.invariant)(credential.credential, void 0, {
       F: __dxlog_file10,
-      L: 119,
+      L: 143,
       S: this,
       A: [
         "credential.credential",
@@ -2870,7 +2894,7 @@ var SpaceInvitationProtocol = class {
   async cancelDelegation(invitation) {
     (0, import_invariant9.invariant)(this._spaceKey, void 0, {
       F: __dxlog_file10,
-      L: 125,
+      L: 149,
       S: this,
       A: [
         "this._spaceKey",
@@ -2879,7 +2903,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant9.invariant)(invitation.type === import_services7.Invitation.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
       F: __dxlog_file10,
-      L: 126,
+      L: 150,
       S: this,
       A: [
         "invitation.type === Invitation.Type.DELEGATED && invitation.delegationCredentialId",
@@ -2889,7 +2913,7 @@ var SpaceInvitationProtocol = class {
     const space = this._spaceManager.spaces.get(this._spaceKey);
     (0, import_invariant9.invariant)(space, void 0, {
       F: __dxlog_file10,
-      L: 128,
+      L: 152,
       S: this,
       A: [
         "space",
@@ -2901,14 +2925,14 @@ var SpaceInvitationProtocol = class {
       id: invitation.invitationId
     }, {
       F: __dxlog_file10,
-      L: 130,
+      L: 154,
       S: this,
       C: (f, a) => f(...a)
     });
     const credential = await (0, import_credentials7.createCancelDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
     (0, import_invariant9.invariant)(credential.credential, void 0, {
       F: __dxlog_file10,
-      L: 137,
+      L: 161,
       S: this,
       A: [
         "credential.credential",
@@ -2920,7 +2944,10 @@ var SpaceInvitationProtocol = class {
     ]);
   }
   checkInvitation(invitation) {
-    if (invitation.spaceKey && this._spaceManager.spaces.has(invitation.spaceKey)) {
+    if (invitation.spaceKey == null) {
+      return new import_protocols7.InvalidInvitationError("No spaceKey was provided for a space invitation.");
+    }
+    if (this._spaceManager.spaces.has(invitation.spaceKey)) {
       return new import_protocols7.AlreadyJoinedError("Already joined space.");
     }
   }
@@ -2944,7 +2971,7 @@ var SpaceInvitationProtocol = class {
   async accept(response) {
     (0, import_invariant9.invariant)(response.space, void 0, {
       F: __dxlog_file10,
-      L: 169,
+      L: 196,
       S: this,
       A: [
         "response.space",
@@ -2955,7 +2982,7 @@ var SpaceInvitationProtocol = class {
     const assertion = (0, import_credentials7.getCredentialAssertion)(credential);
     (0, import_invariant9.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file10,
-      L: 172,
+      L: 199,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2964,7 +2991,7 @@ var SpaceInvitationProtocol = class {
     });
     (0, import_invariant9.invariant)(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
       F: __dxlog_file10,
-      L: 173,
+      L: 200,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -3010,6 +3037,10 @@ var InvitationsManager = class {
       }
     }
     const handler = this._getHandler(options);
+    const invitationError = handler.checkCanInviteNewMembers();
+    if (invitationError != null) {
+      throw invitationError;
+    }
     const invitation = this._createInvitation(handler, options);
     const { ctx, stream, observableInvitation } = this._createObservableInvitation(handler, invitation);
     this._createInvitations.set(invitation.invitationId, observableInvitation);
@@ -3026,7 +3057,7 @@ var InvitationsManager = class {
     } catch (err) {
       import_log9.log.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 77,
+        L: 82,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3049,7 +3080,7 @@ var InvitationsManager = class {
       const loadTasks = freshInvitations.map((persistentInvitation) => {
         (0, import_invariant10.invariant)(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
           F: __dxlog_file11,
-          L: 98,
+          L: 103,
           S: this,
           A: [
             "!this._createInvitations.get(persistentInvitation.invitationId)",
@@ -3068,7 +3099,7 @@ var InvitationsManager = class {
     } catch (err) {
       import_log9.log.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 105,
+        L: 110,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3100,13 +3131,13 @@ var InvitationsManager = class {
   async authenticate({ invitationId, authCode }) {
     (0, import_log9.log)("authenticating...", void 0, {
       F: __dxlog_file11,
-      L: 135,
+      L: 140,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant10.invariant)(invitationId, void 0, {
       F: __dxlog_file11,
-      L: 136,
+      L: 141,
       S: this,
       A: [
         "invitationId",
@@ -3119,7 +3150,7 @@ var InvitationsManager = class {
         invitationId
       }, {
         F: __dxlog_file11,
-        L: 139,
+        L: 144,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3132,13 +3163,13 @@ var InvitationsManager = class {
       invitationId
     }, {
       F: __dxlog_file11,
-      L: 146,
+      L: 151,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant10.invariant)(invitationId, void 0, {
       F: __dxlog_file11,
-      L: 147,
+      L: 152,
       S: this,
       A: [
         "invitationId",
@@ -3217,7 +3248,7 @@ var InvitationsManager = class {
         ...handler.toJSON()
       }, {
         F: __dxlog_file11,
-        L: 236,
+        L: 241,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3250,7 +3281,7 @@ var InvitationsManager = class {
             ...handler.toJSON()
           }, {
             F: __dxlog_file11,
-            L: 256,
+            L: 261,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3261,7 +3292,7 @@ var InvitationsManager = class {
         } else {
           import_log9.log.warn("auth failed", err, {
             F: __dxlog_file11,
-            L: 259,
+            L: 264,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3278,7 +3309,7 @@ var InvitationsManager = class {
         ...handler.toJSON()
       }, {
         F: __dxlog_file11,
-        L: 266,
+        L: 271,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -3323,7 +3354,7 @@ var InvitationsManager = class {
     } catch (err) {
       import_log9.log.catch(err, void 0, {
         F: __dxlog_file11,
-        L: 302,
+        L: 307,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -4012,7 +4043,7 @@ var DataSpace = class {
           err
         }, {
           F: __dxlog_file13,
-          L: 385,
+          L: 387,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4067,7 +4098,7 @@ var DataSpace = class {
           const newRoot = this._echoHost.automergeRepo.create(rootHandle.docSync());
           (0, import_invariant11.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file13,
-            L: 435,
+            L: 437,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -4086,7 +4117,7 @@ var DataSpace = class {
         {
           import_log10.log.info("Fragmenting", void 0, {
             F: __dxlog_file13,
-            L: 447,
+            L: 449,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4098,7 +4129,7 @@ var DataSpace = class {
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
           (0, import_invariant11.invariant)(properties, "Properties not found", {
             F: __dxlog_file13,
-            L: 457,
+            L: 459,
             S: this,
             A: [
               "properties",
@@ -4114,7 +4145,7 @@ var DataSpace = class {
           const newRoot = this._echoHost.automergeRepo.create(newSpaceDoc);
           (0, import_invariant11.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
             F: __dxlog_file13,
-            L: 462,
+            L: 464,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -4183,7 +4214,7 @@ var DataSpace = class {
       state: import_services9.SpaceState[this._state]
     }, {
       F: __dxlog_file13,
-      L: 528,
+      L: 530,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4237,7 +4268,7 @@ DataSpace = _ts_decorate4([
 ], DataSpace);
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
-    await (0, import_credentials15.createCredential)({
+    await (0, import_credentials16.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: space.key,
@@ -4246,14 +4277,14 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key
       }
     }),
-    await (0, import_credentials15.createCredential)({
+    await (0, import_credentials16.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: signingContext.identityKey,
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey: space.key,
-        role: import_credentials16.SpaceMember.Role.OWNER,
+        role: import_credentials17.SpaceMember.Role.OWNER,
         profile: signingContext.getProfile(),
         genesisFeedKey: space.controlFeedKey ?? (0, import_debug4.failUndefined)()
       }
@@ -4265,7 +4296,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials16.AdmittedFeed.Designation.CONTROL
+        designation: import_credentials17.AdmittedFeed.Designation.CONTROL
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -4275,7 +4306,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials16.AdmittedFeed.Designation.DATA
+        designation: import_credentials17.AdmittedFeed.Designation.DATA
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -4337,7 +4368,7 @@ var DataSpaceManager = class {
   async open() {
     (0, import_log12.log)("open", void 0, {
       F: __dxlog_file14,
-      L: 102,
+      L: 115,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4345,7 +4376,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 103,
+      L: 116,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4353,7 +4384,7 @@ var DataSpaceManager = class {
       spaces: this._metadataStore.spaces.length
     }, {
       F: __dxlog_file14,
-      L: 104,
+      L: 117,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4363,7 +4394,7 @@ var DataSpaceManager = class {
           spaceMetadata
         }, {
           F: __dxlog_file14,
-          L: 108,
+          L: 121,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4374,7 +4405,7 @@ var DataSpaceManager = class {
           err
         }, {
           F: __dxlog_file14,
-          L: 111,
+          L: 124,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4391,7 +4422,7 @@ var DataSpaceManager = class {
       id: this._instanceId
     }), {
       F: __dxlog_file14,
-      L: 124,
+      L: 137,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4399,7 +4430,7 @@ var DataSpaceManager = class {
   async close() {
     (0, import_log12.log)("close", void 0, {
       F: __dxlog_file14,
-      L: 129,
+      L: 142,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4415,7 +4446,7 @@ var DataSpaceManager = class {
   async createSpace() {
     (0, import_invariant13.invariant)(this._isOpen, "Not open.", {
       F: __dxlog_file14,
-      L: 142,
+      L: 155,
       S: this,
       A: [
         "this._isOpen",
@@ -4436,7 +4467,7 @@ var DataSpaceManager = class {
       spaceKey
     }, {
       F: __dxlog_file14,
-      L: 154,
+      L: 167,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4447,7 +4478,7 @@ var DataSpaceManager = class {
     const memberCredential = credentials[1];
     (0, import_invariant13.invariant)((0, import_credentials14.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file14,
-      L: 163,
+      L: 176,
       S: this,
       A: [
         "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -4465,13 +4496,13 @@ var DataSpaceManager = class {
       opts
     }, {
       F: __dxlog_file14,
-      L: 175,
+      L: 188,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant13.invariant)(this._isOpen, "Not open.", {
       F: __dxlog_file14,
-      L: 176,
+      L: 189,
       S: this,
       A: [
         "this._isOpen",
@@ -4480,7 +4511,7 @@ var DataSpaceManager = class {
     });
     (0, import_invariant13.invariant)(!this._spaces.has(opts.spaceKey), "Space already exists.", {
       F: __dxlog_file14,
-      L: 177,
+      L: 190,
       S: this,
       A: [
         "!this._spaces.has(opts.spaceKey)",
@@ -4515,7 +4546,7 @@ var DataSpaceManager = class {
       metadata
     }, {
       F: __dxlog_file14,
-      L: 210,
+      L: 223,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4553,11 +4584,16 @@ var DataSpaceManager = class {
       onAuthFailure: () => {
         import_log12.log.warn("auth failure", void 0, {
           F: __dxlog_file14,
-          L: 247,
+          L: 260,
           S: this,
           C: (f, a) => f(...a)
         });
       },
+      onMemberRolesChanged: async (members) => {
+        if (dataSpace?.state === import_services10.SpaceState.READY) {
+          this._handleMemberRoleChanges(presence, space.protocol, members);
+        }
+      },
       memberKey: this._signingContext.identityKey,
       onDelegatedInvitationStatusChange: (invitation, isActive) => {
         return this._handleInvitationStatusChange(dataSpace, invitation, isActive);
@@ -4581,7 +4617,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file14,
-            L: 269,
+            L: 287,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4592,7 +4628,7 @@ var DataSpaceManager = class {
             open: this._isOpen
           }, {
             F: __dxlog_file14,
-            L: 272,
+            L: 290,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4600,6 +4636,9 @@ var DataSpaceManager = class {
             await this._createDelegatedInvitations(dataSpace, [
               ...space.spaceState.invitations.entries()
             ]);
+            this._handleMemberRoleChanges(presence, space.protocol, [
+              ...space.spaceState.members.values()
+            ]);
             this.updated.emit();
           }
         },
@@ -4608,7 +4647,7 @@ var DataSpaceManager = class {
             space: space.key
           }, {
             F: __dxlog_file14,
-            L: 279,
+            L: 298,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4616,6 +4655,11 @@ var DataSpaceManager = class {
       },
       cache: metadata.cache
     });
+    presence.newPeer.on((peerState) => {
+      if (dataSpace.state === import_services10.SpaceState.READY) {
+        this._handleNewPeerConnected(space, peerState);
+      }
+    });
     if (metadata.state !== import_services10.SpaceState.INACTIVE) {
       await dataSpace.open();
     }
@@ -4625,6 +4669,51 @@ var DataSpaceManager = class {
     this._spaces.set(metadata.key, dataSpace);
     return dataSpace;
   }
+  _handleMemberRoleChanges(presence, spaceProtocol, memberInfo) {
+    let closedSessions = 0;
+    for (const member of memberInfo) {
+      if (member.key.equals(presence.getLocalState().identityKey)) {
+        continue;
+      }
+      const peers = presence.getPeersByIdentityKey(member.key);
+      const sessions = peers.map((p) => p.peerId && spaceProtocol.sessions.get(p.peerId));
+      const sessionsToClose = sessions.filter((s) => {
+        return (s && member.role === import_credentials15.SpaceMember.Role.REMOVED !== (s.authStatus === import_echo_pipeline4.AuthStatus.FAILURE)) ?? false;
+      });
+      sessionsToClose.forEach((session) => {
+        void session.close().catch(import_log12.log.error);
+      });
+      closedSessions += sessionsToClose.length;
+    }
+    (0, import_log12.log)("processed member role changes", {
+      roleChangeCount: memberInfo.length,
+      peersOnline: presence.getPeersOnline().length,
+      closedSessions
+    }, {
+      F: __dxlog_file14,
+      L: 338,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    spaceProtocol.updateTopology();
+  }
+  _handleNewPeerConnected(space, peerState) {
+    const role = space.spaceState.getMemberRole(peerState.identityKey);
+    if (role === import_credentials15.SpaceMember.Role.REMOVED) {
+      const session = peerState.peerId && space.protocol.sessions.get(peerState.peerId);
+      if (session != null) {
+        (0, import_log12.log)("closing a session with a removed peer", {
+          peerId: peerState.peerId
+        }, {
+          F: __dxlog_file14,
+          L: 352,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        void session.close().catch(import_log12.log.error);
+      }
+    }
+  }
   async _handleInvitationStatusChange(dataSpace, delegatedInvitation, isActive) {
     if (dataSpace?.state !== import_services10.SpaceState.READY) {
       return;
@@ -4684,9 +4773,7 @@ var SpacesServiceImpl = class {
     this._getDataSpaceManager = _getDataSpaceManager;
   }
   async createSpace() {
-    if (!this._identityManager.identity) {
-      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
-    }
+    this._requireIdentity();
     const dataSpaceManager = await this._getDataSpaceManager();
     const space = await dataSpaceManager.createSpace();
     return this._serializeSpace(space);
@@ -4707,8 +4794,39 @@ var SpacesServiceImpl = class {
       }
     }
   }
-  async updateMemberRole(_) {
-    throw new Error("not implemented");
+  async updateMemberRole(request) {
+    const identity = this._requireIdentity();
+    const space = this._spaceManager.spaces.get(request.spaceKey);
+    if (space == null) {
+      throw new import_protocols11.SpaceNotFoundError(request.spaceKey);
+    }
+    if (!space.spaceState.hasMembershipManagementPermission(identity.identityKey)) {
+      throw new import_protocols11.AuthorizationError("No member management permission.", {
+        spaceKey: space.key,
+        role: space.spaceState.getMemberRole(identity.identityKey)
+      });
+    }
+    const credentials = await (0, import_credentials18.createAdmissionCredentials)(identity.getIdentityCredentialSigner(), request.memberKey, space.key, space.genesisFeedKey, request.newRole, space.spaceState.membershipChainHeads);
+    (0, import_invariant14.invariant)(credentials[0].credential, void 0, {
+      F: __dxlog_file15,
+      L: 95,
+      S: this,
+      A: [
+        "credentials[0].credential",
+        ""
+      ]
+    });
+    const spaceMemberCredential = credentials[0].credential.credential;
+    (0, import_invariant14.invariant)((0, import_credentials18.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file15,
+      L: 97,
+      S: this,
+      A: [
+        "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
+        ""
+      ]
+    });
+    await (0, import_feed_store4.writeMessages)(space.controlPipeline.writer, credentials);
   }
   querySpaces() {
     return new import_codec_protobuf10.Stream(({ next, ctx }) => {
@@ -4719,7 +4837,7 @@ var SpacesServiceImpl = class {
           spaces
         }, {
           F: __dxlog_file15,
-          L: 82,
+          L: 108,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4802,7 +4920,7 @@ var SpacesServiceImpl = class {
       } else {
         (0, import_invariant14.invariant)(!credential.id, "Id on unsigned credentials is not allowed", {
           F: __dxlog_file15,
-          L: 169,
+          L: 195,
           S: this,
           A: [
             "!credential.id",
@@ -4811,7 +4929,7 @@ var SpacesServiceImpl = class {
         });
         (0, import_invariant14.invariant)(this._identityManager.identity, "Identity is not available", {
           F: __dxlog_file15,
-          L: 170,
+          L: 196,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -4821,7 +4939,7 @@ var SpacesServiceImpl = class {
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
         (0, import_invariant14.invariant)(credential.issuer.equals(signer.getIssuer()), void 0, {
           F: __dxlog_file15,
-          L: 172,
+          L: 198,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -4876,7 +4994,8 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.role === import_credentials17.SpaceMember.Role.REMOVED ? import_services11.SpaceMember.PresenceState.REMOVED : isMe || peers.length > 0 ? import_services11.SpaceMember.PresenceState.ONLINE : import_services11.SpaceMember.PresenceState.OFFLINE,
+          role: member.role,
+          presence: peers.length > 0 ? import_services11.SpaceMember.PresenceState.ONLINE : import_services11.SpaceMember.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4885,6 +5004,12 @@ var SpacesServiceImpl = class {
       metrics: space.metrics
     };
   }
+  _requireIdentity() {
+    if (!this._identityManager.identity) {
+      throw new import_protocols11.IdentityNotInitializedError("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
+    }
+    return this._identityManager.identity;
+  }
 };
 var getChannelId = (channel) => `user-channel/${channel}`;
 function _ts_decorate6(decorators, target, key, desc) {
@@ -4909,21 +5034,21 @@ var ServiceContext = class extends import_context12.Resource {
     this.initialized = new import_async16.Trigger();
     this._handlerFactories = /* @__PURE__ */ new Map();
     this._instanceId = import_keys12.PublicKey.random().toHex();
-    this.metadataStore = new import_echo_pipeline4.MetadataStore(storage.createDirectory("metadata"));
-    this.snapshotStore = new import_echo_pipeline4.SnapshotStore(storage.createDirectory("snapshots"));
+    this.metadataStore = new import_echo_pipeline5.MetadataStore(storage.createDirectory("metadata"));
+    this.snapshotStore = new import_echo_pipeline5.SnapshotStore(storage.createDirectory("snapshots"));
     this.blobStore = new import_teleport_extension_object_sync.BlobStore(storage.createDirectory("blobs"));
     this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
-    this.feedStore = new import_feed_store4.FeedStore({
-      factory: new import_feed_store4.FeedFactory({
+    this.feedStore = new import_feed_store5.FeedStore({
+      factory: new import_feed_store5.FeedFactory({
         root: storage.createDirectory("feeds"),
         signer: this.keyring,
         hypercore: {
-          valueEncoding: import_echo_pipeline4.valueEncoding,
+          valueEncoding: import_echo_pipeline5.valueEncoding,
           stats: true
         }
       })
     });
-    this.spaceManager = new import_echo_pipeline4.SpaceManager({
+    this.spaceManager = new import_echo_pipeline5.SpaceManager({
       feedStore: this.feedStore,
       networkManager: this.networkManager,
       blobStore: this.blobStore,
@@ -5089,7 +5214,7 @@ var ServiceContext = class extends import_context12.Resource {
     this.initialized.wake();
     this._deviceSpaceSync = {
       processCredential: async (credential) => {
-        const assertion = (0, import_credentials18.getCredentialAssertion)(credential);
+        const assertion = (0, import_credentials19.getCredentialAssertion)(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
         }
@@ -5176,7 +5301,7 @@ var ServiceRegistry = class {
     delete this._handlers[name];
   }
 };
-var DXOS_VERSION = "0.5.3-main.f752aaa";
+var DXOS_VERSION = "0.5.3-next.2c59258";
 var getPlatform = () => {
   if (process.browser) {
     if (typeof window !== "undefined") {
@@ -5274,11 +5399,12 @@ var getSpaceStats = async (space) => {
   const stats = {
     key: space.key,
     metrics: space.metrics,
-    epochs: space.inner.spaceState.credentials.filter((0, import_credentials19.credentialTypeFilter)("dxos.halo.credentials.Epoch")).map((credential) => ({
+    epochs: space.inner.spaceState.credentials.filter((0, import_credentials20.credentialTypeFilter)("dxos.halo.credentials.Epoch")).map((credential) => ({
       ...credential.subject.assertion,
       id: credential.id
     })),
     members: Array.from(space.inner.spaceState.members.values()).map((member) => ({
+      role: member.role,
       identity: {
         identityKey: member.key,
         profile: {
@@ -6195,4 +6321,4 @@ var findConfigs = () => {
   subscribeToSpaces,
   subscribeToSwarmInfo
 });
-//# sourceMappingURL=chunk-TQQUIYBW.cjs.map
+//# sourceMappingURL=chunk-VOYHS6QR.cjs.map