@dxos/client-services 0.8.4-main.ae835ea → 0.8.4-main.bc2380dfbc

package/src/packlets/identity/identity-service.test.ts

@@ -11,7 +11,6 @@ import { type Identity, type IdentityService } from '@dxos/protocols/proto/dxos/
 
 import { type ServiceContext } from '../services';
 import { createServiceContext } from '../testing';
-
 import { IdentityServiceImpl } from './identity-service';
 
 describe('IdentityService', () => {
@@ -48,6 +47,12 @@ describe('IdentityService', () => {
       await identityService.createIdentity({});
       await expect(identityService.createIdentity({})).rejects.toThrowError('Identity already exists');
     });
+
+    test('creates identity with no spaces', async () => {
+      await identityService.createIdentity({});
+      const dataSpaces = [...(serviceContext.dataSpaceManager?.spaces?.values() ?? [])];
+      expect(dataSpaces.length).to.eq(0);
+    });
   });
 
   describe.skip('recoverIdentity', () => {});
@@ -89,37 +94,11 @@ describe('IdentityService', () => {
   });
 });
 
-describe('open', () => {
-  test('identity without default space fixed', async () => {
-    const serviceContext = await createServiceContext();
-    await serviceContext.open(new Context());
-    const identity = await serviceContext.createIdentity();
-    const identityService = createIdentityService(serviceContext);
-    const getDataSpaces = () => [...(serviceContext.dataSpaceManager?.spaces?.values() ?? [])];
-    expect(getDataSpaces().length).to.eq(0);
-    expect(identity.defaultSpaceId).to.be.undefined;
-    await identityService.open();
-    expect(getDataSpaces()[0].id === identity.defaultSpaceId).to.be.true;
-  });
-
-  test('identity without default space credential fixed', async () => {
-    const serviceContext = await createServiceContext();
-    await serviceContext.open(new Context());
-    const identity = await serviceContext.createIdentity();
-    const space = await serviceContext.dataSpaceManager!.createDefaultSpace();
-    const identityService = createIdentityService(serviceContext);
-    expect(identity.defaultSpaceId).to.be.undefined;
-    await identityService.open();
-    expect(identity.defaultSpaceId === space.id).to.be.true;
-  });
-});
-
 const createIdentityService = (serviceContext: ServiceContext) => {
   return new IdentityServiceImpl(
     serviceContext.identityManager,
     serviceContext.recoveryManager,
     serviceContext.keyring,
-    () => serviceContext.dataSpaceManager!,
     (options) => serviceContext.createIdentity(options),
   );
 };

package/src/packlets/identity/identity-service.ts

@@ -2,13 +2,12 @@
 // Copyright 2023 DXOS.org
 //
 
-import { Trigger, sleep } from '@dxos/async';
+import { type RequestOptions } from '@dxos/codec-protobuf';
 import { Stream } from '@dxos/codec-protobuf/stream';
-import { Resource } from '@dxos/context';
+import { Context, Resource } from '@dxos/context';
 import { createCredential, signPresentation } from '@dxos/credentials';
 import { invariant } from '@dxos/invariant';
 import { type Keyring } from '@dxos/keyring';
-import { log } from '@dxos/log';
 import {
   type CreateIdentityRequest,
   type CreateRecoveryCredentialRequest,
@@ -17,52 +16,30 @@ import {
   type QueryIdentityResponse,
   type RecoverIdentityRequest,
   type SignPresentationRequest,
-  SpaceState,
 } from '@dxos/protocols/proto/dxos/client/services';
 import { type Presentation, type ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
-import { safeAwaitAll } from '@dxos/util';
-
-import { type DataSpaceManager } from '../spaces';
 
 import { type Identity } from './identity';
 import { type CreateIdentityOptions, type IdentityManager } from './identity-manager';
 import { type EdgeIdentityRecoveryManager } from './identity-recovery-manager';
 
-const DEFAULT_SPACE_SEARCH_TIMEOUT = 10_000;
-
 export class IdentityServiceImpl extends Resource implements IdentityService {
   constructor(
     private readonly _identityManager: IdentityManager,
     private readonly _recoveryManager: EdgeIdentityRecoveryManager,
     private readonly _keyring: Keyring,
-    private readonly _dataSpaceManagerProvider: () => DataSpaceManager,
-    private readonly _createIdentity: (params: CreateIdentityOptions) => Promise<Identity>,
+    private readonly _createIdentity: (params: CreateIdentityOptions, ctx?: Context) => Promise<Identity>,
     private readonly _onProfileUpdate?: (profile: ProfileDocument | undefined) => Promise<void>,
   ) {
     super();
   }
 
-  protected override async _open(): Promise<void> {
-    const identity = this._identityManager.identity;
-    if (identity && !identity.defaultSpaceId) {
-      await this._fixIdentityWithoutDefaultSpace(identity);
-    }
-  }
-
-  async createIdentity(request: CreateIdentityRequest): Promise<IdentityProto> {
-    await this._createIdentity({ profile: request.profile, deviceProfile: request.deviceProfile });
-    const dataSpaceManager = this._dataSpaceManagerProvider();
-    await this._createDefaultSpace(dataSpaceManager);
+  async createIdentity(request: CreateIdentityRequest, options?: RequestOptions): Promise<IdentityProto> {
+    const ctx = options?.ctx ?? Context.default();
+    await this._createIdentity({ profile: request.profile, deviceProfile: request.deviceProfile }, ctx);
     return this._getIdentity()!;
   }
 
-  private async _createDefaultSpace(dataSpaceManager: DataSpaceManager): Promise<void> {
-    const space = await dataSpaceManager!.createDefaultSpace();
-    const identity = this._identityManager.identity;
-    invariant(identity);
-    await identity.updateDefaultSpace(space.id);
-  }
-
   queryIdentity(): Stream<QueryIdentityResponse> {
     return new Stream(({ next }) => {
       const emitNext = () => next({ identity: this._getIdentity() });
@@ -96,17 +73,18 @@ export class IdentityServiceImpl extends Resource implements IdentityService {
     return this._recoveryManager.createRecoveryCredential(request);
   }
 
-  async requestRecoveryChallenge() {
-    return this._recoveryManager.requestRecoveryChallenge();
+  async requestRecoveryChallenge(_request: void, options?: RequestOptions) {
+    return this._recoveryManager.requestRecoveryChallenge(options?.ctx ?? Context.default());
   }
 
-  async recoverIdentity(request: RecoverIdentityRequest): Promise<IdentityProto> {
+  async recoverIdentity(request: RecoverIdentityRequest, options?: RequestOptions): Promise<IdentityProto> {
+    const ctx = options?.ctx ?? Context.default();
     if (request.recoveryCode) {
-      await this._recoveryManager.recoverIdentity({ recoveryCode: request.recoveryCode });
+      await this._recoveryManager.recoverIdentity(ctx, { recoveryCode: request.recoveryCode });
     } else if (request.external) {
-      await this._recoveryManager.recoverIdentityWithExternalSignature(request.external);
+      await this._recoveryManager.recoverIdentityWithExternalSignature(ctx, request.external);
     } else if (request.token) {
-      await this._recoveryManager.recoverIdentityWithToken({ token: request.token });
+      await this._recoveryManager.recoverIdentityWithToken(ctx, { token: request.token });
     } else {
       throw new Error('Invalid request.');
     }
@@ -141,50 +119,4 @@ export class IdentityServiceImpl extends Resource implements IdentityService {
       signer: this._keyring,
     });
   }
-
-  private async _fixIdentityWithoutDefaultSpace(identity: Identity): Promise<void> {
-    let recodedDefaultSpace = false;
-    let foundDefaultSpace = false;
-    const dataSpaceManager = this._dataSpaceManagerProvider();
-
-    const recordedDefaultSpaceTrigger = new Trigger();
-
-    const allProcessed = safeAwaitAll(
-      dataSpaceManager.spaces.values(),
-      async (space) => {
-        if (space.state === SpaceState.SPACE_CLOSED) {
-          await space.open();
-
-          // Wait until the space is either READY or REQUIRES_MIGRATION.
-          // NOTE: Space could potentially never initialize if the space data is corrupted.
-          const requiresMigration = space.stateUpdate.waitForCondition(
-            () => space.state === SpaceState.SPACE_REQUIRES_MIGRATION,
-          );
-          await Promise.race([space.initializeDataPipeline(), requiresMigration]);
-        }
-        if (await dataSpaceManager.isDefaultSpace(space)) {
-          if (foundDefaultSpace) {
-            log.warn('Multiple default spaces found. Using the first one.', { duplicate: space.id });
-            return;
-          }
-
-          foundDefaultSpace = true;
-          await identity.updateDefaultSpace(space.id);
-          recodedDefaultSpace = true;
-          recordedDefaultSpaceTrigger.wake();
-        }
-      },
-      (err) => {
-        log.catch(err);
-      },
-    );
-
-    // Wait for all spaces to be processed or until the default space is recorded.
-    // If the timeout is reached, create a new default space.
-    await Promise.race([allProcessed, recordedDefaultSpaceTrigger.wait(), sleep(DEFAULT_SPACE_SEARCH_TIMEOUT)]);
-
-    if (!recodedDefaultSpace) {
-      await this._createDefaultSpace(dataSpaceManager);
-    }
-  }
 }

package/src/packlets/identity/identity.test.ts

@@ -130,7 +130,7 @@ describe('identity/identity', () => {
         onMessage: (_: MessageListener): (() => void) => {
           return () => {};
         },
-        send: async (_) => {
+        send: async (..._) => {
           replicationStarted = true;
         },
       } as EdgeConnection,
@@ -218,7 +218,7 @@ describe('identity/identity', () => {
     });
 
     await identity.open(new Context());
-    await identity.joinNetwork();
+    await identity.joinNetwork(Context.default());
     onTestFinished(() => identity.close(new Context()));
     return { identity, identityKey, keyring, deviceKey, controlFeed, spaceKey, dataFeed };
   };

package/src/packlets/identity/identity.ts

@@ -4,7 +4,7 @@
 
 import { Event } from '@dxos/async';
 import { AUTH_TIMEOUT, LOAD_CONTROL_FEEDS_TIMEOUT } from '@dxos/client-protocol';
-import { type Context } from '@dxos/context';
+import { type Context as DxosContext } from '@dxos/context';
 import {
   type CredentialSigner,
   DeviceStateMachine,
@@ -17,7 +17,7 @@ import { type Space } from '@dxos/echo-pipeline';
 import { type EdgeConnection } from '@dxos/edge-client';
 import { type FeedWrapper, writeMessages } from '@dxos/feed-store';
 import { invariant } from '@dxos/invariant';
-import { type IdentityDid, PublicKey, type SpaceId } from '@dxos/keys';
+import { type IdentityDid, PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { type Runtime } from '@dxos/protocols/proto/dxos/config';
 import { type FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
@@ -29,16 +29,13 @@ import {
 } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type DeviceAdmissionRequest } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { type Presence } from '@dxos/teleport-extension-gossip';
-import { Timeframe } from '@dxos/timeframe';
 import { trace } from '@dxos/tracing';
 import { type ComplexMap, ComplexSet } from '@dxos/util';
 
 import { EdgeFeedReplicator } from '../spaces';
-
 import { TrustedKeySetAuthVerifier } from './authenticator';
-import { DefaultSpaceStateMachine } from './default-space-state-machine';
 
-export type IdentityParams = {
+export type IdentityProps = {
   did: IdentityDid;
   identityKey: PublicKey;
   deviceKey: PublicKey;
@@ -60,7 +57,6 @@ export class Identity {
   private readonly _presence?: Presence;
   private readonly _deviceStateMachine: DeviceStateMachine;
   private readonly _profileStateMachine: ProfileStateMachine;
-  private readonly _defaultSpaceStateMachine: DefaultSpaceStateMachine;
   private readonly _edgeFeedReplicator?: EdgeFeedReplicator = undefined;
 
   public readonly authVerifier: TrustedKeySetAuthVerifier;
@@ -71,7 +67,7 @@ export class Identity {
 
   public readonly stateUpdate = new Event();
 
-  constructor(params: IdentityParams) {
+  constructor(params: IdentityProps) {
     this.space = params.space;
     this._signer = params.signer;
     this._presence = params.presence;
@@ -91,10 +87,6 @@ export class Identity {
       identityKey: this.identityKey,
       onUpdate: () => this.stateUpdate.emit(),
     });
-    this._defaultSpaceStateMachine = new DefaultSpaceStateMachine({
-      identityKey: this.identityKey,
-      onUpdate: () => this.stateUpdate.emit(),
-    });
 
     this.authVerifier = new TrustedKeySetAuthVerifier({
       trustedKeysProvider: () => new ComplexSet(PublicKey.hash, this.authorizedDeviceKeys.keys()),
@@ -112,32 +104,26 @@ export class Identity {
     return this._deviceStateMachine.authorizedDeviceKeys;
   }
 
-  get defaultSpaceId(): SpaceId | undefined {
-    return this._defaultSpaceStateMachine.spaceId;
-  }
-
-  @trace.span()
-  async open(ctx: Context): Promise<void> {
+  @trace.span({ op: 'lifecycle' })
+  async open(ctx: DxosContext): Promise<void> {
     await this._presence?.open();
     await this.space.spaceState.addCredentialProcessor(this._deviceStateMachine);
     await this.space.spaceState.addCredentialProcessor(this._profileStateMachine);
-    await this.space.spaceState.addCredentialProcessor(this._defaultSpaceStateMachine);
     if (this._edgeFeedReplicator) {
       this.space.protocol.feedAdded.append(this._onFeedAdded);
     }
     await this.space.open(ctx);
   }
 
-  public async joinNetwork(): Promise<void> {
-    await this.space.startProtocol();
+  public async joinNetwork(ctx: DxosContext): Promise<void> {
+    await this.space.startProtocol(ctx);
     await this._edgeFeedReplicator?.open();
   }
 
-  @trace.span()
-  async close(ctx: Context): Promise<void> {
+  @trace.span({ op: 'lifecycle' })
+  async close(ctx: DxosContext): Promise<void> {
     await this._presence?.close();
     await this.authVerifier.close();
-    await this.space.spaceState.removeCredentialProcessor(this._defaultSpaceStateMachine);
     await this.space.spaceState.removeCredentialProcessor(this._profileStateMachine);
     await this.space.spaceState.removeCredentialProcessor(this._deviceStateMachine);
 
@@ -147,7 +133,7 @@ export class Identity {
 
     await this._edgeFeedReplicator?.close();
 
-    await this.space.close();
+    await this.space.close(ctx);
   }
 
   async ready(): Promise<void> {
@@ -211,15 +197,6 @@ export class Identity {
     return createCredentialSignerWithKey(this._signer, this.deviceKey);
   }
 
-  async updateDefaultSpace(spaceId: SpaceId): Promise<void> {
-    const credential = await this.getDeviceCredentialSigner().createCredential({
-      subject: this.identityKey,
-      assertion: { '@type': 'dxos.halo.credentials.DefaultSpace', spaceId },
-    });
-    const receipt = await this.controlPipeline.writer.write({ credential: { credential } });
-    await this.controlPipeline.state.waitUntilTimeframe(new Timeframe([[receipt.feedKey, receipt.seq]]));
-  }
-
   async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }: DeviceAdmissionRequest): Promise<Credential> {
     log('Admitting device:', {
       identityKey: this.identityKey,

package/src/packlets/invitations/device-invitation-protocol.ts

@@ -2,11 +2,12 @@
 // Copyright 2023 DXOS.org
 //
 
+import { type Context } from '@dxos/context';
 import { getCredentialAssertion } from '@dxos/credentials';
 import { invariant } from '@dxos/invariant';
 import { type Keyring } from '@dxos/keyring';
 import { type PublicKey } from '@dxos/keys';
-import { AlreadyJoinedError, type ApiError } from '@dxos/protocols';
+import { AlreadyJoinedError } from '@dxos/protocols';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import type { DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import {
@@ -15,15 +16,14 @@ import {
   type IntroductionRequest,
 } from '@dxos/protocols/proto/dxos/halo/invitations';
 
-import { type Identity, type JoinIdentityParams } from '../identity';
-
+import { type Identity, type JoinIdentityProps } from '../identity';
 import { type InvitationProtocol } from './invitation-protocol';
 
 export class DeviceInvitationProtocol implements InvitationProtocol {
   constructor(
     private readonly _keyring: Keyring,
     private readonly _getIdentity: () => Identity,
-    private readonly _acceptIdentity: (identity: JoinIdentityParams) => Promise<Identity>,
+    private readonly _acceptIdentity: (identity: JoinIdentityProps) => Promise<Identity>,
   ) {}
 
   toJSON(): object {
@@ -32,7 +32,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
     };
   }
 
-  checkCanInviteNewMembers(): ApiError | undefined {
+  checkCanInviteNewMembers(): Error | undefined {
     return undefined;
   }
 
@@ -71,7 +71,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
     try {
       const identity = this._getIdentity();
       if (identity) {
-        return new AlreadyJoinedError('Currently only one identity per client is supported.');
+        return new AlreadyJoinedError({ message: 'Currently only one identity per client is supported.' });
       }
     } catch {
       // No identity.
@@ -97,7 +97,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
     };
   }
 
-  async accept(response: AdmissionResponse, request: AdmissionRequest): Promise<Partial<Invitation>> {
+  async accept(_ctx: Context, response: AdmissionResponse, request: AdmissionRequest): Promise<Partial<Invitation>> {
     invariant(response.device);
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
 
@@ -105,6 +105,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
     const { deviceKey, controlFeedKey, dataFeedKey, profile } = request.device;
 
     // TODO(wittjosiah): When multiple identities are supported, verify identity doesn't already exist before accepting.
+    // ctx is unused here because _acceptIdentity uses ServiceContext's lifecycle ctx internally.
 
     await this._acceptIdentity({
       identityKey,

package/src/packlets/invitations/edge-invitation-handler.ts

@@ -23,13 +23,14 @@ import {
   type AdmissionResponse,
   type SpaceAdmissionRequest,
 } from '@dxos/protocols/proto/dxos/halo/invitations';
+import { trace } from '@dxos/tracing';
 
 import { type InvitationProtocol } from './invitation-protocol';
 import { type FlowLockHolder, type GuardedInvitationState } from './invitation-state';
 import { tryAcquireBeforeContextDisposed } from './utils';
 
 export interface EdgeInvitationHandlerCallbacks {
-  onInvitationSuccess(response: AdmissionResponse, request: AdmissionRequest): Promise<void>;
+  onInvitationSuccess(ctx: Context, response: AdmissionResponse, request: AdmissionRequest): Promise<void>;
 }
 
 export const MAX_RETRIES_PER_INVITATION = 5;
@@ -41,6 +42,7 @@ export type EdgeInvitationConfig = {
   retryJitter?: number;
 };
 
+@trace.resource()
 export class EdgeInvitationHandler implements FlowLockHolder {
   private _flowLock: MutexGuard | undefined;
 
@@ -113,6 +115,7 @@ export class EdgeInvitationHandler implements FlowLockHolder {
     scheduleMicroTask(ctx, tryHandleInvitation);
   }
 
+  @trace.span({ op: 'invitation.edge' })
   private async _handleSpaceInvitationFlow(
     ctx: Context,
     guardedState: GuardedInvitationState,
@@ -126,13 +129,13 @@ export class EdgeInvitationHandler implements FlowLockHolder {
 
       guardedState.set(this, Invitation.State.CONNECTING);
 
-      const response = await this._joinSpaceByInvitation(guardedState, spaceId, {
+      const response = await this._joinSpaceByInvitation(ctx, guardedState, spaceId, {
         identityKey: admissionRequest.identityKey.toHex(),
         invitationId: guardedState.current.invitationId,
       });
 
       const admissionResponse = await this._mapToAdmissionResponse(response);
-      await this._callbacks.onInvitationSuccess(admissionResponse, { space: admissionRequest });
+      await this._callbacks.onInvitationSuccess(ctx, admissionResponse, { space: admissionRequest });
     } catch (error) {
       guardedState.set(this, Invitation.State.ERROR);
       throw error;
@@ -153,13 +156,14 @@ export class EdgeInvitationHandler implements FlowLockHolder {
   }
 
   private async _joinSpaceByInvitation(
+    ctx: Context,
     guardedState: GuardedInvitationState,
     spaceId: SpaceId,
     request: JoinSpaceRequest,
   ): Promise<JoinSpaceResponseBody> {
     invariant(this._client);
     try {
-      return await this._client.joinSpaceByInvitation(spaceId, request);
+      return await this._client.joinSpaceByInvitation(ctx, spaceId, request);
     } catch (error: any) {
       if (error instanceof EdgeAuthChallengeError) {
         const publicKey = guardedState.current.guestKeypair?.publicKey;
@@ -168,7 +172,7 @@ export class EdgeInvitationHandler implements FlowLockHolder {
           throw error;
         }
         const signature = sign(Buffer.from(error.challenge, 'base64'), privateKey);
-        return this._client.joinSpaceByInvitation(spaceId, {
+        return this._client.joinSpaceByInvitation(ctx, spaceId, {
           ...request,
           signature: Buffer.from(signature).toString('base64'),
         });

package/src/packlets/invitations/invitation-guest-extenstion.ts

@@ -97,10 +97,12 @@ export class InvitationGuestExtension
       await cancelWithContext(this._ctx, this._remoteOptionsTrigger.wait({ timeout: OPTIONS_TIMEOUT }));
       log.verbose('options received');
       if (this._remoteOptions?.role !== InvitationOptions.Role.HOST) {
-        throw new InvalidInvitationExtensionRoleError(undefined, {
-          expected: InvitationOptions.Role.HOST,
-          remoteOptions: this._remoteOptions,
-          remotePeerId: context.remotePeerId,
+        throw new InvalidInvitationExtensionRoleError({
+          context: {
+            expected: InvitationOptions.Role.HOST,
+            remoteOptions: this._remoteOptions,
+            remotePeerId: context.remotePeerId,
+          },
         });
       }
 

package/src/packlets/invitations/invitation-host-extension.ts

@@ -8,7 +8,7 @@ import { randomBytes, verify } from '@dxos/crypto';
 import { InvariantViolation, invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
-import { InvalidInvitationExtensionRoleError, trace } from '@dxos/protocols';
+import { InvalidInvitationExtensionRoleError } from '@dxos/protocols';
 import { schema } from '@dxos/protocols/proto';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import { type ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
@@ -110,8 +110,7 @@ export class InvitationHostExtension
 
         introduce: async (request) => {
           const { profile, invitationId } = request;
-          const traceId = PublicKey.random().toHex();
-          log.trace('dxos.sdk.invitation-handler.host.introduce', trace.begin({ id: traceId }));
+          log('introducing host invitation');
 
           const invitation = this._requireActiveInvitation();
           this._assertInvitationState(Invitation.State.CONNECTED);
@@ -131,7 +130,7 @@ export class InvitationHostExtension
           this._challenge =
             invitation.authMethod === Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : undefined;
 
-          log.trace('dxos.sdk.invitation-handler.host.introduce', trace.end({ id: traceId }));
+          log('introduced host invitation');
           return {
             authMethod: invitation.authMethod,
             challenge: this._challenge,
@@ -139,8 +138,7 @@ export class InvitationHostExtension
         },
 
         authenticate: async ({ authCode: code, signedChallenge }) => {
-          const traceId = PublicKey.random().toHex();
-          log.trace('dxos.sdk.invitation-handler.host.authenticate', trace.begin({ id: traceId }));
+          log('authenticating host invitation');
 
           const invitation = this._requireActiveInvitation();
           log.verbose('received authentication request', { authCode: code });
@@ -201,13 +199,12 @@ export class InvitationHostExtension
             return { status };
           }
 
-          log.trace('dxos.sdk.invitation-handler.host.authenticate', trace.end({ id: traceId, data: { status } }));
+          log('authenticated host invitation', { status });
           return { status };
         },
 
         admit: async (request) => {
-          const traceId = PublicKey.random().toHex();
-          log.trace('dxos.sdk.invitation-handler.host.admit', trace.begin({ id: traceId }));
+          log('admitting guest');
           const invitation = this._requireActiveInvitation();
 
           try {
@@ -221,7 +218,7 @@ export class InvitationHostExtension
 
             const response = await this._callbacks.admit(request);
 
-            log.trace('dxos.sdk.invitation-handler.host.admit', trace.end({ id: traceId }));
+            log('admitted guest');
             return response;
           } catch (err: any) {
             this._callbacks.onError(err);
@@ -245,10 +242,12 @@ export class InvitationHostExtension
       await cancelWithContext(this._ctx, this._remoteOptionsTrigger.wait({ timeout: OPTIONS_TIMEOUT }));
       log.verbose('options received');
       if (this._remoteOptions?.role !== InvitationOptions.Role.GUEST) {
-        throw new InvalidInvitationExtensionRoleError(undefined, {
-          expected: InvitationOptions.Role.GUEST,
-          remoteOptions: this._remoteOptions,
-          remotePeerId: context.remotePeerId,
+        throw new InvalidInvitationExtensionRoleError({
+          context: {
+            expected: InvitationOptions.Role.GUEST,
+            remoteOptions: this._remoteOptions,
+            remotePeerId: context.remotePeerId,
+          },
         });
       }
       this._callbacks.onStateUpdate(Invitation.State.CONNECTED);

package/src/packlets/invitations/invitation-protocol.ts

@@ -2,8 +2,8 @@
 // Copyright 2023 DXOS.org
 //
 
+import { type Context } from '@dxos/context';
 import { type PublicKey } from '@dxos/keys';
-import type { ApiError } from '@dxos/protocols';
 import type { Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import type { DeviceProfileDocument, ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import type {
@@ -26,7 +26,7 @@ export interface InvitationProtocol {
   // Host
   //
 
-  checkCanInviteNewMembers(): ApiError | undefined;
+  checkCanInviteNewMembers(): Error | undefined;
 
   /**
    * Protocol-specific information to include in the invitation.
@@ -58,7 +58,7 @@ export interface InvitationProtocol {
    *
    * For example, the guest may already be a member of the space.
    */
-  checkInvitation(invitation: Partial<Invitation>): ApiError | undefined;
+  checkInvitation(invitation: Partial<Invitation>): Error | undefined;
 
   /**
    * Get profile information to send to the host to identify the guest.
@@ -72,6 +72,9 @@ export interface InvitationProtocol {
 
   /**
    * Redeem the admission credential.
+   * @param ctx - Caller context used for tracing and cancellation. Forwarded to downstream
+   *   internal methods (e.g. `DataSpaceManager.acceptSpace`) so their spans become children of
+   *   the invitation flow span.
    */
-  accept(response: AdmissionResponse, request: AdmissionRequest): Promise<Partial<Invitation>>;
+  accept(ctx: Context, response: AdmissionResponse, request: AdmissionRequest): Promise<Partial<Invitation>>;
 }

package/src/packlets/invitations/invitation-state.ts

@@ -31,12 +31,6 @@ export const createGuardedInvitationState = (
   invitation: Invitation,
   stream: PushStream<Invitation>,
 ): GuardedInvitationState => {
-  // the mutex guards invitation flow on host and guest side, making sure only one flow is currently active
-  // deadlocks seem very unlikely because hosts don't initiate multiple connections
-  // even if this somehow happens that there are 2 guests (A, B) and 2 hosts (1, 2) and:
-  //  A has lock for flow with 1, B has lock for flow with 2
-  //  1 has lock for flow with B, 2 has lock for flow with A
-  // there'll be a 10-second introduction timeout after which connection will be closed and deadlock broken
   const mutex = new Mutex();
   let lastActiveLockHolder: FlowLockHolder | null = null;
   let currentInvitation = { ...invitation };
@@ -44,9 +38,6 @@ export const createGuardedInvitationState = (
     if (ctx.disposed || (lockHolder !== null && mutex.isLocked() && !lockHolder.hasFlowLock())) {
       return false;
     }
-    // don't allow transitions from a terminal state unless a new extension acquired mutex
-    // handles a case when error occurs (e.g. connection is closed) after we completed the flow
-    // successfully or already reported another error
     return lockHolder == null || lastActiveLockHolder !== lockHolder || isNonTerminalState(currentInvitation.state);
   };
   return {
@@ -54,7 +45,6 @@ export const createGuardedInvitationState = (
     get current() {
       return currentInvitation;
     },
-    // disposing context prevents any further state updates
     complete: (newState: Partial<Invitation>) => {
       logStateUpdate(currentInvitation, undefined, invitation.state);
       currentInvitation = { ...currentInvitation, ...newState };
@@ -94,11 +84,7 @@ const logStateUpdate = (invitation: Invitation, actor: any, newState: Invitation
     error: error?.message,
     errorStack: error?.stack,
   };
-  if (isNonTerminalState(newState)) {
-    log.verbose('dxos.sdk.invitations-handler.state.update', logContext);
-  } else {
-    log.info('dxos.sdk.invitations-handler.state.update', logContext);
-  }
+  log.verbose('dxos.sdk.invitations-handler.state.update', logContext);
 };
 
 const isNonTerminalState = (currentState: Invitation.State): boolean => {