@dxos/echo-pipeline 0.5.9-main.a2de4fa → 0.5.9-main.a75fa71

package/dist/types/src/space/space-manager.d.ts

@@ -4,6 +4,7 @@ import { PublicKey } from '@dxos/keys';
 import { type SwarmNetworkManager } from '@dxos/network-manager';
 import type { FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
 import { type SpaceMetadata } from '@dxos/protocols/proto/dxos/echo/metadata';
+import type { Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type Teleport } from '@dxos/teleport';
 import { type BlobStore } from '@dxos/teleport-extension-object-sync';
 import { ComplexMap } from '@dxos/util';
@@ -33,6 +34,12 @@ export type ConstructSpaceParams = {
     onDelegatedInvitationStatusChange: (invitation: DelegateInvitationCredential, isActive: boolean) => Promise<void>;
     onMemberRolesChanged: (member: MemberInfo[]) => Promise<void>;
 };
+export type RequestSpaceAdmissionCredentialParams = {
+    spaceKey: PublicKey;
+    identityKey: PublicKey;
+    swarmIdentity: SwarmIdentity;
+    timeout: number;
+};
 /**
  * Manages a collection of ECHO (Data) Spaces.
  */
@@ -49,5 +56,6 @@ export declare class SpaceManager {
     open(): Promise<void>;
     close(): Promise<void>;
     constructSpace({ metadata, swarmIdentity, onAuthorizedConnection, onAuthFailure, onDelegatedInvitationStatusChange, onMemberRolesChanged, memberKey, }: ConstructSpaceParams): Promise<Space>;
+    requestSpaceAdmissionCredential(params: RequestSpaceAdmissionCredentialParams): Promise<Credential>;
 }
 //# sourceMappingURL=space-manager.d.ts.map

package/dist/types/src/space/space-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"space-manager.d.ts","sourceRoot":"","sources":["../../../../src/space/space-manager.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,4BAA4B,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,KAAK,EAAwB,MAAM,SAAS,CAAC;AACtD,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAClC,cAAc,EAAE,mBAAmB,CAAC;IACpC,aAAa,EAAE,aAAa,CAAC;IAE7B;;OAEG;IACH,aAAa,EAAE,aAAa,CAAC;IAE7B,SAAS,EAAE,SAAS,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB;;OAEG;IACH,sBAAsB,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpD,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;IAC5C,iCAAiC,EAAE,CAAC,UAAU,EAAE,4BAA4B,EAAE,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClH,oBAAoB,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D,CAAC;AAEF;;GAEG;AACH,qBACa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoD;IAC5E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;gBAE9C,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,kBAAkB;IAUtG,IAAI,MAAM,iCAET;IAGK,IAAI;IAGJ,KAAK;IAIL,cAAc,CAAC,EACnB,QAAQ,EACR,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,iCAAiC,EACjC,oBAAoB,EACpB,SAAS,GACV,EAAE,oBAAoB;CAoCxB"}
+{"version":3,"file":"space-manager.d.ts","sourceRoot":"","sources":["../../../../src/space/space-manager.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,4BAA4B,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,OAAO,EAAE,KAAK,EAAwB,MAAM,SAAS,CAAC;AACtD,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAClC,cAAc,EAAE,mBAAmB,CAAC;IACpC,aAAa,EAAE,aAAa,CAAC;IAE7B;;OAEG;IACH,aAAa,EAAE,aAAa,CAAC;IAE7B,SAAS,EAAE,SAAS,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB;;OAEG;IACH,sBAAsB,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpD,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;IAC5C,iCAAiC,EAAE,CAAC,UAAU,EAAE,4BAA4B,EAAE,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClH,oBAAoB,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG;IAClD,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,EAAE,SAAS,CAAC;IACvB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,qBACa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoD;IAC5E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;gBAE9C,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,kBAAkB;IAUtG,IAAI,MAAM,iCAET;IAGK,IAAI;IAGJ,KAAK;IAIL,cAAc,CAAC,EACnB,QAAQ,EACR,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,iCAAiC,EACjC,oBAAoB,EACpB,SAAS,GACV,EAAE,oBAAoB;IAqCV,+BAA+B,CAAC,MAAM,EAAE,qCAAqC,GAAG,OAAO,CAAC,UAAU,CAAC;CAmCjH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/echo-pipeline",
-  "version": "0.5.9-main.a2de4fa",
+  "version": "0.5.9-main.a75fa71",
   "description": "ECHO database.",
   "homepage": "https://dxos.org",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -39,38 +39,38 @@
     "crc-32": "^1.2.2",
     "level": "^8.0.1",
     "level-transcoder": "^1.0.1",
-    "@dxos/async": "0.5.9-main.a2de4fa",
-    "@dxos/automerge": "0.5.9-main.a2de4fa",
-    "@dxos/context": "0.5.9-main.a2de4fa",
-    "@dxos/codec-protobuf": "0.5.9-main.a2de4fa",
-    "@dxos/credentials": "0.5.9-main.a2de4fa",
-    "@dxos/crypto": "0.5.9-main.a2de4fa",
-    "@dxos/debug": "0.5.9-main.a2de4fa",
-    "@dxos/echo-protocol": "0.5.9-main.a2de4fa",
-    "@dxos/echo-schema": "0.5.9-main.a2de4fa",
-    "@dxos/hypercore": "0.5.9-main.a2de4fa",
-    "@dxos/indexing": "0.5.9-main.a2de4fa",
-    "@dxos/feed-store": "0.5.9-main.a2de4fa",
-    "@dxos/invariant": "0.5.9-main.a2de4fa",
-    "@dxos/keyring": "0.5.9-main.a2de4fa",
-    "@dxos/keys": "0.5.9-main.a2de4fa",
-    "@dxos/kv-store": "0.5.9-main.a2de4fa",
-    "@dxos/log": "0.5.9-main.a2de4fa",
-    "@dxos/messaging": "0.5.9-main.a2de4fa",
-    "@dxos/network-manager": "0.5.9-main.a2de4fa",
-    "@dxos/node-std": "0.5.9-main.a2de4fa",
-    "@dxos/rpc": "0.5.9-main.a2de4fa",
-    "@dxos/teleport": "0.5.9-main.a2de4fa",
-    "@dxos/protocols": "0.5.9-main.a2de4fa",
-    "@dxos/random-access-storage": "0.5.9-main.a2de4fa",
-    "@dxos/teleport-extension-gossip": "0.5.9-main.a2de4fa",
-    "@dxos/teleport-extension-automerge-replicator": "0.5.9-main.a2de4fa",
-    "@dxos/teleport-extension-object-sync": "0.5.9-main.a2de4fa",
-    "@dxos/timeframe": "0.5.9-main.a2de4fa",
-    "@dxos/teleport-extension-replicator": "0.5.9-main.a2de4fa",
-    "@dxos/tracing": "0.5.9-main.a2de4fa",
-    "@dxos/typings": "0.5.9-main.a2de4fa",
-    "@dxos/util": "0.5.9-main.a2de4fa"
+    "@dxos/async": "0.5.9-main.a75fa71",
+    "@dxos/context": "0.5.9-main.a75fa71",
+    "@dxos/automerge": "0.5.9-main.a75fa71",
+    "@dxos/credentials": "0.5.9-main.a75fa71",
+    "@dxos/codec-protobuf": "0.5.9-main.a75fa71",
+    "@dxos/crypto": "0.5.9-main.a75fa71",
+    "@dxos/echo-schema": "0.5.9-main.a75fa71",
+    "@dxos/debug": "0.5.9-main.a75fa71",
+    "@dxos/feed-store": "0.5.9-main.a75fa71",
+    "@dxos/echo-protocol": "0.5.9-main.a75fa71",
+    "@dxos/hypercore": "0.5.9-main.a75fa71",
+    "@dxos/indexing": "0.5.9-main.a75fa71",
+    "@dxos/keyring": "0.5.9-main.a75fa71",
+    "@dxos/keys": "0.5.9-main.a75fa71",
+    "@dxos/invariant": "0.5.9-main.a75fa71",
+    "@dxos/kv-store": "0.5.9-main.a75fa71",
+    "@dxos/log": "0.5.9-main.a75fa71",
+    "@dxos/messaging": "0.5.9-main.a75fa71",
+    "@dxos/network-manager": "0.5.9-main.a75fa71",
+    "@dxos/node-std": "0.5.9-main.a75fa71",
+    "@dxos/random-access-storage": "0.5.9-main.a75fa71",
+    "@dxos/protocols": "0.5.9-main.a75fa71",
+    "@dxos/rpc": "0.5.9-main.a75fa71",
+    "@dxos/teleport": "0.5.9-main.a75fa71",
+    "@dxos/teleport-extension-automerge-replicator": "0.5.9-main.a75fa71",
+    "@dxos/teleport-extension-gossip": "0.5.9-main.a75fa71",
+    "@dxos/teleport-extension-object-sync": "0.5.9-main.a75fa71",
+    "@dxos/timeframe": "0.5.9-main.a75fa71",
+    "@dxos/teleport-extension-replicator": "0.5.9-main.a75fa71",
+    "@dxos/tracing": "0.5.9-main.a75fa71",
+    "@dxos/typings": "0.5.9-main.a75fa71",
+    "@dxos/util": "0.5.9-main.a75fa71"
   },
   "devDependencies": {
     "fast-check": "^3.19.0",

package/src/automerge/automerge-host.ts

@@ -2,10 +2,19 @@
 // Copyright 2023 DXOS.org
 //
 
-import { Event } from '@dxos/async';
-import { next as automerge, getBackend, getHeads, type Doc, type Heads } from '@dxos/automerge/automerge';
+import { Event, asyncTimeout } from '@dxos/async';
+import {
+  next as automerge,
+  getBackend,
+  getHeads,
+  isAutomerge,
+  save,
+  type Doc,
+  type Heads,
+} from '@dxos/automerge/automerge';
 import {
   Repo,
+  type AnyDocumentId,
   type DocHandle,
   type DocHandleChangePayload,
   type DocumentId,
@@ -13,10 +22,9 @@ import {
   type StorageAdapterInterface,
 } from '@dxos/automerge/automerge-repo';
 import { type Stream } from '@dxos/codec-protobuf';
-import { Context, type Lifecycle } from '@dxos/context';
+import { Context, cancelWithContext, type Lifecycle } from '@dxos/context';
 import { type SpaceDoc } from '@dxos/echo-protocol';
 import { type IndexMetadataStore } from '@dxos/indexing';
-import { invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { type SublevelDB } from '@dxos/kv-store';
 import { objectPointerCodec } from '@dxos/protocols';
@@ -29,7 +37,7 @@ import {
 import { trace } from '@dxos/tracing';
 import { mapValues } from '@dxos/util';
 
-import { EchoNetworkAdapter } from './echo-network-adapter';
+import { EchoNetworkAdapter, isEchoPeerMetadata } from './echo-network-adapter';
 import { type EchoReplicator } from './echo-replicator';
 import { LevelDBStorageAdapter, type BeforeSaveParams } from './leveldb-storage-adapter';
 import { LocalHostNetworkAdapter } from './local-host-network-adapter';
@@ -43,6 +51,20 @@ export type AutomergeHostParams = {
   indexMetadataStore: IndexMetadataStore;
 };
 
+export type LoadDocOptions = {
+  timeout?: number;
+};
+
+export type CreateDocOptions = {
+  /**
+   * Import the document together with its history.
+   */
+  preserveHistory?: boolean;
+};
+
+/**
+ * Abstracts over the AutomergeRepo.
+ */
 @trace.resource()
 export class AutomergeHost {
   private readonly _indexMetadataStore: IndexMetadataStore;
@@ -102,6 +124,9 @@ export class AutomergeHost {
     await this._ctx.dispose();
   }
 
+  /**
+   * @deprecated To be abstracted away.
+   */
   get repo(): Repo {
     return this._repo;
   }
@@ -114,6 +139,46 @@ export class AutomergeHost {
     await this._echoNetworkAdapter.removeReplicator(replicator);
   }
 
+  /**
+   * Loads the document handle from the repo and waits for it to be ready.
+   */
+  async loadDoc<T>(ctx: Context, documentId: AnyDocumentId, opts?: LoadDocOptions): Promise<DocHandle<T>> {
+    let handle: DocHandle<T> | undefined;
+    if (typeof documentId === 'string') {
+      // NOTE: documentId might also be a URL, in which case this lookup will fail.
+      handle = this._repo.handles[documentId as DocumentId];
+    }
+    if (!handle) {
+      handle = this._repo.find(documentId as DocumentId);
+    }
+
+    // `whenReady` creates a timeout so we guard it with an if to skip it if the handle is already ready.
+    if (!handle.isReady()) {
+      if (!opts?.timeout) {
+        await cancelWithContext(ctx, handle.whenReady());
+      } else {
+        await cancelWithContext(ctx, asyncTimeout(handle.whenReady(), opts.timeout));
+      }
+    }
+
+    return handle;
+  }
+
+  /**
+   * Create new persisted document.
+   */
+  createDoc<T>(initialValue?: T | Doc<T>, opts?: CreateDocOptions): DocHandle<T> {
+    if (opts?.preserveHistory) {
+      if (!isAutomerge(initialValue)) {
+        throw new TypeError('Initial value must be an Automerge document');
+      }
+      // TODO(dmaretskyi): There's a more efficient way.
+      return this._repo.import(save(initialValue as Doc<T>));
+    } else {
+      return this._repo.create(initialValue);
+    }
+  }
+
   // TODO(dmaretskyi): Share based on HALO permissions and space affinity.
   // Hosts, running in the worker, don't share documents unless requested by other peers.
   // NOTE: If both peers return sharePolicy=false the replication will not happen
@@ -131,7 +196,7 @@ export class AutomergeHost {
     }
 
     const peerMetadata = this.repo.peerMetadataByPeerId[peerId];
-    if ((peerMetadata as any)?.dxos_peerSource === 'EchoNetworkAdapter') {
+    if (isEchoPeerMetadata(peerMetadata)) {
       return this._echoNetworkAdapter.shouldAdvertize(peerId, { documentId });
     }
 
@@ -212,39 +277,52 @@ export class AutomergeHost {
     return PublicKey.from(spaceKeyHex);
   }
 
-  //
-  // Methods for client-services.
-  //
+  /**
+   * Flush documents to disk.
+   */
   @trace.span({ showInBrowserTimeline: true })
   async flush({ states }: FlushRequest): Promise<void> {
     // Note: Wait for all requested documents to be loaded/synced from thin-client.
-    await Promise.all(
-      states?.map(async ({ heads, documentId }) => {
-        invariant(heads, 'heads are required for flush');
-        const handle = this.repo.handles[documentId as DocumentId] ?? this._repo.find(documentId as DocumentId);
-        await waitForHeads(handle, heads);
-      }) ?? [],
-    );
+    if (states) {
+      await Promise.all(
+        states.map(async ({ heads, documentId }) => {
+          if (!heads) {
+            return;
+          }
+          const handle = this.repo.handles[documentId as DocumentId] ?? this._repo.find(documentId as DocumentId);
+          await waitForHeads(handle, heads);
+        }) ?? [],
+      );
+    }
 
     await this._repo.flush(states?.map(({ documentId }) => documentId as DocumentId));
   }
 
+  /**
+   * Host <-> Client sync.
+   */
   syncRepo(request: SyncRepoRequest): Stream<SyncRepoResponse> {
     return this._clientNetwork.syncRepo(request);
   }
 
+  /**
+   * Host <-> Client sync.
+   */
   sendSyncMessage(request: SyncRepoRequest): Promise<void> {
     return this._clientNetwork.sendSyncMessage(request);
   }
 
+  /**
+   * Host <-> Client sync.
+   */
   async getHostInfo(): Promise<HostInfo> {
     return this._clientNetwork.getHostInfo();
   }
 }
 
-export const getSpaceKeyFromDoc = (doc: any): string | null => {
+export const getSpaceKeyFromDoc = (doc: Doc<SpaceDoc>): string | null => {
   // experimental_spaceKey is set on old documents, new ones are created with doc.access.spaceKey
-  const rawSpaceKey = doc.access?.spaceKey ?? doc.experimental_spaceKey;
+  const rawSpaceKey = doc.access?.spaceKey ?? (doc as any).experimental_spaceKey;
   if (rawSpaceKey == null) {
     return null;
   }

package/src/automerge/echo-network-adapter.ts

@@ -174,10 +174,7 @@ export class EchoNetworkAdapter extends NetworkAdapter {
   private _emitPeerCandidate(connection: ReplicatorConnection) {
     this.emit('peer-candidate', {
       peerId: connection.peerId as PeerId,
-      peerMetadata: {
-        // TODO(dmaretskyi): Refactor this.
-        dxos_peerSource: 'EchoNetworkAdapter',
-      } as any,
+      peerMetadata: createEchoPeerMetadata(),
     });
   }
 }
@@ -188,3 +185,12 @@ type ConnectionEntry = {
   writer: WritableStreamDefaultWriter<Message>;
   isOpen: boolean;
 };
+
+export const createEchoPeerMetadata = (): PeerMetadata =>
+  ({
+    // TODO(dmaretskyi): Refactor this.
+    dxos_peerSource: 'EchoNetworkAdapter',
+  }) as any;
+
+export const isEchoPeerMetadata = (metadata: PeerMetadata): boolean =>
+  (metadata as any)?.dxos_peerSource === 'EchoNetworkAdapter';

package/src/automerge/mesh-echo-replicator.ts

@@ -70,8 +70,8 @@ export class MeshEchoReplicator implements EchoReplicator {
       onRemoteDisconnected: async () => {
         log('onRemoteDisconnected', { peerId: connection.peerId });
         this._context?.onConnectionClosed(connection);
-        await connection.disable();
         this._connectionsPerPeer.delete(connection.peerId);
+        await connection.disable();
         this._connections.delete(connection);
       },
       shouldAdvertize: async (params: ShouldAdvertizeParams) => {

package/src/space/admission-discovery-extension.ts

@@ -0,0 +1,90 @@
+//
+// Copyright 2024 DXOS.org
+//
+
+import { scheduleTask, type Trigger } from '@dxos/async';
+import { Context } from '@dxos/context';
+import { ProtocolError, schema } from '@dxos/protocols';
+import { type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
+import {
+  type AdmissionDiscoveryService,
+  type GetAdmissionCredentialResponse,
+  type GetAdmissionCredentialRequest,
+} from '@dxos/protocols/proto/dxos/mesh/teleport';
+import { type ExtensionContext, RpcExtension } from '@dxos/teleport';
+
+import { type Space } from './space';
+
+/**
+ * Guest's side for a connection to a concrete peer in p2p network during invitation.
+ */
+export class CredentialRetrieverExtension extends RpcExtension<
+  { AdmissionDiscoveryService: AdmissionDiscoveryService },
+  {}
+> {
+  private _ctx = new Context();
+
+  constructor(
+    private readonly _request: GetAdmissionCredentialRequest,
+    private readonly _onResult: Trigger<Credential>,
+  ) {
+    super({
+      requested: {
+        AdmissionDiscoveryService: schema.getService('dxos.mesh.teleport.AdmissionDiscoveryService'),
+      },
+    });
+  }
+
+  protected override async getHandlers(): Promise<{}> {
+    return {};
+  }
+
+  override async onOpen(context: ExtensionContext) {
+    await super.onOpen(context);
+    scheduleTask(this._ctx, async () => {
+      try {
+        const result = await this.rpc.AdmissionDiscoveryService.getAdmissionCredential(this._request);
+        this._onResult.wake(result.admissionCredential);
+      } catch (err: any) {
+        context.close(err);
+      }
+    });
+  }
+
+  override async onClose() {
+    await this._ctx.dispose();
+  }
+
+  override async onAbort(): Promise<void> {
+    await this._ctx.dispose();
+  }
+}
+
+export class CredentialServerExtension extends RpcExtension<
+  {},
+  { AdmissionDiscoveryService: AdmissionDiscoveryService }
+> {
+  constructor(private readonly _space: Space) {
+    super({
+      exposed: {
+        AdmissionDiscoveryService: schema.getService('dxos.mesh.teleport.AdmissionDiscoveryService'),
+      },
+    });
+  }
+
+  protected override async getHandlers(): Promise<{ AdmissionDiscoveryService: AdmissionDiscoveryService }> {
+    return {
+      AdmissionDiscoveryService: {
+        getAdmissionCredential: async (
+          request: GetAdmissionCredentialRequest,
+        ): Promise<GetAdmissionCredentialResponse> => {
+          const memberInfo = this._space.spaceState.members.get(request.memberKey);
+          if (!memberInfo?.credential) {
+            throw new ProtocolError('Space member not found.', request);
+          }
+          return { admissionCredential: memberInfo.credential };
+        },
+      },
+    };
+  }
+}

package/src/space/index.ts

@@ -6,3 +6,4 @@ export * from './auth';
 export * from './space';
 export * from './space-manager';
 export * from './space-protocol';
+export * from './admission-discovery-extension';

package/src/space/space-manager.ts

@@ -2,7 +2,7 @@
 // Copyright 2022 DXOS.org
 //
 
-import { synchronized, trackLeaks } from '@dxos/async';
+import { synchronized, trackLeaks, Trigger } from '@dxos/async';
 import { type DelegateInvitationCredential, type MemberInfo } from '@dxos/credentials';
 import { failUndefined } from '@dxos/debug';
 import { type FeedStore } from '@dxos/feed-store';
@@ -12,10 +12,12 @@ import { type SwarmNetworkManager } from '@dxos/network-manager';
 import { trace } from '@dxos/protocols';
 import type { FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
 import { type SpaceMetadata } from '@dxos/protocols/proto/dxos/echo/metadata';
+import type { Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type Teleport } from '@dxos/teleport';
 import { type BlobStore } from '@dxos/teleport-extension-object-sync';
 import { ComplexMap } from '@dxos/util';
 
+import { CredentialRetrieverExtension } from './admission-discovery-extension';
 import { Space, createIdFromSpaceKey } from './space';
 import { SpaceProtocol, type SwarmIdentity } from './space-protocol';
 import { SnapshotManager, type SnapshotStore } from '../db-host';
@@ -47,6 +49,13 @@ export type ConstructSpaceParams = {
   onMemberRolesChanged: (member: MemberInfo[]) => Promise<void>;
 };
 
+export type RequestSpaceAdmissionCredentialParams = {
+  spaceKey: PublicKey;
+  identityKey: PublicKey;
+  swarmIdentity: SwarmIdentity;
+  timeout: number;
+};
+
 /**
  * Manages a collection of ECHO (Data) Spaces.
  */
@@ -126,4 +135,40 @@ export class SpaceManager {
     log.trace('dxos.echo.space-manager.construct-space', trace.end({ id: this._instanceId }));
     return space;
   }
+
+  public async requestSpaceAdmissionCredential(params: RequestSpaceAdmissionCredentialParams): Promise<Credential> {
+    const traceKey = 'dxos.echo.space-manager.request-space-admission';
+    log.trace(traceKey, trace.begin({ id: this._instanceId }));
+    log('requesting space admission credential...', { spaceKey: params.spaceKey });
+
+    const onCredentialResolved = new Trigger<Credential>();
+    const protocol = new SpaceProtocol({
+      topic: params.spaceKey,
+      swarmIdentity: params.swarmIdentity,
+      networkManager: this._networkManager,
+      onSessionAuth: (session: Teleport) => {
+        session.addExtension(
+          'dxos.mesh.teleport.admission-discovery',
+          new CredentialRetrieverExtension(
+            { spaceKey: params.spaceKey, memberKey: params.identityKey },
+            onCredentialResolved,
+          ),
+        );
+      },
+      onAuthFailure: (session: Teleport) => session.close(),
+      blobStore: this._blobStore,
+    });
+
+    try {
+      await protocol.start();
+      const credential = await onCredentialResolved.wait({ timeout: params.timeout });
+      log.trace(traceKey, trace.end({ id: this._instanceId }));
+      return credential;
+    } catch (err: any) {
+      log.trace(traceKey, trace.error({ id: this._instanceId, error: err }));
+      throw err;
+    } finally {
+      await protocol.stop();
+    }
+  }
 }