@dxos/echo-pipeline 0.5.9-main.bdf733d → 0.5.9-main.bf3bb8f

package/dist/lib/browser/index.mjs

@@ -3,6 +3,8 @@ import {
   AuthExtension,
   AuthStatus,
   Buffer,
+  CredentialRetrieverExtension,
+  CredentialServerExtension,
   DataServiceImpl,
   MOCK_AUTH_PROVIDER,
   MOCK_AUTH_VERIFIER,
@@ -23,16 +25,14 @@ import {
   mapTimeframeToFeedIndexes,
   startAfter,
   valueEncoding
-} from "./chunk-I2J5TTHJ.mjs";
+} from "./chunk-HS77A4I4.mjs";
 
 // packages/core/echo/echo-pipeline/src/automerge/automerge-host.ts
-import { Event } from "@dxos/async";
-import { next as automerge, getBackend, getHeads } from "@dxos/automerge/automerge";
+import { Event, asyncTimeout } from "@dxos/async";
+import { next as automerge, getBackend, getHeads, isAutomerge, save } from "@dxos/automerge/automerge";
 import { Repo } from "@dxos/automerge/automerge-repo";
-import { Context } from "@dxos/context";
-import { invariant as invariant3 } from "@dxos/invariant";
+import { Context, cancelWithContext } from "@dxos/context";
 import { PublicKey } from "@dxos/keys";
-import { log as log3 } from "@dxos/log";
 import { objectPointerCodec } from "@dxos/protocols";
 import { trace } from "@dxos/tracing";
 import { mapValues } from "@dxos/util";
@@ -161,13 +161,14 @@ var EchoNetworkAdapter = class extends NetworkAdapter {
       peerId: this.peerId,
       onConnectionOpen: this._onConnectionOpen.bind(this),
       onConnectionClosed: this._onConnectionClosed.bind(this),
+      onConnectionAuthScopeChanged: this._onConnectionAuthScopeChanged.bind(this),
       getContainingSpaceForDocument: this._params.getContainingSpaceForDocument
     });
   }
   async removeReplicator(replicator) {
     invariant(this._lifecycleState === LifecycleState.OPEN, void 0, {
       F: __dxlog_file,
-      L: 102,
+      L: 103,
       S: this,
       A: [
         "this._lifecycleState === LifecycleState.OPEN",
@@ -176,14 +177,13 @@ var EchoNetworkAdapter = class extends NetworkAdapter {
     });
     invariant(this._replicators.has(replicator), void 0, {
       F: __dxlog_file,
-      L: 103,
+      L: 104,
       S: this,
       A: [
         "this._replicators.has(replicator)",
         ""
       ]
     });
-    "";
     await replicator.disconnect();
     this._replicators.delete(replicator);
   }
@@ -249,27 +249,49 @@ var EchoNetworkAdapter = class extends NetworkAdapter {
       S: this,
       C: (f, a) => f(...a)
     });
-    this.emit("peer-candidate", {
-      peerId: connection.peerId,
-      peerMetadata: {
-        // TODO(dmaretskyi): Refactor this.
-        dxos_peerSource: "EchoNetworkAdapter"
-      }
+    this._emitPeerCandidate(connection);
+  }
+  /**
+  * Trigger doc-synchronizer shared documents set recalculation. Happens on peer-candidate.
+  * TODO(y): replace with a proper API call when sharePolicy update becomes supported by automerge-repo
+  */
+  _onConnectionAuthScopeChanged(connection) {
+    log("Connection auth scope changed", {
+      peerId: connection.peerId
+    }, {
+      F: __dxlog_file,
+      L: 153,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const entry = this._connections.get(connection.peerId);
+    invariant(entry, void 0, {
+      F: __dxlog_file,
+      L: 155,
+      S: this,
+      A: [
+        "entry",
+        ""
+      ]
     });
+    this.emit("peer-disconnected", {
+      peerId: connection.peerId
+    });
+    this._emitPeerCandidate(connection);
   }
   _onConnectionClosed(connection) {
     log("Connection closed", {
       peerId: connection.peerId
     }, {
       F: __dxlog_file,
-      L: 155,
+      L: 161,
       S: this,
       C: (f, a) => f(...a)
     });
     const entry = this._connections.get(connection.peerId);
     invariant(entry, void 0, {
       F: __dxlog_file,
-      L: 157,
+      L: 163,
       S: this,
       A: [
         "entry",
@@ -282,18 +304,24 @@ var EchoNetworkAdapter = class extends NetworkAdapter {
     });
     void entry.reader.cancel().catch((err) => log.catch(err, void 0, {
       F: __dxlog_file,
-      L: 162,
+      L: 168,
       S: this,
       C: (f, a) => f(...a)
     }));
     void entry.writer.abort().catch((err) => log.catch(err, void 0, {
       F: __dxlog_file,
-      L: 163,
+      L: 169,
       S: this,
       C: (f, a) => f(...a)
     }));
     this._connections.delete(connection.peerId);
   }
+  _emitPeerCandidate(connection) {
+    this.emit("peer-candidate", {
+      peerId: connection.peerId,
+      peerMetadata: createEchoPeerMetadata()
+    });
+  }
 };
 _ts_decorate([
   synchronized
@@ -307,6 +335,11 @@ _ts_decorate([
 _ts_decorate([
   synchronized
 ], EchoNetworkAdapter.prototype, "removeReplicator", null);
+var createEchoPeerMetadata = () => ({
+  // TODO(dmaretskyi): Refactor this.
+  dxos_peerSource: "EchoNetworkAdapter"
+});
+var isEchoPeerMetadata = (metadata) => metadata?.dxos_peerSource === "EchoNetworkAdapter";
 
 // packages/core/echo/echo-pipeline/src/automerge/leveldb-storage-adapter.ts
 import { LifecycleState as LifecycleState2, Resource } from "@dxos/context";
@@ -542,118 +575,6 @@ var LocalHostNetworkAdapter = class extends NetworkAdapter2 {
   }
 };
 
-// packages/core/echo/echo-pipeline/src/automerge/migrations.ts
-import { IndexedDBStorageAdapter } from "@dxos/automerge/automerge-repo-storage-indexeddb";
-import { log as log2 } from "@dxos/log";
-import { StorageType } from "@dxos/random-access-storage";
-
-// packages/core/echo/echo-pipeline/src/automerge/automerge-storage-adapter.ts
-import { arrayToBuffer, bufferToArray } from "@dxos/util";
-var AutomergeStorageAdapter = class {
-  constructor(_directory) {
-    this._directory = _directory;
-    this._state = "opened";
-  }
-  async load(key) {
-    if (this._state !== "opened") {
-      return void 0;
-    }
-    const filename = this._getFilename(key);
-    const file = this._directory.getOrCreateFile(filename);
-    const { size } = await file.stat();
-    if (!size || size === 0) {
-      return void 0;
-    }
-    const buffer = await file.read(0, size);
-    return bufferToArray(buffer);
-  }
-  async save(key, data) {
-    if (this._state !== "opened") {
-      return void 0;
-    }
-    const filename = this._getFilename(key);
-    const file = this._directory.getOrCreateFile(filename);
-    await file.write(0, arrayToBuffer(data));
-    await file.truncate?.(data.length);
-    await file.flush?.();
-  }
-  async remove(key) {
-    if (this._state !== "opened") {
-      return void 0;
-    }
-    const filename = this._getFilename(key);
-    const file = this._directory.getOrCreateFile(filename);
-    await file.destroy();
-  }
-  async loadRange(keyPrefix) {
-    if (this._state !== "opened") {
-      return [];
-    }
-    const filename = this._getFilename(keyPrefix);
-    const entries = await this._directory.list();
-    return Promise.all(entries.filter((entry) => entry.startsWith(filename)).map(async (entry) => {
-      const file = this._directory.getOrCreateFile(entry);
-      const { size } = await file.stat();
-      const buffer = await file.read(0, size);
-      return {
-        key: this._getKeyFromFilename(entry),
-        data: bufferToArray(buffer)
-      };
-    }));
-  }
-  async removeRange(keyPrefix) {
-    if (this._state !== "opened") {
-      return void 0;
-    }
-    const filename = this._getFilename(keyPrefix);
-    const entries = await this._directory.list();
-    await Promise.all(entries.filter((entry) => entry.startsWith(filename)).map(async (entry) => {
-      const file = this._directory.getOrCreateFile(entry);
-      await file.destroy();
-    }));
-  }
-  async close() {
-    this._state = "closed";
-  }
-  _getFilename(key) {
-    return key.map((k) => k.replaceAll("%", "%25").replaceAll("-", "%2D")).join("-");
-  }
-  _getKeyFromFilename(filename) {
-    return filename.split("-").map((k) => k.replaceAll("%2D", "-").replaceAll("%25", "%"));
-  }
-};
-
-// packages/core/echo/echo-pipeline/src/automerge/migrations.ts
-var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/echo/echo-pipeline/src/automerge/migrations.ts";
-var levelMigration = async ({ db, directory }) => {
-  const isNewLevel = !await db.iterator({
-    ...encodingOptions
-  }).next();
-  if (!isNewLevel) {
-    return;
-  }
-  const oldStorageAdapter = directory.type === StorageType.IDB ? new IndexedDBStorageAdapter(directory.path, "data") : new AutomergeStorageAdapter(directory);
-  const chunks = await oldStorageAdapter.loadRange([]);
-  if (chunks.length === 0) {
-    return;
-  }
-  const batch = db.batch();
-  log2.info("found chunks on old storage adapter", {
-    chunks: chunks.length
-  }, {
-    F: __dxlog_file3,
-    L: 37,
-    S: void 0,
-    C: (f, a) => f(...a)
-  });
-  for (const { key, data } of await oldStorageAdapter.loadRange([])) {
-    data && batch.put(key, data, {
-      ...encodingOptions
-    });
-  }
-  await batch.write();
-};
-
 // packages/core/echo/echo-pipeline/src/automerge/automerge-host.ts
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -665,31 +586,27 @@ function _ts_decorate2(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/echo/echo-pipeline/src/automerge/automerge-host.ts";
+var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/echo/echo-pipeline/src/automerge/automerge-host.ts";
 var AutomergeHost = class {
-  constructor({ directory, db, indexMetadataStore }) {
-    this._ctx = new Context();
+  constructor({ db, indexMetadataStore }) {
+    this._ctx = new Context(void 0, {
+      F: __dxlog_file3,
+      L: 71
+    });
     this._echoNetworkAdapter = new EchoNetworkAdapter({
       getContainingSpaceForDocument: this._getContainingSpaceForDocument.bind(this)
     });
-    this._requestedDocs = /* @__PURE__ */ new Set();
-    this._directory = directory;
-    this._db = db;
-    this._indexMetadataStore = indexMetadataStore;
-  }
-  async open() {
-    this._peerId = `host-${PublicKey.random().toHex()}`;
-    this._directory && await levelMigration({
-      db: this._db,
-      directory: this._directory
-    });
     this._storage = new LevelDBStorageAdapter({
-      db: this._db,
+      db,
       callbacks: {
         beforeSave: async (params) => this._beforeSave(params),
         afterSave: async () => this._afterSave()
       }
     });
+    this._indexMetadataStore = indexMetadataStore;
+  }
+  async open() {
+    this._peerId = `host-${PublicKey.random().toHex()}`;
     await this._storage.open?.();
     this._clientNetwork = new LocalHostNetworkAdapter();
     this._repo = new Repo({
@@ -714,6 +631,9 @@ var AutomergeHost = class {
     await this._echoNetworkAdapter.close();
     await this._ctx.dispose();
   }
+  /**
+  * @deprecated To be abstracted away.
+  */
   get repo() {
     return this._repo;
   }
@@ -723,6 +643,39 @@ var AutomergeHost = class {
   async removeReplicator(replicator) {
     await this._echoNetworkAdapter.removeReplicator(replicator);
   }
+  /**
+  * Loads the document handle from the repo and waits for it to be ready.
+  */
+  async loadDoc(ctx, documentId, opts) {
+    let handle;
+    if (typeof documentId === "string") {
+      handle = this._repo.handles[documentId];
+    }
+    if (!handle) {
+      handle = this._repo.find(documentId);
+    }
+    if (!handle.isReady()) {
+      if (!opts?.timeout) {
+        await cancelWithContext(ctx, handle.whenReady());
+      } else {
+        await cancelWithContext(ctx, asyncTimeout(handle.whenReady(), opts.timeout));
+      }
+    }
+    return handle;
+  }
+  /**
+  * Create new persisted document.
+  */
+  createDoc(initialValue, opts) {
+    if (opts?.preserveHistory) {
+      if (!isAutomerge(initialValue)) {
+        throw new TypeError("Initial value must be an Automerge document");
+      }
+      return this._repo.import(save(initialValue));
+    } else {
+      return this._repo.create(initialValue);
+    }
+  }
   // TODO(dmaretskyi): Share based on HALO permissions and space affinity.
   // Hosts, running in the worker, don't share documents unless requested by other peers.
   // NOTE: If both peers return sharePolicy=false the replication will not happen
@@ -734,23 +687,8 @@ var AutomergeHost = class {
     if (!documentId) {
       return false;
     }
-    const doc = this._repo.handles[documentId]?.docSync();
-    if (!doc) {
-      const isRequested = this._requestedDocs.has(`automerge:${documentId}`);
-      log3("doc share policy check", {
-        peerId,
-        documentId,
-        isRequested
-      }, {
-        F: __dxlog_file4,
-        L: 156,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return isRequested;
-    }
     const peerMetadata = this.repo.peerMetadataByPeerId[peerId];
-    if (peerMetadata?.dxos_peerSource === "EchoNetworkAdapter") {
+    if (isEchoPeerMetadata(peerMetadata)) {
       return this._echoNetworkAdapter.shouldAdvertize(peerId, {
         documentId
       });
@@ -822,31 +760,36 @@ var AutomergeHost = class {
     }
     return PublicKey.from(spaceKeyHex);
   }
-  //
-  // Methods for client-services.
-  //
+  /**
+  * Flush documents to disk.
+  */
   async flush({ states }) {
-    await Promise.all(states?.map(async ({ heads, documentId }) => {
-      invariant3(heads, "heads are required for flush", {
-        F: __dxlog_file4,
-        L: 250,
-        S: this,
-        A: [
-          "heads",
-          "'heads are required for flush'"
-        ]
-      });
-      const handle = this.repo.handles[documentId] ?? this._repo.find(documentId);
-      await waitForHeads(handle, heads);
-    }) ?? []);
+    if (states) {
+      await Promise.all(states.map(async ({ heads, documentId }) => {
+        if (!heads) {
+          return;
+        }
+        const handle = this.repo.handles[documentId] ?? this._repo.find(documentId);
+        await waitForHeads(handle, heads);
+      }) ?? []);
+    }
     await this._repo.flush(states?.map(({ documentId }) => documentId));
   }
+  /**
+  * Host <-> Client sync.
+  */
   syncRepo(request) {
     return this._clientNetwork.syncRepo(request);
   }
+  /**
+  * Host <-> Client sync.
+  */
   sendSyncMessage(request) {
     return this._clientNetwork.sendSyncMessage(request);
   }
+  /**
+  * Host <-> Client sync.
+  */
   async getHostInfo() {
     return this._clientNetwork.getHostInfo();
   }
@@ -900,10 +843,12 @@ var changeIsPresentInDoc = (doc, changeHash) => {
 
 // packages/core/echo/echo-pipeline/src/automerge/automerge-doc-loader.ts
 import { Event as Event2 } from "@dxos/async";
-import { cancelWithContext } from "@dxos/context";
+import { interpretAsDocumentId } from "@dxos/automerge/automerge-repo";
+import { cancelWithContext as cancelWithContext2 } from "@dxos/context";
 import { warnAfterTimeout } from "@dxos/debug";
-import { invariant as invariant4 } from "@dxos/invariant";
-import { log as log4 } from "@dxos/log";
+import { SpaceDocVersion } from "@dxos/echo-protocol";
+import { invariant as invariant3 } from "@dxos/invariant";
+import { log as log2 } from "@dxos/log";
 import { trace as trace2 } from "@dxos/tracing";
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -915,7 +860,7 @@ function _ts_decorate3(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/echo/echo-pipeline/src/automerge/automerge-doc-loader.ts";
+var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/echo/echo-pipeline/src/automerge/automerge-doc-loader.ts";
 var AutomergeDocumentLoaderImpl = class {
   constructor(_spaceId, _repo, _spaceKey) {
     this._spaceId = _spaceId;
@@ -937,32 +882,32 @@ var AutomergeDocumentLoaderImpl = class {
       return;
     }
     if (!spaceState.rootUrl) {
-      log4.error("Database opened with no rootUrl", {
-        spaceId: this._spaceId
-      }, {
-        F: __dxlog_file5,
-        L: 72,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      this._createContextBoundSpaceRootDocument(ctx);
-    } else {
-      const existingDocHandle = await this._initDocHandle(ctx, spaceState.rootUrl);
-      const doc = existingDocHandle.docSync();
-      invariant4(doc, void 0, {
-        F: __dxlog_file5,
-        L: 77,
-        S: this,
-        A: [
-          "doc",
-          ""
-        ]
-      });
-      if (doc.access == null) {
-        this._initDocAccess(existingDocHandle);
-      }
-      this._spaceRootDocHandle = existingDocHandle;
+      throw new Error("Database opened with no rootUrl");
     }
+    const existingDocHandle = await this._initDocHandle(ctx, spaceState.rootUrl);
+    const doc = existingDocHandle.docSync();
+    invariant3(doc, void 0, {
+      F: __dxlog_file4,
+      L: 84,
+      S: this,
+      A: [
+        "doc",
+        ""
+      ]
+    });
+    invariant3(doc.version === SpaceDocVersion.CURRENT, void 0, {
+      F: __dxlog_file4,
+      L: 85,
+      S: this,
+      A: [
+        "doc.version === SpaceDocVersion.CURRENT",
+        ""
+      ]
+    });
+    if (doc.access == null) {
+      this._initDocAccess(existingDocHandle);
+    }
+    this._spaceRootDocHandle = existingDocHandle;
   }
   loadObjectDocument(objectIdOrMany) {
     const objectIds = Array.isArray(objectIdOrMany) ? objectIdOrMany : [
@@ -971,9 +916,9 @@ var AutomergeDocumentLoaderImpl = class {
     let hasUrlsToLoad = false;
     const urlsToLoad = {};
     for (const objectId of objectIds) {
-      invariant4(this._spaceRootDocHandle, void 0, {
-        F: __dxlog_file5,
-        L: 90,
+      invariant3(this._spaceRootDocHandle, void 0, {
+        F: __dxlog_file4,
+        L: 97,
         S: this,
         A: [
           "this._spaceRootDocHandle",
@@ -984,9 +929,9 @@ var AutomergeDocumentLoaderImpl = class {
         continue;
       }
       const spaceRootDoc = this._spaceRootDocHandle.docSync();
-      invariant4(spaceRootDoc, void 0, {
-        F: __dxlog_file5,
-        L: 95,
+      invariant3(spaceRootDoc, void 0, {
+        F: __dxlog_file4,
+        L: 102,
         S: this,
         A: [
           "spaceRootDoc",
@@ -996,11 +941,11 @@ var AutomergeDocumentLoaderImpl = class {
       const documentUrl = (spaceRootDoc.links ?? {})[objectId];
       if (documentUrl == null) {
         this._objectsPendingDocumentLoad.add(objectId);
-        log4.info("loading delayed until object links are initialized", {
+        log2.info("loading delayed until object links are initialized", {
           objectId
         }, {
-          F: __dxlog_file5,
-          L: 99,
+          F: __dxlog_file4,
+          L: 106,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1013,6 +958,32 @@ var AutomergeDocumentLoaderImpl = class {
       this._loadLinkedObjects(urlsToLoad);
     }
   }
+  getObjectDocumentId(objectId) {
+    invariant3(this._spaceRootDocHandle, void 0, {
+      F: __dxlog_file4,
+      L: 118,
+      S: this,
+      A: [
+        "this._spaceRootDocHandle",
+        ""
+      ]
+    });
+    const spaceRootDoc = this._spaceRootDocHandle.docSync();
+    invariant3(spaceRootDoc, void 0, {
+      F: __dxlog_file4,
+      L: 120,
+      S: this,
+      A: [
+        "spaceRootDoc",
+        ""
+      ]
+    });
+    if (spaceRootDoc.objects?.[objectId]) {
+      return this._spaceRootDocHandle.documentId;
+    }
+    const documentUrl = (spaceRootDoc.links ?? {})[objectId];
+    return documentUrl && interpretAsDocumentId(documentUrl);
+  }
   onObjectLinksUpdated(links) {
     if (!links) {
       return;
@@ -1022,9 +993,9 @@ var AutomergeDocumentLoaderImpl = class {
     linksAwaitingLoad.forEach(([objectId]) => this._objectsPendingDocumentLoad.delete(objectId));
   }
   getSpaceRootDocHandle() {
-    invariant4(this._spaceRootDocHandle, void 0, {
-      F: __dxlog_file5,
-      L: 122,
+    invariant3(this._spaceRootDocHandle, void 0, {
+      F: __dxlog_file4,
+      L: 140,
       S: this,
       A: [
         "this._spaceRootDocHandle",
@@ -1034,16 +1005,18 @@ var AutomergeDocumentLoaderImpl = class {
     return this._spaceRootDocHandle;
   }
   createDocumentForObject(objectId) {
-    invariant4(this._spaceRootDocHandle, void 0, {
-      F: __dxlog_file5,
-      L: 127,
+    invariant3(this._spaceRootDocHandle, void 0, {
+      F: __dxlog_file4,
+      L: 145,
       S: this,
       A: [
         "this._spaceRootDocHandle",
         ""
       ]
     });
-    const spaceDocHandle = this._repo.create();
+    const spaceDocHandle = this._repo.create({
+      version: SpaceDocVersion.CURRENT
+    });
     this._initDocAccess(spaceDocHandle);
     this.onObjectBoundToDocument(spaceDocHandle, objectId);
     this._spaceRootDocHandle.change((newDoc) => {
@@ -1074,30 +1047,30 @@ var AutomergeDocumentLoaderImpl = class {
       };
       const objectDocumentHandle = this._objectDocumentHandles.get(objectId);
       if (objectDocumentHandle != null && objectDocumentHandle.url !== automergeUrl) {
-        log4.warn("object already inlined in a different document, ignoring the link", {
+        log2.warn("object already inlined in a different document, ignoring the link", {
           ...logMeta,
           actualDocumentUrl: objectDocumentHandle.url
         }, {
-          F: __dxlog_file5,
-          L: 157,
+          F: __dxlog_file4,
+          L: 177,
           S: this,
           C: (f, a) => f(...a)
         });
         continue;
       }
       if (objectDocumentHandle?.url === automergeUrl) {
-        log4.warn("object document was already loaded", logMeta, {
-          F: __dxlog_file5,
-          L: 164,
+        log2.warn("object document was already loaded", logMeta, {
+          F: __dxlog_file4,
+          L: 184,
           S: this,
           C: (f, a) => f(...a)
         });
         continue;
       }
       const handle = this._repo.find(automergeUrl);
-      log4.debug("document loading triggered", logMeta, {
-        F: __dxlog_file5,
-        L: 168,
+      log2.debug("document loading triggered", logMeta, {
+        F: __dxlog_file4,
+        L: 188,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1110,17 +1083,17 @@ var AutomergeDocumentLoaderImpl = class {
     while (true) {
       try {
         await warnAfterTimeout(5e3, "Automerge root doc load timeout (CoreDatabase)", async () => {
-          await cancelWithContext(ctx, docHandle.whenReady());
+          await cancelWithContext2(ctx, docHandle.whenReady());
         });
         break;
       } catch (err) {
         if (`${err}`.includes("Timeout")) {
-          log4.info("wraparound", {
+          log2.info("wraparound", {
             id: docHandle.documentId,
             state: docHandle.state
           }, {
-            F: __dxlog_file5,
-            L: 184,
+            F: __dxlog_file4,
+            L: 204,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1134,14 +1107,6 @@ var AutomergeDocumentLoaderImpl = class {
     }
     return docHandle;
   }
-  _createContextBoundSpaceRootDocument(ctx) {
-    const docHandle = this._repo.create();
-    this._spaceRootDocHandle = docHandle;
-    ctx.onDispose(() => {
-      docHandle.delete();
-      this._spaceRootDocHandle = null;
-    });
-  }
   _initDocAccess(handle) {
     handle.change((newDoc) => {
       newDoc.access ??= {
@@ -1160,9 +1125,9 @@ var AutomergeDocumentLoaderImpl = class {
         docUrl: handle.url
       };
       if (this.onObjectDocumentLoaded.listenerCount() === 0) {
-        log4.info("document loaded after all listeners were removed", logMeta, {
-          F: __dxlog_file5,
-          L: 220,
+        log2.info("document loaded after all listeners were removed", logMeta, {
+          F: __dxlog_file4,
+          L: 231,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1170,9 +1135,9 @@ var AutomergeDocumentLoaderImpl = class {
       }
       const objectDocHandle = this._objectDocumentHandles.get(objectId);
       if (objectDocHandle?.url !== handle.url) {
-        log4.warn("object was rebound while a document was loading, discarding handle", logMeta, {
-          F: __dxlog_file5,
-          L: 225,
+        log2.warn("object was rebound while a document was loading, discarding handle", logMeta, {
+          F: __dxlog_file4,
+          L: 236,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1184,14 +1149,14 @@ var AutomergeDocumentLoaderImpl = class {
       });
     } catch (err) {
       const shouldRetryLoading = this.onObjectDocumentLoaded.listenerCount() > 0;
-      log4.warn("failed to load a document", {
+      log2.warn("failed to load a document", {
         objectId,
         automergeUrl: handle.url,
         retryLoading: shouldRetryLoading,
         err
       }, {
-        F: __dxlog_file5,
-        L: 231,
+        F: __dxlog_file4,
+        L: 242,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1213,12 +1178,12 @@ AutomergeDocumentLoaderImpl = _ts_decorate3([
 // packages/core/echo/echo-pipeline/src/automerge/mesh-echo-replicator.ts
 import { cbor as cbor2 } from "@dxos/automerge/automerge-repo";
 import { Resource as Resource2 } from "@dxos/context";
-import { invariant as invariant5 } from "@dxos/invariant";
+import { invariant as invariant4 } from "@dxos/invariant";
 import { PublicKey as PublicKey2 } from "@dxos/keys";
-import { log as log5 } from "@dxos/log";
+import { log as log3 } from "@dxos/log";
 import { AutomergeReplicator } from "@dxos/teleport-extension-automerge-replicator";
 import { ComplexMap, ComplexSet, defaultMap } from "@dxos/util";
-var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/echo/echo-pipeline/src/automerge/mesh-echo-replicator.ts";
+var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/echo/echo-pipeline/src/automerge/mesh-echo-replicator.ts";
 var MeshEchoReplicator = class {
   constructor() {
     this._connections = /* @__PURE__ */ new Set();
@@ -1244,8 +1209,8 @@ var MeshEchoReplicator = class {
     this._context = null;
   }
   createExtension() {
-    invariant5(this._context, void 0, {
-      F: __dxlog_file6,
+    invariant4(this._context, void 0, {
+      F: __dxlog_file5,
       L: 54,
       S: this,
       A: [
@@ -1256,16 +1221,16 @@ var MeshEchoReplicator = class {
     const connection = new MeshReplicatorConnection({
       ownPeerId: this._context.peerId,
       onRemoteConnected: async () => {
-        log5("onRemoteConnected", {
+        log3("onRemoteConnected", {
           peerId: connection.peerId
         }, {
-          F: __dxlog_file6,
+          F: __dxlog_file5,
           L: 59,
           S: this,
           C: (f, a) => f(...a)
         });
-        invariant5(this._context, void 0, {
-          F: __dxlog_file6,
+        invariant4(this._context, void 0, {
+          F: __dxlog_file5,
           L: 60,
           S: this,
           A: [
@@ -1273,39 +1238,41 @@ var MeshEchoReplicator = class {
             ""
           ]
         });
-        if (!this._connectionsPerPeer.has(connection.peerId)) {
+        if (this._connectionsPerPeer.has(connection.peerId)) {
+          this._context.onConnectionAuthScopeChanged(connection);
+        } else {
           this._connectionsPerPeer.set(connection.peerId, connection);
-          await connection.enable();
           this._context.onConnectionOpen(connection);
+          await connection.enable();
         }
       },
       onRemoteDisconnected: async () => {
-        log5("onRemoteDisconnected", {
+        log3("onRemoteDisconnected", {
           peerId: connection.peerId
         }, {
-          F: __dxlog_file6,
-          L: 69,
+          F: __dxlog_file5,
+          L: 71,
           S: this,
           C: (f, a) => f(...a)
         });
         this._context?.onConnectionClosed(connection);
-        await connection.disable();
         this._connectionsPerPeer.delete(connection.peerId);
+        await connection.disable();
         this._connections.delete(connection);
       },
       shouldAdvertize: async (params) => {
-        log5("shouldAdvertize", {
+        log3("shouldAdvertize", {
           peerId: connection.peerId,
           documentId: params.documentId
         }, {
-          F: __dxlog_file6,
-          L: 76,
+          F: __dxlog_file5,
+          L: 78,
           S: this,
           C: (f, a) => f(...a)
         });
-        invariant5(this._context, void 0, {
-          F: __dxlog_file6,
-          L: 77,
+        invariant4(this._context, void 0, {
+          F: __dxlog_file5,
+          L: 79,
           S: this,
           A: [
             "this._context",
@@ -1315,12 +1282,12 @@ var MeshEchoReplicator = class {
         try {
           const spaceKey = await this._context.getContainingSpaceForDocument(params.documentId);
           if (!spaceKey) {
-            log5("space key not found for share policy check", {
+            log3("space key not found for share policy check", {
               peerId: connection.peerId,
               documentId: params.documentId
             }, {
-              F: __dxlog_file6,
-              L: 81,
+              F: __dxlog_file5,
+              L: 83,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1328,19 +1295,19 @@ var MeshEchoReplicator = class {
           }
           const authorizedDevices = this._authorizedDevices.get(spaceKey);
           if (!connection.remoteDeviceKey) {
-            log5("device key not found for share policy check", {
+            log3("device key not found for share policy check", {
               peerId: connection.peerId,
               documentId: params.documentId
             }, {
-              F: __dxlog_file6,
-              L: 91,
+              F: __dxlog_file5,
+              L: 93,
               S: this,
               C: (f, a) => f(...a)
             });
             return false;
           }
           const isAuthorized = authorizedDevices?.has(connection.remoteDeviceKey) ?? false;
-          log5("share policy check", {
+          log3("share policy check", {
             localPeer: this._context.peerId,
             remotePeer: connection.peerId,
             documentId: params.documentId,
@@ -1348,16 +1315,16 @@ var MeshEchoReplicator = class {
             spaceKey,
             isAuthorized
           }, {
-            F: __dxlog_file6,
-            L: 99,
+            F: __dxlog_file5,
+            L: 101,
             S: this,
             C: (f, a) => f(...a)
           });
           return isAuthorized;
         } catch (err) {
-          log5.catch(err, void 0, {
-            F: __dxlog_file6,
-            L: 109,
+          log3.catch(err, void 0, {
+            F: __dxlog_file5,
+            L: 111,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1369,16 +1336,21 @@ var MeshEchoReplicator = class {
     return connection.replicatorExtension;
   }
   authorizeDevice(spaceKey, deviceKey) {
-    log5("authorizeDevice", {
+    log3("authorizeDevice", {
       spaceKey,
       deviceKey
     }, {
-      F: __dxlog_file6,
-      L: 120,
+      F: __dxlog_file5,
+      L: 122,
       S: this,
       C: (f, a) => f(...a)
     });
     defaultMap(this._authorizedDevices, spaceKey, () => new ComplexSet(PublicKey2.hash)).add(deviceKey);
+    for (const connection of this._connections) {
+      if (connection.remoteDeviceKey && connection.remoteDeviceKey.equals(deviceKey)) {
+        this._context?.onConnectionAuthScopeChanged(connection);
+      }
+    }
   }
 };
 var MeshReplicatorConnection = class extends Resource2 {
@@ -1410,13 +1382,13 @@ var MeshReplicatorConnection = class extends Resource2 {
       onStartReplication: async (info, remotePeerId) => {
         this.remoteDeviceKey = remotePeerId;
         this._remotePeerId = info.id;
-        log5("onStartReplication", {
+        log3("onStartReplication", {
           id: info.id,
           thisPeerId: this.peerId,
           remotePeerId: remotePeerId.toHex()
         }, {
-          F: __dxlog_file6,
-          L: 185,
+          F: __dxlog_file5,
+          L: 192,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1438,9 +1410,9 @@ var MeshReplicatorConnection = class extends Resource2 {
     });
   }
   get peerId() {
-    invariant5(this._remotePeerId != null, "Remote peer has not connected yet.", {
-      F: __dxlog_file6,
-      L: 208,
+    invariant4(this._remotePeerId != null, "Remote peer has not connected yet.", {
+      F: __dxlog_file5,
+      L: 215,
       S: this,
       A: [
         "this._remotePeerId != null",
@@ -1457,9 +1429,9 @@ var MeshReplicatorConnection = class extends Resource2 {
   * Call after the remote peer has connected.
   */
   async enable() {
-    invariant5(this._remotePeerId != null, "Remote peer has not connected yet.", {
-      F: __dxlog_file6,
-      L: 221,
+    invariant4(this._remotePeerId != null, "Remote peer has not connected yet.", {
+      F: __dxlog_file5,
+      L: 228,
       S: this,
       A: [
         "this._remotePeerId != null",
@@ -1480,7 +1452,8 @@ export {
   AuthStatus,
   AutomergeDocumentLoaderImpl,
   AutomergeHost,
-  AutomergeStorageAdapter,
+  CredentialRetrieverExtension,
+  CredentialServerExtension,
   DataServiceImpl,
   LevelDBStorageAdapter,
   LocalHostNetworkAdapter,