@dxos/protocols 0.8.4-staging.ac66bdf99f → 0.9.0

package/src/edge/edge.ts

@@ -13,10 +13,16 @@ import { SpaceId } from '@dxos/keys';
  */
 export const EDGE_CLIENT_TAG_HEADER = 'X-DXOS-Client-Tag';
 
+/**
+ * HTTP header sent on every Edge request to provide a BYOK (Bring Your Own Key) for AI services.
+ */
+export const BYOK_HEADER = 'X-BYOK';
+
 // TODO(burdon): Rename EdgerRouterEndpoint.
 // If we would rename it, we need to be careful to not break composer production.
 export enum EdgeService {
   AUTOMERGE_REPLICATOR = 'automerge-replicator',
+  SUBDUCTION_REPLICATOR = 'subduction-replicator',
   /**
    * Control feed replicator (hypercore append only logs) for the space.
    */
@@ -216,6 +222,12 @@ export type RecoverIdentityRequest = {
   lookupKey?: string;
   signature?: RecoverIdentitySignature;
   token?: string;
+  /**
+   * One-time proof minted by kms-service after a successful OAuth recovery flow.
+   * When provided, db-service redeems the proof to obtain the bound identityKey directly
+   * and `lookupKey`/`signature` are not required.
+   */
+  recoveryProof?: string;
 };
 
 export type RecoverIdentityResponseBody = {
@@ -314,8 +326,17 @@ export type EdgeAuthChallenge = {
 };
 
 export enum OAuthProvider {
-  GOOGLE = 'google',
+  ATLASSIAN = 'atlassian',
+  ATPROTO = 'atproto',
+  /** @deprecated Use ATPROTO instead. */
   BLUESKY = 'bluesky',
+  DISCORD = 'discord',
+  GITHUB = 'github',
+  GOOGLE = 'google',
+  LINEAR = 'linear',
+  NOTION = 'notion',
+  SLACK = 'slack',
+  TRELLO = 'trello',
 }
 
 export const InitiateOAuthFlowRequestSchema = Schema.Struct({
@@ -325,8 +346,17 @@ export const InitiateOAuthFlowRequestSchema = Schema.Struct({
   scopes: Schema.mutable(Schema.Array(Schema.String)),
   // Set to true if we don't want periodic token refreshes in background, for cases like account connect
   noRefresh: Schema.optional(Schema.Boolean),
-  // Provider-specific (user handle or did for bluesky) hint for auth server resolution
+  // Provider-specific (user handle or did for atproto) hint for auth server resolution
   loginHint: Schema.optional(Schema.String),
+  // Return a 302 redirect to composer://oauth/callback instead of HTML.
+  // Required for ASWebAuthenticationSession (iOS) which blocks JavaScript redirects.
+  nativeAppRedirect: Schema.optional(Schema.Boolean),
+  // OAuth-based account recovery: when purpose === 'register', kms-service writes a
+  // recovery binding for `identityKey` after the OAuth flow completes; when 'recovery',
+  // kms-service mints a one-time `recoveryProof` the client forwards to db-service.
+  registerRecovery: Schema.optional(Schema.Boolean),
+  identityKey: Schema.optional(Schema.String),
+  purpose: Schema.optional(Schema.Literal('register', 'recovery')),
 });
 export type InitiateOAuthFlowRequest = Schema.Schema.Type<typeof InitiateOAuthFlowRequestSchema>;
 
@@ -335,9 +365,29 @@ export type InitiateOAuthFlowResponse = {
 };
 
 export type OAuthFlowResult =
-  | { success: true; accessToken: string; accessTokenId: string }
+  | { success: true; accessToken: string; accessTokenId: string; recoveryProof?: string }
   | { success: false; reason: string };
 
+/**
+ * Completes OAuth recovery registration for an existing identity: routes the OAuth refresh token
+ * into the personal space and writes the recovery binding.
+ */
+export type CompleteOAuthRegistrationRequest = {
+  registrationToken: string;
+  identityKey: string;
+  spaceKey: string;
+};
+
+export type CompleteOAuthRegistrationResponse = {
+  email?: string;
+  provider: OAuthProvider;
+  accessTokenId: string;
+  accessToken: string;
+  expiresInSeconds: number;
+  scopes: string[];
+  identifier: string;
+};
+
 export enum EdgeWebsocketProtocol {
   V0 = 'edge-ws-v0',
   /**
@@ -543,7 +593,7 @@ export type InspectSpaceResponse = {
     objectCount: number;
     deletedObjectCount: number;
     indexedDocumentCount: number;
-    objectsByType: { typeDxn: string; count: number }[];
+    objectsByType: { typeURI: string; count: number }[];
     indexerStatus: {
       indexingInProgress: boolean;
       cursors: { indexName: string; sourceName: string; resourceId: string | null; cursor: string | number }[];
@@ -571,7 +621,7 @@ export type InspectIdentityResponse = {
   spaces: InspectSpaceResponse[];
 };
 
-/** Matches the SerializedSpace format from @dxos/echo-db, extended with spaceId. */
+/** Matches the SerializedSpace format from @dxos/echo-client, extended with spaceId. */
 export type SpaceExportPayload = {
   version: number;
   timestamp: string;
@@ -602,3 +652,167 @@ export type DeleteSpaceResponse = { status: string; spaceId: string };
 
 export type DeleteIdentityRequest = { identityKey: string };
 export type DeleteIdentityResponse = { status: string; identityKey: string };
+
+//
+// Account / Invitation
+//
+
+export const INVITATION_CODE_LENGTH = 8;
+export const DEFAULT_INVITATIONS_PER_ACCOUNT = 5;
+
+/** Crockford base32 alphabet (no I, L, O, U). Case-insensitive on the wire. */
+export const INVITATION_CODE_ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+
+export const InvitationCodeSchema = Schema.String.pipe(
+  Schema.pattern(new RegExp(`^[${INVITATION_CODE_ALPHABET}]{${INVITATION_CODE_LENGTH}}$`)),
+);
+
+export const CheckEmailExistsRequestSchema = Schema.Struct({
+  email: Schema.String,
+});
+export type CheckEmailExistsRequest = Schema.Schema.Type<typeof CheckEmailExistsRequestSchema>;
+export type CheckEmailExistsResponse = { exists: boolean };
+
+export const ValidateInvitationCodeRequestSchema = Schema.Struct({
+  code: InvitationCodeSchema,
+});
+export type ValidateInvitationCodeRequest = Schema.Schema.Type<typeof ValidateInvitationCodeRequestSchema>;
+export type ValidateInvitationCodeResponse = { valid: boolean };
+
+/**
+ * Body of `POST /account/login`. Existing-account email recovery only --
+ * unlike `/account/signup`, this never creates new identities or waitlist rows.
+ */
+export const LoginRequestSchema = Schema.Struct({
+  email: Schema.String,
+  identityDid: Schema.optional(Schema.String),
+  identityKey: Schema.optional(Schema.String),
+});
+export type LoginRequest = Schema.Schema.Type<typeof LoginRequestSchema>;
+
+/**
+ * Response from `POST /account/login`. The shape is identical regardless of
+ * whether the email is registered, so the endpoint is safe against enumeration.
+ * Regular emails are delivered out-of-band and the response is `{}`.
+ */
+export const LoginResponseSchema = Schema.Struct({
+  token: Schema.optional(Schema.String),
+  needsIdentity: Schema.optional(Schema.Boolean),
+  admitted: Schema.optional(Schema.Boolean),
+});
+export type LoginResponse = Schema.Schema.Type<typeof LoginResponseSchema>;
+
+// Two-step signup: invitation code + identity DID + email.
+export const RedeemInvitationCodeRequestSchema = Schema.Struct({
+  code: Schema.optional(InvitationCodeSchema),
+  identityDid: Schema.optional(Schema.String),
+  /** Raw hex public key, stored alongside the DID for the magic-link recovery flow. */
+  identityKey: Schema.optional(Schema.String),
+  email: Schema.String,
+});
+export type RedeemInvitationCodeRequest = Schema.Schema.Type<typeof RedeemInvitationCodeRequestSchema>;
+export type RedeemInvitationCodeResponse =
+  | { accountId: string; emailVerificationSent: boolean }
+  | { needsIdentity: true };
+
+export const GetAccountResponseSchema = Schema.Struct({
+  identityDid: Schema.String,
+  email: Schema.String,
+  emailVerified: Schema.Boolean,
+  /** ISO timestamp. */
+  createdAt: Schema.String,
+  invitationsRemaining: Schema.Number,
+});
+export type GetAccountResponse = Schema.Schema.Type<typeof GetAccountResponseSchema>;
+
+export const AccountInvitationSchema = Schema.Struct({
+  code: Schema.String,
+  /** ISO timestamp. */
+  createdAt: Schema.String,
+  redeemedByIdentityDid: Schema.optional(Schema.String),
+  /** ISO timestamp. */
+  redeemedAt: Schema.optional(Schema.String),
+});
+export type AccountInvitation = Schema.Schema.Type<typeof AccountInvitationSchema>;
+
+export const ListAccountInvitationsResponseSchema = Schema.Struct({
+  invitations: Schema.Array(AccountInvitationSchema),
+});
+export type ListAccountInvitationsResponse = Schema.Schema.Type<typeof ListAccountInvitationsResponseSchema>;
+
+export type IssueInvitationResponse = { code: string };
+
+export type ResendVerificationEmailResponse = {
+  sent: boolean;
+  cooldownSecondsRemaining?: number;
+};
+
+/**
+ * Submitted by users without an Account who want to request access. Captured
+ * by Hub for admin follow-up (e.g. mailing list, Discord notification).
+ */
+export const RequestAccessRequestSchema = Schema.Struct({
+  email: Schema.String,
+  /** Optional: identity DID the user is currently signed in as. */
+  identityDid: Schema.optional(Schema.String),
+  /** Optional free-form message from the requester. */
+  message: Schema.optional(Schema.String),
+});
+export type RequestAccessRequest = Schema.Schema.Type<typeof RequestAccessRequestSchema>;
+export type RequestAccessResponse = { received: boolean };
+
+//
+// Admin (X-API-KEY)
+//
+
+export type AdminListAccountsResponse = {
+  accounts: GetAccountResponse[];
+};
+
+export const AdminGrantInvitationsRequestSchema = Schema.Struct({
+  identityDid: Schema.String,
+  count: Schema.Number,
+});
+export type AdminGrantInvitationsRequest = Schema.Schema.Type<typeof AdminGrantInvitationsRequestSchema>;
+
+export const AdminCreateInvitationCodesRequestSchema = Schema.Struct({
+  count: Schema.Number,
+  note: Schema.optional(Schema.String),
+});
+export type AdminCreateInvitationCodesRequest = Schema.Schema.Type<typeof AdminCreateInvitationCodesRequestSchema>;
+export type AdminCreateInvitationCodesResponse = { codes: string[] };
+
+export type AdminListInvitationCodesResponse = {
+  codes: Array<{
+    code: string;
+    /** ISO timestamp. */
+    createdAt: string;
+    note?: string;
+    issuedByIdentityDid?: string;
+    redeemedByIdentityDid?: string;
+    /** ISO timestamp. */
+    redeemedAt?: string;
+    /** ISO timestamp. Set when revoked. */
+    revokedAt?: string;
+  }>;
+};
+
+export const AdminRevokeInvitationCodeRequestSchema = Schema.Struct({
+  code: InvitationCodeSchema,
+});
+export type AdminRevokeInvitationCodeRequest = Schema.Schema.Type<typeof AdminRevokeInvitationCodeRequestSchema>;
+
+/**
+ * Account/invitation-related variants placed in `EdgeFailure.data.type`.
+ * EdgeErrorData is open-ended; these are documentation for known values.
+ */
+export type AccountErrorType =
+  | 'invitation_code_invalid'
+  | 'invitation_code_already_redeemed'
+  | 'invitation_code_revoked'
+  | 'email_already_registered'
+  | 'identity_already_associated'
+  | 'no_invitations_remaining'
+  | 'identity_not_associated_with_account'
+  | 'no_account'
+  | 'rate_limited';

package/src/edge/registry.ts

@@ -15,6 +15,7 @@ export const PluginMetaSchema = Schema.Struct({
   id: Schema.String.pipe(Schema.nonEmptyString()),
   name: Schema.String.pipe(Schema.nonEmptyString()),
   description: Schema.optional(Schema.String),
+  author: Schema.optional(Schema.String),
   homePage: Schema.optional(Schema.String),
   source: Schema.optional(Schema.String),
   screenshots: Schema.optional(Schema.Array(Schema.String)),
@@ -31,14 +32,32 @@ export type PluginMeta = Schema.Schema.Type<typeof PluginMetaSchema>;
 export const PluginHealthSchema = Schema.Literal('ok', 'release-missing', 'manifest-invalid', 'repo-unavailable');
 export type PluginHealth = Schema.Schema.Type<typeof PluginHealthSchema>;
 
+/**
+ * Filename of the entry module every plugin must publish at the root of its bundle.
+ * The host dynamic-imports `<manifest URL base>/index.mjs` directly — no per-plugin
+ * configuration. `composerPlugin` outputs the bundle under this name so plugin authors
+ * never have to think about it.
+ */
+export const PLUGIN_ENTRY_FILENAME = 'index.mjs';
+
 /**
  * Shape of the manifest-asset JSON the registry service fetches from each plugin's latest release.
- * Extends {@link PluginMetaSchema} with an optional override for the module bundle filename
- * (defaults to `plugin.mjs`).
+ *
+ * Emitted by `@dxos/app-framework/vite-plugin`'s `composerPlugin` (see
+ * `MANIFEST_ASSET_NAME`). Lists every file the plugin needs at runtime — the entry
+ * module ({@link PLUGIN_ENTRY_FILENAME}) plus any sibling CSS, code-split chunks,
+ * fonts, etc. — so the host can eagerly precache the whole bundle for offline use.
+ * Paths in `assets` are relative to the manifest's URL.
  */
 export const PluginManifestSchema = Schema.Struct({
   ...PluginMetaSchema.fields,
-  moduleFile: Schema.optional(Schema.String),
+  /** Plugin version (semver). Sourced from the publishing project's `package.json`. */
+  version: Schema.String.pipe(Schema.nonEmptyString()),
+  /**
+   * Relative paths of every file the plugin needs at runtime, including the entry.
+   * Must include {@link PLUGIN_ENTRY_FILENAME}; consumers verify on parse.
+   */
+  assets: Schema.Array(Schema.String).pipe(Schema.minItems(1)),
 });
 export type PluginManifest = Schema.Schema.Type<typeof PluginManifestSchema>;
 
@@ -46,17 +65,17 @@ export type PluginManifest = Schema.Schema.Type<typeof PluginManifestSchema>;
  * Single hydrated plugin entry returned by the registry service.
  */
 export const PluginEntrySchema = Schema.Struct({
-  /** GitHub repository in `owner/name` form. */
-  repo: Schema.String.pipe(Schema.nonEmptyString()),
+  /** GitHub repository in `owner/name` form. Empty string for entries sourced from a `manifestUrl`. */
+  repo: Schema.String,
   /** Plugin metadata from the repo's latest-release `manifest.json`. */
   meta: PluginMetaSchema,
   /**
-   * URL from which Composer can dynamic-import the plugin module. The registry service is
-   * responsible for returning a URL that is CORS-safe for browser `import()` (e.g. served or
-   * proxied by the service itself); clients pass this value directly to the URL loader.
+   * URL of the plugin's `manifest.json`. Composer's URL loader fetches this, eagerly caches
+   * every declared asset via the platform `PluginAssetCache`, then dynamic-imports the entry.
+   * The URL must be CORS-safe and have its declared assets reachable as siblings.
    */
   moduleUrl: Schema.String,
-  /** Release tag the entry was resolved from (e.g. `v0.1.0`). */
+  /** Release tag the entry was resolved from (e.g. `v0.1.0`). Empty string for `manifestUrl` entries. */
   releaseTag: Schema.String,
   /** Health signal set by the service when an entry fails to refresh. */
   health: PluginHealthSchema,
@@ -78,6 +97,59 @@ export const GetPluginsResponseBodySchema = Schema.Struct({
 });
 export type GetPluginsResponseBody = Schema.Schema.Type<typeof GetPluginsResponseBodySchema>;
 
+/**
+ * A single published version of a plugin, as returned by the registry service's
+ * versions endpoint. Sourced from the publishing project's GitHub releases.
+ *
+ * The host treats `tag` opaquely; ordering — newest first — is the service's
+ * responsibility (typically reverse-chronological by release date).
+ */
+export const PluginVersionSchema = Schema.Struct({
+  /** Release tag (e.g. `v0.1.21`). Stable identifier for this version. */
+  tag: Schema.String.pipe(Schema.nonEmptyString()),
+  /**
+   * URL of this version's `manifest.json`. Matches the shape of {@link PluginEntrySchema.fields.moduleUrl}
+   * but pinned to a specific release rather than the latest. Composer's URL loader fetches
+   * this when the user installs / rolls back to this version.
+   */
+  moduleUrl: Schema.String.pipe(Schema.nonEmptyString()),
+  /** Unix ms when the version was released. Optional — services that lack this signal can omit. */
+  releasedAt: Schema.optional(Schema.Number),
+});
+export type PluginVersion = Schema.Schema.Type<typeof PluginVersionSchema>;
+
+/**
+ * Response body of `GET /registry/plugins/:repo/versions`.
+ *
+ * `:repo` is the GitHub `owner/name` form, URL-encoded (so `/` is escaped).
+ * Returns all hydratable releases for the repo, newest first; clients display them
+ * in the version picker for install / roll-back. Unauthenticated; same surface area
+ * as `GET /registry/plugins`.
+ */
+export const GetPluginVersionsResponseBodySchema = Schema.Struct({
+  /** Wire-format schema version, pinned to 1. */
+  version: Schema.Literal(1),
+  /** Available versions for the requested repo, newest first. */
+  versions: Schema.Array(PluginVersionSchema),
+  /** Unix ms timestamp of the most recent successful refresh cycle for this repo. */
+  refreshedAt: Schema.Number,
+});
+export type GetPluginVersionsResponseBody = Schema.Schema.Type<typeof GetPluginVersionsResponseBodySchema>;
+
+/**
+ * A catalog entry. Two flavours:
+ *  - `{ repo }`: the registry service hydrates from the GitHub repo's latest release.
+ *    Used by the production catalog.
+ *  - `{ manifestUrl }`: the registry service skips GitHub and fetches the manifest directly.
+ *    Used for local development against an in-progress plugin (e.g. served by `vite preview`)
+ *    so authors can iterate without publishing a release.
+ */
+export const RegistryEntrySchema = Schema.Union(
+  Schema.Struct({ repo: Schema.String.pipe(Schema.nonEmptyString()) }),
+  Schema.Struct({ manifestUrl: Schema.String.pipe(Schema.nonEmptyString()) }),
+);
+export type RegistryEntry = Schema.Schema.Type<typeof RegistryEntrySchema>;
+
 /**
  * Shape of the catalog manifest published in the upstream community-plugins repo.
  * Extra keys (e.g. `$schema`) are permitted.
@@ -85,11 +157,7 @@ export type GetPluginsResponseBody = Schema.Schema.Type<typeof GetPluginsRespons
 export const RegistryManifestSchema = Schema.Struct(
   {
     version: Schema.Literal(1),
-    plugins: Schema.Array(
-      Schema.Struct({
-        repo: Schema.String,
-      }),
-    ),
+    plugins: Schema.Array(RegistryEntrySchema),
   },
   Schema.Record({ key: Schema.String, value: Schema.Unknown }),
 );

package/src/index.ts

@@ -10,7 +10,7 @@ export * from './messenger.ts';
 export * from './profile-archive.ts';
 export * from './space-archive.ts';
 export * from './storage.ts';
-export * from './tracing.ts';
 export type * from './types.ts';
 export * as FunctionProtocol from './FunctionProtocol.ts';
 export * as FeedProtocol from './FeedProtocol.ts';
+export * as TraceProtocol from './TraceProtocol.ts';

package/src/invitation.ts

@@ -4,11 +4,11 @@
 
 import * as Schema from 'effect/Schema';
 
-import { ParamKeyAnnotation } from '@dxos/effect';
+import { SchemaEx } from '@dxos/effect';
 
 // TODO(burdon): Use uniformly for processing HTTP params.
 export const InvitationUrl = Schema.Struct({
   accessToken: Schema.String, // TODO(burdon): Remove.
-  deviceInvitationCode: Schema.String.pipe(ParamKeyAnnotation({ key: 'deviceInvitationCode' })),
-  spaceInvitationCode: Schema.String.pipe(ParamKeyAnnotation({ key: 'spaceInvitationCode' })),
+  deviceInvitationCode: Schema.String.pipe(SchemaEx.ParamKeyAnnotation({ key: 'deviceInvitationCode' })),
+  spaceInvitationCode: Schema.String.pipe(SchemaEx.ParamKeyAnnotation({ key: 'spaceInvitationCode' })),
 });

package/src/profile-archive.ts

@@ -8,17 +8,30 @@
 export type ProfileArchive = {
   meta: {
     timestamp: string;
+    /** Host (e.g. `main.composer.space`, `localhost:5173`) where the archive was exported. */
+    origin?: string;
   };
   storage: ProfileArchiveEntry[];
 };
 
 export type ProfileArchiveEntry = {
   type: ProfileArchiveEntryType;
+  /**
+   * FILE: filename in random-access storage.
+   * KEY_VALUE: binary LevelDB key.
+   * SQLITE_DATABASE: OPFS database filename (e.g. `DXOS`).
+   */
   key: string | Uint8Array;
+  /**
+   * FILE / KEY_VALUE / SQLITE_DATABASE: binary payload.
+   * SQLITE_DATABASE must be a valid SQLite file (magic `SQLite format 3`).
+   */
   value: string | Uint8Array;
 };
 
 export enum ProfileArchiveEntryType {
   FILE = 1,
   KEY_VALUE = 2,
+  /** OPFS-hosted SQLite database; `key` is the OPFS filename, `value` is raw SQLite bytes. */
+  SQLITE_DATABASE = 3,
 }

package/src/proto/dxos/client/invitation.proto

@@ -43,6 +43,9 @@ enum SpaceState {
   /// Space is active. Swarming and replication will be done.
   SPACE_ACTIVE = 6;
 
+  /// Space is tombstoned (soft-deleted). Replicated to other devices; never auto-opened.
+  SPACE_DELETED = 9;
+
   ///
   /// Runtime states:
   ///
@@ -85,8 +88,12 @@ message Invitation {
   }
 
   enum Kind {
-    DEVICE = 0;
-    SPACE = 1;
+    /// Unset / unknown. Must not be used for new invitations.
+    INVALID = 0;
+
+    DEVICE = 1;
+
+    SPACE = 2;
   }
 
   enum AuthMethod {

package/src/proto/dxos/client/queue.proto

@@ -73,9 +73,30 @@ message SyncQueueRequest {
   optional bool should_pull = 5;
 }
 
+message GetSyncStateRequest {
+  string space_id = 1;
+  /// If empty, returns state for all namespaces synced by the client.
+  repeated string namespaces = 2;
+}
+
+message QueueNamespaceSyncState {
+  string namespace = 1;
+  /// Blocks still to pull from remote. 0 when caught up.
+  int64 blocks_to_pull = 2;
+  /// Unpositioned blocks still to push to remote. 0 when caught up.
+  int64 blocks_to_push = 3;
+  /// Total blocks stored locally for this namespace in the space.
+  int64 total_blocks = 4;
+}
+
+message GetSyncStateResponse {
+  repeated QueueNamespaceSyncState namespaces = 1;
+}
+
 service QueueService {
   rpc QueryQueue(QueryQueueRequest) returns (QueueQueryResult);
   rpc InsertIntoQueue(InsertIntoQueueRequest) returns (google.protobuf.Empty);
   rpc DeleteFromQueue(DeleteFromQueueRequest) returns (google.protobuf.Empty);
   rpc SyncQueue(SyncQueueRequest) returns (google.protobuf.Empty);
+  rpc GetSyncState(GetSyncStateRequest) returns (GetSyncStateResponse);
 }

package/src/proto/dxos/client/services.proto

@@ -146,6 +146,8 @@ message RecoverIdentityRequest {
     string recovery_code = 1;
     ExternalSignature external = 2;
     string token = 3;
+    /// One-time proof minted by edge kms-service after a successful OAuth recovery flow.
+    string recovery_proof = 4;
   }
 }
 
@@ -467,6 +469,8 @@ message ExportSpaceResponse {
 
 message ImportSpaceRequest {
   SpaceArchive archive = 1;
+  /// Immutable tags to set on the imported space at creation time.
+  repeated string tags = 2;
 }
 
 message ImportSpaceResponse {

package/src/proto/dxos/config.proto

@@ -145,6 +145,8 @@ message Runtime {
     message EdgeFeatures {
       optional bool feed_replicator = 1;
       optional bool echo_replicator = 2;
+      /// Enables Subduction sedimentree transport for Automerge document replication.
+      optional bool subduction_replicator = 5;
       optional bool signaling = 3;
       optional bool agents = 4;
     }

package/src/proto/dxos/devtools/host.proto

@@ -78,6 +78,13 @@ service DevtoolsHost {
   rpc SubscribeToSignalStatus(google.protobuf.Empty) returns (stream SubscribeToSignalStatusResponse);
   rpc SubscribeToSignal(google.protobuf.Empty) returns (stream SignalResponse);
   rpc SubscribeToSwarmInfo(SubscribeToSwarmInfoRequest) returns (stream SubscribeToSwarmInfoResponse);
+
+  //
+  // SQLite
+  //
+
+  rpc ExportSqliteDatabase(google.protobuf.Empty) returns (ExportSqliteDatabaseResponse);
+  rpc RunSqliteQuery(RunSqliteQueryRequest) returns (RunSqliteQueryResponse);
 }
 
 message Event {
@@ -338,3 +345,23 @@ message SubscribeToSwarmInfoRequest {}
 message SubscribeToSwarmInfoResponse {
   repeated dxos.devtools.swarm.SwarmInfo data = 1;
 }
+
+//
+// SQLite
+//
+
+message ExportSqliteDatabaseResponse {
+  bytes data = 1;
+}
+
+message RunSqliteQueryRequest {
+  string query = 1;
+  // JSON-encoded array of query parameters.
+  optional string params = 2;
+}
+
+message RunSqliteQueryResponse {
+  // JSON-encoded array of row objects.
+  string rows = 1;
+  optional string error = 2;
+}

package/src/proto/dxos/echo/metadata.proto

@@ -34,6 +34,9 @@ message EchoMetadata {
 
   // TODO(burdon): Circular dep.
   repeated dxos.client.services.Invitation invitations = 12;
+
+  /// Keys of spaces that have been tombstoned (soft-deleted). Survives restart; prevents re-acceptance.
+  repeated dxos.keys.PublicKey deleted_spaces = 13;
 }
 
 /// Per-space metadata. Frequent updates. Keep small.

package/src/proto/dxos/echo/service.proto

@@ -60,8 +60,21 @@ message DocumentUpdate {
   /**
    * Automerge document incremental update.
    * Value returned by `Automerge.saveSince()`.
+   * Optional: if absent, the update only carries a transition signal (e.g.
+   * `requesting`) and not new bytes.
    */
-  bytes mutation = 2;
+  optional bytes mutation = 2;
+
+  /**
+   * Set by the worker when the disk probe for this document completes
+   * negative — i.e. the document is not on local storage, and the worker
+   * has started a network fetch. The client moves the corresponding
+   * `DocHandleProxy` from `'pending'` to `'requesting'`. Once the bytes
+   * eventually arrive, a normal `mutation` update follows and the handle
+   * transitions to `'ready'`. Used by query-driven (disk-only) callers to
+   * give up on a load without waiting on the network.
+   */
+  optional bool requesting = 3;
 }
 
 message DocHeadsList {

package/src/proto/dxos/halo/credentials.proto

@@ -87,6 +87,15 @@ message MemberProfile {
   optional ProfileDocument profile = 3;
 }
 
+// [ASSERTION]: Space has been tombstoned (soft-deleted) by its owner.
+// Written to the identity's HALO so the deletion replicates across the user's devices.
+// A tombstone stops replication and unloads the space; data is not removed until garbage collection.
+message SpaceDeleted {
+  dxos.keys.PublicKey space_key = 1;
+  google.protobuf.Timestamp deleted_at = 2;
+  optional string reason = 3;
+}
+
 // [ASSERTION]: Device is authorized to sign messages for a given Agent (Identity).
 // NOTE: Devices are Admitted to Identities.
 message AuthorizedDevice {

package/src/proto/dxos/halo/invitations.proto

@@ -16,8 +16,11 @@ package dxos.halo.invitations;
 
 message InvitationOptions {
   enum Role {
-    GUEST = 0;
-    HOST = 1;
+    // Sentinel so neither real role is the proto3 default (which is stripped on the wire,
+    // causing the receiver to see `role === undefined` and reject with InvalidInvitationExtensionRoleError).
+    INVALID = 0;
+    GUEST = 1;
+    HOST = 2;
   }
 
   /// Role of the peer.