From 5599b3042a09b9581810e2dae1ab345352fe8c4d Mon Sep 17 00:00:00 2001
From: Nik Graf <nik@nikgraf.com>
Date: Sat, 16 Nov 2024 16:00:43 +0100
Subject: [PATCH 1/2] add accept-invitation

---
 .../src/components/debug-invitations.tsx      |  9 ++-
 apps/events/src/routes/playground.tsx         | 24 ++++++-
 .../migration.sql                             | 24 +++++++
 apps/server/prisma/schema.prisma              | 15 +++--
 apps/server/src/handlers/applySpaceEvent.ts   | 28 +++++++--
 apps/server/src/handlers/listInvitations.ts   |  2 +-
 apps/server/src/index.ts                      | 13 +++-
 .../src/accept-invitation.test.ts             | 60 ++++++++++++++++++
 .../src/accept-invitation.ts                  | 30 +++++++++
 .../src/apply-event.ts                        | 63 ++++++++++++++-----
 .../src/create-invitation.test.ts             | 45 ++++++++++++-
 .../src/create-invitation.ts                  |  4 +-
 .../src/create-space.ts                       |  4 +-
 .../src/delete-space.test.ts                  | 57 ++++++++++++++---
 .../graph-framework-space-events/src/index.ts |  1 +
 .../graph-framework-space-events/src/types.ts | 21 ++++++-
 16 files changed, 355 insertions(+), 45 deletions(-)
 create mode 100644 apps/server/prisma/migrations/20241116161206_extend_invitation/migration.sql
 create mode 100644 packages/graph-framework-space-events/src/accept-invitation.test.ts
 create mode 100644 packages/graph-framework-space-events/src/accept-invitation.ts

diff --git a/apps/events/src/components/debug-invitations.tsx b/apps/events/src/components/debug-invitations.tsx
index d940c611..8b262315 100644
--- a/apps/events/src/components/debug-invitations.tsx
+++ b/apps/events/src/components/debug-invitations.tsx
@@ -1,7 +1,12 @@
 import type { Invitation } from 'graph-framework';
 import { Button } from './ui/button';
 
-export function DebugInvitations({ invitations }: { invitations: Invitation[] }) {
+type Props = {
+  invitations: Invitation[];
+  accept: (invitation: Invitation) => void;
+};
+
+export function DebugInvitations({ invitations, accept }: Props) {
   return (
     <ul className="text-xs">
       {invitations.map((invitation) => {
@@ -10,7 +15,7 @@ export function DebugInvitations({ invitations }: { invitations: Invitation[] })
             <pre>{JSON.stringify(invitation, null, 2)}</pre>
             <Button
               onClick={() => {
-                alert('TODO');
+                accept(invitation);
               }}
             >
               Accept
diff --git a/apps/events/src/routes/playground.tsx b/apps/events/src/routes/playground.tsx
index eee6a573..209fa3eb 100644
--- a/apps/events/src/routes/playground.tsx
+++ b/apps/events/src/routes/playground.tsx
@@ -15,7 +15,7 @@ import type {
   SpaceEvent,
   SpaceState,
 } from 'graph-framework';
-import { ResponseMessage, applyEvent, createInvitation, createSpace } from 'graph-framework';
+import { ResponseMessage, acceptInvitation, applyEvent, createInvitation, createSpace } from 'graph-framework';
 import { useEffect, useState } from 'react';
 
 const availableAccounts = [
@@ -186,7 +186,27 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
         </Button>
       </div>
       <h2 className="text-lg">Invitations</h2>
-      <DebugInvitations invitations={invitations} />
+      <DebugInvitations
+        invitations={invitations}
+        accept={async (invitation) => {
+          const spaceEvent = await Effect.runPromiseExit(
+            acceptInvitation({
+              author: {
+                signaturePublicKey: accountId,
+                encryptionPublicKey: 'TODO',
+                signaturePrivateKey,
+              },
+              previousEventHash: invitation.previousEventHash,
+            }),
+          );
+          if (Exit.isFailure(spaceEvent)) {
+            console.error('Failed to accept invitation', spaceEvent);
+            return;
+          }
+          const message: EventMessage = { type: 'event', event: spaceEvent.value, spaceId: invitation.spaceId };
+          websocketConnection?.send(JSON.stringify(message));
+        }}
+      />
       <h2 className="text-lg">Spaces</h2>
       <ul>
         {spaces.map((space) => {
diff --git a/apps/server/prisma/migrations/20241116161206_extend_invitation/migration.sql b/apps/server/prisma/migrations/20241116161206_extend_invitation/migration.sql
new file mode 100644
index 00000000..a79b0fd8
--- /dev/null
+++ b/apps/server/prisma/migrations/20241116161206_extend_invitation/migration.sql
@@ -0,0 +1,24 @@
+/*
+  Warnings:
+
+  - Added the required column `inviteeAccountId` to the `Invitation` table without a default value. This is not possible if the table is not empty.
+
+*/
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_Invitation" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "spaceId" TEXT NOT NULL,
+    "accountId" TEXT NOT NULL,
+    "inviteeAccountId" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "Invitation_spaceId_fkey" FOREIGN KEY ("spaceId") REFERENCES "Space" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
+    CONSTRAINT "Invitation_accountId_fkey" FOREIGN KEY ("accountId") REFERENCES "Account" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+INSERT INTO "new_Invitation" ("accountId", "createdAt", "id", "spaceId") SELECT "accountId", "createdAt", "id", "spaceId" FROM "Invitation";
+DROP TABLE "Invitation";
+ALTER TABLE "new_Invitation" RENAME TO "Invitation";
+CREATE UNIQUE INDEX "Invitation_spaceId_inviteeAccountId_key" ON "Invitation"("spaceId", "inviteeAccountId");
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;
diff --git a/apps/server/prisma/schema.prisma b/apps/server/prisma/schema.prisma
index bd2a4ebe..7a0346c2 100644
--- a/apps/server/prisma/schema.prisma
+++ b/apps/server/prisma/schema.prisma
@@ -36,10 +36,13 @@ model Account {
 }
 
 model Invitation {
-  id        String   @id
-  space     Space    @relation(fields: [spaceId], references: [id])
-  spaceId   String
-  account   Account  @relation(fields: [accountId], references: [id])
-  accountId String
-  createdAt DateTime @default(now())
+  id               String   @id
+  space            Space    @relation(fields: [spaceId], references: [id])
+  spaceId          String
+  account          Account  @relation(fields: [accountId], references: [id])
+  accountId        String
+  inviteeAccountId String
+  createdAt        DateTime @default(now())
+
+  @@unique([spaceId, inviteeAccountId])
 }
diff --git a/apps/server/src/handlers/applySpaceEvent.ts b/apps/server/src/handlers/applySpaceEvent.ts
index 3a4fc542..80894e37 100644
--- a/apps/server/src/handlers/applySpaceEvent.ts
+++ b/apps/server/src/handlers/applySpaceEvent.ts
@@ -15,11 +15,18 @@ export async function applySpaceEvent({ accountId, spaceId, event }: Params) {
   }
 
   return await prisma.$transaction(async (transaction) => {
-    // verify that the account is a member of the space
-    // TODO verify that the account is a admin of the space
-    await transaction.space.findUniqueOrThrow({
-      where: { id: spaceId, members: { some: { id: accountId } } },
-    });
+    if (event.transaction.type === 'accept-invitation') {
+      // verify that the account is the invitee
+      await transaction.invitation.findFirstOrThrow({
+        where: { inviteeAccountId: event.author.publicKey },
+      });
+    } else {
+      // verify that the account is a member of the space
+      // TODO verify that the account is a admin of the space
+      await transaction.space.findUniqueOrThrow({
+        where: { id: spaceId, members: { some: { id: accountId } } },
+      });
+    }
 
     const lastEvent = await transaction.spaceEvent.findFirstOrThrow({
       where: { spaceId },
@@ -38,9 +45,20 @@ export async function applySpaceEvent({ accountId, spaceId, event }: Params) {
           id: event.transaction.id,
           spaceId,
           accountId: event.transaction.signaturePublicKey,
+          inviteeAccountId: event.transaction.signaturePublicKey,
         },
       });
     }
+    if (event.transaction.type === 'accept-invitation') {
+      await transaction.invitation.delete({
+        where: { spaceId_inviteeAccountId: { spaceId, inviteeAccountId: event.author.publicKey } },
+      });
+
+      await transaction.space.update({
+        where: { id: spaceId },
+        data: { members: { connect: { id: event.author.publicKey } } },
+      });
+    }
 
     return await transaction.spaceEvent.create({
       data: {
diff --git a/apps/server/src/handlers/listInvitations.ts b/apps/server/src/handlers/listInvitations.ts
index e4b17bf5..b4a65fb1 100644
--- a/apps/server/src/handlers/listInvitations.ts
+++ b/apps/server/src/handlers/listInvitations.ts
@@ -18,7 +18,7 @@ export const listInvitations = async ({ accountId }: Params) => {
         include: {
           events: {
             orderBy: {
-              counter: 'asc',
+              counter: 'desc',
             },
             take: 1,
           },
diff --git a/apps/server/src/index.ts b/apps/server/src/index.ts
index 5627da16..fab16532 100755
--- a/apps/server/src/index.ts
+++ b/apps/server/src/index.ts
@@ -1,11 +1,11 @@
 import cors from 'cors';
 import 'dotenv/config';
-import { parse } from 'node:url';
 import { Effect, Exit, Schema } from 'effect';
 import express from 'express';
 import type { ResponseListInvitations, ResponseListSpaces, ResponseSpace } from 'graph-framework-messages';
 import { RequestMessage } from 'graph-framework-messages';
 import { type CreateSpaceEvent, applyEvent } from 'graph-framework-space-events';
+import { parse } from 'node:url';
 import type WebSocket from 'ws';
 import { WebSocketServer } from 'ws';
 import { applySpaceEvent } from './handlers/applySpaceEvent.js';
@@ -106,6 +106,17 @@ webSocketServer.on('connection', async (webSocket: WebSocket, request: Request)
               webSocket.send(JSON.stringify(outgoingMessage));
               break;
             }
+            case 'accept-invitation': {
+              await applySpaceEvent({ accountId, spaceId: data.spaceId, event: data.event });
+              const spaceWithEvents = await getSpace({ accountId, spaceId: data.spaceId });
+              const outgoingMessage: ResponseSpace = {
+                type: 'space',
+                id: data.spaceId,
+                events: spaceWithEvents.events.map((wrapper) => JSON.parse(wrapper.event)),
+              };
+              webSocket.send(JSON.stringify(outgoingMessage));
+              break;
+            }
           }
           break;
         }
diff --git a/packages/graph-framework-space-events/src/accept-invitation.test.ts b/packages/graph-framework-space-events/src/accept-invitation.test.ts
new file mode 100644
index 00000000..73b2fdd7
--- /dev/null
+++ b/packages/graph-framework-space-events/src/accept-invitation.test.ts
@@ -0,0 +1,60 @@
+import { expect, it } from 'vitest';
+
+import { Effect } from 'effect';
+import { acceptInvitation } from './accept-invitation.js';
+import { applyEvent } from './apply-event.js';
+import { createInvitation } from './create-invitation.js';
+import { createSpace } from './create-space.js';
+
+const author = {
+  signaturePublicKey: '03594161eed61407084114a142d1ce05ef4c5a5279479fdd73a2b16944fbff003b',
+  signaturePrivateKey: '76b78f644c19d6133018a97a3bc2d5038be0af5a2858b9e640ff3e2f2db63a0b',
+  encryptionPublicKey: 'encryption',
+};
+
+const invitee = {
+  signaturePublicKey: '03bf5d2a1badf15387b08a007d1a9a13a9bfd6e1c56f681e251514d9ba10b57462',
+  signaturePrivateKey: '1eee32d3bc202dcb5d17c3b1454fb541d2290cb941860735408f1bfe39e7bc15',
+  encryptionPublicKey: 'encryption',
+};
+
+it('should accept an invitation', async () => {
+  const { state3 } = await Effect.runPromise(
+    Effect.gen(function* () {
+      const spaceEvent = yield* createSpace({ author });
+      const state = yield* applyEvent({ event: spaceEvent });
+      const spaceEvent2 = yield* createInvitation({
+        author,
+        previousEventHash: state.lastEventHash,
+        invitee,
+      });
+      const state2 = yield* applyEvent({ state, event: spaceEvent2 });
+      const spaceEvent3 = yield* acceptInvitation({
+        previousEventHash: state2.lastEventHash,
+        author: invitee,
+      });
+      const state3 = yield* applyEvent({ state: state2, event: spaceEvent3 });
+      return {
+        state3,
+        spaceEvent3,
+      };
+    }),
+  );
+
+  expect(state3.id).toBeTypeOf('string');
+  expect(state3.invitations).toEqual({});
+  expect(state3.members).toEqual({
+    [author.signaturePublicKey]: {
+      signaturePublicKey: author.signaturePublicKey,
+      encryptionPublicKey: author.encryptionPublicKey,
+      role: 'admin',
+    },
+    [invitee.signaturePublicKey]: {
+      signaturePublicKey: invitee.signaturePublicKey,
+      encryptionPublicKey: invitee.encryptionPublicKey,
+      role: 'member',
+    },
+  });
+  expect(state3.removedMembers).toEqual({});
+  expect(state3.lastEventHash).toBeTypeOf('string');
+});
diff --git a/packages/graph-framework-space-events/src/accept-invitation.ts b/packages/graph-framework-space-events/src/accept-invitation.ts
new file mode 100644
index 00000000..49d80758
--- /dev/null
+++ b/packages/graph-framework-space-events/src/accept-invitation.ts
@@ -0,0 +1,30 @@
+import { secp256k1 } from '@noble/curves/secp256k1';
+import { Effect } from 'effect';
+import { canonicalize, generateId, stringToUint8Array } from 'graph-framework-utils';
+import type { AcceptInvitationEvent, Author } from './types.js';
+
+type Params = {
+  author: Author;
+  previousEventHash: string;
+};
+
+export const acceptInvitation = ({
+  author,
+  previousEventHash,
+}: Params): Effect.Effect<AcceptInvitationEvent, undefined> => {
+  const transaction = {
+    id: generateId(),
+    type: 'accept-invitation' as const,
+    previousEventHash,
+  };
+  const encodedTransaction = stringToUint8Array(canonicalize(transaction));
+  const signature = secp256k1.sign(encodedTransaction, author.signaturePrivateKey, { prehash: true }).toCompactHex();
+
+  return Effect.succeed({
+    transaction,
+    author: {
+      publicKey: author.signaturePublicKey,
+      signature,
+    },
+  });
+};
diff --git a/packages/graph-framework-space-events/src/apply-event.ts b/packages/graph-framework-space-events/src/apply-event.ts
index df2310d0..618f9627 100644
--- a/packages/graph-framework-space-events/src/apply-event.ts
+++ b/packages/graph-framework-space-events/src/apply-event.ts
@@ -34,11 +34,13 @@ export const applyEvent = ({
       return Effect.fail(new InvalidEventError());
     }
     if (event.transaction.previousEventHash !== state.lastEventHash) {
+      console.log('WEEEEE', event.transaction.previousEventHash, state.lastEventHash);
       return Effect.fail(new InvalidEventError());
     }
   }
 
   const encodedTransaction = stringToUint8Array(canonicalize(event.transaction));
+
   const isValidSignature = secp256k1.verify(event.author.signature, encodedTransaction, event.author.publicKey, {
     prehash: true,
   });
@@ -65,27 +67,58 @@ export const applyEvent = ({
     removedMembers = { ...state.removedMembers };
     invitations = { ...state.invitations };
 
-    if (event.transaction.type === 'delete-space') {
-      removedMembers = { ...members };
-      members = {};
-      invitations = {};
-    } else if (event.transaction.type === 'create-invitation') {
-      if (members[event.transaction.signaturePublicKey] !== undefined) {
+    if (event.transaction.type === 'accept-invitation') {
+      // is already a member
+      if (members[event.author.publicKey] !== undefined) {
         return Effect.fail(new InvalidEventError());
       }
-      for (const invitation of Object.values(invitations)) {
-        if (invitation.signaturePublicKey === event.transaction.signaturePublicKey) {
-          return Effect.fail(new InvalidEventError());
-        }
+
+      // find the invitation
+      const result = Object.entries(invitations).find(
+        ([, invitation]) => invitation.signaturePublicKey === event.author.publicKey,
+      );
+      if (!result) {
+        return Effect.fail(new InvalidEventError());
       }
+      const [id, invitation] = result;
 
-      invitations[event.transaction.id] = {
-        signaturePublicKey: event.transaction.signaturePublicKey,
-        encryptionPublicKey: event.transaction.encryptionPublicKey,
+      members[event.author.publicKey] = {
+        signaturePublicKey: event.author.publicKey,
+        encryptionPublicKey: invitation.encryptionPublicKey,
+        role: 'member',
       };
+      delete invitations[id];
+      if (removedMembers[event.author.publicKey] !== undefined) {
+        delete removedMembers[event.author.publicKey];
+      }
+    } else {
+      // check if the author is an admin
+      if (members[event.author.publicKey]?.role !== 'admin') {
+        return Effect.fail(new InvalidEventError());
+      }
+
+      if (event.transaction.type === 'delete-space') {
+        removedMembers = { ...members };
+        members = {};
+        invitations = {};
+      } else if (event.transaction.type === 'create-invitation') {
+        if (members[event.transaction.signaturePublicKey] !== undefined) {
+          return Effect.fail(new InvalidEventError());
+        }
+        for (const invitation of Object.values(invitations)) {
+          if (invitation.signaturePublicKey === event.transaction.signaturePublicKey) {
+            return Effect.fail(new InvalidEventError());
+          }
+        }
+
+        invitations[event.transaction.id] = {
+          signaturePublicKey: event.transaction.signaturePublicKey,
+          encryptionPublicKey: event.transaction.encryptionPublicKey,
+        };
+      } else {
+        throw new Error('State is required for all events except create-space');
+      }
     }
-  } else {
-    throw new Error('State is required for all events except create-space');
   }
 
   return Effect.succeed({
diff --git a/packages/graph-framework-space-events/src/create-invitation.test.ts b/packages/graph-framework-space-events/src/create-invitation.test.ts
index 07e1760d..84feb9c1 100644
--- a/packages/graph-framework-space-events/src/create-invitation.test.ts
+++ b/packages/graph-framework-space-events/src/create-invitation.test.ts
@@ -1,9 +1,11 @@
 import { expect, it } from 'vitest';
 
-import { Effect, Exit } from 'effect';
+import { Cause, Effect, Exit } from 'effect';
+import { acceptInvitation } from './accept-invitation.js';
 import { applyEvent } from './apply-event.js';
 import { createInvitation } from './create-invitation.js';
 import { createSpace } from './create-space.js';
+import { InvalidEventError } from './types.js';
 
 const author = {
   signaturePublicKey: '03594161eed61407084114a142d1ce05ef4c5a5279479fdd73a2b16944fbff003b',
@@ -17,6 +19,12 @@ const invitee = {
   encryptionPublicKey: 'encryption',
 };
 
+const invitee2 = {
+  signaturePublicKey: '0351460706cf386282d9b6ebee2ccdcb9ba61194fd024345e53037f3036242e6a2',
+  signaturePrivateKey: '434518a2c9a665a7c20da086232c818b6c1592e2edfeecab29a40cf5925ca8fe',
+  encryptionPublicKey: 'encryption',
+};
+
 it('should create an invitation', async () => {
   const { spaceEvent2, state2 } = await Effect.runPromise(
     Effect.gen(function* () {
@@ -37,6 +45,7 @@ it('should create an invitation', async () => {
 
   expect(state2.id).toBeTypeOf('string');
   expect(state2.invitations).toEqual({
+    // @ts-expect-error
     [spaceEvent2.transaction.id]: {
       signaturePublicKey: '03bf5d2a1badf15387b08a007d1a9a13a9bfd6e1c56f681e251514d9ba10b57462',
       encryptionPublicKey: 'encryption',
@@ -92,3 +101,37 @@ it('should fail to invite an account that is already a member', async () => {
 
   expect(Exit.isFailure(result)).toBe(true);
 });
+
+it('should fail in case the author is not an admin', async () => {
+  const result = await Effect.runPromiseExit(
+    Effect.gen(function* () {
+      const spaceEvent = yield* createSpace({ author });
+      const state = yield* applyEvent({ event: spaceEvent });
+      const spaceEvent2 = yield* createInvitation({
+        author,
+        previousEventHash: state.lastEventHash,
+        invitee,
+      });
+      const state2 = yield* applyEvent({ state, event: spaceEvent2 });
+      const spaceEvent3 = yield* acceptInvitation({
+        previousEventHash: state2.lastEventHash,
+        author: invitee,
+      });
+      const state3 = yield* applyEvent({ state: state2, event: spaceEvent3 });
+      const spaceEvent4 = yield* createInvitation({
+        author: invitee,
+        previousEventHash: state.lastEventHash,
+        invitee: invitee2,
+      });
+      yield* applyEvent({ state: state3, event: spaceEvent4 });
+    }),
+  );
+
+  expect(Exit.isFailure(result)).toBe(true);
+  if (Exit.isFailure(result)) {
+    const cause = result.cause;
+    if (Cause.isFailType(cause)) {
+      expect(cause.error).toBeInstanceOf(InvalidEventError);
+    }
+  }
+});
diff --git a/packages/graph-framework-space-events/src/create-invitation.ts b/packages/graph-framework-space-events/src/create-invitation.ts
index 8f59ae38..60b36499 100644
--- a/packages/graph-framework-space-events/src/create-invitation.ts
+++ b/packages/graph-framework-space-events/src/create-invitation.ts
@@ -1,7 +1,7 @@
 import { secp256k1 } from '@noble/curves/secp256k1';
 import { Effect } from 'effect';
 import { canonicalize, generateId, stringToUint8Array } from 'graph-framework-utils';
-import type { Author, SpaceEvent } from './types.js';
+import type { Author, CreateInvitationEvent } from './types.js';
 
 type Params = {
   author: Author;
@@ -16,7 +16,7 @@ export const createInvitation = ({
   author,
   previousEventHash,
   invitee,
-}: Params): Effect.Effect<SpaceEvent, undefined> => {
+}: Params): Effect.Effect<CreateInvitationEvent, undefined> => {
   const transaction = {
     id: generateId(),
     type: 'create-invitation' as const,
diff --git a/packages/graph-framework-space-events/src/create-space.ts b/packages/graph-framework-space-events/src/create-space.ts
index e46b1469..49c97b83 100644
--- a/packages/graph-framework-space-events/src/create-space.ts
+++ b/packages/graph-framework-space-events/src/create-space.ts
@@ -1,13 +1,13 @@
 import { secp256k1 } from '@noble/curves/secp256k1';
 import { Effect } from 'effect';
 import { canonicalize, generateId, stringToUint8Array } from 'graph-framework-utils';
-import type { Author, CreateSpaceEvent, SpaceEvent } from './types.js';
+import type { Author, CreateSpaceEvent } from './types.js';
 
 type Params = {
   author: Author;
 };
 
-export const createSpace = ({ author }: Params): Effect.Effect<SpaceEvent, undefined> => {
+export const createSpace = ({ author }: Params): Effect.Effect<CreateSpaceEvent, undefined> => {
   const transaction = {
     type: 'create-space' as const,
     id: generateId(),
diff --git a/packages/graph-framework-space-events/src/delete-space.test.ts b/packages/graph-framework-space-events/src/delete-space.test.ts
index 2c822a64..73aa6a92 100644
--- a/packages/graph-framework-space-events/src/delete-space.test.ts
+++ b/packages/graph-framework-space-events/src/delete-space.test.ts
@@ -1,16 +1,25 @@
-import { Effect } from 'effect';
+import { Cause, Effect, Exit } from 'effect';
 import { expect, it } from 'vitest';
+import { acceptInvitation } from './accept-invitation.js';
 import { applyEvent } from './apply-event.js';
+import { createInvitation } from './create-invitation.js';
 import { createSpace } from './create-space.js';
 import { deleteSpace } from './delete-space.js';
+import { InvalidEventError } from './types.js';
 
-it('should delete a space', async () => {
-  const author = {
-    signaturePublicKey: '03594161eed61407084114a142d1ce05ef4c5a5279479fdd73a2b16944fbff003b',
-    signaturePrivateKey: '76b78f644c19d6133018a97a3bc2d5038be0af5a2858b9e640ff3e2f2db63a0b',
-    encryptionPublicKey: 'encryption',
-  };
+const author = {
+  signaturePublicKey: '03594161eed61407084114a142d1ce05ef4c5a5279479fdd73a2b16944fbff003b',
+  signaturePrivateKey: '76b78f644c19d6133018a97a3bc2d5038be0af5a2858b9e640ff3e2f2db63a0b',
+  encryptionPublicKey: 'encryption',
+};
+
+const invitee = {
+  signaturePublicKey: '03bf5d2a1badf15387b08a007d1a9a13a9bfd6e1c56f681e251514d9ba10b57462',
+  signaturePrivateKey: '1eee32d3bc202dcb5d17c3b1454fb541d2290cb941860735408f1bfe39e7bc15',
+  encryptionPublicKey: 'encryption',
+};
 
+it('should delete a space', async () => {
   const state = await Effect.runPromise(
     Effect.gen(function* () {
       const spaceEvent = yield* createSpace({ author });
@@ -32,3 +41,37 @@ it('should delete a space', async () => {
   });
   expect(state.lastEventHash).toBeTypeOf('string');
 });
+
+it('should fail in case the author is not an admin', async () => {
+  const result = await Effect.runPromiseExit(
+    Effect.gen(function* () {
+      const spaceEvent = yield* createSpace({ author });
+      const state = yield* applyEvent({ event: spaceEvent });
+      const spaceEvent2 = yield* createInvitation({
+        author,
+        previousEventHash: state.lastEventHash,
+        invitee,
+      });
+      const state2 = yield* applyEvent({ state, event: spaceEvent2 });
+      const spaceEvent3 = yield* acceptInvitation({
+        previousEventHash: state2.lastEventHash,
+        author: invitee,
+      });
+      const state3 = yield* applyEvent({ state: state2, event: spaceEvent3 });
+      const spaceEvent4 = yield* deleteSpace({
+        author: invitee,
+        previousEventHash: state.lastEventHash,
+        id: state.id,
+      });
+      yield* applyEvent({ state: state3, event: spaceEvent4 });
+    }),
+  );
+
+  expect(Exit.isFailure(result)).toBe(true);
+  if (Exit.isFailure(result)) {
+    const cause = result.cause;
+    if (Cause.isFailType(cause)) {
+      expect(cause.error).toBeInstanceOf(InvalidEventError);
+    }
+  }
+});
diff --git a/packages/graph-framework-space-events/src/index.ts b/packages/graph-framework-space-events/src/index.ts
index f3e2c4ca..5e3167aa 100644
--- a/packages/graph-framework-space-events/src/index.ts
+++ b/packages/graph-framework-space-events/src/index.ts
@@ -1,3 +1,4 @@
+export * from './accept-invitation.js';
 export * from './apply-event.js';
 export * from './create-invitation.js';
 export * from './create-space.js';
diff --git a/packages/graph-framework-space-events/src/types.ts b/packages/graph-framework-space-events/src/types.ts
index 2b5000f6..001ca548 100644
--- a/packages/graph-framework-space-events/src/types.ts
+++ b/packages/graph-framework-space-events/src/types.ts
@@ -72,7 +72,26 @@ export const CreateInvitationEvent = Schema.Struct({
 
 export type CreateInvitationEvent = Schema.Schema.Type<typeof CreateInvitationEvent>;
 
-export const SpaceEvent = Schema.Union(CreateSpaceEvent, DeleteSpaceEvent, CreateInvitationEvent);
+export const AcceptInvitationEvent = Schema.Struct({
+  transaction: Schema.Struct({
+    id: Schema.String,
+    type: Schema.Literal('accept-invitation'),
+    previousEventHash: Schema.String,
+  }),
+  author: Schema.Struct({
+    publicKey: Schema.String,
+    signature: Schema.String,
+  }),
+});
+
+export type AcceptInvitationEvent = Schema.Schema.Type<typeof AcceptInvitationEvent>;
+
+export const SpaceEvent = Schema.Union(
+  CreateSpaceEvent,
+  DeleteSpaceEvent,
+  CreateInvitationEvent,
+  AcceptInvitationEvent,
+);
 
 export type SpaceEvent = Schema.Schema.Type<typeof SpaceEvent>;
 

From a730fdc644b1f16a94c2381a4f2445904b447c64 Mon Sep 17 00:00:00 2001
From: Nik Graf <nik@nikgraf.com>
Date: Sun, 17 Nov 2024 20:38:35 +0100
Subject: [PATCH 2/2] add space key

---
 apps/events/src/routes/playground.tsx         | 119 ++++++++-
 .../20241117202441_add_key/migration.sql      |  20 ++
 apps/server/prisma/schema.prisma              |  24 +-
 apps/server/src/handlers/applySpaceEvent.ts   |  17 +-
 apps/server/src/handlers/createSpace.ts       |  19 +-
 apps/server/src/handlers/getSpace.ts          |  32 ++-
 apps/server/src/index.ts                      |  67 ++---
 packages/graph-framework-key/README.md        |   3 +
 packages/graph-framework-key/package.json     |  31 +++
 .../graph-framework-key/src/create-key.ts     |  27 ++
 .../graph-framework-key/src/decrypt-key.ts    |  19 ++
 .../graph-framework-key/src/encrypt-key.ts    |  27 ++
 packages/graph-framework-key/src/index.ts     |   4 +
 .../graph-framework-key/src/key-box.test.ts   | 213 ++++++++++++++++
 packages/graph-framework-key/src/key-box.ts   |  66 +++++
 packages/graph-framework-key/src/key.test.ts  | 235 ++++++++++++++++++
 .../graph-framework-key/tsconfig.build.json   |   9 +
 packages/graph-framework-key/tsconfig.json    |   9 +
 packages/graph-framework-key/vite.config.mts  |  24 ++
 .../graph-framework-messages/package.json     |   2 +
 .../graph-framework-messages/src/types.ts     |  48 +++-
 .../src/create-invitation.test.ts             |   1 -
 packages/graph-framework/package.json         |   3 +-
 packages/graph-framework/src/index.tsx        |   1 +
 pnpm-lock.yaml                                |  34 +++
 25 files changed, 1000 insertions(+), 54 deletions(-)
 create mode 100644 apps/server/prisma/migrations/20241117202441_add_key/migration.sql
 create mode 100644 packages/graph-framework-key/README.md
 create mode 100644 packages/graph-framework-key/package.json
 create mode 100644 packages/graph-framework-key/src/create-key.ts
 create mode 100644 packages/graph-framework-key/src/decrypt-key.ts
 create mode 100644 packages/graph-framework-key/src/encrypt-key.ts
 create mode 100644 packages/graph-framework-key/src/index.ts
 create mode 100644 packages/graph-framework-key/src/key-box.test.ts
 create mode 100644 packages/graph-framework-key/src/key-box.ts
 create mode 100644 packages/graph-framework-key/src/key.test.ts
 create mode 100644 packages/graph-framework-key/tsconfig.build.json
 create mode 100644 packages/graph-framework-key/tsconfig.json
 create mode 100644 packages/graph-framework-key/vite.config.mts

diff --git a/apps/events/src/routes/playground.tsx b/apps/events/src/routes/playground.tsx
index 209fa3eb..23594040 100644
--- a/apps/events/src/routes/playground.tsx
+++ b/apps/events/src/routes/playground.tsx
@@ -3,33 +3,52 @@ import { DebugSpaceEvents } from '@/components/debug-space-events';
 import { DebugSpaceState } from '@/components/debug-space-state';
 import { Button } from '@/components/ui/button';
 import { assertExhaustive } from '@/lib/assertExhaustive';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
 import { createFileRoute } from '@tanstack/react-router';
 import { Effect, Exit } from 'effect';
 import * as Schema from 'effect/Schema';
 import type {
   EventMessage,
   Invitation,
+  RequestCreateInvitationEvent,
+  RequestCreateSpaceEvent,
   RequestListInvitations,
   RequestListSpaces,
   RequestSubscribeToSpace,
   SpaceEvent,
   SpaceState,
 } from 'graph-framework';
-import { ResponseMessage, acceptInvitation, applyEvent, createInvitation, createSpace } from 'graph-framework';
+import {
+  ResponseMessage,
+  acceptInvitation,
+  applyEvent,
+  createInvitation,
+  createKey,
+  createSpace,
+  decryptKey,
+  encryptKey,
+  generateId,
+} from 'graph-framework';
 import { useEffect, useState } from 'react';
 
 const availableAccounts = [
   {
     accountId: '0262701b2eb1b6b37ad03e24445dfcad1b91309199e43017b657ce2604417c12f5',
     signaturePrivateKey: '88bb6f20de8dc1787c722dc847f4cf3d00285b8955445f23c483d1237fe85366',
+    encryptionPrivateKey: 'bbf164a93b0f78a85346017fa2673cf367c64d81b1c3d6af7ad45e308107a812',
+    encryptionPublicKey: '595e1a6b0bb346d83bc382998943d2e6d9210fd341bc8b9f41a7229eede27240',
   },
   {
     accountId: '03bf5d2a1badf15387b08a007d1a9a13a9bfd6e1c56f681e251514d9ba10b57462',
     signaturePrivateKey: '1eee32d3bc202dcb5d17c3b1454fb541d2290cb941860735408f1bfe39e7bc15',
+    encryptionPrivateKey: 'b32478dc6f40482127a09d0f1cabbf45dc83ebce638d6246f5552191009fda2c',
+    encryptionPublicKey: '0f4e22dc85167597af85cba85988770cd77c25d317f2b14a1f49a54efcbfae3f',
   },
   {
     accountId: '0351460706cf386282d9b6ebee2ccdcb9ba61194fd024345e53037f3036242e6a2',
     signaturePrivateKey: '434518a2c9a665a7c20da086232c818b6c1592e2edfeecab29a40cf5925ca8fe',
+    encryptionPrivateKey: 'aaf71397e44fc57b42eaad5b0869d1e0247b4a7f2fe9ec5cc00dec3815849e7a',
+    encryptionPublicKey: 'd494144358a610604c4ab453b442d014f2843772eed19be155dd9fc55fe8a332',
   },
 ];
 
@@ -37,6 +56,7 @@ type SpaceStorageEntry = {
   id: string;
   events: SpaceEvent[];
   state: SpaceState | undefined;
+  keys: { id: string; key: string }[];
 };
 
 const decodeResponseMessage = Schema.decodeUnknownEither(ResponseMessage);
@@ -45,7 +65,17 @@ export const Route = createFileRoute('/playground')({
   component: () => <ChooseAccount />,
 });
 
-const App = ({ accountId, signaturePrivateKey }: { accountId: string; signaturePrivateKey: string }) => {
+const App = ({
+  accountId,
+  signaturePrivateKey,
+  encryptionPublicKey,
+  encryptionPrivateKey,
+}: {
+  accountId: string;
+  signaturePrivateKey: string;
+  encryptionPrivateKey: string;
+  encryptionPublicKey: string;
+}) => {
   const [websocketConnection, setWebsocketConnection] = useState<WebSocket>();
   const [spaces, setSpaces] = useState<SpaceStorageEntry[]>([]);
   const [invitations, setInvitations] = useState<Invitation[]>([]);
@@ -66,7 +96,12 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
             setSpaces((existingSpaces) => {
               return response.spaces.map((space) => {
                 const existingSpace = existingSpaces.find((s) => s.id === space.id);
-                return { id: space.id, events: existingSpace?.events ?? [], state: existingSpace?.state };
+                return {
+                  id: space.id,
+                  events: existingSpace?.events ?? [],
+                  state: existingSpace?.state,
+                  keys: existingSpace?.keys ?? [],
+                };
               });
             });
             // fetch all spaces (for debugging purposes)
@@ -96,11 +131,26 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
 
             const newState = state as SpaceState;
 
+            const keys = response.keyBoxes.map((keyBox) => {
+              const key = decryptKey({
+                keyBoxCiphertext: hexToBytes(keyBox.ciphertext),
+                keyBoxNonce: hexToBytes(keyBox.nonce),
+                publicKey: hexToBytes(keyBox.authorPublicKey),
+                privateKey: hexToBytes(encryptionPrivateKey),
+              });
+              return { id: keyBox.id, key: bytesToHex(key) };
+            });
+
             setSpaces((spaces) =>
               spaces.map((space) => {
                 if (space.id === response.id) {
                   // TODO fix readonly type issue
-                  return { ...space, events: response.events as SpaceEvent[], state: newState };
+                  return {
+                    ...space,
+                    events: response.events as SpaceEvent[],
+                    state: newState,
+                    keys,
+                  };
                 }
                 return space;
               }),
@@ -144,7 +194,7 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
       websocketConnection.removeEventListener('close', onClose);
       websocketConnection.close();
     };
-  }, [accountId]);
+  }, [accountId, encryptionPrivateKey]);
 
   return (
     <>
@@ -154,13 +204,28 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
             const spaceEvent = await Effect.runPromise(
               createSpace({
                 author: {
-                  encryptionPublicKey: 'TODO',
+                  encryptionPublicKey,
                   signaturePrivateKey,
                   signaturePublicKey: accountId,
                 },
               }),
             );
-            const message: EventMessage = { type: 'event', event: spaceEvent, spaceId: spaceEvent.transaction.id };
+            const result = createKey({
+              privateKey: hexToBytes(encryptionPrivateKey),
+              publicKey: hexToBytes(encryptionPublicKey),
+            });
+            const message: RequestCreateSpaceEvent = {
+              type: 'create-space-event',
+              event: spaceEvent,
+              spaceId: spaceEvent.transaction.id,
+              keyId: generateId(),
+              keyBox: {
+                accountId,
+                ciphertext: bytesToHex(result.keyBoxCiphertext),
+                nonce: bytesToHex(result.keyBoxNonce),
+                authorPublicKey: encryptionPublicKey,
+              },
+            };
             websocketConnection?.send(JSON.stringify(message));
           }}
         >
@@ -193,7 +258,7 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
             acceptInvitation({
               author: {
                 signaturePublicKey: accountId,
-                encryptionPublicKey: 'TODO',
+                encryptionPublicKey,
                 signaturePrivateKey,
               },
               previousEventHash: invitation.previousEventHash,
@@ -213,6 +278,8 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
           return (
             <li key={space.id}>
               <h3>Space id: {space.id}</h3>
+              <p>Keys:</p>
+              <pre className="text-xs">{JSON.stringify(space.keys)}</pre>
               <Button
                 onClick={() => {
                   const message: RequestSubscribeToSpace = { type: 'subscribe-space', id: space.id };
@@ -235,13 +302,13 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
                         createInvitation({
                           author: {
                             signaturePublicKey: accountId,
-                            encryptionPublicKey: 'TODO',
+                            encryptionPublicKey,
                             signaturePrivateKey,
                           },
                           previousEventHash: space.state.lastEventHash,
                           invitee: {
                             signaturePublicKey: invitee.accountId,
-                            encryptionPublicKey: 'TODO',
+                            encryptionPublicKey,
                           },
                         }),
                       );
@@ -249,7 +316,28 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
                         console.error('Failed to create invitation', spaceEvent);
                         return;
                       }
-                      const message: EventMessage = { type: 'event', event: spaceEvent.value, spaceId: space.id };
+
+                      const keyBoxes = space.keys.map((key) => {
+                        const keyBox = encryptKey({
+                          key: hexToBytes(key.key),
+                          publicKey: hexToBytes(invitee.encryptionPublicKey),
+                          privateKey: hexToBytes(encryptionPrivateKey),
+                        });
+                        return {
+                          id: key.id,
+                          ciphertext: bytesToHex(keyBox.keyBoxCiphertext),
+                          nonce: bytesToHex(keyBox.keyBoxNonce),
+                          authorPublicKey: encryptionPublicKey,
+                          accountId: invitee.accountId,
+                        };
+                      });
+
+                      const message: RequestCreateInvitationEvent = {
+                        type: 'create-invitation-event',
+                        event: spaceEvent.value,
+                        spaceId: space.id,
+                        keyBoxes,
+                      };
                       websocketConnection?.send(JSON.stringify(message));
                     }}
                   >
@@ -271,7 +359,12 @@ const App = ({ accountId, signaturePrivateKey }: { accountId: string; signatureP
 };
 
 export const ChooseAccount = () => {
-  const [account, setAccount] = useState<{ accountId: string; signaturePrivateKey: string } | null>();
+  const [account, setAccount] = useState<{
+    accountId: string;
+    signaturePrivateKey: string;
+    encryptionPrivateKey: string;
+    encryptionPublicKey: string;
+  } | null>();
 
   return (
     <div>
@@ -305,6 +398,8 @@ export const ChooseAccount = () => {
           key={account.accountId}
           accountId={account.accountId}
           signaturePrivateKey={account.signaturePrivateKey}
+          encryptionPrivateKey={account.encryptionPrivateKey}
+          encryptionPublicKey={account.encryptionPublicKey}
         />
       )}
     </div>
diff --git a/apps/server/prisma/migrations/20241117202441_add_key/migration.sql b/apps/server/prisma/migrations/20241117202441_add_key/migration.sql
new file mode 100644
index 00000000..9ec5e0a2
--- /dev/null
+++ b/apps/server/prisma/migrations/20241117202441_add_key/migration.sql
@@ -0,0 +1,20 @@
+-- CreateTable
+CREATE TABLE "SpaceKey" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "spaceId" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "SpaceKey_spaceId_fkey" FOREIGN KEY ("spaceId") REFERENCES "Space" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "SpaceKeyBox" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "spaceKeyId" TEXT NOT NULL,
+    "accountId" TEXT NOT NULL,
+    "ciphertext" TEXT NOT NULL,
+    "nonce" TEXT NOT NULL,
+    "authorPublicKey" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "SpaceKeyBox_spaceKeyId_fkey" FOREIGN KEY ("spaceKeyId") REFERENCES "SpaceKey" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
+    CONSTRAINT "SpaceKeyBox_accountId_fkey" FOREIGN KEY ("accountId") REFERENCES "Account" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
diff --git a/apps/server/prisma/schema.prisma b/apps/server/prisma/schema.prisma
index 7a0346c2..e0cea4ad 100644
--- a/apps/server/prisma/schema.prisma
+++ b/apps/server/prisma/schema.prisma
@@ -27,12 +27,34 @@ model Space {
   events      SpaceEvent[]
   members     Account[]
   invitations Invitation[]
+  keys        SpaceKey[]
+}
+
+model SpaceKey {
+  id        String        @id
+  space     Space         @relation(fields: [spaceId], references: [id])
+  spaceId   String
+  createdAt DateTime      @default(now())
+  keyBoxes  SpaceKeyBox[]
+}
+
+model SpaceKeyBox {
+  id              String   @id
+  spaceKey        SpaceKey @relation(fields: [spaceKeyId], references: [id])
+  spaceKeyId      String
+  account         Account  @relation(fields: [accountId], references: [id])
+  accountId       String
+  ciphertext      String
+  nonce           String
+  authorPublicKey String
+  createdAt       DateTime @default(now())
 }
 
 model Account {
-  id          String       @id
+  id          String        @id
   spaces      Space[]
   invitations Invitation[]
+  keyBoxes    SpaceKeyBox[]
 }
 
 model Invitation {
diff --git a/apps/server/src/handlers/applySpaceEvent.ts b/apps/server/src/handlers/applySpaceEvent.ts
index 80894e37..ee466ef0 100644
--- a/apps/server/src/handlers/applySpaceEvent.ts
+++ b/apps/server/src/handlers/applySpaceEvent.ts
@@ -1,4 +1,5 @@
 import { Effect, Exit } from 'effect';
+import type { KeyBoxWithKeyId } from 'graph-framework-messages';
 import type { SpaceEvent } from 'graph-framework-space-events';
 import { applyEvent } from 'graph-framework-space-events';
 import { prisma } from '../prisma.js';
@@ -7,9 +8,10 @@ type Params = {
   accountId: string;
   spaceId: string;
   event: SpaceEvent;
+  keyBoxes: KeyBoxWithKeyId[];
 };
 
-export async function applySpaceEvent({ accountId, spaceId, event }: Params) {
+export async function applySpaceEvent({ accountId, spaceId, event, keyBoxes }: Params) {
   if (event.transaction.type === 'create-space') {
     throw new Error('applySpaceEvent does not support create-space events.');
   }
@@ -40,14 +42,25 @@ export async function applySpaceEvent({ accountId, spaceId, event }: Params) {
     }
 
     if (event.transaction.type === 'create-invitation') {
+      const inviteeAccountId = event.transaction.signaturePublicKey;
       await transaction.invitation.create({
         data: {
           id: event.transaction.id,
           spaceId,
           accountId: event.transaction.signaturePublicKey,
-          inviteeAccountId: event.transaction.signaturePublicKey,
+          inviteeAccountId,
         },
       });
+      await transaction.spaceKeyBox.createMany({
+        data: keyBoxes.map((keyBox) => ({
+          id: `${keyBox.id}-${inviteeAccountId}`,
+          nonce: keyBox.nonce,
+          ciphertext: keyBox.ciphertext,
+          accountId: inviteeAccountId,
+          authorPublicKey: keyBox.authorPublicKey,
+          spaceKeyId: keyBox.id,
+        })),
+      });
     }
     if (event.transaction.type === 'accept-invitation') {
       await transaction.invitation.delete({
diff --git a/apps/server/src/handlers/createSpace.ts b/apps/server/src/handlers/createSpace.ts
index b0f0b847..6acf6223 100644
--- a/apps/server/src/handlers/createSpace.ts
+++ b/apps/server/src/handlers/createSpace.ts
@@ -1,13 +1,16 @@
 import { Effect, Exit } from 'effect';
+import type { KeyBox } from 'graph-framework-messages';
 import { type CreateSpaceEvent, applyEvent } from 'graph-framework-space-events';
 import { prisma } from '../prisma.js';
 
 type Params = {
   accountId: string;
   event: CreateSpaceEvent;
+  keyBox: KeyBox;
+  keyId: string;
 };
 
-export const createSpace = async ({ accountId, event }: Params) => {
+export const createSpace = async ({ accountId, event, keyBox, keyId }: Params) => {
   const result = await Effect.runPromiseExit(applyEvent({ event }));
   if (Exit.isFailure(result)) {
     throw new Error('Invalid event');
@@ -27,6 +30,20 @@ export const createSpace = async ({ accountId, event }: Params) => {
               id: accountId,
             },
           },
+          keys: {
+            create: {
+              id: keyId,
+              keyBoxes: {
+                create: {
+                  id: `${keyId}-${accountId}`,
+                  nonce: keyBox.nonce,
+                  ciphertext: keyBox.ciphertext,
+                  accountId: accountId,
+                  authorPublicKey: keyBox.authorPublicKey,
+                },
+              },
+            },
+          },
         },
       },
     },
diff --git a/apps/server/src/handlers/getSpace.ts b/apps/server/src/handlers/getSpace.ts
index b0edd025..9ed63271 100644
--- a/apps/server/src/handlers/getSpace.ts
+++ b/apps/server/src/handlers/getSpace.ts
@@ -6,7 +6,7 @@ type Params = {
 };
 
 export const getSpace = async ({ spaceId, accountId }: Params) => {
-  return await prisma.space.findUniqueOrThrow({
+  const space = await prisma.space.findUniqueOrThrow({
     where: {
       id: spaceId,
       members: {
@@ -21,6 +21,36 @@ export const getSpace = async ({ spaceId, accountId }: Params) => {
           counter: 'asc',
         },
       },
+      keys: {
+        include: {
+          keyBoxes: {
+            where: {
+              accountId,
+            },
+            select: {
+              nonce: true,
+              ciphertext: true,
+              authorPublicKey: true,
+            },
+          },
+        },
+      },
     },
   });
+
+  const keyBoxes = space.keys.flatMap((key) => {
+    return {
+      id: key.id,
+      nonce: key.keyBoxes[0].nonce,
+      ciphertext: key.keyBoxes[0].ciphertext,
+      accountId,
+      authorPublicKey: key.keyBoxes[0].authorPublicKey,
+    };
+  });
+
+  return {
+    id: space.id,
+    events: space.events.map((wrapper) => JSON.parse(wrapper.event)),
+    keyBoxes,
+  };
 };
diff --git a/apps/server/src/index.ts b/apps/server/src/index.ts
index fab16532..5f4b9355 100755
--- a/apps/server/src/index.ts
+++ b/apps/server/src/index.ts
@@ -1,11 +1,11 @@
 import cors from 'cors';
 import 'dotenv/config';
+import { parse } from 'node:url';
 import { Effect, Exit, Schema } from 'effect';
 import express from 'express';
 import type { ResponseListInvitations, ResponseListSpaces, ResponseSpace } from 'graph-framework-messages';
 import { RequestMessage } from 'graph-framework-messages';
-import { type CreateSpaceEvent, applyEvent } from 'graph-framework-space-events';
-import { parse } from 'node:url';
+import { applyEvent } from 'graph-framework-space-events';
 import type WebSocket from 'ws';
 import { WebSocketServer } from 'ws';
 import { applySpaceEvent } from './handlers/applySpaceEvent.js';
@@ -56,9 +56,8 @@ webSocketServer.on('connection', async (webSocket: WebSocket, request: Request)
         case 'subscribe-space': {
           const space = await getSpace({ accountId, spaceId: data.id });
           const outgoingMessage: ResponseSpace = {
+            ...space,
             type: 'space',
-            id: space.id,
-            events: space.events.map((wrapper) => JSON.parse(wrapper.event)),
           };
           webSocket.send(JSON.stringify(outgoingMessage));
           break;
@@ -75,44 +74,46 @@ webSocketServer.on('connection', async (webSocket: WebSocket, request: Request)
           webSocket.send(JSON.stringify(outgoingMessage));
           break;
         }
+        case 'create-space-event': {
+          const applyEventResult = await Effect.runPromiseExit(applyEvent({ event: data.event }));
+          if (Exit.isSuccess(applyEventResult)) {
+            const space = await createSpace({ accountId, event: data.event, keyBox: data.keyBox, keyId: data.keyId });
+            const spaceWithEvents = await getSpace({ accountId, spaceId: space.id });
+            const outgoingMessage: ResponseSpace = {
+              ...spaceWithEvents,
+              type: 'space',
+            };
+            webSocket.send(JSON.stringify(outgoingMessage));
+          }
+          // TODO send back error
+          break;
+        }
+        case 'create-invitation-event': {
+          await applySpaceEvent({
+            accountId,
+            spaceId: data.spaceId,
+            event: data.event,
+            keyBoxes: data.keyBoxes.map((keyBox) => keyBox),
+          });
+          const spaceWithEvents = await getSpace({ accountId, spaceId: data.spaceId });
+          const outgoingMessage: ResponseSpace = {
+            ...spaceWithEvents,
+            type: 'space',
+          };
+          webSocket.send(JSON.stringify(outgoingMessage));
+          break;
+        }
         case 'event': {
           switch (data.event.transaction.type) {
-            case 'create-space': {
-              const applyEventResult = await Effect.runPromiseExit(applyEvent({ event: data.event }));
-              if (Exit.isSuccess(applyEventResult)) {
-                const space = await createSpace({ accountId, event: data.event as CreateSpaceEvent });
-                const spaceWithEvents = await getSpace({ accountId, spaceId: space.id });
-                const outgoingMessage: ResponseSpace = {
-                  type: 'space',
-                  id: space.id,
-                  events: spaceWithEvents.events.map((wrapper) => JSON.parse(wrapper.event)),
-                };
-                webSocket.send(JSON.stringify(outgoingMessage));
-              }
-              // TODO send back error
-              break;
-            }
             case 'delete-space': {
               break;
             }
-            case 'create-invitation': {
-              await applySpaceEvent({ accountId, spaceId: data.spaceId, event: data.event });
-              const spaceWithEvents = await getSpace({ accountId, spaceId: data.spaceId });
-              const outgoingMessage: ResponseSpace = {
-                type: 'space',
-                id: data.spaceId,
-                events: spaceWithEvents.events.map((wrapper) => JSON.parse(wrapper.event)),
-              };
-              webSocket.send(JSON.stringify(outgoingMessage));
-              break;
-            }
             case 'accept-invitation': {
-              await applySpaceEvent({ accountId, spaceId: data.spaceId, event: data.event });
+              await applySpaceEvent({ accountId, spaceId: data.spaceId, event: data.event, keyBoxes: [] });
               const spaceWithEvents = await getSpace({ accountId, spaceId: data.spaceId });
               const outgoingMessage: ResponseSpace = {
+                ...spaceWithEvents,
                 type: 'space',
-                id: data.spaceId,
-                events: spaceWithEvents.events.map((wrapper) => JSON.parse(wrapper.event)),
               };
               webSocket.send(JSON.stringify(outgoingMessage));
               break;
diff --git a/packages/graph-framework-key/README.md b/packages/graph-framework-key/README.md
new file mode 100644
index 00000000..064e0944
--- /dev/null
+++ b/packages/graph-framework-key/README.md
@@ -0,0 +1,3 @@
+# Graph Framework Key
+
+Utilities for Space Keys and Key boxes.
diff --git a/packages/graph-framework-key/package.json b/packages/graph-framework-key/package.json
new file mode 100644
index 00000000..e1875ba1
--- /dev/null
+++ b/packages/graph-framework-key/package.json
@@ -0,0 +1,31 @@
+{
+  "name": "graph-framework-key",
+  "version": "0.0.1",
+  "description": "Utilities for Space Keys and Key boxes",
+  "type": "module",
+  "exports": {
+    ".": {
+      "default": "./src/index.js"
+    }
+  },
+  "scripts": {
+    "build": "vite build",
+    "test": "vitest run --typecheck",
+    "ts:check": "tsc --noEmit",
+    "lint": "pnpm biome lint src/*",
+    "lint:fix": "pnpm biome lint --write src/*",
+    "format": "pnpm biome format src/*",
+    "format:fix": "pnpm biome format --write src/*",
+    "check": "pnpm biome check src/*",
+    "check:fix": "pnpm biome check --write src/*"
+  },
+  "dependencies": {
+    "@noble/ciphers": "^1.0.0",
+    "@noble/curves": "^1.6.0",
+    "@noble/hashes": "^1.5.0",
+    "effect": "^3.10.12"
+  },
+  "devDependencies": {
+    "vite-plugin-dts": "^4.3.0"
+  }
+}
diff --git a/packages/graph-framework-key/src/create-key.ts b/packages/graph-framework-key/src/create-key.ts
new file mode 100644
index 00000000..e796885e
--- /dev/null
+++ b/packages/graph-framework-key/src/create-key.ts
@@ -0,0 +1,27 @@
+import { randomBytes } from '@noble/ciphers/webcrypto';
+import { encryptKey } from './encrypt-key.js';
+
+type Params = {
+  privateKey: Uint8Array;
+  publicKey: Uint8Array;
+};
+
+export function createKey({ privateKey, publicKey }: Params): {
+  key: Uint8Array;
+  keyBoxCiphertext: Uint8Array;
+  keyBoxNonce: Uint8Array;
+} {
+  const key = randomBytes(32);
+
+  const { keyBoxCiphertext, keyBoxNonce } = encryptKey({
+    key,
+    publicKey,
+    privateKey,
+  });
+
+  return {
+    key,
+    keyBoxCiphertext,
+    keyBoxNonce,
+  };
+}
diff --git a/packages/graph-framework-key/src/decrypt-key.ts b/packages/graph-framework-key/src/decrypt-key.ts
new file mode 100644
index 00000000..497147ab
--- /dev/null
+++ b/packages/graph-framework-key/src/decrypt-key.ts
@@ -0,0 +1,19 @@
+import { decryptKeyBox } from './key-box.js';
+
+type Params = {
+  privateKey: Uint8Array;
+  publicKey: Uint8Array;
+  keyBoxCiphertext: Uint8Array;
+  keyBoxNonce: Uint8Array;
+};
+
+export function decryptKey({ privateKey, publicKey, keyBoxNonce, keyBoxCiphertext }: Params): Uint8Array {
+  const key = decryptKeyBox({
+    nonce: keyBoxNonce,
+    ciphertext: keyBoxCiphertext,
+    publicKey,
+    secretKey: privateKey,
+  });
+
+  return key;
+}
diff --git a/packages/graph-framework-key/src/encrypt-key.ts b/packages/graph-framework-key/src/encrypt-key.ts
new file mode 100644
index 00000000..c5d9876d
--- /dev/null
+++ b/packages/graph-framework-key/src/encrypt-key.ts
@@ -0,0 +1,27 @@
+import { randomBytes } from '@noble/ciphers/webcrypto';
+import { encryptKeyBox } from './key-box.js';
+
+type Params = {
+  privateKey: Uint8Array;
+  publicKey: Uint8Array;
+  key: Uint8Array;
+};
+
+export function encryptKey({ privateKey, publicKey, key }: Params): {
+  keyBoxCiphertext: Uint8Array;
+  keyBoxNonce: Uint8Array;
+} {
+  const nonce = randomBytes(24);
+
+  const ciphertext = encryptKeyBox({
+    message: key,
+    nonce,
+    publicKey,
+    secretKey: privateKey,
+  });
+
+  return {
+    keyBoxCiphertext: ciphertext,
+    keyBoxNonce: nonce,
+  };
+}
diff --git a/packages/graph-framework-key/src/index.ts b/packages/graph-framework-key/src/index.ts
new file mode 100644
index 00000000..799f254b
--- /dev/null
+++ b/packages/graph-framework-key/src/index.ts
@@ -0,0 +1,4 @@
+export * from './create-key.js';
+export * from './decrypt-key.js';
+export * from './encrypt-key.js';
+export * from './key-box.js';
diff --git a/packages/graph-framework-key/src/key-box.test.ts b/packages/graph-framework-key/src/key-box.test.ts
new file mode 100644
index 00000000..ed63cf97
--- /dev/null
+++ b/packages/graph-framework-key/src/key-box.test.ts
@@ -0,0 +1,213 @@
+import { randomBytes } from '@noble/ciphers/webcrypto';
+import { bytesToHex } from '@noble/hashes/utils';
+import { describe, expect, it } from 'vitest';
+import { decryptKeyBox, encryptKeyBox, generateKeypair } from './key-box.js';
+
+describe('KeyBox Encryption/Decryption', () => {
+  describe('encryptKeyBox', () => {
+    it('should encrypt a message successfully', () => {
+      const { publicKey, secretKey } = generateKeypair();
+      console.log(bytesToHex(publicKey));
+      console.log(bytesToHex(secretKey));
+
+      const nonce = randomBytes(24);
+      const message = new TextEncoder().encode('Hello, world!');
+
+      const encrypted = encryptKeyBox({
+        message,
+        nonce,
+        publicKey,
+        secretKey,
+      });
+
+      expect(encrypted).toBeInstanceOf(Uint8Array);
+      expect(encrypted.length).toBeGreaterThan(message.length); // Account for MAC
+    });
+
+    it('should throw error for invalid nonce length', () => {
+      const { publicKey, secretKey } = generateKeypair();
+      const invalidNonce = new Uint8Array(16); // Wrong length
+      const message = new TextEncoder().encode('Hello, world!');
+
+      expect(() =>
+        encryptKeyBox({
+          message,
+          nonce: invalidNonce,
+          publicKey,
+          secretKey,
+        }),
+      ).toThrow('Nonce must be 24 bytes');
+    });
+
+    it('should handle empty message', () => {
+      const { publicKey, secretKey } = generateKeypair();
+      const nonce = randomBytes(24);
+      const message = new Uint8Array(0);
+
+      const encrypted = encryptKeyBox({
+        message,
+        nonce,
+        publicKey,
+        secretKey,
+      });
+
+      expect(encrypted).toBeInstanceOf(Uint8Array);
+      expect(encrypted.length).toBeGreaterThanOrEqual(16); // At least MAC length
+    });
+
+    it('should produce different ciphertexts for same message with different nonces', () => {
+      const { publicKey, secretKey } = generateKeypair();
+      const nonce1 = randomBytes(24);
+      const nonce2 = randomBytes(24);
+
+      const message = new TextEncoder().encode('Hello, world!');
+
+      const encrypted1 = encryptKeyBox({
+        message,
+        nonce: nonce1,
+        publicKey,
+        secretKey,
+      });
+
+      const encrypted2 = encryptKeyBox({
+        message,
+        nonce: nonce2,
+        publicKey,
+        secretKey,
+      });
+
+      expect(Buffer.from(encrypted1)).not.toEqual(Buffer.from(encrypted2));
+    });
+  });
+
+  describe('decryptKeyBox', () => {
+    it('should successfully decrypt an encrypted message', () => {
+      const alice = generateKeypair();
+      const bob = generateKeypair();
+      const nonce = randomBytes(24);
+      const message = new TextEncoder().encode('Hello, world!');
+
+      const encrypted = encryptKeyBox({
+        message,
+        nonce,
+        publicKey: bob.publicKey,
+        secretKey: alice.secretKey,
+      });
+
+      const decrypted = decryptKeyBox({
+        ciphertext: encrypted,
+        nonce,
+        publicKey: alice.publicKey,
+        secretKey: bob.secretKey,
+      });
+
+      expect(Buffer.from(decrypted)).toEqual(Buffer.from(message));
+    });
+
+    it('should throw error for invalid nonce length during decryption', () => {
+      const { publicKey, secretKey } = generateKeypair();
+      const invalidNonce = new Uint8Array(16);
+      const ciphertext = new Uint8Array(32);
+
+      expect(() =>
+        decryptKeyBox({
+          ciphertext,
+          nonce: invalidNonce,
+          publicKey,
+          secretKey,
+        }),
+      ).toThrow('Nonce must be 24 bytes');
+    });
+
+    it('should throw error for ciphertext too short', () => {
+      const { publicKey, secretKey } = generateKeypair();
+      const nonce = new Uint8Array(24);
+      const shortCiphertext = new Uint8Array(8);
+
+      expect(() =>
+        decryptKeyBox({
+          ciphertext: shortCiphertext,
+          nonce,
+          publicKey,
+          secretKey,
+        }),
+      ).toThrow('Ciphertext too short');
+    });
+
+    it('should fail to decrypt with wrong keys', () => {
+      const alice = generateKeypair();
+      const bob = generateKeypair();
+      const eve = generateKeypair(); // Attacker
+      const nonce = randomBytes(24);
+      const message = new TextEncoder().encode('Secret message');
+
+      const encrypted = encryptKeyBox({
+        message,
+        nonce,
+        publicKey: bob.publicKey,
+        secretKey: alice.secretKey,
+      });
+
+      expect(() =>
+        decryptKeyBox({
+          ciphertext: encrypted,
+          nonce,
+          publicKey: alice.publicKey,
+          secretKey: eve.secretKey, // Wrong key
+        }),
+      ).toThrow();
+    });
+  });
+
+  describe('integration tests', () => {
+    it('should handle messages of various lengths', () => {
+      const testLengths = [0, 1, 32, 100, 1000];
+      const alice = generateKeypair();
+      const bob = generateKeypair();
+      const nonce = randomBytes(24);
+
+      for (const length of testLengths) {
+        const message = randomBytes(length);
+
+        const encrypted = encryptKeyBox({
+          message,
+          nonce,
+          publicKey: bob.publicKey,
+          secretKey: alice.secretKey,
+        });
+
+        const decrypted = decryptKeyBox({
+          ciphertext: encrypted,
+          nonce,
+          publicKey: alice.publicKey,
+          secretKey: bob.secretKey,
+        });
+
+        expect(Buffer.from(decrypted)).toEqual(Buffer.from(message));
+      }
+    });
+
+    it('should be deterministic with same inputs', () => {
+      const alice = generateKeypair();
+      const bob = generateKeypair();
+      const nonce = new Uint8Array(24).fill(1); // Fixed nonce
+      const message = new TextEncoder().encode('Hello, world!');
+
+      const encrypted1 = encryptKeyBox({
+        message,
+        nonce,
+        publicKey: bob.publicKey,
+        secretKey: alice.secretKey,
+      });
+
+      const encrypted2 = encryptKeyBox({
+        message,
+        nonce,
+        publicKey: bob.publicKey,
+        secretKey: alice.secretKey,
+      });
+
+      expect(Buffer.from(encrypted1)).toEqual(Buffer.from(encrypted2));
+    });
+  });
+});
diff --git a/packages/graph-framework-key/src/key-box.ts b/packages/graph-framework-key/src/key-box.ts
new file mode 100644
index 00000000..c304bef1
--- /dev/null
+++ b/packages/graph-framework-key/src/key-box.ts
@@ -0,0 +1,66 @@
+import { xchacha20poly1305 } from '@noble/ciphers/chacha';
+import { x25519 } from '@noble/curves/ed25519';
+import { blake2b } from '@noble/hashes/blake2b';
+
+const NONCE_LENGTH = 24;
+const MAC_LENGTH = 16;
+
+type EncryptKeyBoxParams = {
+  message: Uint8Array;
+  nonce: Uint8Array;
+  publicKey: Uint8Array;
+  secretKey: Uint8Array;
+};
+
+export function generateKeypair() {
+  const secretKey = x25519.utils.randomPrivateKey();
+  const publicKey = x25519.getPublicKey(secretKey);
+  return { publicKey, secretKey };
+}
+
+export function encryptKeyBox({ message, nonce, publicKey, secretKey }: EncryptKeyBoxParams): Uint8Array {
+  if (nonce.length !== NONCE_LENGTH) {
+    throw new Error(`Nonce must be ${NONCE_LENGTH} bytes`);
+  }
+
+  // Compute shared key using X25519
+  const sharedSecret = x25519.getSharedSecret(secretKey, publicKey);
+
+  // Derive symmetric key using BLAKE2b
+  const key = blake2b.create({ dkLen: 32 }).update(sharedSecret).digest();
+
+  // Encrypt using XChaCha20-Poly1305
+  const cipher = xchacha20poly1305(key, nonce);
+  const ciphertext = cipher.encrypt(message);
+
+  return ciphertext;
+}
+
+export type DecryptKeyBoxParams = {
+  ciphertext: Uint8Array;
+  nonce: Uint8Array;
+  publicKey: Uint8Array;
+  secretKey: Uint8Array;
+};
+
+export function decryptKeyBox({ ciphertext, nonce, publicKey, secretKey }: DecryptKeyBoxParams): Uint8Array {
+  if (nonce.length !== NONCE_LENGTH) {
+    throw new Error(`Nonce must be ${NONCE_LENGTH} bytes`);
+  }
+
+  if (ciphertext.length < MAC_LENGTH) {
+    throw new Error('Ciphertext too short');
+  }
+
+  // Compute shared key using X25519
+  const sharedSecret = x25519.getSharedSecret(secretKey, publicKey);
+
+  // Derive symmetric key using BLAKE2b
+  const key = blake2b.create({ dkLen: 32 }).update(sharedSecret).digest();
+
+  // Decrypt using XChaCha20-Poly1305
+  const cipher = xchacha20poly1305(key, nonce);
+  const plaintext = cipher.decrypt(ciphertext);
+
+  return plaintext;
+}
diff --git a/packages/graph-framework-key/src/key.test.ts b/packages/graph-framework-key/src/key.test.ts
new file mode 100644
index 00000000..f7a2599b
--- /dev/null
+++ b/packages/graph-framework-key/src/key.test.ts
@@ -0,0 +1,235 @@
+import { randomBytes } from '@noble/ciphers/webcrypto';
+import { describe, expect, it } from 'vitest';
+import { createKey } from './create-key.js';
+import { encryptKey } from './encrypt-key.js';
+import { decryptKeyBox, generateKeypair } from './key-box.js';
+
+describe('Key Encryption', () => {
+  describe('encryptKey', () => {
+    it('should encrypt a provided key with correct output structure', () => {
+      const { publicKey, secretKey } = generateKeypair();
+      const key = randomBytes(32);
+
+      const result = encryptKey({
+        privateKey: secretKey,
+        publicKey,
+        key,
+      });
+
+      expect(result).toHaveProperty('keyBoxCiphertext');
+      expect(result).toHaveProperty('keyBoxNonce');
+      expect(result.keyBoxCiphertext).toBeInstanceOf(Uint8Array);
+      expect(result.keyBoxNonce).toBeInstanceOf(Uint8Array);
+      expect(result.keyBoxNonce.length).toBe(24);
+    });
+
+    it('should generate different nonces for same key', () => {
+      const { publicKey, secretKey } = generateKeypair();
+      const key = randomBytes(32);
+
+      const result1 = encryptKey({
+        privateKey: secretKey,
+        publicKey,
+        key,
+      });
+
+      const result2 = encryptKey({
+        privateKey: secretKey,
+        publicKey,
+        key,
+      });
+
+      expect(Buffer.from(result1.keyBoxNonce)).not.toEqual(Buffer.from(result2.keyBoxNonce));
+      expect(Buffer.from(result1.keyBoxCiphertext)).not.toEqual(Buffer.from(result2.keyBoxCiphertext));
+    });
+
+    it('should be decryptable with correct keys', () => {
+      const alice = generateKeypair();
+      const bob = generateKeypair();
+      const originalKey = randomBytes(32);
+
+      const { keyBoxCiphertext, keyBoxNonce } = encryptKey({
+        privateKey: alice.secretKey,
+        publicKey: bob.publicKey,
+        key: originalKey,
+      });
+
+      const decryptedKey = decryptKeyBox({
+        ciphertext: keyBoxCiphertext,
+        nonce: keyBoxNonce,
+        publicKey: alice.publicKey,
+        secretKey: bob.secretKey,
+      });
+
+      expect(Buffer.from(decryptedKey)).toEqual(Buffer.from(originalKey));
+    });
+
+    it('should handle keys of different lengths', () => {
+      const { publicKey, secretKey } = generateKeypair();
+      const keyLengths = [16, 24, 32, 48];
+
+      for (const length of keyLengths) {
+        const key = randomBytes(length);
+
+        const result = encryptKey({
+          privateKey: secretKey,
+          publicKey,
+          key,
+        });
+
+        expect(result.keyBoxCiphertext.length).toBeGreaterThan(length); // Account for MAC
+        expect(result.keyBoxNonce.length).toBe(24);
+      }
+    });
+  });
+
+  describe('createKey', () => {
+    it('should create a new key with correct structure', () => {
+      const { publicKey, secretKey } = generateKeypair();
+
+      const result = createKey({
+        privateKey: secretKey,
+        publicKey,
+      });
+
+      expect(result).toHaveProperty('key');
+      expect(result).toHaveProperty('keyBoxCiphertext');
+      expect(result).toHaveProperty('keyBoxNonce');
+      expect(result.key).toBeInstanceOf(Uint8Array);
+      expect(result.key.length).toBe(32);
+      expect(result.keyBoxCiphertext).toBeInstanceOf(Uint8Array);
+      expect(result.keyBoxNonce).toBeInstanceOf(Uint8Array);
+      expect(result.keyBoxNonce.length).toBe(24);
+    });
+
+    it('should generate unique keys on each call', () => {
+      const { publicKey, secretKey } = generateKeypair();
+
+      const result1 = createKey({
+        privateKey: secretKey,
+        publicKey,
+      });
+
+      const result2 = createKey({
+        privateKey: secretKey,
+        publicKey,
+      });
+
+      expect(Buffer.from(result1.key)).not.toEqual(Buffer.from(result2.key));
+      expect(Buffer.from(result1.keyBoxNonce)).not.toEqual(Buffer.from(result2.keyBoxNonce));
+      expect(Buffer.from(result1.keyBoxCiphertext)).not.toEqual(Buffer.from(result2.keyBoxCiphertext));
+    });
+
+    it('should create decryptable keys', () => {
+      const alice = generateKeypair();
+      const bob = generateKeypair();
+
+      const { key, keyBoxCiphertext, keyBoxNonce } = createKey({
+        privateKey: alice.secretKey,
+        publicKey: bob.publicKey,
+      });
+
+      const decryptedKey = decryptKeyBox({
+        ciphertext: keyBoxCiphertext,
+        nonce: keyBoxNonce,
+        publicKey: alice.publicKey,
+        secretKey: bob.secretKey,
+      });
+
+      expect(Buffer.from(decryptedKey)).toEqual(Buffer.from(key));
+    });
+  });
+
+  describe('integration tests', () => {
+    it('should work with multiple recipients', () => {
+      const sender = generateKeypair();
+      const recipients = Array.from({ length: 5 }, () => generateKeypair());
+      const key = randomBytes(32);
+
+      // Encrypt same key for multiple recipients
+      const encryptedKeys = recipients.map((recipient) =>
+        encryptKey({
+          privateKey: sender.secretKey,
+          publicKey: recipient.publicKey,
+          key,
+        }),
+      );
+
+      // Each recipient should be able to decrypt their version
+      recipients.forEach((recipient, index) => {
+        const decryptedKey = decryptKeyBox({
+          // @ts-expect-error entry is defined
+          ciphertext: encryptedKeys[index].keyBoxCiphertext,
+          // @ts-expect-error entry is defined
+          nonce: encryptedKeys[index].keyBoxNonce,
+          publicKey: sender.publicKey,
+          secretKey: recipient.secretKey,
+        });
+
+        expect(Buffer.from(decryptedKey)).toEqual(Buffer.from(key));
+      });
+    });
+
+    it('should fail decryption with wrong keys', () => {
+      const alice = generateKeypair();
+      const bob = generateKeypair();
+      const eve = generateKeypair();
+      const key = randomBytes(32);
+
+      const { keyBoxCiphertext, keyBoxNonce } = encryptKey({
+        privateKey: alice.secretKey,
+        publicKey: bob.publicKey,
+        key,
+      });
+
+      expect(() =>
+        decryptKeyBox({
+          ciphertext: keyBoxCiphertext,
+          nonce: keyBoxNonce,
+          publicKey: alice.publicKey,
+          secretKey: eve.secretKey, // Wrong key
+        }),
+      ).toThrow();
+    });
+
+    it('should create and encrypt keys consistently', () => {
+      const alice = generateKeypair();
+      const bob = generateKeypair();
+
+      // Create a key using createKey
+      const {
+        key: createdKey,
+        keyBoxCiphertext: createdCiphertext,
+        keyBoxNonce: createdNonce,
+      } = createKey({
+        privateKey: alice.secretKey,
+        publicKey: bob.publicKey,
+      });
+
+      // Encrypt the same key using encryptKey
+      const { keyBoxCiphertext: encryptedCiphertext, keyBoxNonce: encryptedNonce } = encryptKey({
+        privateKey: alice.secretKey,
+        publicKey: bob.publicKey,
+        key: createdKey,
+      });
+
+      // Both should be decryptable to the same key
+      const decryptedCreated = decryptKeyBox({
+        ciphertext: createdCiphertext,
+        nonce: createdNonce,
+        publicKey: alice.publicKey,
+        secretKey: bob.secretKey,
+      });
+
+      const decryptedEncrypted = decryptKeyBox({
+        ciphertext: encryptedCiphertext,
+        nonce: encryptedNonce,
+        publicKey: alice.publicKey,
+        secretKey: bob.secretKey,
+      });
+
+      expect(Buffer.from(decryptedCreated)).toEqual(Buffer.from(createdKey));
+      expect(Buffer.from(decryptedEncrypted)).toEqual(Buffer.from(createdKey));
+    });
+  });
+});
diff --git a/packages/graph-framework-key/tsconfig.build.json b/packages/graph-framework-key/tsconfig.build.json
new file mode 100644
index 00000000..9f8c8762
--- /dev/null
+++ b/packages/graph-framework-key/tsconfig.build.json
@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.options.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["./src"],
+  "exclude": ["node_modules", "src/**/*.test.ts", "src/**/*.spec.ts", "dist"]
+}
diff --git a/packages/graph-framework-key/tsconfig.json b/packages/graph-framework-key/tsconfig.json
new file mode 100644
index 00000000..e71c5154
--- /dev/null
+++ b/packages/graph-framework-key/tsconfig.json
@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.options.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "noEmit": true
+  },
+  "include": ["**/*", "vite.config.mts", "../../shared/*.ts"],
+  "exclude": ["**/node_modules", "**/dist"]
+}
diff --git a/packages/graph-framework-key/vite.config.mts b/packages/graph-framework-key/vite.config.mts
new file mode 100644
index 00000000..cb41057d
--- /dev/null
+++ b/packages/graph-framework-key/vite.config.mts
@@ -0,0 +1,24 @@
+import { defineConfig } from 'vite';
+import dts from 'vite-plugin-dts';
+
+import { vitePluginExternalizeDependencies } from '../../shared/vitePluginExternalizeDependencies.js';
+
+// https://vitejs.dev/config/
+export default defineConfig({
+  plugins: [
+    dts({ tsconfigPath: './tsconfig.build.json', insertTypesEntry: true }),
+    vitePluginExternalizeDependencies(),
+  ],
+  build: {
+    lib: {
+      entry: {
+        index: './src/index.ts',
+        base58: './src/base58.ts',
+      },
+      formats: ['es', 'cjs'],
+      fileName(format, entryName) {
+        return `${entryName}${format === 'es' ? '.mjs' : '.cjs'}`;
+      },
+    },
+  },
+});
diff --git a/packages/graph-framework-messages/package.json b/packages/graph-framework-messages/package.json
index 20045b1c..2753f6f8 100644
--- a/packages/graph-framework-messages/package.json
+++ b/packages/graph-framework-messages/package.json
@@ -20,6 +20,8 @@
     "check:fix": "pnpm biome check --write src/*"
   },
   "dependencies": {
+    "@noble/ciphers": "^1.0.0",
+    "@noble/curves": "^1.6.0",
     "effect": "^3.10.12",
     "graph-framework-space-events": "workspace:*"
   },
diff --git a/packages/graph-framework-messages/src/types.ts b/packages/graph-framework-messages/src/types.ts
index 603c7116..0136e966 100644
--- a/packages/graph-framework-messages/src/types.ts
+++ b/packages/graph-framework-messages/src/types.ts
@@ -1,10 +1,51 @@
 import * as Schema from 'effect/Schema';
-import { SpaceEvent } from 'graph-framework-space-events';
+import {
+  AcceptInvitationEvent,
+  CreateInvitationEvent,
+  CreateSpaceEvent,
+  DeleteSpaceEvent,
+  SpaceEvent,
+} from 'graph-framework-space-events';
+
+export const KeyBox = Schema.Struct({
+  accountId: Schema.String,
+  ciphertext: Schema.String,
+  nonce: Schema.String,
+  authorPublicKey: Schema.String,
+});
+
+export type KeyBox = Schema.Schema.Type<typeof KeyBox>;
+
+export const KeyBoxWithKeyId = Schema.Struct({
+  ...KeyBox.fields,
+  id: Schema.String,
+});
+
+export type KeyBoxWithKeyId = Schema.Schema.Type<typeof KeyBoxWithKeyId>;
+
+export const RequestCreateSpaceEvent = Schema.Struct({
+  type: Schema.Literal('create-space-event'),
+  spaceId: Schema.String,
+  event: CreateSpaceEvent,
+  keyId: Schema.String,
+  keyBox: KeyBox, // TODO change to KeyBoxWithKeyId and remove keyId
+});
+
+export type RequestCreateSpaceEvent = Schema.Schema.Type<typeof RequestCreateSpaceEvent>;
+
+export const RequestCreateInvitationEvent = Schema.Struct({
+  type: Schema.Literal('create-invitation-event'),
+  spaceId: Schema.String,
+  event: CreateInvitationEvent,
+  keyBoxes: Schema.Array(KeyBoxWithKeyId),
+});
+
+export type RequestCreateInvitationEvent = Schema.Schema.Type<typeof RequestCreateInvitationEvent>;
 
 export const EventMessage = Schema.Struct({
   type: Schema.Literal('event'),
   spaceId: Schema.String,
-  event: SpaceEvent,
+  event: Schema.Union(DeleteSpaceEvent, AcceptInvitationEvent),
 });
 
 export type EventMessage = Schema.Schema.Type<typeof EventMessage>;
@@ -29,6 +70,8 @@ export const RequestListInvitations = Schema.Struct({
 export type RequestListInvitations = Schema.Schema.Type<typeof RequestListInvitations>;
 
 export const RequestMessage = Schema.Union(
+  RequestCreateSpaceEvent,
+  RequestCreateInvitationEvent,
   EventMessage,
   RequestSubscribeToSpace,
   RequestListSpaces,
@@ -67,6 +110,7 @@ export const ResponseSpace = Schema.Struct({
   type: Schema.Literal('space'),
   id: Schema.String,
   events: Schema.Array(SpaceEvent),
+  keyBoxes: Schema.Array(KeyBoxWithKeyId),
 });
 
 export type ResponseSpace = Schema.Schema.Type<typeof ResponseSpace>;
diff --git a/packages/graph-framework-space-events/src/create-invitation.test.ts b/packages/graph-framework-space-events/src/create-invitation.test.ts
index 84feb9c1..d0569719 100644
--- a/packages/graph-framework-space-events/src/create-invitation.test.ts
+++ b/packages/graph-framework-space-events/src/create-invitation.test.ts
@@ -45,7 +45,6 @@ it('should create an invitation', async () => {
 
   expect(state2.id).toBeTypeOf('string');
   expect(state2.invitations).toEqual({
-    // @ts-expect-error
     [spaceEvent2.transaction.id]: {
       signaturePublicKey: '03bf5d2a1badf15387b08a007d1a9a13a9bfd6e1c56f681e251514d9ba10b57462',
       encryptionPublicKey: 'encryption',
diff --git a/packages/graph-framework/package.json b/packages/graph-framework/package.json
index 4cc6a1a2..0a3b614e 100644
--- a/packages/graph-framework/package.json
+++ b/packages/graph-framework/package.json
@@ -40,6 +40,7 @@
     "graph-framework-space-events": "workspace:*",
     "graph-framework-identity": "workspace:*",
     "graph-framework-schema": "workspace:*",
-    "graph-framework-messages": "workspace:*"
+    "graph-framework-messages": "workspace:*",
+    "graph-framework-key": "workspace:*"
   }
 }
diff --git a/packages/graph-framework/src/index.tsx b/packages/graph-framework/src/index.tsx
index f42367a2..ece5b4f8 100644
--- a/packages/graph-framework/src/index.tsx
+++ b/packages/graph-framework/src/index.tsx
@@ -1,4 +1,5 @@
 export * from 'graph-framework-identity';
+export * from 'graph-framework-key';
 export * from 'graph-framework-messages';
 export * from 'graph-framework-schema';
 export * from 'graph-framework-space-events';
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0d378504..79cad9ac 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -199,6 +199,9 @@ importers:
       graph-framework-identity:
         specifier: workspace:*
         version: link:../graph-framework-identity
+      graph-framework-key:
+        specifier: workspace:*
+        version: link:../graph-framework-key
       graph-framework-messages:
         specifier: workspace:*
         version: link:../graph-framework-messages
@@ -256,8 +259,33 @@ importers:
         specifier: ^3.10.12
         version: 3.10.12
 
+  packages/graph-framework-key:
+    dependencies:
+      '@noble/ciphers':
+        specifier: ^1.0.0
+        version: 1.0.0
+      '@noble/curves':
+        specifier: ^1.6.0
+        version: 1.6.0
+      '@noble/hashes':
+        specifier: ^1.5.0
+        version: 1.5.0
+      effect:
+        specifier: ^3.10.12
+        version: 3.10.12
+    devDependencies:
+      vite-plugin-dts:
+        specifier: ^4.3.0
+        version: 4.3.0(@types/node@22.9.0)(rollup@4.21.3)(typescript@5.6.3)(vite@5.4.10(@types/node@22.9.0))
+
   packages/graph-framework-messages:
     dependencies:
+      '@noble/ciphers':
+        specifier: ^1.0.0
+        version: 1.0.0
+      '@noble/curves':
+        specifier: ^1.6.0
+        version: 1.6.0
       effect:
         specifier: ^3.10.12
         version: 3.10.12
@@ -1180,6 +1208,10 @@ packages:
     resolution: {integrity: sha512-z10PF9JV6SbjFq+/rYabM+8CVlMokgl8RFGvieSGNTmrkQanfHn+15XBrhG3BgUfvmTeSeyShfOHpG0i9zEdcg==}
     deprecated: Motion One for Vue is deprecated. Use Oku Motion instead https://oku-ui.com/motion
 
+  '@noble/ciphers@1.0.0':
+    resolution: {integrity: sha512-wH5EHOmLi0rEazphPbecAzmjd12I6/Yv/SiHdkA9LSycsQk7RuuTp7am5/o62qYr0RScE7Pc9icXGBbsr6cesA==}
+    engines: {node: ^14.21.3 || >=16}
+
   '@noble/curves@1.2.0':
     resolution: {integrity: sha512-oYclrNgRaM9SsBUBVbb8M6DTV7ZHRTKugureoYEncY5c65HOmRzvSiTE3y5CYaPYJA/GVkrhXEoF0M3Ya9PMnw==}
 
@@ -6183,6 +6215,8 @@ snapshots:
       '@motionone/dom': 10.18.0
       tslib: 2.8.1
 
+  '@noble/ciphers@1.0.0': {}
+
   '@noble/curves@1.2.0':
     dependencies:
       '@noble/hashes': 1.3.2