@dxos/client-services 0.1.18 → 0.1.19

package/dist/lib/browser/index.mjs

@@ -6,6 +6,7 @@ import { EventSubscriptions } from "@dxos/async";
 import { Stream } from "@dxos/codec-protobuf";
 import { todo } from "@dxos/debug";
 import { log } from "@dxos/log";
+import { SpaceMember } from "@dxos/protocols/proto/dxos/client";
 import { humanize } from "@dxos/util";
 var SpaceServiceImpl = class {
   constructor(serviceContext) {
@@ -28,26 +29,27 @@ var SpaceServiceImpl = class {
     return new Stream(({ next }) => {
       const subscriptions = new EventSubscriptions();
       const onUpdate = () => {
-        const spaces = Array.from(this.serviceContext.spaceManager.spaces.values()).map((space) => ({
+        const spaces = Array.from(this.serviceContext.dataSpaceManager.spaces.values()).map((space) => ({
           publicKey: space.key,
           isOpen: true,
           isActive: true,
-          members: Array.from(space.spaceState.members.values()).map((member) => {
-            var _a, _b;
+          members: Array.from(space.inner.spaceState.members.values()).map((member) => {
+            var _a, _b, _c;
             return {
               identityKey: member.key,
               profile: {
                 identityKey: member.key,
                 displayName: (_b = (_a = member.assertion.profile) == null ? void 0 : _a.displayName) != null ? _b : humanize(member.key)
-              }
+              },
+              presenceState: ((_c = this.serviceContext.identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember.PresenceState.ONLINE : SpaceMember.PresenceState.OFFLINE
             };
           })
         }));
         log("update", {
           spaces
         }, {
-          file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/deprecated/space.ts",
-          line: 114,
+          file: "space.ts",
+          line: 120,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -56,20 +58,22 @@ var SpaceServiceImpl = class {
         });
       };
       setTimeout(async () => {
-        if (!this.serviceContext.spaceManager) {
+        if (!this.serviceContext.dataSpaceManager) {
           next({
             spaces: []
           });
         }
         await this.serviceContext.initialized.wait();
-        subscriptions.add(this.serviceContext.spaceManager.updated.on(() => {
-          this.serviceContext.spaceManager.spaces.forEach((space) => {
+        subscriptions.add(this.serviceContext.dataSpaceManager.updated.on(() => {
+          this.serviceContext.dataSpaceManager.spaces.forEach((space) => {
             subscriptions.add(space.stateUpdate.on(onUpdate));
+            subscriptions.add(space.presence.updated.on(onUpdate));
           });
           onUpdate();
         }));
-        this.serviceContext.spaceManager.spaces.forEach((space) => {
+        this.serviceContext.dataSpaceManager.spaces.forEach((space) => {
           subscriptions.add(space.stateUpdate.on(onUpdate));
+          subscriptions.add(space.presence.updated.on(onUpdate));
         });
         onUpdate();
       });
@@ -81,7 +85,7 @@ var SpaceServiceImpl = class {
   }
   async createSpace() {
     await this.serviceContext.initialized.wait();
-    const space = await this.serviceContext.spaceManager.createSpace();
+    const space = await this.serviceContext.dataSpaceManager.createSpace();
     return {
       publicKey: space.key,
       isOpen: true,
@@ -378,7 +382,7 @@ var subscribeToSpaces = (context, { spaceKeys = [] }) => new Stream6(({ next })
   };
   const timeout = setTimeout(async () => {
     await context.initialized.wait();
-    unsubscribe = context.spaceManager.updated.on(() => update());
+    unsubscribe = context.dataSpaceManager.updated.on(() => update());
     await update();
   });
   return () => {
@@ -475,6 +479,8 @@ var DevtoolsServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/authenticator.ts
+import { Trigger } from "@dxos/async";
+import { Context } from "@dxos/context";
 import { verifyCredential } from "@dxos/credentials";
 import { log as log2 } from "@dxos/log";
 import { schema } from "@dxos/protocols";
@@ -488,76 +494,108 @@ var createHaloAuthProvider = (signer) => async (nonce) => {
   });
   return schema.getCodecForType("dxos.halo.credentials.Credential").encode(credential);
 };
-var createHaloAuthVerifier = (getDeviceSet) => async (nonce, auth) => {
-  const credential = schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
-  const deviceSet = getDeviceSet();
-  const result = await verifyCredential(credential);
-  if (result.kind === "fail") {
-    log2("Invalid credential", {
-      result
-    }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts",
-      line: 34,
-      scope: void 0,
-      callSite: (f, a) => f(...a)
-    });
-    return false;
-  }
-  if (!credential.proof.nonce || !Buffer.from(nonce).equals(credential.proof.nonce)) {
-    log2("Invalid nonce", {
-      nonce,
-      credential
-    }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts",
-      line: 39,
-      scope: void 0,
-      callSite: (f, a) => f(...a)
-    });
-    return false;
+var HaloAuthVerifier = class {
+  constructor(_params) {
+    this._params = _params;
+    this._ctx = new Context();
   }
-  if (!deviceSet.has(credential.issuer)) {
-    log2("Device not in allowed set", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts",
-      line: 44,
-      scope: void 0,
-      callSite: (f, a) => f(...a)
-    });
-    return false;
+  async close() {
+    await this._ctx.dispose();
+  }
+  _isTrustedDevice(deviceKey) {
+    const deviceSet = this._params.trustedDevicesProvider();
+    return deviceSet.has(deviceKey);
+  }
+  get verifier() {
+    return async (nonce, auth) => {
+      const credential = schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
+      const result = await verifyCredential(credential);
+      if (result.kind === "fail") {
+        log2("Invalid credential", {
+          result
+        }, {
+          file: "authenticator.ts",
+          line: 61,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        return false;
+      }
+      if (!credential.proof.nonce || !Buffer.from(nonce).equals(credential.proof.nonce)) {
+        log2("Invalid nonce", {
+          nonce,
+          credential
+        }, {
+          file: "authenticator.ts",
+          line: 66,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        return false;
+      }
+      if (this._isTrustedDevice(credential.issuer)) {
+        return true;
+      }
+      const trigger = new Trigger();
+      this._ctx.onDispose(() => {
+        trigger.wake(false);
+      });
+      const clear = this._params.update.on(this._ctx, () => {
+        if (this._isTrustedDevice(credential.issuer)) {
+          trigger.wake(true);
+        }
+      });
+      try {
+        await trigger.wait({
+          timeout: this._params.authTimeout
+        });
+        return true;
+      } catch (e) {
+        return false;
+      } finally {
+        clear();
+      }
+    };
   }
-  return true;
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity.ts
 import assert2 from "@dxos/node-std/assert";
 import { Event } from "@dxos/async";
 import { DeviceStateMachine, createCredentialSignerWithKey, createCredentialSignerWithChain, ProfileStateMachine } from "@dxos/credentials";
-import { failUndefined } from "@dxos/debug";
 import { writeMessages } from "@dxos/feed-store";
 import { log as log3 } from "@dxos/log";
 import { AdmittedFeed } from "@dxos/protocols/proto/dxos/halo/credentials";
+var AUTH_TIMEOUT = 3e4;
 var Identity = class {
   constructor({ space, signer, identityKey, deviceKey }) {
     this.stateUpdate = new Event();
-    this._space = space;
+    this.space = space;
     this._signer = signer;
     this.identityKey = identityKey;
     this.deviceKey = deviceKey;
     this._deviceStateMachine = new DeviceStateMachine(this.identityKey, this.deviceKey);
     this._profileStateMachine = new ProfileStateMachine(this.identityKey);
-    this._space.onCredentialProcessed.set(async (credential) => {
+    this.space.onCredentialProcessed.set(async (credential) => {
       await this._deviceStateMachine.process(credential);
       await this._profileStateMachine.process(credential);
       this.stateUpdate.emit();
     });
+    this.authVerifier = new HaloAuthVerifier({
+      trustedDevicesProvider: () => this.authorizedDeviceKeys,
+      update: this.stateUpdate,
+      authTimeout: AUTH_TIMEOUT
+    });
   }
   get authorizedDeviceKeys() {
     return this._deviceStateMachine.authorizedDeviceKeys;
   }
   async open() {
-    await this._space.open();
+    await this.space.open();
   }
   async close() {
-    await this._space.close();
+    await this.authVerifier.close();
+    await this.space.close();
   }
   async ready() {
     await this._deviceStateMachine.deviceChainReady.wait();
@@ -566,23 +604,19 @@ var Identity = class {
     return this._profileStateMachine.profile;
   }
   get controlPipeline() {
-    return this._space.controlPipeline;
+    return this.space.controlPipeline;
   }
   get haloSpaceKey() {
-    return this._space.key;
+    return this.space.key;
   }
   get haloGenesisFeedKey() {
-    return this._space.genesisFeedKey;
-  }
-  get haloDatabase() {
-    var _a;
-    return (_a = this._space.database) != null ? _a : failUndefined();
+    return this.space.genesisFeedKey;
   }
   getAdmissionCredentials() {
     return {
       deviceKey: this.deviceKey,
-      controlFeedKey: this._space.controlFeedKey,
-      dataFeedKey: this._space.dataFeedKey
+      controlFeedKey: this.space.controlFeedKey,
+      dataFeedKey: this.space.dataFeedKey
     };
   }
   getIdentityCredentialSigner() {
@@ -600,8 +634,8 @@ var Identity = class {
       controlFeedKey,
       dataFeedKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity.ts",
-      line: 137,
+      file: "identity.ts",
+      line: 147,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -645,17 +679,17 @@ var Identity = class {
 // packages/sdk/client-services/src/packlets/identity/identity-manager.ts
 import assert3 from "@dxos/node-std/assert";
 import { Event as Event2 } from "@dxos/async";
-import { CredentialGenerator } from "@dxos/credentials";
-import { MOCK_AUTH_PROVIDER, MOCK_AUTH_VERIFIER, Space, Database, SpaceProtocol } from "@dxos/echo-db";
+import { createCredentialSignerWithKey as createCredentialSignerWithKey2, CredentialGenerator } from "@dxos/credentials";
+import { NoopDataPipelineController } from "@dxos/echo-db";
 import { log as log4 } from "@dxos/log";
 import { AdmittedFeed as AdmittedFeed2 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { Presence } from "@dxos/teleport-extension-presence";
+import { deferFunction } from "@dxos/util";
 var IdentityManager = class {
-  constructor(_metadataStore, _feedStore, _keyring, _networkManager, _modelFactory) {
+  constructor(_metadataStore, _keyring, _spaceManager) {
     this._metadataStore = _metadataStore;
-    this._feedStore = _feedStore;
     this._keyring = _keyring;
-    this._networkManager = _networkManager;
-    this._modelFactory = _modelFactory;
+    this._spaceManager = _spaceManager;
     this.stateUpdate = new Event2();
   }
   get identity() {
@@ -678,8 +712,8 @@ var IdentityManager = class {
   async createIdentity({ displayName } = {}) {
     assert3(!this._identity, "Identity already exists.");
     log4("creating identity...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 82,
+      file: "identity-manager.ts",
+      line: 72,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -723,8 +757,8 @@ var IdentityManager = class {
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 141,
+      file: "identity-manager.ts",
+      line: 131,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -734,8 +768,8 @@ var IdentityManager = class {
     log4("accepting identity", {
       params
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 149,
+      file: "identity-manager.ts",
+      line: 139,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -762,8 +796,8 @@ var IdentityManager = class {
     log4("constructing identity", {
       identityRecord
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 173,
+      file: "identity-manager.ts",
+      line: 163,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -771,46 +805,43 @@ var IdentityManager = class {
       spaceRecord: identityRecord.haloSpace,
       swarmIdentity: {
         peerKey: identityRecord.deviceKey,
-        credentialProvider: MOCK_AUTH_PROVIDER,
-        credentialAuthenticator: MOCK_AUTH_VERIFIER
-      }
-    });
-    log4("done", {
+        credentialProvider: createHaloAuthProvider(createCredentialSignerWithKey2(this._keyring, identityRecord.deviceKey)),
+        credentialAuthenticator: deferFunction(() => identity.authVerifier.verifier)
+      },
       identityKey: identityRecord.identityKey
-    }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 184,
-      scope: this,
-      callSite: (f, a) => f(...a)
     });
-    return new Identity({
+    const identity = new Identity({
       space,
       signer: this._keyring,
       identityKey: identityRecord.identityKey,
       deviceKey: identityRecord.deviceKey
     });
-  }
-  async _constructSpace({ spaceRecord, swarmIdentity }) {
-    const controlFeed = await this._feedStore.openFeed(spaceRecord.writeControlFeedKey, {
-      writable: true
-    });
-    const dataFeed = await this._feedStore.openFeed(spaceRecord.writeDataFeedKey, {
-      writable: true
-    });
-    const genesisFeed = await this._feedStore.openFeed(spaceRecord.genesisFeedKey);
-    const protocol = new SpaceProtocol({
-      topic: spaceRecord.spaceKey,
-      identity: swarmIdentity,
-      networkManager: this._networkManager
+    log4("done", {
+      identityKey: identityRecord.identityKey
+    }, {
+      file: "identity-manager.ts",
+      line: 182,
+      scope: this,
+      callSite: (f, a) => f(...a)
     });
-    return new Space({
-      spaceKey: spaceRecord.spaceKey,
-      protocol,
-      genesisFeed,
-      controlFeed,
-      dataFeed,
-      feedProvider: (feedKey) => this._feedStore.openFeed(feedKey),
-      databaseFactory: async ({ databaseBackend }) => new Database(this._modelFactory, databaseBackend, swarmIdentity.peerKey)
+    return identity;
+  }
+  async _constructSpace({ spaceRecord, swarmIdentity, identityKey }) {
+    return this._spaceManager.constructSpace({
+      metadata: {
+        key: spaceRecord.spaceKey,
+        genesisFeedKey: spaceRecord.genesisFeedKey,
+        controlFeedKey: spaceRecord.writeControlFeedKey,
+        dataFeedKey: spaceRecord.writeDataFeedKey
+      },
+      dataPipelineControllerProvider: () => new NoopDataPipelineController(),
+      swarmIdentity,
+      presence: new Presence({
+        localPeerId: swarmIdentity.peerKey,
+        announceInterval: 1e3,
+        offlineTimeout: 3e4,
+        identityKey
+      })
     });
   }
 };
@@ -831,16 +862,17 @@ var InvitationEncoder = class {
 
 // packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
 import assert5 from "@dxos/node-std/assert";
-import { scheduleTask, sleep, Trigger } from "@dxos/async";
-import { Context } from "@dxos/context";
+import { scheduleTask, sleep, Trigger as Trigger2 } from "@dxos/async";
+import { Context as Context2 } from "@dxos/context";
 import { generatePasscode } from "@dxos/credentials";
-import { failUndefined as failUndefined2 } from "@dxos/debug";
+import { failUndefined } from "@dxos/debug";
 import { PublicKey as PublicKey3 } from "@dxos/keys";
 import { log as log5 } from "@dxos/log";
 import { createTeleportProtocolFactory, StarTopology } from "@dxos/network-manager";
 import { schema as schema3 } from "@dxos/protocols";
 import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
 import { AuthenticationResponse } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { RpcExtension } from "@dxos/teleport";
 
 // packages/sdk/client-services/src/packlets/invitations/invitations.ts
 import assert4 from "@dxos/node-std/assert";
@@ -889,45 +921,6 @@ var AbstractInvitationsHandler = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/rpc-extension.ts
-import { createProtoRpcPeer } from "@dxos/rpc";
-var RpcExtension = class {
-  constructor(_params) {
-    this._params = _params;
-  }
-  get initiator() {
-    return this._extensionContext.initiator;
-  }
-  get localPeerId() {
-    return this._extensionContext.localPeerId;
-  }
-  get remotePeerId() {
-    return this._extensionContext.remotePeerId;
-  }
-  get rpc() {
-    return this._rpc.rpc;
-  }
-  async onOpen(context) {
-    this._extensionContext = context;
-    const handlers = await this.getHandlers();
-    const port = context.createPort("rpc", {
-      contentType: 'application/x-protobuf; messageType="dxos.rpc.Message"'
-    });
-    this._rpc = createProtoRpcPeer({
-      ...this._params,
-      handlers,
-      port
-    });
-    await this._rpc.open();
-  }
-  async onClose(err) {
-    await this._rpc.close();
-  }
-  close() {
-    this._extensionContext.close();
-  }
-};
-
 // packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
 var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
   constructor(networkManager, _identityManager) {
@@ -938,14 +931,14 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
     var _a;
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
     assert5(type !== Invitation2.Type.OFFLINE);
-    const identity = (_a = this._identityManager.identity) != null ? _a : failUndefined2();
+    const identity = (_a = this._identityManager.identity) != null ? _a : failUndefined();
     const invitation = {
       type,
       invitationId: PublicKey3.random().toHex(),
       swarmKey: swarmKey != null ? swarmKey : PublicKey3.random(),
       authenticationCode: generatePasscode(AUTHENTICATION_CODE_LENGTH)
     };
-    const ctx = new Context({
+    const ctx = new Context2({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
@@ -955,7 +948,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       await ctx.dispose();
     });
     let authenticationCode;
-    const complete = new Trigger();
+    const complete = new Trigger2();
     const createExtension = () => {
       const hostInvitationExtension = new HostHaloInvitationExtension({
         requestAdmission: async () => {
@@ -963,8 +956,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
           log5("responding with admission offer", {
             host: identity.deviceKey
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-            line: 85,
+            file: "halo-invitations-handler.ts",
+            line: 84,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -979,8 +972,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
           log5("received authentication request", {
             authenticationCode: code
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-            line: 99,
+            file: "halo-invitations-handler.ts",
+            line: 98,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1000,8 +993,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               host: identity.deviceKey,
               guest: credentials.deviceKey
             }, {
-              file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-              line: 114,
+              file: "halo-invitations-handler.ts",
+              line: 113,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -1019,8 +1012,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               log5("connected", {
                 host: identity.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 130,
+                file: "halo-invitations-handler.ts",
+                line: 129,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1032,8 +1025,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 host: identity.deviceKey,
                 guest: deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 133,
+                file: "halo-invitations-handler.ts",
+                line: 132,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1041,8 +1034,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
             } catch (err) {
               if (!observable.cancelled) {
                 log5.error("failed", err, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                  line: 137,
+                  file: "halo-invitations-handler.ts",
+                  line: 136,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1075,13 +1068,13 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
   }
   acceptInvitation(invitation, options) {
     const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
-    const ctx = new Context({
+    const ctx = new Context2({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
       }
     });
-    const authenticated = new Trigger();
+    const authenticated = new Trigger2();
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         await ctx.dispose();
@@ -1091,7 +1084,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       }
     });
     let connectionCount = 0;
-    const complete = new Trigger();
+    const complete = new Trigger2();
     const createExtension = () => {
       const extension = new GuestHaloInvitationExtension({
         onOpen: () => {
@@ -1102,23 +1095,23 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
               }
               log5("connected", {}, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 210,
+                file: "halo-invitations-handler.ts",
+                line: 209,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
               log5("sending admission request", {}, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 214,
+                file: "halo-invitations-handler.ts",
+                line: 213,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               const { identityKey, haloSpaceKey, genesisFeedKey } = await extension.rpc.HaloHostService.requestAdmission();
               if (invitation.type === void 0 || invitation.type === Invitation2.Type.INTERACTIVE) {
                 log5("guest waiting for authentication code...", {}, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                  line: 221,
+                  file: "halo-invitations-handler.ts",
+                  line: 220,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1127,8 +1120,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                   timeout
                 });
                 log5("sending authentication request", {}, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                  line: 224,
+                  file: "halo-invitations-handler.ts",
+                  line: 223,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1145,8 +1138,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: identity.deviceKey,
                 identityKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 237,
+                file: "halo-invitations-handler.ts",
+                line: 236,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1155,8 +1148,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: identity.deviceKey,
                 identityKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 241,
+                file: "halo-invitations-handler.ts",
+                line: 240,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1164,8 +1157,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
             } catch (err) {
               if (!observable.cancelled) {
                 log5.warn("auth failed", err, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                  line: 245,
+                  file: "halo-invitations-handler.ts",
+                  line: 244,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1298,7 +1291,7 @@ var AbstractInvitationsProxy = class {
         }
         default: {
           log6.error(`Invalid state: ${invitation2.state}`, {}, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts",
+            file: "invitations-proxy.ts",
             line: 81,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -1364,7 +1357,7 @@ var AbstractInvitationsProxy = class {
         }
         default: {
           log6.error(`Invalid state: ${invitation2.state}`, {}, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts",
+            file: "invitations-proxy.ts",
             line: 146,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -1410,7 +1403,7 @@ var AbstractInvitationsService = class {
       const invitationsHandler = this._getInvitationsHandler();
       const context = this.getContext(invitation);
       log7("stream opened", this.getLoggingContext(), {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+        file: "invitations-service.ts",
         line: 43,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -1468,14 +1461,14 @@ var AbstractInvitationsService = class {
             ...context2,
             err
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+            file: "invitations-service.ts",
             line: 92,
             scope: this,
             callSite: (f, a) => f(...a)
           });
         } else {
           log7("stream closed", context2, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+            file: "invitations-service.ts",
             line: 94,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -1488,7 +1481,7 @@ var AbstractInvitationsService = class {
   acceptInvitation(invitation, options) {
     return new Stream8(({ next, close }) => {
       log7("stream opened", this.getLoggingContext(), {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+        file: "invitations-service.ts",
         line: 104,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -1542,14 +1535,14 @@ var AbstractInvitationsService = class {
             ...context,
             err
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+            file: "invitations-service.ts",
             line: 152,
             scope: this,
             callSite: (f, a) => f(...a)
           });
         } else {
           log7("stream closed", context, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+            file: "invitations-service.ts",
             line: 154,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -1561,7 +1554,7 @@ var AbstractInvitationsService = class {
   }
   async authenticate({ invitationId, authenticationCode }) {
     log7("authenticating...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+      file: "invitations-service.ts",
       line: 163,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -1572,7 +1565,7 @@ var AbstractInvitationsService = class {
       log7.warn("invalid invitation", {
         invitationId
       }, {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+        file: "invitations-service.ts",
         line: 167,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -1584,7 +1577,7 @@ var AbstractInvitationsService = class {
   async cancelInvitation(invitation) {
     var _a;
     log7("cancelling...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+      file: "invitations-service.ts",
       line: 174,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -1595,7 +1588,7 @@ var AbstractInvitationsService = class {
       log7.warn("invalid invitation", {
         invitationId: invitation.invitationId
       }, {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+        file: "invitations-service.ts",
         line: 179,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -1618,8 +1611,8 @@ var HaloInvitationsServiceImpl = class extends AbstractInvitationsService {
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts
 import assert8 from "@dxos/node-std/assert";
-import { scheduleTask as scheduleTask2, sleep as sleep2, Trigger as Trigger2 } from "@dxos/async";
-import { Context as Context2 } from "@dxos/context";
+import { scheduleTask as scheduleTask2, sleep as sleep2, Trigger as Trigger3 } from "@dxos/async";
+import { Context as Context3 } from "@dxos/context";
 import { createAdmissionCredentials, generatePasscode as generatePasscode2, getCredentialAssertion } from "@dxos/credentials";
 import { writeMessages as writeMessages2 } from "@dxos/feed-store";
 import { PublicKey as PublicKey4 } from "@dxos/keys";
@@ -1628,6 +1621,7 @@ import { createTeleportProtocolFactory as createTeleportProtocolFactory2, StarTo
 import { schema as schema4 } from "@dxos/protocols";
 import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
 import { AuthenticationResponse as AuthenticationResponse2 } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
 var MAX_OTP_ATTEMPTS = 3;
 var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   constructor(networkManager, _spaceManager, _signingContext, _keyring) {
@@ -1648,7 +1642,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       spaceKey: space.key,
       authenticationCode: generatePasscode2(AUTHENTICATION_CODE_LENGTH)
     };
-    const ctx = new Context2({
+    const ctx = new Context3({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
@@ -1659,7 +1653,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     });
     let authenticationCode;
     let authenticationRetry = 0;
-    const complete = new Trigger2();
+    const complete = new Trigger3();
     const createExtension = () => {
       let guestProfile;
       const hostInvitationExtension = new HostSpaceInvitationExtension({
@@ -1670,8 +1664,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
             host: this._signingContext.deviceKey,
             spaceKey: space.key
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-            line: 97,
+            file: "space-invitations-handler.ts",
+            line: 98,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1682,8 +1676,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
           log8("received authentication request", {
             authenticationCode: code
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-            line: 111,
+            file: "space-invitations-handler.ts",
+            line: 112,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1712,16 +1706,16 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               host: this._signingContext.deviceKey,
               guest: deviceKey
             }, {
-              file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-              line: 135,
+              file: "space-invitations-handler.ts",
+              line: 136,
               scope: this,
               callSite: (f, a) => f(...a)
             });
-            const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, deviceKey, space.key, controlFeedKey, dataFeedKey, space.genesisFeedKey, guestProfile);
+            const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, deviceKey, space.key, controlFeedKey, dataFeedKey, space.inner.genesisFeedKey, guestProfile);
             assert8(credentials[0]["@type"] === "dxos.echo.feed.CredentialsMessage");
             const spaceMemberCredential = credentials[0].credential;
             assert8(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
-            await writeMessages2(space.controlPipeline.writer, credentials);
+            await writeMessages2(space.inner.controlPipeline.writer, credentials);
             complete.wake(deviceKey);
             return {
               credential: spaceMemberCredential
@@ -1738,8 +1732,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               log8("connected", {
                 host: this._signingContext.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 169,
+                file: "space-invitations-handler.ts",
+                line: 170,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1751,8 +1745,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 host: this._signingContext.deviceKey,
                 guest: deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 172,
+                file: "space-invitations-handler.ts",
+                line: 173,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1760,8 +1754,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
             } catch (err) {
               if (!observable.cancelled) {
                 log8.error("failed", err, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                  line: 176,
+                  file: "space-invitations-handler.ts",
+                  line: 177,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1794,13 +1788,13 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   }
   acceptInvitation(invitation, options) {
     const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
-    const ctx = new Context2({
+    const ctx = new Context3({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
       }
     });
-    const authenticated = new Trigger2();
+    const authenticated = new Trigger3();
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         await ctx.dispose();
@@ -1810,7 +1804,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       }
     });
     let connectionCount = 0;
-    const complete = new Trigger2();
+    const complete = new Trigger3();
     const createExtension = () => {
       const extension = new GuestSpaceInvitationExtension({
         onOpen: () => {
@@ -1823,8 +1817,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               log8("connected", {
                 guest: this._signingContext.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 247,
+                file: "space-invitations-handler.ts",
+                line: 248,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1832,8 +1826,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               log8("introduce", {
                 guest: this._signingContext.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 251,
+                file: "space-invitations-handler.ts",
+                line: 252,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1843,8 +1837,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               if (invitation.type === void 0 || invitation.type === Invitation5.Type.INTERACTIVE) {
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
                   log8("guest waiting for authentication code...", {}, {
-                    file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                    line: 260,
+                    file: "space-invitations-handler.ts",
+                    line: 261,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -1853,8 +1847,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                     timeout
                   });
                   log8("sending authentication request", {}, {
-                    file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                    line: 264,
+                    file: "space-invitations-handler.ts",
+                    line: 265,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -1871,8 +1865,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                       log8("retrying invalid code", {
                         attempt
                       }, {
-                        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                        line: 274,
+                        file: "space-invitations-handler.ts",
+                        line: 275,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -1886,8 +1880,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               log8("request admission", {
                 guest: this._signingContext.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 285,
+                file: "space-invitations-handler.ts",
+                line: 286,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1910,8 +1904,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: this._signingContext.deviceKey,
                 spaceKey: space.key
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 308,
+                file: "space-invitations-handler.ts",
+                line: 309,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1919,8 +1913,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
             } catch (err) {
               if (!observable.cancelled) {
                 log8.warn("auth failed", err, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                  line: 312,
+                  file: "space-invitations-handler.ts",
+                  line: 313,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1955,7 +1949,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     return observable;
   }
 };
-var HostSpaceInvitationExtension = class extends RpcExtension {
+var HostSpaceInvitationExtension = class extends RpcExtension2 {
   constructor(_callbacks) {
     super({
       exposed: {
@@ -1984,7 +1978,7 @@ var HostSpaceInvitationExtension = class extends RpcExtension {
     this._callbacks.onOpen();
   }
 };
-var GuestSpaceInvitationExtension = class extends RpcExtension {
+var GuestSpaceInvitationExtension = class extends RpcExtension2 {
   constructor(_callbacks) {
     super({
       requested: {
@@ -2029,18 +2023,173 @@ var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-import { Trigger as Trigger3 } from "@dxos/async";
-import { failUndefined as failUndefined3 } from "@dxos/debug";
-import { MOCK_AUTH_PROVIDER as MOCK_AUTH_PROVIDER2, MOCK_AUTH_VERIFIER as MOCK_AUTH_VERIFIER2, valueEncoding, DataServiceSubscriptions, MetadataStore, SpaceManager } from "@dxos/echo-db";
+import { Trigger as Trigger4 } from "@dxos/async";
+import { failUndefined as failUndefined2 } from "@dxos/debug";
+import { MOCK_AUTH_PROVIDER, MOCK_AUTH_VERIFIER, valueEncoding, DataServiceSubscriptions, MetadataStore, SpaceManager } from "@dxos/echo-db";
 import { FeedFactory, FeedStore } from "@dxos/feed-store";
 import { Keyring } from "@dxos/keyring";
+import { log as log10 } from "@dxos/log";
+
+// packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+import { Event as Event3, synchronized } from "@dxos/async";
+import { spaceGenesis } from "@dxos/echo-db";
+import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log as log9 } from "@dxos/log";
+import { Presence as Presence2 } from "@dxos/teleport-extension-presence";
+import { ComplexMap as ComplexMap2 } from "@dxos/util";
+
+// packages/sdk/client-services/src/packlets/spaces/data-space.ts
+import assert10 from "@dxos/node-std/assert";
+import { Context as Context4 } from "@dxos/context";
+import { DataPipelineControllerImpl } from "@dxos/echo-db";
+var DataSpace = class {
+  constructor(_inner, _modelFactory, _memberKey, _presence) {
+    this._inner = _inner;
+    this._modelFactory = _modelFactory;
+    this._memberKey = _memberKey;
+    this._presence = _presence;
+    this._ctx = new Context4();
+    this._dataPipelineController = new DataPipelineControllerImpl(_modelFactory, _memberKey, (feedKey) => _inner.spaceState.feeds.get(feedKey));
+  }
+  get key() {
+    return this._inner.key;
+  }
+  get inner() {
+    return this._inner;
+  }
+  get isOpen() {
+    return this._inner.isOpen;
+  }
+  get dataPipelineController() {
+    return this._dataPipelineController;
+  }
+  get database() {
+    assert10(this._dataPipelineController.database);
+    return this._dataPipelineController.database;
+  }
+  get stateUpdate() {
+    return this._inner.stateUpdate;
+  }
+  get presence() {
+    return this._presence;
+  }
+  async open() {
+    await this._inner.open();
+  }
+  async close() {
+    await this._ctx.dispose();
+    await this._inner.close();
+    await this._presence.destroy();
+  }
+};
+
+// packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+var __decorate = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var DataSpaceManager = class {
+  constructor(_spaceManager, _metadataStore, _dataServiceSubscriptions, _keyring, _signingContext, _modelFactory) {
+    this._spaceManager = _spaceManager;
+    this._metadataStore = _metadataStore;
+    this._dataServiceSubscriptions = _dataServiceSubscriptions;
+    this._keyring = _keyring;
+    this._signingContext = _signingContext;
+    this._modelFactory = _modelFactory;
+    this.updated = new Event3();
+    this._spaces = new ComplexMap2(PublicKey5.hash);
+  }
+  get spaces() {
+    return this._spaces;
+  }
+  async open() {
+    await this._metadataStore.load();
+    for (const spaceMetadata of this._metadataStore.spaces) {
+      await this._constructSpace(spaceMetadata);
+    }
+  }
+  async close() {
+  }
+  async createSpace() {
+    const spaceKey = await this._keyring.createKey();
+    const controlFeedKey = await this._keyring.createKey();
+    const dataFeedKey = await this._keyring.createKey();
+    const metadata = {
+      key: spaceKey,
+      genesisFeedKey: controlFeedKey,
+      controlFeedKey,
+      dataFeedKey
+    };
+    log9("creating space...", {
+      spaceKey
+    }, {
+      file: "data-space-manager.ts",
+      line: 70,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const space = await this._constructSpace(metadata);
+    await spaceGenesis(this._keyring, this._signingContext, space.inner);
+    await this._metadataStore.addSpace(metadata);
+    this.updated.emit();
+    return space;
+  }
+  async acceptSpace(opts) {
+    const metadata = {
+      key: opts.spaceKey,
+      genesisFeedKey: opts.genesisFeedKey,
+      controlFeedKey: opts.controlFeedKey,
+      dataFeedKey: opts.dataFeedKey
+    };
+    const space = await this._constructSpace(metadata);
+    await this._metadataStore.addSpace(metadata);
+    this.updated.emit();
+    return space;
+  }
+  async _constructSpace(metadata) {
+    const presence = new Presence2({
+      localPeerId: this._signingContext.deviceKey,
+      announceInterval: 1e3,
+      offlineTimeout: 3e4,
+      identityKey: this._signingContext.identityKey
+    });
+    const space = await this._spaceManager.constructSpace({
+      metadata,
+      swarmIdentity: {
+        peerKey: this._signingContext.deviceKey,
+        credentialProvider: this._signingContext.credentialProvider,
+        credentialAuthenticator: this._signingContext.credentialAuthenticator
+      },
+      dataPipelineControllerProvider: () => dataSpace.dataPipelineController,
+      presence
+    });
+    const dataSpace = new DataSpace(space, this._modelFactory, this._signingContext.identityKey, presence);
+    await space.open();
+    this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.database.createDataServiceHost());
+    this._spaces.set(metadata.key, dataSpace);
+    return dataSpace;
+  }
+};
+__decorate([
+  synchronized
+], DataSpaceManager.prototype, "open", null);
+__decorate([
+  synchronized
+], DataSpaceManager.prototype, "close", null);
+
+// packages/sdk/client-services/src/packlets/services/service-context.ts
 var ServiceContext = class {
   constructor(storage, networkManager, modelFactory) {
     this.storage = storage;
     this.networkManager = networkManager;
     this.modelFactory = modelFactory;
-    this.initialized = new Trigger3();
+    this.initialized = new Trigger4();
     this.dataServiceSubscriptions = new DataServiceSubscriptions();
     this.metadataStore = new MetadataStore(storage.createDirectory("metadata"));
     this.keyring = new Keyring(storage.createDirectory("keyring"));
@@ -2053,92 +2202,88 @@ var ServiceContext = class {
         }
       })
     });
-    this.identityManager = new IdentityManager(this.metadataStore, this.feedStore, this.keyring, networkManager, modelFactory);
+    this.spaceManager = new SpaceManager({
+      feedStore: this.feedStore,
+      networkManager: this.networkManager
+    });
+    this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.spaceManager);
     this.haloInvitations = new HaloInvitationsHandler(this.networkManager, this.identityManager);
   }
   async open() {
-    log9("opening...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 78,
+    log10("opening...", {}, {
+      file: "service-context.ts",
+      line: 81,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    await this.spaceManager.open();
     await this.identityManager.open();
     if (this.identityManager.identity) {
       await this._initialize();
     }
-    log9("opened", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 83,
+    log10("opened", {}, {
+      file: "service-context.ts",
+      line: 87,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
   async close() {
     var _a;
-    log9("closing...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 87,
+    log10("closing...", {}, {
+      file: "service-context.ts",
+      line: 91,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    await ((_a = this.dataSpaceManager) == null ? void 0 : _a.close());
     await this.identityManager.close();
-    await ((_a = this.spaceManager) == null ? void 0 : _a.close());
+    await this.spaceManager.close();
     await this.feedStore.close();
     await this.networkManager.close();
     this.dataServiceSubscriptions.clear();
-    log9("closed", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 93,
+    log10("closed", {}, {
+      file: "service-context.ts",
+      line: 98,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
   async reset() {
-    log9("resetting...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 97,
+    log10("resetting...", {}, {
+      file: "service-context.ts",
+      line: 102,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this.close();
     await this.storage.reset();
-    log9("reset", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 100,
+    log10("reset", {}, {
+      file: "service-context.ts",
+      line: 105,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
   async createIdentity(params = {}) {
     const identity = await this.identityManager.createIdentity(params);
-    this.dataServiceSubscriptions.registerSpace(identity.haloSpaceKey, identity.haloDatabase.createDataServiceHost());
     await this._initialize();
     return identity;
   }
   async _initialize() {
     var _a;
-    const identity = (_a = this.identityManager.identity) != null ? _a : failUndefined3();
+    const identity = (_a = this.identityManager.identity) != null ? _a : failUndefined2();
     const signingContext = {
-      credentialProvider: MOCK_AUTH_PROVIDER2,
-      credentialAuthenticator: MOCK_AUTH_VERIFIER2,
+      credentialProvider: MOCK_AUTH_PROVIDER,
+      credentialAuthenticator: MOCK_AUTH_VERIFIER,
       credentialSigner: identity.getIdentityCredentialSigner(),
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey,
       profile: identity.profileDocument
     };
-    const spaceManager = new SpaceManager({
-      metadataStore: this.metadataStore,
-      feedStore: this.feedStore,
-      networkManager: this.networkManager,
-      keyring: this.keyring,
-      dataServiceSubscriptions: this.dataServiceSubscriptions,
-      modelFactory: this.modelFactory,
-      signingContext
-    });
-    await spaceManager.open();
-    this.spaceManager = spaceManager;
-    this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.spaceManager, signingContext, this.keyring);
+    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.modelFactory);
+    await this.dataSpaceManager.open();
+    this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.dataSpaceManager, signingContext, this.keyring);
     this.initialized.wake();
   }
 };
@@ -2162,7 +2307,7 @@ var clientServiceBundle = createServiceBundle({
 // packages/sdk/client-services/src/packlets/services/service-host.ts
 import { raise } from "@dxos/debug";
 import { DataServiceImpl } from "@dxos/echo-db";
-import { log as log10 } from "@dxos/log";
+import { log as log11 } from "@dxos/log";
 import { ModelFactory } from "@dxos/model-factory";
 import { ObjectModel } from "@dxos/object-model";
 import { TextModel } from "@dxos/text-model";
@@ -2337,20 +2482,20 @@ var ClientServicesHost = class {
     var _a;
     await this._initialize();
     const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    log10("opening...", {
+    log11("opening...", {
       deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts",
+      file: "service-host.ts",
       line: 69,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._initialize();
     await this._serviceContext.open();
-    log10("opened", {
+    log11("opened", {
       deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts",
+      file: "service-host.ts",
       line: 72,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -2359,19 +2504,19 @@ var ClientServicesHost = class {
   async close() {
     var _a;
     const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    log10("closing...", {
+    log11("closing...", {
       deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts",
+      file: "service-host.ts",
       line: 77,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._serviceContext.close();
-    log10("closed", {
+    log11("closed", {
       deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts",
+      file: "service-host.ts",
       line: 79,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -2388,7 +2533,7 @@ var ClientServicesHost = class {
         return (_a = this._serviceContext.spaceInvitations) != null ? _a : raise(new Error("SpaceInvitations not initialized"));
       }, () => {
         var _a;
-        return (_a = this._serviceContext.spaceManager) != null ? _a : raise(new Error("SpaceManager not initialized"));
+        return (_a = this._serviceContext.dataSpaceManager) != null ? _a : raise(new Error("SpaceManager not initialized"));
       }),
       SpacesService: new SpacesServiceImpl(),
       DataService: new DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
@@ -2408,11 +2553,11 @@ var ClientServicesHost = class {
 // packages/sdk/client-services/src/packlets/services/service-proxy.ts
 import { asyncTimeout } from "@dxos/async";
 import { RemoteServiceConnectionTimeout } from "@dxos/errors";
-import { createProtoRpcPeer as createProtoRpcPeer2 } from "@dxos/rpc";
+import { createProtoRpcPeer } from "@dxos/rpc";
 var ClientServicesProxy = class {
   constructor(port, _timeout = 3e4) {
     this._timeout = _timeout;
-    this._proxy = createProtoRpcPeer2({
+    this._proxy = createProtoRpcPeer({
       requested: clientServiceBundle,
       exposed: {},
       handlers: {},
@@ -2438,7 +2583,7 @@ var ClientServicesProxy = class {
 
 // packages/sdk/client-services/src/packlets/vault/iframe-runtime.ts
 import { WebRTCTransportService } from "@dxos/network-manager";
-import { createProtoRpcPeer as createProtoRpcPeer3 } from "@dxos/rpc";
+import { createProtoRpcPeer as createProtoRpcPeer2 } from "@dxos/rpc";
 
 // packages/sdk/client-services/src/packlets/vault/services.ts
 import { schema as schema6 } from "@dxos/protocols";
@@ -2457,7 +2602,7 @@ var IFrameRuntime = class {
     this._systemPort = systemPort;
     this._windowAppPort = windowAppPort;
     this._workerAppPort = workerAppPort;
-    this._systemRpc = createProtoRpcPeer3({
+    this._systemRpc = createProtoRpcPeer2({
       requested: workerServiceBundle,
       exposed: iframeServiceBundle,
       handlers: {
@@ -2486,17 +2631,17 @@ var IFrameRuntime = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
-import { Trigger as Trigger5 } from "@dxos/async";
+import { Trigger as Trigger6 } from "@dxos/async";
 import { MemorySignalManager, MemorySignalManagerContext, WebsocketSignalManager } from "@dxos/messaging";
 import { NetworkManager, WebRTCTransportProxyFactory } from "@dxos/network-manager";
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
-import assert10 from "@dxos/node-std/assert";
-import { Trigger as Trigger4 } from "@dxos/async";
-import { log as log11, logInfo } from "@dxos/log";
-import { createProtoRpcPeer as createProtoRpcPeer4 } from "@dxos/rpc";
+import assert11 from "@dxos/node-std/assert";
+import { Trigger as Trigger5 } from "@dxos/async";
+import { log as log12, logInfo } from "@dxos/log";
+import { createProtoRpcPeer as createProtoRpcPeer3 } from "@dxos/rpc";
 import { Callback } from "@dxos/util";
-var __decorate = function(decorators, target, key, desc) {
+var __decorate2 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2510,13 +2655,13 @@ var WorkerSession = class {
   constructor({ getServices, systemPort, appPort, options = {
     heartbeatInterval: 1e3
   } }) {
-    this._startTrigger = new Trigger4();
+    this._startTrigger = new Trigger5();
     this.onClose = new Callback();
-    assert10(options);
-    assert10(getServices);
+    assert11(options);
+    assert11(getServices);
     this._options = options;
     this._getServices = getServices;
-    this._clientRpc = createProtoRpcPeer4({
+    this._clientRpc = createProtoRpcPeer3({
       exposed: clientServiceBundle,
       handlers: {
         HaloInvitationsService: async () => (await this._getServices()).services.HaloInvitationsService,
@@ -2532,7 +2677,7 @@ var WorkerSession = class {
       },
       port: appPort
     });
-    this._iframeRpc = createProtoRpcPeer4({
+    this._iframeRpc = createProtoRpcPeer3({
       requested: iframeServiceBundle,
       exposed: workerServiceBundle,
       handlers: {
@@ -2546,8 +2691,8 @@ var WorkerSession = class {
               try {
                 await this.close();
               } catch (err) {
-                log11.catch(err, {}, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+                log12.catch(err, {}, {
+                  file: "worker-session.ts",
                   line: 89,
                   scope: this,
                   callSite: (f, a) => f(...a)
@@ -2563,8 +2708,8 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    log11.info("opening..", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+    log12.info("opening..", {}, {
+      file: "worker-session.ts",
       line: 103,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -2580,10 +2725,10 @@ var WorkerSession = class {
       try {
         await this._iframeRpc.rpc.IframeService.heartbeat();
       } catch (err1) {
-        log11.warn("Heartbeat failed", {
+        log12.warn("Heartbeat failed", {
           err: err1
         }, {
-          file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+          file: "worker-session.ts",
           line: 115,
           scope: this,
           callSite: (f, a) => f(...a)
@@ -2591,8 +2736,8 @@ var WorkerSession = class {
         try {
           await this.close();
         } catch (err) {
-          log11.catch(err, {}, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+          log12.catch(err, {}, {
+            file: "worker-session.ts",
             line: 119,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -2602,8 +2747,8 @@ var WorkerSession = class {
     }, this._options.heartbeatInterval);
   }
   async close() {
-    log11.info("closing..", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+    log12.info("closing..", {}, {
+      file: "worker-session.ts",
       line: 126,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -2611,8 +2756,8 @@ var WorkerSession = class {
     try {
       await this.onClose.callIfSet();
     } catch (err) {
-      log11.catch(err, {}, {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+      log12.catch(err, {}, {
+        file: "worker-session.ts",
         line: 130,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -2627,7 +2772,7 @@ var WorkerSession = class {
     ]);
   }
 };
-__decorate([
+__decorate2([
   logInfo
 ], WorkerSession.prototype, "origin", void 0);
 
@@ -2636,7 +2781,7 @@ var WorkerRuntime = class {
   constructor(_configProvider) {
     this._configProvider = _configProvider;
     this._transportFactory = new WebRTCTransportProxyFactory();
-    this._ready = new Trigger5();
+    this._ready = new Trigger6();
     this.sessions = /* @__PURE__ */ new Set();
   }
   async start() {
@@ -2710,6 +2855,7 @@ export {
   ClientServicesProxy,
   DevtoolsHostEvents,
   DevtoolsServiceImpl,
+  HaloAuthVerifier,
   HaloInvitationsHandler,
   HaloInvitationsProxy,
   HaloInvitationsServiceImpl,
@@ -2734,7 +2880,6 @@ export {
   clientServiceBundle,
   createDefaultModelFactory,
   createHaloAuthProvider,
-  createHaloAuthVerifier,
   createStorageObjects,
   getNetworkPeers,
   subscribeToFeedBlocks,
@@ -2746,3 +2891,4 @@ export {
   subscribeToSwarmInfo,
   wrapObservable
 };
+//# sourceMappingURL=index.mjs.map