@dxos/client-services 0.1.18 → 0.1.19

package/dist/lib/node/index.cjs

@@ -35,6 +35,7 @@ __export(src_exports, {
   ClientServicesProxy: () => ClientServicesProxy,
   DevtoolsHostEvents: () => DevtoolsHostEvents,
   DevtoolsServiceImpl: () => DevtoolsServiceImpl,
+  HaloAuthVerifier: () => HaloAuthVerifier,
   HaloInvitationsHandler: () => HaloInvitationsHandler,
   HaloInvitationsProxy: () => HaloInvitationsProxy,
   HaloInvitationsServiceImpl: () => HaloInvitationsServiceImpl,
@@ -59,7 +60,6 @@ __export(src_exports, {
   clientServiceBundle: () => clientServiceBundle,
   createDefaultModelFactory: () => createDefaultModelFactory,
   createHaloAuthProvider: () => createHaloAuthProvider,
-  createHaloAuthVerifier: () => createHaloAuthVerifier,
   createStorageObjects: () => createStorageObjects,
   getNetworkPeers: () => getNetworkPeers,
   subscribeToFeedBlocks: () => subscribeToFeedBlocks,
@@ -79,6 +79,7 @@ var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_debug = require("@dxos/debug");
 var import_log = require("@dxos/log");
+var import_client = require("@dxos/protocols/proto/dxos/client");
 var import_util = require("@dxos/util");
 var SpaceServiceImpl = class {
   constructor(serviceContext) {
@@ -101,26 +102,27 @@ var SpaceServiceImpl = class {
     return new import_codec_protobuf.Stream(({ next }) => {
       const subscriptions = new import_async.EventSubscriptions();
       const onUpdate = () => {
-        const spaces = Array.from(this.serviceContext.spaceManager.spaces.values()).map((space) => ({
+        const spaces = Array.from(this.serviceContext.dataSpaceManager.spaces.values()).map((space) => ({
           publicKey: space.key,
           isOpen: true,
           isActive: true,
-          members: Array.from(space.spaceState.members.values()).map((member) => {
-            var _a, _b;
+          members: Array.from(space.inner.spaceState.members.values()).map((member) => {
+            var _a, _b, _c;
             return {
               identityKey: member.key,
               profile: {
                 identityKey: member.key,
                 displayName: (_b = (_a = member.assertion.profile) == null ? void 0 : _a.displayName) != null ? _b : (0, import_util.humanize)(member.key)
-              }
+              },
+              presenceState: ((_c = this.serviceContext.identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_client.SpaceMember.PresenceState.ONLINE : import_client.SpaceMember.PresenceState.OFFLINE
             };
           })
         }));
         (0, import_log.log)("update", {
           spaces
         }, {
-          file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/deprecated/space.ts",
-          line: 114,
+          file: "space.ts",
+          line: 120,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -129,20 +131,22 @@ var SpaceServiceImpl = class {
         });
       };
       setTimeout(async () => {
-        if (!this.serviceContext.spaceManager) {
+        if (!this.serviceContext.dataSpaceManager) {
           next({
             spaces: []
           });
         }
         await this.serviceContext.initialized.wait();
-        subscriptions.add(this.serviceContext.spaceManager.updated.on(() => {
-          this.serviceContext.spaceManager.spaces.forEach((space) => {
+        subscriptions.add(this.serviceContext.dataSpaceManager.updated.on(() => {
+          this.serviceContext.dataSpaceManager.spaces.forEach((space) => {
             subscriptions.add(space.stateUpdate.on(onUpdate));
+            subscriptions.add(space.presence.updated.on(onUpdate));
           });
           onUpdate();
         }));
-        this.serviceContext.spaceManager.spaces.forEach((space) => {
+        this.serviceContext.dataSpaceManager.spaces.forEach((space) => {
           subscriptions.add(space.stateUpdate.on(onUpdate));
+          subscriptions.add(space.presence.updated.on(onUpdate));
         });
         onUpdate();
       });
@@ -154,7 +158,7 @@ var SpaceServiceImpl = class {
   }
   async createSpace() {
     await this.serviceContext.initialized.wait();
-    const space = await this.serviceContext.spaceManager.createSpace();
+    const space = await this.serviceContext.dataSpaceManager.createSpace();
     return {
       publicKey: space.key,
       isOpen: true,
@@ -451,7 +455,7 @@ var subscribeToSpaces = (context, { spaceKeys = [] }) => new import_codec_protob
   };
   const timeout = setTimeout(async () => {
     await context.initialized.wait();
-    unsubscribe = context.spaceManager.updated.on(() => update());
+    unsubscribe = context.dataSpaceManager.updated.on(() => update());
     await update();
   });
   return () => {
@@ -548,6 +552,8 @@ var DevtoolsServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/authenticator.ts
+var import_async4 = require("@dxos/async");
+var import_context = require("@dxos/context");
 var import_credentials = require("@dxos/credentials");
 var import_log2 = require("@dxos/log");
 var import_protocols = require("@dxos/protocols");
@@ -561,76 +567,108 @@ var createHaloAuthProvider = (signer) => async (nonce) => {
   });
   return import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").encode(credential);
 };
-var createHaloAuthVerifier = (getDeviceSet) => async (nonce, auth) => {
-  const credential = import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
-  const deviceSet = getDeviceSet();
-  const result = await (0, import_credentials.verifyCredential)(credential);
-  if (result.kind === "fail") {
-    (0, import_log2.log)("Invalid credential", {
-      result
-    }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts",
-      line: 34,
-      scope: void 0,
-      callSite: (f, a) => f(...a)
-    });
-    return false;
-  }
-  if (!credential.proof.nonce || !Buffer.from(nonce).equals(credential.proof.nonce)) {
-    (0, import_log2.log)("Invalid nonce", {
-      nonce,
-      credential
-    }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts",
-      line: 39,
-      scope: void 0,
-      callSite: (f, a) => f(...a)
-    });
-    return false;
+var HaloAuthVerifier = class {
+  constructor(_params) {
+    this._params = _params;
+    this._ctx = new import_context.Context();
   }
-  if (!deviceSet.has(credential.issuer)) {
-    (0, import_log2.log)("Device not in allowed set", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts",
-      line: 44,
-      scope: void 0,
-      callSite: (f, a) => f(...a)
-    });
-    return false;
+  async close() {
+    await this._ctx.dispose();
+  }
+  _isTrustedDevice(deviceKey) {
+    const deviceSet = this._params.trustedDevicesProvider();
+    return deviceSet.has(deviceKey);
+  }
+  get verifier() {
+    return async (nonce, auth) => {
+      const credential = import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
+      const result = await (0, import_credentials.verifyCredential)(credential);
+      if (result.kind === "fail") {
+        (0, import_log2.log)("Invalid credential", {
+          result
+        }, {
+          file: "authenticator.ts",
+          line: 61,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        return false;
+      }
+      if (!credential.proof.nonce || !Buffer.from(nonce).equals(credential.proof.nonce)) {
+        (0, import_log2.log)("Invalid nonce", {
+          nonce,
+          credential
+        }, {
+          file: "authenticator.ts",
+          line: 66,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        return false;
+      }
+      if (this._isTrustedDevice(credential.issuer)) {
+        return true;
+      }
+      const trigger = new import_async4.Trigger();
+      this._ctx.onDispose(() => {
+        trigger.wake(false);
+      });
+      const clear = this._params.update.on(this._ctx, () => {
+        if (this._isTrustedDevice(credential.issuer)) {
+          trigger.wake(true);
+        }
+      });
+      try {
+        await trigger.wait({
+          timeout: this._params.authTimeout
+        });
+        return true;
+      } catch (e) {
+        return false;
+      } finally {
+        clear();
+      }
+    };
   }
-  return true;
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity.ts
 var import_node_assert2 = __toESM(require("node:assert"));
-var import_async4 = require("@dxos/async");
+var import_async5 = require("@dxos/async");
 var import_credentials2 = require("@dxos/credentials");
-var import_debug3 = require("@dxos/debug");
 var import_feed_store2 = require("@dxos/feed-store");
 var import_log3 = require("@dxos/log");
 var import_credentials3 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var AUTH_TIMEOUT = 3e4;
 var Identity = class {
   constructor({ space, signer, identityKey, deviceKey }) {
-    this.stateUpdate = new import_async4.Event();
-    this._space = space;
+    this.stateUpdate = new import_async5.Event();
+    this.space = space;
     this._signer = signer;
     this.identityKey = identityKey;
     this.deviceKey = deviceKey;
     this._deviceStateMachine = new import_credentials2.DeviceStateMachine(this.identityKey, this.deviceKey);
     this._profileStateMachine = new import_credentials2.ProfileStateMachine(this.identityKey);
-    this._space.onCredentialProcessed.set(async (credential) => {
+    this.space.onCredentialProcessed.set(async (credential) => {
       await this._deviceStateMachine.process(credential);
       await this._profileStateMachine.process(credential);
       this.stateUpdate.emit();
     });
+    this.authVerifier = new HaloAuthVerifier({
+      trustedDevicesProvider: () => this.authorizedDeviceKeys,
+      update: this.stateUpdate,
+      authTimeout: AUTH_TIMEOUT
+    });
   }
   get authorizedDeviceKeys() {
     return this._deviceStateMachine.authorizedDeviceKeys;
   }
   async open() {
-    await this._space.open();
+    await this.space.open();
   }
   async close() {
-    await this._space.close();
+    await this.authVerifier.close();
+    await this.space.close();
   }
   async ready() {
     await this._deviceStateMachine.deviceChainReady.wait();
@@ -639,23 +677,19 @@ var Identity = class {
     return this._profileStateMachine.profile;
   }
   get controlPipeline() {
-    return this._space.controlPipeline;
+    return this.space.controlPipeline;
   }
   get haloSpaceKey() {
-    return this._space.key;
+    return this.space.key;
   }
   get haloGenesisFeedKey() {
-    return this._space.genesisFeedKey;
-  }
-  get haloDatabase() {
-    var _a;
-    return (_a = this._space.database) != null ? _a : (0, import_debug3.failUndefined)();
+    return this.space.genesisFeedKey;
   }
   getAdmissionCredentials() {
     return {
       deviceKey: this.deviceKey,
-      controlFeedKey: this._space.controlFeedKey,
-      dataFeedKey: this._space.dataFeedKey
+      controlFeedKey: this.space.controlFeedKey,
+      dataFeedKey: this.space.dataFeedKey
     };
   }
   getIdentityCredentialSigner() {
@@ -673,8 +707,8 @@ var Identity = class {
       controlFeedKey,
       dataFeedKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity.ts",
-      line: 137,
+      file: "identity.ts",
+      line: 147,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -717,19 +751,19 @@ var Identity = class {
 
 // packages/sdk/client-services/src/packlets/identity/identity-manager.ts
 var import_node_assert3 = __toESM(require("node:assert"));
-var import_async5 = require("@dxos/async");
+var import_async6 = require("@dxos/async");
 var import_credentials4 = require("@dxos/credentials");
 var import_echo_db = require("@dxos/echo-db");
 var import_log4 = require("@dxos/log");
 var import_credentials5 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_teleport_extension_presence = require("@dxos/teleport-extension-presence");
+var import_util3 = require("@dxos/util");
 var IdentityManager = class {
-  constructor(_metadataStore, _feedStore, _keyring, _networkManager, _modelFactory) {
+  constructor(_metadataStore, _keyring, _spaceManager) {
     this._metadataStore = _metadataStore;
-    this._feedStore = _feedStore;
     this._keyring = _keyring;
-    this._networkManager = _networkManager;
-    this._modelFactory = _modelFactory;
-    this.stateUpdate = new import_async5.Event();
+    this._spaceManager = _spaceManager;
+    this.stateUpdate = new import_async6.Event();
   }
   get identity() {
     return this._identity;
@@ -751,8 +785,8 @@ var IdentityManager = class {
   async createIdentity({ displayName } = {}) {
     (0, import_node_assert3.default)(!this._identity, "Identity already exists.");
     (0, import_log4.log)("creating identity...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 82,
+      file: "identity-manager.ts",
+      line: 72,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -796,8 +830,8 @@ var IdentityManager = class {
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 141,
+      file: "identity-manager.ts",
+      line: 131,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -807,8 +841,8 @@ var IdentityManager = class {
     (0, import_log4.log)("accepting identity", {
       params
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 149,
+      file: "identity-manager.ts",
+      line: 139,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -835,8 +869,8 @@ var IdentityManager = class {
     (0, import_log4.log)("constructing identity", {
       identityRecord
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 173,
+      file: "identity-manager.ts",
+      line: 163,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -844,46 +878,43 @@ var IdentityManager = class {
       spaceRecord: identityRecord.haloSpace,
       swarmIdentity: {
         peerKey: identityRecord.deviceKey,
-        credentialProvider: import_echo_db.MOCK_AUTH_PROVIDER,
-        credentialAuthenticator: import_echo_db.MOCK_AUTH_VERIFIER
-      }
-    });
-    (0, import_log4.log)("done", {
+        credentialProvider: createHaloAuthProvider((0, import_credentials4.createCredentialSignerWithKey)(this._keyring, identityRecord.deviceKey)),
+        credentialAuthenticator: (0, import_util3.deferFunction)(() => identity.authVerifier.verifier)
+      },
       identityKey: identityRecord.identityKey
-    }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts",
-      line: 184,
-      scope: this,
-      callSite: (f, a) => f(...a)
     });
-    return new Identity({
+    const identity = new Identity({
       space,
       signer: this._keyring,
       identityKey: identityRecord.identityKey,
       deviceKey: identityRecord.deviceKey
     });
-  }
-  async _constructSpace({ spaceRecord, swarmIdentity }) {
-    const controlFeed = await this._feedStore.openFeed(spaceRecord.writeControlFeedKey, {
-      writable: true
-    });
-    const dataFeed = await this._feedStore.openFeed(spaceRecord.writeDataFeedKey, {
-      writable: true
-    });
-    const genesisFeed = await this._feedStore.openFeed(spaceRecord.genesisFeedKey);
-    const protocol = new import_echo_db.SpaceProtocol({
-      topic: spaceRecord.spaceKey,
-      identity: swarmIdentity,
-      networkManager: this._networkManager
+    (0, import_log4.log)("done", {
+      identityKey: identityRecord.identityKey
+    }, {
+      file: "identity-manager.ts",
+      line: 182,
+      scope: this,
+      callSite: (f, a) => f(...a)
     });
-    return new import_echo_db.Space({
-      spaceKey: spaceRecord.spaceKey,
-      protocol,
-      genesisFeed,
-      controlFeed,
-      dataFeed,
-      feedProvider: (feedKey) => this._feedStore.openFeed(feedKey),
-      databaseFactory: async ({ databaseBackend }) => new import_echo_db.Database(this._modelFactory, databaseBackend, swarmIdentity.peerKey)
+    return identity;
+  }
+  async _constructSpace({ spaceRecord, swarmIdentity, identityKey }) {
+    return this._spaceManager.constructSpace({
+      metadata: {
+        key: spaceRecord.spaceKey,
+        genesisFeedKey: spaceRecord.genesisFeedKey,
+        controlFeedKey: spaceRecord.writeControlFeedKey,
+        dataFeedKey: spaceRecord.writeDataFeedKey
+      },
+      dataPipelineControllerProvider: () => new import_echo_db.NoopDataPipelineController(),
+      swarmIdentity,
+      presence: new import_teleport_extension_presence.Presence({
+        localPeerId: swarmIdentity.peerKey,
+        announceInterval: 1e3,
+        offlineTimeout: 3e4,
+        identityKey
+      })
     });
   }
 };
@@ -904,25 +935,26 @@ var InvitationEncoder = class {
 
 // packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
 var import_node_assert5 = __toESM(require("node:assert"));
-var import_async7 = require("@dxos/async");
-var import_context = require("@dxos/context");
+var import_async8 = require("@dxos/async");
+var import_context2 = require("@dxos/context");
 var import_credentials6 = require("@dxos/credentials");
-var import_debug4 = require("@dxos/debug");
+var import_debug3 = require("@dxos/debug");
 var import_keys4 = require("@dxos/keys");
 var import_log5 = require("@dxos/log");
 var import_network_manager = require("@dxos/network-manager");
 var import_protocols3 = require("@dxos/protocols");
 var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
+var import_teleport = require("@dxos/teleport");
 
 // packages/sdk/client-services/src/packlets/invitations/invitations.ts
 var import_node_assert4 = __toESM(require("node:assert"));
-var import_async6 = require("@dxos/async");
+var import_async7 = require("@dxos/async");
 var import_services = require("@dxos/protocols/proto/dxos/client/services");
 var AUTHENTICATION_CODE_LENGTH = 6;
 var INVITATION_TIMEOUT = 3 * 6e4;
 var ON_CLOSE_DELAY = 500;
-var InvitationObservableProvider = class extends import_async6.CancellableObservableProvider {
+var InvitationObservableProvider = class extends import_async7.CancellableObservableProvider {
   get invitation() {
     return this._invitation;
   }
@@ -962,45 +994,6 @@ var AbstractInvitationsHandler = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/rpc-extension.ts
-var import_rpc = require("@dxos/rpc");
-var RpcExtension = class {
-  constructor(_params) {
-    this._params = _params;
-  }
-  get initiator() {
-    return this._extensionContext.initiator;
-  }
-  get localPeerId() {
-    return this._extensionContext.localPeerId;
-  }
-  get remotePeerId() {
-    return this._extensionContext.remotePeerId;
-  }
-  get rpc() {
-    return this._rpc.rpc;
-  }
-  async onOpen(context) {
-    this._extensionContext = context;
-    const handlers = await this.getHandlers();
-    const port = context.createPort("rpc", {
-      contentType: 'application/x-protobuf; messageType="dxos.rpc.Message"'
-    });
-    this._rpc = (0, import_rpc.createProtoRpcPeer)({
-      ...this._params,
-      handlers,
-      port
-    });
-    await this._rpc.open();
-  }
-  async onClose(err) {
-    await this._rpc.close();
-  }
-  close() {
-    this._extensionContext.close();
-  }
-};
-
 // packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
 var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
   constructor(networkManager, _identityManager) {
@@ -1011,14 +1004,14 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
     var _a;
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
     (0, import_node_assert5.default)(type !== import_services2.Invitation.Type.OFFLINE);
-    const identity = (_a = this._identityManager.identity) != null ? _a : (0, import_debug4.failUndefined)();
+    const identity = (_a = this._identityManager.identity) != null ? _a : (0, import_debug3.failUndefined)();
     const invitation = {
       type,
       invitationId: import_keys4.PublicKey.random().toHex(),
       swarmKey: swarmKey != null ? swarmKey : import_keys4.PublicKey.random(),
       authenticationCode: (0, import_credentials6.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
     };
-    const ctx = new import_context.Context({
+    const ctx = new import_context2.Context({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
@@ -1028,7 +1021,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       await ctx.dispose();
     });
     let authenticationCode;
-    const complete = new import_async7.Trigger();
+    const complete = new import_async8.Trigger();
     const createExtension = () => {
       const hostInvitationExtension = new HostHaloInvitationExtension({
         requestAdmission: async () => {
@@ -1036,8 +1029,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
           (0, import_log5.log)("responding with admission offer", {
             host: identity.deviceKey
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-            line: 85,
+            file: "halo-invitations-handler.ts",
+            line: 84,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1052,8 +1045,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
           (0, import_log5.log)("received authentication request", {
             authenticationCode: code
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-            line: 99,
+            file: "halo-invitations-handler.ts",
+            line: 98,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1073,8 +1066,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               host: identity.deviceKey,
               guest: credentials.deviceKey
             }, {
-              file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-              line: 114,
+              file: "halo-invitations-handler.ts",
+              line: 113,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -1086,14 +1079,14 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
           }
         },
         onOpen: () => {
-          (0, import_async7.scheduleTask)(ctx, async () => {
+          (0, import_async8.scheduleTask)(ctx, async () => {
             var _a2, _b;
             try {
               (0, import_log5.log)("connected", {
                 host: identity.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 130,
+                file: "halo-invitations-handler.ts",
+                line: 129,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1105,8 +1098,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 host: identity.deviceKey,
                 guest: deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 133,
+                file: "halo-invitations-handler.ts",
+                line: 132,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1114,15 +1107,15 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
             } catch (err) {
               if (!observable.cancelled) {
                 import_log5.log.error("failed", err, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                  line: 137,
+                  file: "halo-invitations-handler.ts",
+                  line: 136,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 observable.callback.onError(err);
               }
             } finally {
-              await (0, import_async7.sleep)(ON_CLOSE_DELAY);
+              await (0, import_async8.sleep)(ON_CLOSE_DELAY);
               await ctx.dispose();
             }
           });
@@ -1130,7 +1123,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return hostInvitationExtension;
     };
-    (0, import_async7.scheduleTask)(ctx, async () => {
+    (0, import_async8.scheduleTask)(ctx, async () => {
       var _a2, _b;
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
@@ -1148,13 +1141,13 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
   }
   acceptInvitation(invitation, options) {
     const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
-    const ctx = new import_context.Context({
+    const ctx = new import_context2.Context({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
       }
     });
-    const authenticated = new import_async7.Trigger();
+    const authenticated = new import_async8.Trigger();
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         await ctx.dispose();
@@ -1164,34 +1157,34 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       }
     });
     let connectionCount = 0;
-    const complete = new import_async7.Trigger();
+    const complete = new import_async8.Trigger();
     const createExtension = () => {
       const extension = new GuestHaloInvitationExtension({
         onOpen: () => {
-          (0, import_async7.scheduleTask)(ctx, async () => {
+          (0, import_async8.scheduleTask)(ctx, async () => {
             var _a, _b, _c, _d;
             try {
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
               }
               (0, import_log5.log)("connected", {}, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 210,
+                file: "halo-invitations-handler.ts",
+                line: 209,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
               (0, import_log5.log)("sending admission request", {}, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 214,
+                file: "halo-invitations-handler.ts",
+                line: 213,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               const { identityKey, haloSpaceKey, genesisFeedKey } = await extension.rpc.HaloHostService.requestAdmission();
               if (invitation.type === void 0 || invitation.type === import_services2.Invitation.Type.INTERACTIVE) {
                 (0, import_log5.log)("guest waiting for authentication code...", {}, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                  line: 221,
+                  file: "halo-invitations-handler.ts",
+                  line: 220,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1200,8 +1193,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                   timeout
                 });
                 (0, import_log5.log)("sending authentication request", {}, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                  line: 224,
+                  file: "halo-invitations-handler.ts",
+                  line: 223,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1218,8 +1211,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: identity.deviceKey,
                 identityKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 237,
+                file: "halo-invitations-handler.ts",
+                line: 236,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1228,8 +1221,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: identity.deviceKey,
                 identityKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                line: 241,
+                file: "halo-invitations-handler.ts",
+                line: 240,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1237,8 +1230,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
             } catch (err) {
               if (!observable.cancelled) {
                 import_log5.log.warn("auth failed", err, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts",
-                  line: 245,
+                  file: "halo-invitations-handler.ts",
+                  line: 244,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1252,7 +1245,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return extension;
     };
-    (0, import_async7.scheduleTask)(ctx, async () => {
+    (0, import_async8.scheduleTask)(ctx, async () => {
       var _a, _b;
       (0, import_node_assert5.default)(invitation.swarmKey);
       const topic = invitation.swarmKey;
@@ -1273,7 +1266,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
     return observable;
   }
 };
-var HostHaloInvitationExtension = class extends RpcExtension {
+var HostHaloInvitationExtension = class extends import_teleport.RpcExtension {
   constructor(_callbacks) {
     super({
       exposed: {
@@ -1302,7 +1295,7 @@ var HostHaloInvitationExtension = class extends RpcExtension {
     this._callbacks.onOpen();
   }
 };
-var GuestHaloInvitationExtension = class extends RpcExtension {
+var GuestHaloInvitationExtension = class extends import_teleport.RpcExtension {
   constructor(_callbacks) {
     super({
       requested: {
@@ -1322,7 +1315,7 @@ var GuestHaloInvitationExtension = class extends RpcExtension {
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts
 var import_node_assert6 = __toESM(require("node:assert"));
-var import_async8 = require("@dxos/async");
+var import_async9 = require("@dxos/async");
 var import_log6 = require("@dxos/log");
 var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var AbstractInvitationsProxy = class {
@@ -1371,7 +1364,7 @@ var AbstractInvitationsProxy = class {
         }
         default: {
           import_log6.log.error(`Invalid state: ${invitation2.state}`, {}, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts",
+            file: "invitations-proxy.ts",
             line: 81,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -1380,7 +1373,7 @@ var AbstractInvitationsProxy = class {
       }
     }, (err) => {
       if (err) {
-        (0, import_async8.observableError)(observable, err);
+        (0, import_async9.observableError)(observable, err);
       }
     });
     return observable;
@@ -1437,7 +1430,7 @@ var AbstractInvitationsProxy = class {
         }
         default: {
           import_log6.log.error(`Invalid state: ${invitation2.state}`, {}, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts",
+            file: "invitations-proxy.ts",
             line: 146,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -1446,7 +1439,7 @@ var AbstractInvitationsProxy = class {
       }
     }, (err) => {
       if (err) {
-        (0, import_async8.observableError)(observable, err);
+        (0, import_async9.observableError)(observable, err);
       }
     });
     return observable;
@@ -1483,7 +1476,7 @@ var AbstractInvitationsService = class {
       const invitationsHandler = this._getInvitationsHandler();
       const context = this.getContext(invitation);
       (0, import_log7.log)("stream opened", this.getLoggingContext(), {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+        file: "invitations-service.ts",
         line: 43,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -1541,14 +1534,14 @@ var AbstractInvitationsService = class {
             ...context2,
             err
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+            file: "invitations-service.ts",
             line: 92,
             scope: this,
             callSite: (f, a) => f(...a)
           });
         } else {
           (0, import_log7.log)("stream closed", context2, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+            file: "invitations-service.ts",
             line: 94,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -1561,7 +1554,7 @@ var AbstractInvitationsService = class {
   acceptInvitation(invitation, options) {
     return new import_codec_protobuf8.Stream(({ next, close }) => {
       (0, import_log7.log)("stream opened", this.getLoggingContext(), {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+        file: "invitations-service.ts",
         line: 104,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -1615,14 +1608,14 @@ var AbstractInvitationsService = class {
             ...context,
             err
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+            file: "invitations-service.ts",
             line: 152,
             scope: this,
             callSite: (f, a) => f(...a)
           });
         } else {
           (0, import_log7.log)("stream closed", context, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+            file: "invitations-service.ts",
             line: 154,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -1634,7 +1627,7 @@ var AbstractInvitationsService = class {
   }
   async authenticate({ invitationId, authenticationCode }) {
     (0, import_log7.log)("authenticating...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+      file: "invitations-service.ts",
       line: 163,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -1645,7 +1638,7 @@ var AbstractInvitationsService = class {
       import_log7.log.warn("invalid invitation", {
         invitationId
       }, {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+        file: "invitations-service.ts",
         line: 167,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -1657,7 +1650,7 @@ var AbstractInvitationsService = class {
   async cancelInvitation(invitation) {
     var _a;
     (0, import_log7.log)("cancelling...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+      file: "invitations-service.ts",
       line: 174,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -1668,7 +1661,7 @@ var AbstractInvitationsService = class {
       import_log7.log.warn("invalid invitation", {
         invitationId: invitation.invitationId
       }, {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts",
+        file: "invitations-service.ts",
         line: 179,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -1691,8 +1684,8 @@ var HaloInvitationsServiceImpl = class extends AbstractInvitationsService {
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts
 var import_node_assert8 = __toESM(require("node:assert"));
-var import_async9 = require("@dxos/async");
-var import_context2 = require("@dxos/context");
+var import_async10 = require("@dxos/async");
+var import_context3 = require("@dxos/context");
 var import_credentials7 = require("@dxos/credentials");
 var import_feed_store3 = require("@dxos/feed-store");
 var import_keys5 = require("@dxos/keys");
@@ -1701,6 +1694,7 @@ var import_network_manager2 = require("@dxos/network-manager");
 var import_protocols4 = require("@dxos/protocols");
 var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations4 = require("@dxos/protocols/proto/dxos/halo/invitations");
+var import_teleport2 = require("@dxos/teleport");
 var MAX_OTP_ATTEMPTS = 3;
 var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   constructor(networkManager, _spaceManager, _signingContext, _keyring) {
@@ -1721,7 +1715,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       spaceKey: space.key,
       authenticationCode: (0, import_credentials7.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
     };
-    const ctx = new import_context2.Context({
+    const ctx = new import_context3.Context({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
@@ -1732,7 +1726,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     });
     let authenticationCode;
     let authenticationRetry = 0;
-    const complete = new import_async9.Trigger();
+    const complete = new import_async10.Trigger();
     const createExtension = () => {
       let guestProfile;
       const hostInvitationExtension = new HostSpaceInvitationExtension({
@@ -1743,8 +1737,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
             host: this._signingContext.deviceKey,
             spaceKey: space.key
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-            line: 97,
+            file: "space-invitations-handler.ts",
+            line: 98,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1755,8 +1749,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
           (0, import_log8.log)("received authentication request", {
             authenticationCode: code
           }, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-            line: 111,
+            file: "space-invitations-handler.ts",
+            line: 112,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1785,16 +1779,16 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               host: this._signingContext.deviceKey,
               guest: deviceKey
             }, {
-              file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-              line: 135,
+              file: "space-invitations-handler.ts",
+              line: 136,
               scope: this,
               callSite: (f, a) => f(...a)
             });
-            const credentials = await (0, import_credentials7.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, deviceKey, space.key, controlFeedKey, dataFeedKey, space.genesisFeedKey, guestProfile);
+            const credentials = await (0, import_credentials7.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, deviceKey, space.key, controlFeedKey, dataFeedKey, space.inner.genesisFeedKey, guestProfile);
             (0, import_node_assert8.default)(credentials[0]["@type"] === "dxos.echo.feed.CredentialsMessage");
             const spaceMemberCredential = credentials[0].credential;
             (0, import_node_assert8.default)((0, import_credentials7.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
-            await (0, import_feed_store3.writeMessages)(space.controlPipeline.writer, credentials);
+            await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, credentials);
             complete.wake(deviceKey);
             return {
               credential: spaceMemberCredential
@@ -1805,14 +1799,14 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
           }
         },
         onOpen: () => {
-          (0, import_async9.scheduleTask)(ctx, async () => {
+          (0, import_async10.scheduleTask)(ctx, async () => {
             var _a, _b;
             try {
               (0, import_log8.log)("connected", {
                 host: this._signingContext.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 169,
+                file: "space-invitations-handler.ts",
+                line: 170,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1824,8 +1818,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 host: this._signingContext.deviceKey,
                 guest: deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 172,
+                file: "space-invitations-handler.ts",
+                line: 173,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1833,15 +1827,15 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
             } catch (err) {
               if (!observable.cancelled) {
                 import_log8.log.error("failed", err, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                  line: 176,
+                  file: "space-invitations-handler.ts",
+                  line: 177,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 observable.callback.onError(err);
               }
             } finally {
-              await (0, import_async9.sleep)(ON_CLOSE_DELAY);
+              await (0, import_async10.sleep)(ON_CLOSE_DELAY);
               await ctx.dispose();
             }
           });
@@ -1849,7 +1843,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return hostInvitationExtension;
     };
-    (0, import_async9.scheduleTask)(ctx, async () => {
+    (0, import_async10.scheduleTask)(ctx, async () => {
       var _a, _b;
       const topic = invitation.swarmKey;
       const swarmConnection2 = await this._networkManager.joinSwarm({
@@ -1867,13 +1861,13 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   }
   acceptInvitation(invitation, options) {
     const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
-    const ctx = new import_context2.Context({
+    const ctx = new import_context3.Context({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
       }
     });
-    const authenticated = new import_async9.Trigger();
+    const authenticated = new import_async10.Trigger();
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         await ctx.dispose();
@@ -1883,11 +1877,11 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       }
     });
     let connectionCount = 0;
-    const complete = new import_async9.Trigger();
+    const complete = new import_async10.Trigger();
     const createExtension = () => {
       const extension = new GuestSpaceInvitationExtension({
         onOpen: () => {
-          (0, import_async9.scheduleTask)(ctx, async () => {
+          (0, import_async10.scheduleTask)(ctx, async () => {
             var _a, _b, _c, _d;
             try {
               if (++connectionCount > 1) {
@@ -1896,8 +1890,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               (0, import_log8.log)("connected", {
                 guest: this._signingContext.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 247,
+                file: "space-invitations-handler.ts",
+                line: 248,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1905,8 +1899,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               (0, import_log8.log)("introduce", {
                 guest: this._signingContext.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 251,
+                file: "space-invitations-handler.ts",
+                line: 252,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1916,8 +1910,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               if (invitation.type === void 0 || invitation.type === import_services5.Invitation.Type.INTERACTIVE) {
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
                   (0, import_log8.log)("guest waiting for authentication code...", {}, {
-                    file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                    line: 260,
+                    file: "space-invitations-handler.ts",
+                    line: 261,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -1926,8 +1920,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                     timeout
                   });
                   (0, import_log8.log)("sending authentication request", {}, {
-                    file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                    line: 264,
+                    file: "space-invitations-handler.ts",
+                    line: 265,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -1944,8 +1938,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                       (0, import_log8.log)("retrying invalid code", {
                         attempt
                       }, {
-                        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                        line: 274,
+                        file: "space-invitations-handler.ts",
+                        line: 275,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -1959,8 +1953,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               (0, import_log8.log)("request admission", {
                 guest: this._signingContext.deviceKey
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 285,
+                file: "space-invitations-handler.ts",
+                line: 286,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1983,8 +1977,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: this._signingContext.deviceKey,
                 spaceKey: space.key
               }, {
-                file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                line: 308,
+                file: "space-invitations-handler.ts",
+                line: 309,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1992,8 +1986,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
             } catch (err) {
               if (!observable.cancelled) {
                 import_log8.log.warn("auth failed", err, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts",
-                  line: 312,
+                  file: "space-invitations-handler.ts",
+                  line: 313,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -2007,7 +2001,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return extension;
     };
-    (0, import_async9.scheduleTask)(ctx, async () => {
+    (0, import_async10.scheduleTask)(ctx, async () => {
       var _a, _b;
       (0, import_node_assert8.default)(invitation.swarmKey);
       const topic = invitation.swarmKey;
@@ -2028,7 +2022,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     return observable;
   }
 };
-var HostSpaceInvitationExtension = class extends RpcExtension {
+var HostSpaceInvitationExtension = class extends import_teleport2.RpcExtension {
   constructor(_callbacks) {
     super({
       exposed: {
@@ -2057,7 +2051,7 @@ var HostSpaceInvitationExtension = class extends RpcExtension {
     this._callbacks.onOpen();
   }
 };
-var GuestSpaceInvitationExtension = class extends RpcExtension {
+var GuestSpaceInvitationExtension = class extends import_teleport2.RpcExtension {
   constructor(_callbacks) {
     super({
       requested: {
@@ -2102,124 +2096,275 @@ var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-var import_async10 = require("@dxos/async");
-var import_debug5 = require("@dxos/debug");
-var import_echo_db2 = require("@dxos/echo-db");
+var import_async12 = require("@dxos/async");
+var import_debug4 = require("@dxos/debug");
+var import_echo_db4 = require("@dxos/echo-db");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_keyring = require("@dxos/keyring");
+var import_log10 = require("@dxos/log");
+
+// packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+var import_async11 = require("@dxos/async");
+var import_echo_db3 = require("@dxos/echo-db");
+var import_keys6 = require("@dxos/keys");
 var import_log9 = require("@dxos/log");
+var import_teleport_extension_presence2 = require("@dxos/teleport-extension-presence");
+var import_util4 = require("@dxos/util");
+
+// packages/sdk/client-services/src/packlets/spaces/data-space.ts
+var import_node_assert10 = __toESM(require("node:assert"));
+var import_context4 = require("@dxos/context");
+var import_echo_db2 = require("@dxos/echo-db");
+var DataSpace = class {
+  constructor(_inner, _modelFactory, _memberKey, _presence) {
+    this._inner = _inner;
+    this._modelFactory = _modelFactory;
+    this._memberKey = _memberKey;
+    this._presence = _presence;
+    this._ctx = new import_context4.Context();
+    this._dataPipelineController = new import_echo_db2.DataPipelineControllerImpl(_modelFactory, _memberKey, (feedKey) => _inner.spaceState.feeds.get(feedKey));
+  }
+  get key() {
+    return this._inner.key;
+  }
+  get inner() {
+    return this._inner;
+  }
+  get isOpen() {
+    return this._inner.isOpen;
+  }
+  get dataPipelineController() {
+    return this._dataPipelineController;
+  }
+  get database() {
+    (0, import_node_assert10.default)(this._dataPipelineController.database);
+    return this._dataPipelineController.database;
+  }
+  get stateUpdate() {
+    return this._inner.stateUpdate;
+  }
+  get presence() {
+    return this._presence;
+  }
+  async open() {
+    await this._inner.open();
+  }
+  async close() {
+    await this._ctx.dispose();
+    await this._inner.close();
+    await this._presence.destroy();
+  }
+};
+
+// packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+var __decorate = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var DataSpaceManager = class {
+  constructor(_spaceManager, _metadataStore, _dataServiceSubscriptions, _keyring, _signingContext, _modelFactory) {
+    this._spaceManager = _spaceManager;
+    this._metadataStore = _metadataStore;
+    this._dataServiceSubscriptions = _dataServiceSubscriptions;
+    this._keyring = _keyring;
+    this._signingContext = _signingContext;
+    this._modelFactory = _modelFactory;
+    this.updated = new import_async11.Event();
+    this._spaces = new import_util4.ComplexMap(import_keys6.PublicKey.hash);
+  }
+  get spaces() {
+    return this._spaces;
+  }
+  async open() {
+    await this._metadataStore.load();
+    for (const spaceMetadata of this._metadataStore.spaces) {
+      await this._constructSpace(spaceMetadata);
+    }
+  }
+  async close() {
+  }
+  async createSpace() {
+    const spaceKey = await this._keyring.createKey();
+    const controlFeedKey = await this._keyring.createKey();
+    const dataFeedKey = await this._keyring.createKey();
+    const metadata = {
+      key: spaceKey,
+      genesisFeedKey: controlFeedKey,
+      controlFeedKey,
+      dataFeedKey
+    };
+    (0, import_log9.log)("creating space...", {
+      spaceKey
+    }, {
+      file: "data-space-manager.ts",
+      line: 70,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const space = await this._constructSpace(metadata);
+    await (0, import_echo_db3.spaceGenesis)(this._keyring, this._signingContext, space.inner);
+    await this._metadataStore.addSpace(metadata);
+    this.updated.emit();
+    return space;
+  }
+  async acceptSpace(opts) {
+    const metadata = {
+      key: opts.spaceKey,
+      genesisFeedKey: opts.genesisFeedKey,
+      controlFeedKey: opts.controlFeedKey,
+      dataFeedKey: opts.dataFeedKey
+    };
+    const space = await this._constructSpace(metadata);
+    await this._metadataStore.addSpace(metadata);
+    this.updated.emit();
+    return space;
+  }
+  async _constructSpace(metadata) {
+    const presence = new import_teleport_extension_presence2.Presence({
+      localPeerId: this._signingContext.deviceKey,
+      announceInterval: 1e3,
+      offlineTimeout: 3e4,
+      identityKey: this._signingContext.identityKey
+    });
+    const space = await this._spaceManager.constructSpace({
+      metadata,
+      swarmIdentity: {
+        peerKey: this._signingContext.deviceKey,
+        credentialProvider: this._signingContext.credentialProvider,
+        credentialAuthenticator: this._signingContext.credentialAuthenticator
+      },
+      dataPipelineControllerProvider: () => dataSpace.dataPipelineController,
+      presence
+    });
+    const dataSpace = new DataSpace(space, this._modelFactory, this._signingContext.identityKey, presence);
+    await space.open();
+    this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.database.createDataServiceHost());
+    this._spaces.set(metadata.key, dataSpace);
+    return dataSpace;
+  }
+};
+__decorate([
+  import_async11.synchronized
+], DataSpaceManager.prototype, "open", null);
+__decorate([
+  import_async11.synchronized
+], DataSpaceManager.prototype, "close", null);
+
+// packages/sdk/client-services/src/packlets/services/service-context.ts
 var ServiceContext = class {
   constructor(storage, networkManager, modelFactory) {
     this.storage = storage;
     this.networkManager = networkManager;
     this.modelFactory = modelFactory;
-    this.initialized = new import_async10.Trigger();
-    this.dataServiceSubscriptions = new import_echo_db2.DataServiceSubscriptions();
-    this.metadataStore = new import_echo_db2.MetadataStore(storage.createDirectory("metadata"));
+    this.initialized = new import_async12.Trigger();
+    this.dataServiceSubscriptions = new import_echo_db4.DataServiceSubscriptions();
+    this.metadataStore = new import_echo_db4.MetadataStore(storage.createDirectory("metadata"));
     this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
     this.feedStore = new import_feed_store4.FeedStore({
       factory: new import_feed_store4.FeedFactory({
         root: storage.createDirectory("feeds"),
         signer: this.keyring,
         hypercore: {
-          valueEncoding: import_echo_db2.valueEncoding
+          valueEncoding: import_echo_db4.valueEncoding
         }
       })
     });
-    this.identityManager = new IdentityManager(this.metadataStore, this.feedStore, this.keyring, networkManager, modelFactory);
+    this.spaceManager = new import_echo_db4.SpaceManager({
+      feedStore: this.feedStore,
+      networkManager: this.networkManager
+    });
+    this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.spaceManager);
     this.haloInvitations = new HaloInvitationsHandler(this.networkManager, this.identityManager);
   }
   async open() {
-    (0, import_log9.log)("opening...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 78,
+    (0, import_log10.log)("opening...", {}, {
+      file: "service-context.ts",
+      line: 81,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    await this.spaceManager.open();
     await this.identityManager.open();
     if (this.identityManager.identity) {
       await this._initialize();
     }
-    (0, import_log9.log)("opened", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 83,
+    (0, import_log10.log)("opened", {}, {
+      file: "service-context.ts",
+      line: 87,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
   async close() {
     var _a;
-    (0, import_log9.log)("closing...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 87,
+    (0, import_log10.log)("closing...", {}, {
+      file: "service-context.ts",
+      line: 91,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    await ((_a = this.dataSpaceManager) == null ? void 0 : _a.close());
     await this.identityManager.close();
-    await ((_a = this.spaceManager) == null ? void 0 : _a.close());
+    await this.spaceManager.close();
     await this.feedStore.close();
     await this.networkManager.close();
     this.dataServiceSubscriptions.clear();
-    (0, import_log9.log)("closed", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 93,
+    (0, import_log10.log)("closed", {}, {
+      file: "service-context.ts",
+      line: 98,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
   async reset() {
-    (0, import_log9.log)("resetting...", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 97,
+    (0, import_log10.log)("resetting...", {}, {
+      file: "service-context.ts",
+      line: 102,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this.close();
     await this.storage.reset();
-    (0, import_log9.log)("reset", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts",
-      line: 100,
+    (0, import_log10.log)("reset", {}, {
+      file: "service-context.ts",
+      line: 105,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
   async createIdentity(params = {}) {
     const identity = await this.identityManager.createIdentity(params);
-    this.dataServiceSubscriptions.registerSpace(identity.haloSpaceKey, identity.haloDatabase.createDataServiceHost());
     await this._initialize();
     return identity;
   }
   async _initialize() {
     var _a;
-    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug5.failUndefined)();
+    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug4.failUndefined)();
     const signingContext = {
-      credentialProvider: import_echo_db2.MOCK_AUTH_PROVIDER,
-      credentialAuthenticator: import_echo_db2.MOCK_AUTH_VERIFIER,
+      credentialProvider: import_echo_db4.MOCK_AUTH_PROVIDER,
+      credentialAuthenticator: import_echo_db4.MOCK_AUTH_VERIFIER,
       credentialSigner: identity.getIdentityCredentialSigner(),
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey,
       profile: identity.profileDocument
     };
-    const spaceManager = new import_echo_db2.SpaceManager({
-      metadataStore: this.metadataStore,
-      feedStore: this.feedStore,
-      networkManager: this.networkManager,
-      keyring: this.keyring,
-      dataServiceSubscriptions: this.dataServiceSubscriptions,
-      modelFactory: this.modelFactory,
-      signingContext
-    });
-    await spaceManager.open();
-    this.spaceManager = spaceManager;
-    this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.spaceManager, signingContext, this.keyring);
+    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.modelFactory);
+    await this.dataSpaceManager.open();
+    this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.dataSpaceManager, signingContext, this.keyring);
     this.initialized.wake();
   }
 };
 
 // packages/sdk/client-services/src/packlets/services/service-definitions.ts
 var import_protocols5 = require("@dxos/protocols");
-var import_rpc2 = require("@dxos/rpc");
-var clientServiceBundle = (0, import_rpc2.createServiceBundle)({
+var import_rpc = require("@dxos/rpc");
+var clientServiceBundle = (0, import_rpc.createServiceBundle)({
   HaloInvitationsService: import_protocols5.schema.getService("dxos.client.services.HaloInvitationsService"),
   DevicesService: import_protocols5.schema.getService("dxos.client.services.DevicesService"),
   SpaceInvitationsService: import_protocols5.schema.getService("dxos.client.services.SpaceInvitationsService"),
@@ -2233,15 +2378,15 @@ var clientServiceBundle = (0, import_rpc2.createServiceBundle)({
 });
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-var import_debug6 = require("@dxos/debug");
-var import_echo_db3 = require("@dxos/echo-db");
-var import_log10 = require("@dxos/log");
+var import_debug5 = require("@dxos/debug");
+var import_echo_db5 = require("@dxos/echo-db");
+var import_log11 = require("@dxos/log");
 var import_model_factory = require("@dxos/model-factory");
 var import_object_model = require("@dxos/object-model");
 var import_text_model = require("@dxos/text-model");
 
 // packages/sdk/client-services/src/packlets/identity/devices-service-impl.ts
-var import_async11 = require("@dxos/async");
+var import_async13 = require("@dxos/async");
 var import_codec_protobuf9 = require("@dxos/codec-protobuf");
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
@@ -2267,7 +2412,7 @@ var DevicesServiceImpl = class {
           });
         }
       };
-      const dispose = new import_async11.EventSubscriptions();
+      const dispose = new import_async13.EventSubscriptions();
       dispose.add(this._identityManager.stateUpdate.on(() => {
         update();
         if (this._identityManager.identity) {
@@ -2302,7 +2447,7 @@ var import_memdown = __toESM(require("memdown"));
 var import_errors = require("@dxos/errors");
 var import_config = require("@dxos/protocols/proto/dxos/config");
 var import_random_access_storage = require("@dxos/random-access-storage");
-var import_util3 = require("@dxos/util");
+var import_util5 = require("@dxos/util");
 var StorageDriver = import_config.Runtime.Client.Storage.StorageDriver;
 var createStorageObjects = (config) => {
   const { path = "dxos/storage", storageType, keyStorage, persistent = false } = config != null ? config : {};
@@ -2327,7 +2472,7 @@ var createStorageObjects = (config) => {
   };
 };
 var createKeyStorage = (path, type) => {
-  const defaultedType = type != null ? type : (0, import_util3.isNode)() ? "jsondown" : "leveljs";
+  const defaultedType = type != null ? type : (0, import_util5.isNode)() ? "jsondown" : "leveljs";
   switch (defaultedType) {
     case "leveljs":
       return (0, import_level_js.default)(path);
@@ -2410,20 +2555,20 @@ var ClientServicesHost = class {
     var _a;
     await this._initialize();
     const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    (0, import_log10.log)("opening...", {
+    (0, import_log11.log)("opening...", {
       deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts",
+      file: "service-host.ts",
       line: 69,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._initialize();
     await this._serviceContext.open();
-    (0, import_log10.log)("opened", {
+    (0, import_log11.log)("opened", {
       deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts",
+      file: "service-host.ts",
       line: 72,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -2432,19 +2577,19 @@ var ClientServicesHost = class {
   async close() {
     var _a;
     const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    (0, import_log10.log)("closing...", {
+    (0, import_log11.log)("closing...", {
       deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts",
+      file: "service-host.ts",
       line: 77,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._serviceContext.close();
-    (0, import_log10.log)("closed", {
+    (0, import_log11.log)("closed", {
       deviceKey
     }, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts",
+      file: "service-host.ts",
       line: 79,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -2458,13 +2603,13 @@ var ClientServicesHost = class {
       DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
       SpaceInvitationsService: new SpaceInvitationsServiceImpl(this._serviceContext.identityManager, () => {
         var _a;
-        return (_a = this._serviceContext.spaceInvitations) != null ? _a : (0, import_debug6.raise)(new Error("SpaceInvitations not initialized"));
+        return (_a = this._serviceContext.spaceInvitations) != null ? _a : (0, import_debug5.raise)(new Error("SpaceInvitations not initialized"));
       }, () => {
         var _a;
-        return (_a = this._serviceContext.spaceManager) != null ? _a : (0, import_debug6.raise)(new Error("SpaceManager not initialized"));
+        return (_a = this._serviceContext.dataSpaceManager) != null ? _a : (0, import_debug5.raise)(new Error("SpaceManager not initialized"));
       }),
       SpacesService: new SpacesServiceImpl(),
-      DataService: new import_echo_db3.DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
+      DataService: new import_echo_db5.DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
       ProfileService: new ProfileServiceImpl(this._serviceContext),
       SpaceService: new SpaceServiceImpl(this._serviceContext),
       SystemService: new SystemServiceImpl(this._config, this._serviceContext),
@@ -2479,13 +2624,13 @@ var ClientServicesHost = class {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-proxy.ts
-var import_async12 = require("@dxos/async");
+var import_async14 = require("@dxos/async");
 var import_errors2 = require("@dxos/errors");
-var import_rpc3 = require("@dxos/rpc");
+var import_rpc2 = require("@dxos/rpc");
 var ClientServicesProxy = class {
   constructor(port, _timeout = 3e4) {
     this._timeout = _timeout;
-    this._proxy = (0, import_rpc3.createProtoRpcPeer)({
+    this._proxy = (0, import_rpc2.createProtoRpcPeer)({
       requested: clientServiceBundle,
       exposed: {},
       handlers: {},
@@ -2502,7 +2647,7 @@ var ClientServicesProxy = class {
     return this._proxy.rpc;
   }
   async open() {
-    await (0, import_async12.asyncTimeout)(this._proxy.open(), this._timeout, new import_errors2.RemoteServiceConnectionTimeout());
+    await (0, import_async14.asyncTimeout)(this._proxy.open(), this._timeout, new import_errors2.RemoteServiceConnectionTimeout());
   }
   async close() {
     await this._proxy.close();
@@ -2511,7 +2656,7 @@ var ClientServicesProxy = class {
 
 // packages/sdk/client-services/src/packlets/vault/iframe-runtime.ts
 var import_network_manager3 = require("@dxos/network-manager");
-var import_rpc4 = require("@dxos/rpc");
+var import_rpc3 = require("@dxos/rpc");
 
 // packages/sdk/client-services/src/packlets/vault/services.ts
 var import_protocols6 = require("@dxos/protocols");
@@ -2530,7 +2675,7 @@ var IFrameRuntime = class {
     this._systemPort = systemPort;
     this._windowAppPort = windowAppPort;
     this._workerAppPort = workerAppPort;
-    this._systemRpc = (0, import_rpc4.createProtoRpcPeer)({
+    this._systemRpc = (0, import_rpc3.createProtoRpcPeer)({
       requested: workerServiceBundle,
       exposed: iframeServiceBundle,
       handlers: {
@@ -2559,17 +2704,17 @@ var IFrameRuntime = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
-var import_async14 = require("@dxos/async");
+var import_async16 = require("@dxos/async");
 var import_messaging = require("@dxos/messaging");
 var import_network_manager4 = require("@dxos/network-manager");
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
-var import_node_assert10 = __toESM(require("node:assert"));
-var import_async13 = require("@dxos/async");
-var import_log11 = require("@dxos/log");
-var import_rpc5 = require("@dxos/rpc");
-var import_util4 = require("@dxos/util");
-var __decorate = function(decorators, target, key, desc) {
+var import_node_assert11 = __toESM(require("node:assert"));
+var import_async15 = require("@dxos/async");
+var import_log12 = require("@dxos/log");
+var import_rpc4 = require("@dxos/rpc");
+var import_util6 = require("@dxos/util");
+var __decorate2 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2583,13 +2728,13 @@ var WorkerSession = class {
   constructor({ getServices, systemPort, appPort, options = {
     heartbeatInterval: 1e3
   } }) {
-    this._startTrigger = new import_async13.Trigger();
-    this.onClose = new import_util4.Callback();
-    (0, import_node_assert10.default)(options);
-    (0, import_node_assert10.default)(getServices);
+    this._startTrigger = new import_async15.Trigger();
+    this.onClose = new import_util6.Callback();
+    (0, import_node_assert11.default)(options);
+    (0, import_node_assert11.default)(getServices);
     this._options = options;
     this._getServices = getServices;
-    this._clientRpc = (0, import_rpc5.createProtoRpcPeer)({
+    this._clientRpc = (0, import_rpc4.createProtoRpcPeer)({
       exposed: clientServiceBundle,
       handlers: {
         HaloInvitationsService: async () => (await this._getServices()).services.HaloInvitationsService,
@@ -2605,7 +2750,7 @@ var WorkerSession = class {
       },
       port: appPort
     });
-    this._iframeRpc = (0, import_rpc5.createProtoRpcPeer)({
+    this._iframeRpc = (0, import_rpc4.createProtoRpcPeer)({
       requested: iframeServiceBundle,
       exposed: workerServiceBundle,
       handlers: {
@@ -2619,8 +2764,8 @@ var WorkerSession = class {
               try {
                 await this.close();
               } catch (err) {
-                import_log11.log.catch(err, {}, {
-                  file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+                import_log12.log.catch(err, {}, {
+                  file: "worker-session.ts",
                   line: 89,
                   scope: this,
                   callSite: (f, a) => f(...a)
@@ -2636,8 +2781,8 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    import_log11.log.info("opening..", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+    import_log12.log.info("opening..", {}, {
+      file: "worker-session.ts",
       line: 103,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -2653,10 +2798,10 @@ var WorkerSession = class {
       try {
         await this._iframeRpc.rpc.IframeService.heartbeat();
       } catch (err1) {
-        import_log11.log.warn("Heartbeat failed", {
+        import_log12.log.warn("Heartbeat failed", {
           err: err1
         }, {
-          file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+          file: "worker-session.ts",
           line: 115,
           scope: this,
           callSite: (f, a) => f(...a)
@@ -2664,8 +2809,8 @@ var WorkerSession = class {
         try {
           await this.close();
         } catch (err) {
-          import_log11.log.catch(err, {}, {
-            file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+          import_log12.log.catch(err, {}, {
+            file: "worker-session.ts",
             line: 119,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -2675,8 +2820,8 @@ var WorkerSession = class {
     }, this._options.heartbeatInterval);
   }
   async close() {
-    import_log11.log.info("closing..", {}, {
-      file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+    import_log12.log.info("closing..", {}, {
+      file: "worker-session.ts",
       line: 126,
       scope: this,
       callSite: (f, a) => f(...a)
@@ -2684,8 +2829,8 @@ var WorkerSession = class {
     try {
       await this.onClose.callIfSet();
     } catch (err) {
-      import_log11.log.catch(err, {}, {
-        file: "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts",
+      import_log12.log.catch(err, {}, {
+        file: "worker-session.ts",
         line: 130,
         scope: this,
         callSite: (f, a) => f(...a)
@@ -2700,8 +2845,8 @@ var WorkerSession = class {
     ]);
   }
 };
-__decorate([
-  import_log11.logInfo
+__decorate2([
+  import_log12.logInfo
 ], WorkerSession.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
@@ -2709,7 +2854,7 @@ var WorkerRuntime = class {
   constructor(_configProvider) {
     this._configProvider = _configProvider;
     this._transportFactory = new import_network_manager4.WebRTCTransportProxyFactory();
-    this._ready = new import_async14.Trigger();
+    this._ready = new import_async16.Trigger();
     this.sessions = /* @__PURE__ */ new Set();
   }
   async start() {
@@ -2784,6 +2929,7 @@ var WorkerRuntime = class {
   ClientServicesProxy,
   DevtoolsHostEvents,
   DevtoolsServiceImpl,
+  HaloAuthVerifier,
   HaloInvitationsHandler,
   HaloInvitationsProxy,
   HaloInvitationsServiceImpl,
@@ -2808,7 +2954,6 @@ var WorkerRuntime = class {
   clientServiceBundle,
   createDefaultModelFactory,
   createHaloAuthProvider,
-  createHaloAuthVerifier,
   createStorageObjects,
   getNetworkPeers,
   subscribeToFeedBlocks,
@@ -2820,3 +2965,4 @@ var WorkerRuntime = class {
   subscribeToSwarmInfo,
   wrapObservable
 });
+//# sourceMappingURL=index.cjs.map