@dxos/client-services 0.1.22 → 0.1.24-next.6b1f434

package/dist/lib/node/index.cjs

@@ -39,47 +39,55 @@ __export(src_exports, {
   ClientServicesProxy: () => ClientServicesProxy,
   DevtoolsHostEvents: () => DevtoolsHostEvents,
   DevtoolsServiceImpl: () => DevtoolsServiceImpl,
-  HaloAuthVerifier: () => HaloAuthVerifier,
   HaloInvitationsHandler: () => HaloInvitationsHandler,
   HaloInvitationsProxy: () => HaloInvitationsProxy,
   HaloInvitationsServiceImpl: () => HaloInvitationsServiceImpl,
-  IFrameRuntime: () => IFrameRuntime,
+  IFrameHostRuntime: () => IFrameHostRuntime,
+  IFrameProxyRuntime: () => IFrameProxyRuntime,
   INVITATION_TIMEOUT: () => INVITATION_TIMEOUT,
   Identity: () => Identity,
   IdentityManager: () => IdentityManager,
   InvitationEncoder: () => InvitationEncoder,
   InvitationObservableProvider: () => InvitationObservableProvider,
+  MemoryShellRuntime: () => MemoryShellRuntime,
   ON_CLOSE_DELAY: () => ON_CLOSE_DELAY,
   ProfileServiceImpl: () => ProfileServiceImpl,
   ServiceContext: () => ServiceContext,
   ServiceRegistry: () => ServiceRegistry,
+  ShellController: () => ShellController,
+  ShellRuntimeImpl: () => ShellRuntimeImpl,
   SpaceInvitationsHandler: () => SpaceInvitationsHandler,
   SpaceInvitationsProxy: () => SpaceInvitationsProxy,
   SpaceInvitationsServiceImpl: () => SpaceInvitationsServiceImpl,
   SpaceServiceImpl: () => SpaceServiceImpl,
   SystemServiceImpl: () => SystemServiceImpl,
   TracingServiceImpl: () => TracingServiceImpl,
+  TrustedKeySetAuthVerifier: () => TrustedKeySetAuthVerifier,
+  VaultResourceLock: () => VaultResourceLock,
   WorkerRuntime: () => WorkerRuntime,
   WorkerSession: () => WorkerSession,
+  appServiceBundle: () => appServiceBundle,
   clientServiceBundle: () => clientServiceBundle,
+  createAuthProvider: () => createAuthProvider,
   createDefaultModelFactory: () => createDefaultModelFactory,
-  createHaloAuthProvider: () => createHaloAuthProvider,
   createStorageObjects: () => createStorageObjects,
   getNetworkPeers: () => getNetworkPeers,
+  iframeServiceBundle: () => iframeServiceBundle,
+  shellServiceBundle: () => shellServiceBundle,
   subscribeToFeedBlocks: () => subscribeToFeedBlocks,
   subscribeToFeeds: () => subscribeToFeeds,
   subscribeToNetworkStatus: () => subscribeToNetworkStatus,
   subscribeToNetworkTopics: () => subscribeToNetworkTopics,
-  subscribeToSignalTrace: () => subscribeToSignalTrace,
+  subscribeToSignal: () => subscribeToSignal,
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo,
+  workerServiceBundle: () => workerServiceBundle,
   wrapObservable: () => wrapObservable
 });
 module.exports = __toCommonJS(src_exports);
 
 // packages/sdk/client-services/src/packlets/deprecated/space.ts
 var import_node_assert = __toESM(require("node:assert"));
-var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_debug = require("@dxos/debug");
 var import_log = require("@dxos/log");
@@ -103,10 +111,9 @@ var SpaceServiceImpl = class {
     });
   }
   subscribeSpaces() {
-    return new import_codec_protobuf.Stream(({ next }) => {
-      const subscriptions = new import_async.EventSubscriptions();
+    return new import_codec_protobuf.Stream(({ next, ctx }) => {
       const onUpdate = () => {
-        const spaces = Array.from(this.serviceContext.dataSpaceManager.spaces.values()).map((space) => ({
+        const spaces = Array.from(this.serviceContext.dataSpaceManager.spaces.values()).filter((space) => this.serviceContext.dataServiceSubscriptions.getDataService(space.key)).map((space) => ({
           publicKey: space.key,
           isOpen: true,
           isActive: true,
@@ -126,7 +133,7 @@ var SpaceServiceImpl = class {
           spaces
         }, {
           file: "space.ts",
-          line: 120,
+          line: 119,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -141,26 +148,31 @@ var SpaceServiceImpl = class {
           });
         }
         await this.serviceContext.initialized.wait();
-        subscriptions.add(this.serviceContext.dataSpaceManager.updated.on(() => {
-          this.serviceContext.dataSpaceManager.spaces.forEach((space) => {
-            subscriptions.add(space.stateUpdate.on(onUpdate));
-            subscriptions.add(space.presence.updated.on(onUpdate));
-          });
+        const subscribeSpaces = () => {
+          for (const space of this.serviceContext.dataSpaceManager.spaces.values()) {
+            if (!this.serviceContext.dataServiceSubscriptions.getDataService(space.key)) {
+              continue;
+            }
+            space.stateUpdate.on(ctx, onUpdate);
+            space.presence.updated.on(ctx, onUpdate);
+          }
+        };
+        this.serviceContext.dataSpaceManager.updated.on(ctx, () => {
+          subscribeSpaces();
           onUpdate();
-        }));
-        this.serviceContext.dataSpaceManager.spaces.forEach((space) => {
-          subscriptions.add(space.stateUpdate.on(onUpdate));
-          subscriptions.add(space.presence.updated.on(onUpdate));
         });
+        subscribeSpaces();
         onUpdate();
       });
-      return () => subscriptions.clear();
     });
   }
   async getSpaceDetails(request) {
     return (0, import_debug.todo)();
   }
   async createSpace() {
+    if (!this.serviceContext.identityManager.identity) {
+      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/halo");
+    }
     await this.serviceContext.initialized.wait();
     const space = await this.serviceContext.dataSpaceManager.createSpace();
     return {
@@ -193,7 +205,9 @@ var SpaceServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/deprecated/profile.ts
+var import_node_assert2 = __toESM(require("node:assert"));
 var import_codec_protobuf2 = require("@dxos/codec-protobuf");
+var import_credentials = require("@dxos/credentials");
 var import_debug2 = require("@dxos/debug");
 var ProfileServiceImpl = class {
   constructor(context) {
@@ -208,7 +222,8 @@ var ProfileServiceImpl = class {
           profile: this.context.identityManager.identity ? {
             identityKey: this.context.identityManager.identity.identityKey,
             deviceKey: this.context.identityManager.identity.deviceKey,
-            displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName
+            displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName,
+            haloSpace: this.context.identityManager.identity.space.key
           } : void 0
         });
       };
@@ -224,7 +239,8 @@ var ProfileServiceImpl = class {
     return {
       identityKey: this.context.identityManager.identity.identityKey,
       deviceKey: this.context.identityManager.identity.deviceKey,
-      displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName
+      displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName,
+      haloSpace: this.context.identityManager.identity.space.key
     };
   }
   async recoverProfile(request) {
@@ -233,28 +249,38 @@ var ProfileServiceImpl = class {
       throw new Error("Recovery SeedPhrase not provided.");
     }
   }
+  async signPresentation({ presentation, nonce }) {
+    (0, import_node_assert2.default)(this.context.identityManager.identity, "Identity not initialized.");
+    return await (0, import_credentials.signPresentation)({
+      presentation,
+      signer: this.context.keyring,
+      signerKey: this.context.identityManager.identity.deviceKey,
+      chain: this.context.identityManager.identity.deviceCredentialChain,
+      nonce
+    });
+  }
 };
 
 // packages/sdk/client-services/src/packlets/deprecated/system.ts
 var SystemServiceImpl = class {
-  constructor(_config, _serviceContext) {
-    this._config = _config;
-    this._serviceContext = _serviceContext;
-  }
-  // TODO(burdon): Remove.
-  async initSession() {
+  constructor({ config, onInit, onStatus, onReset }) {
+    this._config = config;
+    this._onInit = onInit;
+    this._onStatus = onStatus;
+    this._onReset = onReset;
   }
-  async getConfig(request) {
+  async getConfig() {
     return this._config.values;
   }
   // TODO(burdon): Connect to iframe RPC heartbeat for network status?
-  async getStatus(request) {
-    return {
-      message: `ok: ${Date.now()}`
-    };
+  async getStatus() {
+    return this._onStatus();
+  }
+  async initSession() {
+    await this._onInit();
   }
-  async reset(request) {
-    await this._serviceContext.reset();
+  async reset() {
+    await this._onReset();
   }
 };
 
@@ -272,79 +298,83 @@ var TracingServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/devtools/devtools.ts
-var import_async3 = require("@dxos/async");
+var import_async2 = require("@dxos/async");
 var import_codec_protobuf7 = require("@dxos/codec-protobuf");
 
 // packages/sdk/client-services/src/packlets/devtools/feeds.ts
-var import_async2 = require("@dxos/async");
+var import_async = require("@dxos/async");
 var import_codec_protobuf3 = require("@dxos/codec-protobuf");
 var import_feed_store = require("@dxos/feed-store");
 var import_keys = require("@dxos/keys");
 var import_util2 = require("@dxos/util");
-var subscribeToFeeds = ({ feedStore }, { feedKeys }) => new import_codec_protobuf3.Stream(({ next }) => {
-  if ((feedKeys == null ? void 0 : feedKeys.length) === 0) {
-    return;
-  }
-  const feedMap = new import_util2.ComplexMap(import_keys.PublicKey.hash);
-  const subscriptions = new import_async2.EventSubscriptions();
-  const update = () => {
-    const feeds = feedStore.feeds;
-    feeds.filter((feed) => !(feedKeys == null ? void 0 : feedKeys.length) || feedKeys.some((feedKey) => feedKey.equals(feed.key))).forEach((feed) => {
-      if (!feedMap.has(feed.key)) {
-        feedMap.set(feed.key, feed);
-        feed.on("close", update);
-        subscriptions.add(feed.off("close", update));
-      }
-    });
-    next({
-      feeds: Array.from(feedMap.values()).map((feed) => ({
-        feedKey: feed.key,
-        length: feed.properties.length
-      }))
-    });
-  };
-  subscriptions.add(feedStore.feedOpened.on(update));
-  update();
-  return () => {
-    subscriptions.clear();
-  };
-});
-var subscribeToFeedBlocks = ({ feedStore }, { feedKey, maxBlocks = 10 }) => new import_codec_protobuf3.Stream(({ next }) => {
-  if (!feedKey) {
-    return;
-  }
-  const subscriptions = new import_async2.EventSubscriptions();
-  const timeout = setTimeout(async () => {
-    const feed = feedStore.getFeed(feedKey);
-    if (!feed) {
+var subscribeToFeeds = ({ feedStore }, { feedKeys }) => {
+  return new import_codec_protobuf3.Stream(({ next }) => {
+    if ((feedKeys == null ? void 0 : feedKeys.length) === 0) {
       return;
     }
-    const update = async () => {
-      const iterator = new import_feed_store.FeedIterator(feed);
-      await iterator.open();
-      const blocks = [];
-      for await (const block of iterator) {
-        blocks.push(block);
-        if (blocks.length >= feed.properties.length) {
-          break;
+    const subscriptions = new import_async.EventSubscriptions();
+    const feedMap = new import_util2.ComplexMap(import_keys.PublicKey.hash);
+    const update = () => {
+      const { feeds } = feedStore;
+      feeds.filter((feed) => !(feedKeys == null ? void 0 : feedKeys.length) || feedKeys.some((feedKey) => feedKey.equals(feed.key))).forEach((feed) => {
+        if (!feedMap.has(feed.key)) {
+          feedMap.set(feed.key, feed);
+          feed.on("close", update);
+          subscriptions.add(feed.off("close", update));
         }
-      }
+      });
       next({
-        blocks: blocks.slice(-maxBlocks)
+        feeds: Array.from(feedMap.values()).map((feed) => ({
+          feedKey: feed.key,
+          length: feed.properties.length
+        }))
       });
-      await iterator.close();
     };
-    feed.on("append", update);
-    subscriptions.add(() => feed.off("append", update));
-    feed.on("truncate", update);
-    subscriptions.add(() => feed.off("truncate", update));
-    await update();
+    subscriptions.add(feedStore.feedOpened.on(update));
+    update();
+    return () => {
+      subscriptions.clear();
+    };
   });
-  return () => {
-    subscriptions.clear();
-    clearTimeout(timeout);
-  };
-});
+};
+var subscribeToFeedBlocks = ({ feedStore }, { feedKey, maxBlocks = 10 }) => {
+  return new import_codec_protobuf3.Stream(({ next }) => {
+    if (!feedKey) {
+      return;
+    }
+    const subscriptions = new import_async.EventSubscriptions();
+    const timeout = setTimeout(async () => {
+      const feed = feedStore.getFeed(feedKey);
+      if (!feed) {
+        return;
+      }
+      const update = async () => {
+        const iterator = new import_feed_store.FeedIterator(feed);
+        await iterator.open();
+        const blocks = [];
+        for await (const block of iterator) {
+          blocks.push(block);
+          if (blocks.length >= feed.properties.length) {
+            break;
+          }
+        }
+        next({
+          blocks: blocks.slice(-maxBlocks)
+        });
+        await iterator.close();
+      };
+      feed.on("append", update);
+      subscriptions.add(() => feed.off("append", update));
+      feed.on("truncate", update);
+      subscriptions.add(() => feed.off("truncate", update));
+      await update();
+    });
+    return () => {
+      subscriptions.clear();
+      clearTimeout(timeout);
+    };
+  });
+};
 
 // packages/sdk/client-services/src/packlets/devtools/keys.ts
 var import_codec_protobuf4 = require("@dxos/codec-protobuf");
@@ -361,6 +391,7 @@ var subscribeToKeyringKeys = ({ keyring }) => new import_codec_protobuf4.Stream(
 
 // packages/sdk/client-services/src/packlets/devtools/network.ts
 var import_codec_protobuf5 = require("@dxos/codec-protobuf");
+var import_context = require("@dxos/context");
 var import_keys2 = require("@dxos/keys");
 var subscribeToNetworkStatus = ({ networkManager }) => new import_codec_protobuf5.Stream(({ next, close }) => {
   const update = () => {
@@ -376,17 +407,27 @@ var subscribeToNetworkStatus = ({ networkManager }) => new import_codec_protobuf
   networkManager.signalManager.statusChanged.on(update);
   update();
 });
-var subscribeToSignalTrace = ({ networkManager }) => new import_codec_protobuf5.Stream(({ next }) => {
-  next({
-    events: []
+var subscribeToSignal = ({ networkManager }) => new import_codec_protobuf5.Stream(({ next }) => {
+  const ctx = new import_context.Context();
+  networkManager.signalManager.onMessage.on(ctx, (message) => {
+    next({
+      message: {
+        author: message.author.asUint8Array(),
+        recipient: message.recipient.asUint8Array(),
+        payload: message.payload
+      },
+      receivedAt: new Date()
+    });
   });
-  const trace = [];
-  networkManager.signalManager.commandTrace.on((msg) => {
-    trace.push(msg);
+  networkManager.signalManager.swarmEvent.on(ctx, (swarmEvent) => {
     next({
-      events: trace.map((msg2) => JSON.stringify(msg2))
+      swarmEvent: swarmEvent.swarmEvent,
+      receivedAt: new Date()
     });
   });
+  return () => {
+    return ctx.dispose();
+  };
 });
 var subscribeToNetworkTopics = ({ networkManager }) => new import_codec_protobuf5.Stream(({ next, close }) => {
   const update = () => {
@@ -438,42 +479,44 @@ var getNetworkPeers = ({ networkManager }, request) => {
 
 // packages/sdk/client-services/src/packlets/devtools/spaces.ts
 var import_codec_protobuf6 = require("@dxos/codec-protobuf");
-var subscribeToSpaces = (context, { spaceKeys = [] }) => new import_codec_protobuf6.Stream(({ next }) => {
-  let unsubscribe;
-  const update = async () => {
-    const spaces = [
-      ...context.spaceManager.spaces.values()
-    ];
-    const filteredSpaces = spaces.filter((space) => !(spaceKeys == null ? void 0 : spaceKeys.length) || spaceKeys.some((spaceKey) => spaceKey.equals(space.key)));
-    next({
-      spaces: filteredSpaces.map((space) => {
-        const spaceMetadata = context.metadataStore.spaces.find((spaceMetadata2) => spaceMetadata2.key.equals(space.key));
-        return {
-          key: space.key,
-          isOpen: space.isOpen,
-          timeframe: spaceMetadata == null ? void 0 : spaceMetadata.latestTimeframe,
-          genesisFeed: space.genesisFeedKey,
-          controlFeed: space.controlFeedKey,
-          dataFeed: space.dataFeedKey
-        };
-      })
+var subscribeToSpaces = (context, { spaceKeys = [] }) => {
+  return new import_codec_protobuf6.Stream(({ next }) => {
+    let unsubscribe;
+    const update = async () => {
+      const spaces = [
+        ...context.spaceManager.spaces.values()
+      ];
+      const filteredSpaces = spaces.filter((space) => !(spaceKeys == null ? void 0 : spaceKeys.length) || spaceKeys.some((spaceKey) => spaceKey.equals(space.key)));
+      next({
+        spaces: filteredSpaces.map((space) => {
+          const spaceMetadata = context.metadataStore.spaces.find((spaceMetadata2) => spaceMetadata2.key.equals(space.key));
+          return {
+            key: space.key,
+            isOpen: space.isOpen,
+            timeframe: spaceMetadata == null ? void 0 : spaceMetadata.dataTimeframe,
+            genesisFeed: space.genesisFeedKey,
+            controlFeed: space.controlFeedKey,
+            dataFeed: space.dataFeedKey
+          };
+        })
+      });
+    };
+    const timeout = setTimeout(async () => {
+      await context.initialized.wait();
+      unsubscribe = context.dataSpaceManager.updated.on(() => update());
+      await update();
     });
-  };
-  const timeout = setTimeout(async () => {
-    await context.initialized.wait();
-    unsubscribe = context.dataSpaceManager.updated.on(() => update());
-    await update();
+    return () => {
+      unsubscribe == null ? void 0 : unsubscribe();
+      clearTimeout(timeout);
+    };
   });
-  return () => {
-    unsubscribe == null ? void 0 : unsubscribe();
-    clearTimeout(timeout);
-  };
-});
+};
 
 // packages/sdk/client-services/src/packlets/devtools/devtools.ts
 var DevtoolsHostEvents = class {
   constructor() {
-    this.ready = new import_async3.Event();
+    this.ready = new import_async2.Event();
   }
 };
 var DevtoolsServiceImpl = class {
@@ -545,8 +588,8 @@ var DevtoolsServiceImpl = class {
       networkManager: this.params.context.networkManager
     });
   }
-  subscribeToSignalTrace() {
-    return subscribeToSignalTrace({
+  subscribeToSignal() {
+    return subscribeToSignal({
       networkManager: this.params.context.networkManager
     });
   }
@@ -558,12 +601,12 @@ var DevtoolsServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/authenticator.ts
-var import_async4 = require("@dxos/async");
-var import_context = require("@dxos/context");
-var import_credentials = require("@dxos/credentials");
+var import_async3 = require("@dxos/async");
+var import_context2 = require("@dxos/context");
+var import_credentials2 = require("@dxos/credentials");
 var import_log2 = require("@dxos/log");
 var import_protocols = require("@dxos/protocols");
-var createHaloAuthProvider = (signer) => async (nonce) => {
+var createAuthProvider = (signer) => async (nonce) => {
   const credential = await signer.createCredential({
     assertion: {
       "@type": "dxos.halo.credentials.Auth"
@@ -573,22 +616,27 @@ var createHaloAuthProvider = (signer) => async (nonce) => {
   });
   return import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").encode(credential);
 };
-var HaloAuthVerifier = class {
+var TrustedKeySetAuthVerifier = class {
+  // prettier-ignore
   constructor(_params) {
     this._params = _params;
-    this._ctx = new import_context.Context();
+    this._ctx = new import_context2.Context();
   }
   async close() {
     await this._ctx.dispose();
   }
-  _isTrustedDevice(deviceKey) {
-    const deviceSet = this._params.trustedDevicesProvider();
-    return deviceSet.has(deviceKey);
-  }
   get verifier() {
     return async (nonce, auth) => {
       const credential = import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
-      const result = await (0, import_credentials.verifyCredential)(credential);
+      (0, import_log2.log)("authenticating...", {
+        credential
+      }, {
+        file: "authenticator.ts",
+        line: 57,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      const result = await (0, import_credentials2.verifyCredential)(credential);
       if (result.kind === "fail") {
         (0, import_log2.log)("Invalid credential", {
           result
@@ -612,23 +660,47 @@ var HaloAuthVerifier = class {
         });
         return false;
       }
-      if (this._isTrustedDevice(credential.issuer)) {
+      if (this._isTrustedKey(credential.issuer)) {
+        (0, import_log2.log)("key is not currently in trusted set, waiting...", {
+          key: credential.issuer
+        }, {
+          file: "authenticator.ts",
+          line: 71,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
         return true;
       }
-      const trigger = new import_async4.Trigger();
+      const trigger = new import_async3.Trigger();
       this._ctx.onDispose(() => {
         trigger.wake(false);
       });
       const clear = this._params.update.on(this._ctx, () => {
-        if (this._isTrustedDevice(credential.issuer)) {
+        if (this._isTrustedKey(credential.issuer)) {
+          (0, import_log2.log)("auth success", {
+            key: credential.issuer
+          }, {
+            file: "authenticator.ts",
+            line: 82,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
           trigger.wake(true);
+        } else {
+          (0, import_log2.log)("key is not currently in trusted set, waiting...", {
+            key: credential.issuer
+          }, {
+            file: "authenticator.ts",
+            line: 85,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
         }
       });
       try {
-        await trigger.wait({
+        return await trigger.wait({
           timeout: this._params.authTimeout
         });
-        return true;
       } catch (e) {
         return false;
       } finally {
@@ -636,34 +708,39 @@ var HaloAuthVerifier = class {
       }
     };
   }
+  _isTrustedKey(deviceKey) {
+    const deviceSet = this._params.trustedKeysProvider();
+    return deviceSet.has(deviceKey);
+  }
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity.ts
-var import_node_assert2 = __toESM(require("node:assert"));
-var import_async5 = require("@dxos/async");
-var import_credentials2 = require("@dxos/credentials");
+var import_node_assert3 = __toESM(require("node:assert"));
+var import_async4 = require("@dxos/async");
+var import_credentials3 = require("@dxos/credentials");
+var import_debug3 = require("@dxos/debug");
 var import_feed_store2 = require("@dxos/feed-store");
 var import_log3 = require("@dxos/log");
-var import_credentials3 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials4 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var AUTH_TIMEOUT = 3e4;
 var Identity = class {
   constructor({ space, signer, identityKey, deviceKey }) {
-    this.stateUpdate = new import_async5.Event();
+    this.stateUpdate = new import_async4.Event();
     this.space = space;
     this._signer = signer;
     this.identityKey = identityKey;
     this.deviceKey = deviceKey;
-    this._deviceStateMachine = this.space.spaceState.registerProcessor(new import_credentials2.DeviceStateMachine({
+    this._deviceStateMachine = this.space.spaceState.registerProcessor(new import_credentials3.DeviceStateMachine({
       identityKey: this.identityKey,
       deviceKey: this.deviceKey,
       onUpdate: () => this.stateUpdate.emit()
     }));
-    this._profileStateMachine = this.space.spaceState.registerProcessor(new import_credentials2.ProfileStateMachine({
+    this._profileStateMachine = this.space.spaceState.registerProcessor(new import_credentials3.ProfileStateMachine({
       identityKey: this.identityKey,
       onUpdate: () => this.stateUpdate.emit()
     }));
-    this.authVerifier = new HaloAuthVerifier({
-      trustedDevicesProvider: () => this.authorizedDeviceKeys,
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => this.authorizedDeviceKeys,
       update: this.stateUpdate,
       authTimeout: AUTH_TIMEOUT
     });
@@ -685,6 +762,9 @@ var Identity = class {
   }
   async ready() {
     await this._deviceStateMachine.processor.deviceChainReady.wait();
+    await this.controlPipeline.state.waitUntilReachedTargetTimeframe({
+      timeout: 3e3
+    });
   }
   get profileDocument() {
     return this._profileStateMachine.processor.profile;
@@ -701,11 +781,15 @@ var Identity = class {
   get haloGenesisFeedKey() {
     return this.space.genesisFeedKey;
   }
+  get deviceCredentialChain() {
+    return this._deviceStateMachine.processor.deviceCredentialChain;
+  }
   getAdmissionCredentials() {
+    var _a, _b;
     return {
       deviceKey: this.deviceKey,
-      controlFeedKey: this.space.controlFeedKey,
-      dataFeedKey: this.space.dataFeedKey
+      controlFeedKey: (_a = this.space.controlFeedKey) != null ? _a : (0, import_debug3.failUndefined)(),
+      dataFeedKey: (_b = this.space.dataFeedKey) != null ? _b : (0, import_debug3.failUndefined)()
     };
   }
   /**
@@ -713,14 +797,14 @@ var Identity = class {
   * Requires identity to be ready.
   */
   getIdentityCredentialSigner() {
-    (0, import_node_assert2.default)(this._deviceStateMachine.processor.deviceCredentialChain, "Device credential chain is not ready.");
-    return (0, import_credentials2.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.processor.deviceCredentialChain, this.deviceKey);
+    (0, import_node_assert3.default)(this._deviceStateMachine.processor.deviceCredentialChain, "Device credential chain is not ready.");
+    return (0, import_credentials3.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.processor.deviceCredentialChain, this.deviceKey);
   }
   /**
   * Issues credentials as device.
   */
   getDeviceCredentialSigner() {
-    return (0, import_credentials2.createCredentialSignerWithKey)(this._signer, this.deviceKey);
+    return (0, import_credentials3.createCredentialSignerWithKey)(this._signer, this.deviceKey);
   }
   async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }) {
     (0, import_log3.log)("Admitting device:", {
@@ -731,7 +815,7 @@ var Identity = class {
       dataFeedKey
     }, {
       file: "identity.ts",
-      line: 155,
+      line: 160,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -752,7 +836,7 @@ var Identity = class {
           spaceKey: this.haloSpaceKey,
           deviceKey,
           identityKey: this.identityKey,
-          designation: import_credentials3.AdmittedFeed.Designation.CONTROL
+          designation: import_credentials4.AdmittedFeed.Designation.CONTROL
         }
       }),
       await signer.createCredential({
@@ -762,31 +846,33 @@ var Identity = class {
           spaceKey: this.haloSpaceKey,
           deviceKey,
           identityKey: this.identityKey,
-          designation: import_credentials3.AdmittedFeed.Designation.DATA
+          designation: import_credentials4.AdmittedFeed.Designation.DATA
         }
       })
     ].map((credential) => ({
-      "@type": "dxos.echo.feed.CredentialsMessage",
-      credential
+      credential: {
+        credential
+      }
     })));
   }
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity-manager.ts
-var import_node_assert3 = __toESM(require("node:assert"));
-var import_async6 = require("@dxos/async");
-var import_credentials4 = require("@dxos/credentials");
+var import_node_assert4 = __toESM(require("node:assert"));
+var import_async5 = require("@dxos/async");
+var import_credentials5 = require("@dxos/credentials");
 var import_log4 = require("@dxos/log");
-var import_credentials5 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials6 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util3 = require("@dxos/util");
 var IdentityManager = class {
   // TODO(burdon): IdentityManagerParams.
   // TODO(dmaretskyi): Perhaps this should take/generate the peerKey outside of an initialized identity.
-  constructor(_metadataStore, _keyring, _spaceManager) {
+  constructor(_metadataStore, _keyring, _feedStore, _spaceManager) {
     this._metadataStore = _metadataStore;
     this._keyring = _keyring;
+    this._feedStore = _feedStore;
     this._spaceManager = _spaceManager;
-    this.stateUpdate = new import_async6.Event();
+    this.stateUpdate = new import_async5.Event();
   }
   get identity() {
     return this._identity;
@@ -798,7 +884,7 @@ var IdentityManager = class {
       identityRecord
     }, {
       file: "identity-manager.ts",
-      line: 57,
+      line: 63,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -814,10 +900,10 @@ var IdentityManager = class {
     await ((_a = this._identity) == null ? void 0 : _a.close());
   }
   async createIdentity({ displayName } = {}) {
-    (0, import_node_assert3.default)(!this._identity, "Identity already exists.");
+    (0, import_node_assert4.default)(!this._identity, "Identity already exists.");
     (0, import_log4.log)("creating identity...", {}, {
       file: "identity-manager.ts",
-      line: 72,
+      line: 78,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -835,12 +921,12 @@ var IdentityManager = class {
     const identity = await this._constructIdentity(identityRecord);
     await identity.open();
     {
-      const generator = new import_credentials4.CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
+      const generator = new import_credentials5.CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
       const credentials = [
         // Space genesis.
         ...await generator.createSpaceGenesis(identityRecord.haloSpace.spaceKey, identityRecord.haloSpace.genesisFeedKey),
         // Feed admission.
-        await generator.createFeedAdmission(identityRecord.haloSpace.spaceKey, identityRecord.haloSpace.writeDataFeedKey, import_credentials5.AdmittedFeed.Designation.DATA)
+        await generator.createFeedAdmission(identityRecord.haloSpace.spaceKey, identityRecord.haloSpace.writeDataFeedKey, import_credentials6.AdmittedFeed.Designation.DATA)
       ];
       if (displayName) {
         credentials.push(await generator.createProfileCredential({
@@ -850,8 +936,9 @@ var IdentityManager = class {
       credentials.push(await generator.createDeviceAuthorization(identityRecord.deviceKey));
       for (const credential of credentials) {
         await identity.controlPipeline.writer.write({
-          "@type": "dxos.echo.feed.CredentialsMessage",
-          credential
+          credential: {
+            credential
+          }
         });
       }
     }
@@ -864,7 +951,7 @@ var IdentityManager = class {
       deviceKey: identity.deviceKey
     }, {
       file: "identity-manager.ts",
-      line: 131,
+      line: 136,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -878,47 +965,65 @@ var IdentityManager = class {
       params
     }, {
       file: "identity-manager.ts",
-      line: 139,
+      line: 144,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert3.default)(!this._identity, "Identity already exists.");
+    (0, import_node_assert4.default)(!this._identity, "Identity already exists.");
     const identityRecord = {
       identityKey: params.identityKey,
-      deviceKey: await this._keyring.createKey(),
+      deviceKey: params.deviceKey,
       haloSpace: {
         spaceKey: params.haloSpaceKey,
         genesisFeedKey: params.haloGenesisFeedKey,
-        writeControlFeedKey: await this._keyring.createKey(),
-        writeDataFeedKey: await this._keyring.createKey()
+        writeControlFeedKey: params.controlFeedKey,
+        writeDataFeedKey: params.dataFeedKey
       }
     };
     const identity = await this._constructIdentity(identityRecord);
     await identity.open();
     this._identity = identity;
     await this._metadataStore.setIdentityRecord(identityRecord);
+    await this._identity.ready();
     this.stateUpdate.emit();
+    (0, import_log4.log)("accepted identity", {
+      identityKey: identity.identityKey,
+      deviceKey: identity.deviceKey
+    }, {
+      file: "identity-manager.ts",
+      line: 164,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
     return identity;
   }
   async _constructIdentity(identityRecord) {
-    (0, import_node_assert3.default)(!this._identity);
+    (0, import_node_assert4.default)(!this._identity);
     (0, import_log4.log)("constructing identity", {
       identityRecord
     }, {
       file: "identity-manager.ts",
-      line: 163,
+      line: 170,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    const controlFeed = await this._feedStore.openFeed(identityRecord.haloSpace.writeControlFeedKey, {
+      writable: true
+    });
+    const dataFeed = await this._feedStore.openFeed(identityRecord.haloSpace.writeDataFeedKey, {
+      writable: true
+    });
     const space = await this._constructSpace({
       spaceRecord: identityRecord.haloSpace,
       swarmIdentity: {
         peerKey: identityRecord.deviceKey,
-        credentialProvider: createHaloAuthProvider((0, import_credentials4.createCredentialSignerWithKey)(this._keyring, identityRecord.deviceKey)),
+        credentialProvider: createAuthProvider((0, import_credentials5.createCredentialSignerWithKey)(this._keyring, identityRecord.deviceKey)),
         credentialAuthenticator: (0, import_util3.deferFunction)(() => identity.authVerifier.verifier)
       },
       identityKey: identityRecord.identityKey
     });
+    space.setControlFeed(controlFeed);
+    space.setDataFeed(dataFeed);
     const identity = new Identity({
       space,
       signer: this._keyring,
@@ -929,7 +1034,7 @@ var IdentityManager = class {
       identityKey: identityRecord.identityKey
     }, {
       file: "identity-manager.ts",
-      line: 182,
+      line: 196,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -939,9 +1044,7 @@ var IdentityManager = class {
     return this._spaceManager.constructSpace({
       metadata: {
         key: spaceRecord.spaceKey,
-        genesisFeedKey: spaceRecord.genesisFeedKey,
-        controlFeedKey: spaceRecord.writeControlFeedKey,
-        dataFeedKey: spaceRecord.writeDataFeedKey
+        genesisFeedKey: spaceRecord.genesisFeedKey
       },
       swarmIdentity,
       onNetworkConnection: () => {
@@ -965,11 +1068,10 @@ var InvitationEncoder = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
-var import_node_assert5 = __toESM(require("node:assert"));
-var import_async8 = require("@dxos/async");
-var import_context2 = require("@dxos/context");
-var import_credentials6 = require("@dxos/credentials");
-var import_debug3 = require("@dxos/debug");
+var import_node_assert6 = __toESM(require("node:assert"));
+var import_async7 = require("@dxos/async");
+var import_context3 = require("@dxos/context");
+var import_credentials7 = require("@dxos/credentials");
 var import_keys4 = require("@dxos/keys");
 var import_log5 = require("@dxos/log");
 var import_network_manager = require("@dxos/network-manager");
@@ -979,13 +1081,13 @@ var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport = require("@dxos/teleport");
 
 // packages/sdk/client-services/src/packlets/invitations/invitations.ts
-var import_node_assert4 = __toESM(require("node:assert"));
-var import_async7 = require("@dxos/async");
+var import_node_assert5 = __toESM(require("node:assert"));
+var import_async6 = require("@dxos/async");
 var import_services = require("@dxos/protocols/proto/dxos/client/services");
 var AUTHENTICATION_CODE_LENGTH = 6;
 var INVITATION_TIMEOUT = 3 * 6e4;
-var ON_CLOSE_DELAY = 500;
-var InvitationObservableProvider = class extends import_async7.CancellableObservableProvider {
+var ON_CLOSE_DELAY = 1e3;
+var InvitationObservableProvider = class extends import_async6.CancellableObservableProvider {
   get invitation() {
     return this._invitation;
   }
@@ -1007,7 +1109,7 @@ var wrapObservable = async (observable) => {
   return new Promise((resolve, reject) => {
     const unsubscribe = observable.subscribe({
       onSuccess: (invitation) => {
-        (0, import_node_assert4.default)(invitation.state === import_services.Invitation.State.SUCCESS);
+        (0, import_node_assert5.default)(invitation.state === import_services.Invitation.State.SUCCESS);
         unsubscribe();
         resolve(invitation);
       },
@@ -1030,25 +1132,24 @@ var AbstractInvitationsHandler = class {
 // packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
 var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
   // prettier-ignore
-  constructor(networkManager, _identityManager) {
-    super(networkManager);
-    this._identityManager = _identityManager;
+  constructor(_params) {
+    super(_params.networkManager);
+    this._params = _params;
   }
   /**
   * Creates an invitation and listens for a join request from the invited (guest) peer.
   */
   createInvitation(context, options) {
-    var _a;
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    (0, import_node_assert5.default)(type !== import_services2.Invitation.Type.OFFLINE);
-    const identity = (_a = this._identityManager.identity) != null ? _a : (0, import_debug3.failUndefined)();
+    (0, import_node_assert6.default)(type !== import_services2.Invitation.Type.OFFLINE);
+    const identity = this._params.getIdentity();
     const invitation = {
       type,
       invitationId: import_keys4.PublicKey.random().toHex(),
       swarmKey: swarmKey != null ? swarmKey : import_keys4.PublicKey.random(),
-      authenticationCode: (0, import_credentials6.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
+      authenticationCode: (0, import_credentials7.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
     };
-    const ctx = new import_context2.Context({
+    const ctx = new import_context3.Context({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
@@ -1058,111 +1159,108 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       await ctx.dispose();
     });
     let authenticationCode;
-    const complete = new import_async8.Trigger();
-    const createExtension = () => {
-      const hostInvitationExtension = new HostHaloInvitationExtension({
-        requestAdmission: async () => {
-          var _a2, _b;
-          (0, import_log5.log)("responding with admission offer", {
-            host: identity.deviceKey
-          }, {
-            file: "halo-invitations-handler.ts",
-            line: 84,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          (_b = (_a2 = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a2, invitation);
-          return {
-            identityKey: identity.identityKey,
-            haloSpaceKey: identity.haloSpaceKey,
-            genesisFeedKey: identity.haloGenesisFeedKey
-          };
-        },
-        authenticate: async ({ authenticationCode: code }) => {
-          (0, import_log5.log)("received authentication request", {
-            authenticationCode: code
+    const complete = new import_async7.Trigger();
+    const createExtension = () => new HostHaloInvitationExtension({
+      requestAdmission: async () => {
+        var _a, _b;
+        (0, import_log5.log)("responding with admission offer", {
+          host: identity.deviceKey
+        }, {
+          file: "halo-invitations-handler.ts",
+          line: 91,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        (_b = (_a = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a, invitation);
+        return {
+          identityKey: identity.identityKey,
+          haloSpaceKey: identity.haloSpaceKey,
+          genesisFeedKey: identity.haloGenesisFeedKey
+        };
+      },
+      authenticate: async ({ authenticationCode: code }) => {
+        (0, import_log5.log)("received authentication request", {
+          authenticationCode: code
+        }, {
+          file: "halo-invitations-handler.ts",
+          line: 105,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        authenticationCode = code;
+        return {
+          status: import_invitations.AuthenticationResponse.Status.OK
+        };
+      },
+      // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
+      presentAdmissionCredentials: async (credentials) => {
+        try {
+          if (invitation.type !== import_services2.Invitation.Type.INTERACTIVE_TESTING) {
+            if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
+              throw new Error(`invalid authentication code: ${authenticationCode}`);
+            }
+          }
+          (0, import_log5.log)("writing guest credentials", {
+            host: identity.deviceKey,
+            guest: credentials.deviceKey
           }, {
             file: "halo-invitations-handler.ts",
-            line: 98,
+            line: 120,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          authenticationCode = code;
-          return {
-            status: import_invitations.AuthenticationResponse.Status.OK
-          };
-        },
-        // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
-        presentAdmissionCredentials: async (credentials) => {
+          await identity.admitDevice(credentials);
+          complete.wake(credentials.deviceKey);
+        } catch (err) {
+          observable.callback.onError(err);
+          throw err;
+        }
+      },
+      onOpen: () => {
+        (0, import_async7.scheduleTask)(ctx, async () => {
+          var _a, _b;
           try {
-            if (invitation.type !== import_services2.Invitation.Type.INTERACTIVE_TESTING) {
-              if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
-                throw new Error(`invalid authentication code: ${authenticationCode}`);
-              }
-            }
-            (0, import_log5.log)("writing guest credentials", {
+            (0, import_log5.log)("connected", {
+              host: identity.deviceKey
+            }, {
+              file: "halo-invitations-handler.ts",
+              line: 136,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
+            const deviceKey = await complete.wait({
+              timeout
+            });
+            (0, import_log5.log)("admitted guest", {
               host: identity.deviceKey,
-              guest: credentials.deviceKey
+              guest: deviceKey
             }, {
               file: "halo-invitations-handler.ts",
-              line: 113,
+              line: 139,
               scope: this,
               callSite: (f, a) => f(...a)
             });
-            await identity.admitDevice(credentials);
-            complete.wake(credentials.deviceKey);
+            observable.callback.onSuccess(invitation);
           } catch (err) {
-            observable.callback.onError(err);
-            throw err;
-          }
-        },
-        onOpen: () => {
-          (0, import_async8.scheduleTask)(ctx, async () => {
-            var _a2, _b;
-            try {
-              (0, import_log5.log)("connected", {
-                host: identity.deviceKey
-              }, {
-                file: "halo-invitations-handler.ts",
-                line: 129,
-                scope: this,
-                callSite: (f, a) => f(...a)
-              });
-              (_b = (_a2 = observable.callback).onConnected) == null ? void 0 : _b.call(_a2, invitation);
-              const deviceKey = await complete.wait({
-                timeout
-              });
-              (0, import_log5.log)("admitted guest", {
-                host: identity.deviceKey,
-                guest: deviceKey
-              }, {
+            if (!observable.cancelled) {
+              import_log5.log.error("failed", err, {
                 file: "halo-invitations-handler.ts",
-                line: 132,
+                line: 143,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              observable.callback.onSuccess(invitation);
-            } catch (err) {
-              if (!observable.cancelled) {
-                import_log5.log.error("failed", err, {
-                  file: "halo-invitations-handler.ts",
-                  line: 136,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
-                });
-                observable.callback.onError(err);
-              }
-            } finally {
-              await (0, import_async8.sleep)(ON_CLOSE_DELAY);
-              await ctx.dispose();
+              observable.callback.onError(err);
             }
-          });
-        }
-      });
-      return hostInvitationExtension;
-    };
-    (0, import_async8.scheduleTask)(ctx, async () => {
-      var _a2, _b;
+          } finally {
+            await (0, import_async7.sleep)(ON_CLOSE_DELAY);
+            await ctx.dispose();
+          }
+        });
+      }
+    });
+    (0, import_async7.scheduleTask)(ctx, async () => {
+      var _a, _b;
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1173,7 +1271,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
         topology: new import_network_manager.StarTopology(topic)
       });
       ctx.onDispose(() => swarmConnection.close());
-      (_b = (_a2 = observable.callback).onConnecting) == null ? void 0 : _b.call(_a2, invitation);
+      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
     });
     return observable;
   }
@@ -1184,13 +1282,13 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
   */
   acceptInvitation(invitation, options) {
     const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
-    const ctx = new import_context2.Context({
+    const ctx = new import_context3.Context({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
       }
     });
-    const authenticated = new import_async8.Trigger();
+    const authenticated = new import_async7.Trigger();
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         await ctx.dispose();
@@ -1201,11 +1299,11 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       }
     });
     let connectionCount = 0;
-    const complete = new import_async8.Trigger();
+    const complete = new import_async7.Trigger();
     const createExtension = () => {
       const extension = new GuestHaloInvitationExtension({
         onOpen: () => {
-          (0, import_async8.scheduleTask)(ctx, async () => {
+          (0, import_async7.scheduleTask)(ctx, async () => {
             var _a, _b, _c, _d;
             try {
               if (++connectionCount > 1) {
@@ -1213,14 +1311,14 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               }
               (0, import_log5.log)("connected", {}, {
                 file: "halo-invitations-handler.ts",
-                line: 209,
+                line: 214,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
               (0, import_log5.log)("sending admission request", {}, {
                 file: "halo-invitations-handler.ts",
-                line: 213,
+                line: 218,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1228,7 +1326,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               if (invitation.type === void 0 || invitation.type === import_services2.Invitation.Type.INTERACTIVE) {
                 (0, import_log5.log)("guest waiting for authentication code...", {}, {
                   file: "halo-invitations-handler.ts",
-                  line: 220,
+                  line: 225,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1238,7 +1336,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 });
                 (0, import_log5.log)("sending authentication request", {}, {
                   file: "halo-invitations-handler.ts",
-                  line: 223,
+                  line: 228,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1246,27 +1344,39 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                   authenticationCode
                 });
               }
-              const identity = await this._identityManager.acceptIdentity({
+              const deviceKey = await this._params.keyring.createKey();
+              const controlFeedKey = await this._params.keyring.createKey();
+              const dataFeedKey = await this._params.keyring.createKey();
+              (0, import_log5.log)("presenting admission credentials", {
                 identityKey,
-                haloSpaceKey,
-                haloGenesisFeedKey: genesisFeedKey
-              });
-              (0, import_log5.log)("presenting admission credentials", {
-                guest: identity.deviceKey,
-                identityKey
+                deviceKey,
+                controlFeedKey,
+                dataFeedKey
               }, {
                 file: "halo-invitations-handler.ts",
-                line: 236,
+                line: 237,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              await extension.rpc.HaloHostService.presentAdmissionCredentials(identity.getAdmissionCredentials());
+              await extension.rpc.HaloHostService.presentAdmissionCredentials({
+                deviceKey,
+                controlFeedKey,
+                dataFeedKey
+              });
+              const identity = await this._params.acceptIdentity({
+                identityKey,
+                deviceKey,
+                haloSpaceKey,
+                haloGenesisFeedKey: genesisFeedKey,
+                controlFeedKey,
+                dataFeedKey
+              });
               (0, import_log5.log)("admitted by host", {
                 guest: identity.deviceKey,
                 identityKey
               }, {
                 file: "halo-invitations-handler.ts",
-                line: 240,
+                line: 256,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1275,7 +1385,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               if (!observable.cancelled) {
                 import_log5.log.warn("auth failed", err, {
                   file: "halo-invitations-handler.ts",
-                  line: 244,
+                  line: 260,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1289,9 +1399,9 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return extension;
     };
-    (0, import_async8.scheduleTask)(ctx, async () => {
+    (0, import_async7.scheduleTask)(ctx, async () => {
       var _a, _b;
-      (0, import_node_assert5.default)(invitation.swarmKey);
+      (0, import_node_assert6.default)(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1361,8 +1471,8 @@ var GuestHaloInvitationExtension = class extends import_teleport.RpcExtension {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts
-var import_node_assert6 = __toESM(require("node:assert"));
-var import_async9 = require("@dxos/async");
+var import_node_assert7 = __toESM(require("node:assert"));
+var import_async8 = require("@dxos/async");
 var import_log6 = require("@dxos/log");
 var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var AbstractInvitationsProxy = class {
@@ -1389,7 +1499,7 @@ var AbstractInvitationsProxy = class {
       observable.setInvitation(invitation2);
       switch (invitation2.state) {
         case import_services3.Invitation.State.CONNECTING: {
-          (0, import_node_assert6.default)(invitation2.invitationId);
+          (0, import_node_assert7.default)(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation2);
           break;
@@ -1421,18 +1531,18 @@ var AbstractInvitationsProxy = class {
       }
     }, (err) => {
       if (err) {
-        (0, import_async9.observableError)(observable, err);
+        (0, import_async8.observableError)(observable, err);
       }
     });
     return observable;
   }
   acceptInvitation(invitation, options) {
-    (0, import_node_assert6.default)(invitation && invitation.swarmKey);
+    (0, import_node_assert7.default)(invitation && invitation.swarmKey);
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         var _a;
         const invitationId = (_a = observable.invitation) == null ? void 0 : _a.invitationId;
-        (0, import_node_assert6.default)(invitationId);
+        (0, import_node_assert7.default)(invitationId);
         await this._invitationsService.cancelInvitation({
           invitationId
         });
@@ -1440,7 +1550,7 @@ var AbstractInvitationsProxy = class {
       onAuthenticate: async (authenticationCode) => {
         var _a;
         const invitationId = (_a = observable.invitation) == null ? void 0 : _a.invitationId;
-        (0, import_node_assert6.default)(invitationId);
+        (0, import_node_assert7.default)(invitationId);
         await this._invitationsService.authenticate({
           invitationId,
           authenticationCode
@@ -1453,7 +1563,7 @@ var AbstractInvitationsProxy = class {
     });
     stream.subscribe((invitation2) => {
       var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
-      (0, import_node_assert6.default)(invitation2.invitationId);
+      (0, import_node_assert7.default)(invitation2.invitationId);
       observable.setInvitation(invitation2);
       switch (invitation2.state) {
         case import_services3.Invitation.State.CONNECTING: {
@@ -1487,7 +1597,7 @@ var AbstractInvitationsProxy = class {
       }
     }, (err) => {
       if (err) {
-        (0, import_async9.observableError)(observable, err);
+        (0, import_async8.observableError)(observable, err);
       }
     });
     return observable;
@@ -1502,7 +1612,7 @@ var HaloInvitationsProxy = class extends AbstractInvitationsProxy {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
-var import_node_assert7 = __toESM(require("node:assert"));
+var import_node_assert8 = __toESM(require("node:assert"));
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
 var import_log7 = require("@dxos/log");
 var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
@@ -1539,30 +1649,30 @@ var AbstractInvitationsService = class {
       });
       observable.subscribe({
         onConnecting: (invitation2) => {
-          (0, import_node_assert7.default)(invitation2.invitationId);
+          (0, import_node_assert8.default)(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           this._createInvitations.set(invitation2.invitationId, observable);
           invitation2.state = import_services4.Invitation.State.CONNECTING;
           next(invitation2);
         },
         onConnected: (invitation2) => {
-          (0, import_node_assert7.default)(invitation2.invitationId);
+          (0, import_node_assert8.default)(invitation2.invitationId);
           invitation2.state = import_services4.Invitation.State.CONNECTED;
           next(invitation2);
         },
         onAuthenticating: (invitation2) => {
-          (0, import_node_assert7.default)(invitation2.invitationId);
+          (0, import_node_assert8.default)(invitation2.invitationId);
           invitation2.state = import_services4.Invitation.State.AUTHENTICATING;
           next(invitation2);
         },
         onSuccess: (invitation2) => {
-          (0, import_node_assert7.default)(invitation2.invitationId);
+          (0, import_node_assert8.default)(invitation2.invitationId);
           invitation2.state = import_services4.Invitation.State.SUCCESS;
           next(invitation2);
           close();
         },
         onCancelled: () => {
-          (0, import_node_assert7.default)(invitationId);
+          (0, import_node_assert8.default)(invitationId);
           invitation.invitationId = invitationId;
           invitation.state = import_services4.Invitation.State.CANCELLED;
           next(invitation);
@@ -1614,19 +1724,19 @@ var AbstractInvitationsService = class {
       const observable = invitationsHandler.acceptInvitation(invitation, options);
       observable.subscribe({
         onConnecting: (invitation2) => {
-          (0, import_node_assert7.default)(invitation2.invitationId);
+          (0, import_node_assert8.default)(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           this._acceptInvitations.set(invitation2.invitationId, observable);
           invitation2.state = import_services4.Invitation.State.CONNECTING;
           next(invitation2);
         },
         onConnected: (invitation2) => {
-          (0, import_node_assert7.default)(invitation2.invitationId);
+          (0, import_node_assert8.default)(invitation2.invitationId);
           invitation2.state = import_services4.Invitation.State.CONNECTED;
           next(invitation2);
         },
         onAuthenticating: (invitation2) => {
-          (0, import_node_assert7.default)(invitation2.invitationId);
+          (0, import_node_assert8.default)(invitation2.invitationId);
           invitation2.state = import_services4.Invitation.State.AUTHENTICATING;
           next(invitation2);
         },
@@ -1636,7 +1746,7 @@ var AbstractInvitationsService = class {
           close();
         },
         onCancelled: () => {
-          (0, import_node_assert7.default)(invitationId);
+          (0, import_node_assert8.default)(invitationId);
           invitation.invitationId = invitationId;
           invitation.state = import_services4.Invitation.State.CANCELLED;
           next(invitation);
@@ -1682,7 +1792,7 @@ var AbstractInvitationsService = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert7.default)(invitationId);
+    (0, import_node_assert8.default)(invitationId);
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
       import_log7.log.warn("invalid invitation", {
@@ -1705,7 +1815,7 @@ var AbstractInvitationsService = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert7.default)(invitation.invitationId);
+    (0, import_node_assert8.default)(invitation.invitationId);
     const observable = (_a = this._createInvitations.get(invitation.invitationId)) != null ? _a : this._acceptInvitations.get(invitation.invitationId);
     if (!observable) {
       import_log7.log.warn("invalid invitation", {
@@ -1734,10 +1844,10 @@ var HaloInvitationsServiceImpl = class extends AbstractInvitationsService {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts
-var import_node_assert8 = __toESM(require("node:assert"));
-var import_async10 = require("@dxos/async");
-var import_context3 = require("@dxos/context");
-var import_credentials7 = require("@dxos/credentials");
+var import_node_assert9 = __toESM(require("node:assert"));
+var import_async9 = require("@dxos/async");
+var import_context4 = require("@dxos/context");
+var import_credentials8 = require("@dxos/credentials");
 var import_feed_store3 = require("@dxos/feed-store");
 var import_keys5 = require("@dxos/keys");
 var import_log8 = require("@dxos/log");
@@ -1760,16 +1870,16 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   createInvitation(space, options) {
     let swarmConnection;
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    (0, import_node_assert8.default)(type !== import_services5.Invitation.Type.OFFLINE);
-    (0, import_node_assert8.default)(space);
+    (0, import_node_assert9.default)(type !== import_services5.Invitation.Type.OFFLINE);
+    (0, import_node_assert9.default)(space);
     const invitation = {
       type,
       invitationId: import_keys5.PublicKey.random().toHex(),
       swarmKey: swarmKey != null ? swarmKey : import_keys5.PublicKey.random(),
       spaceKey: space.key,
-      authenticationCode: (0, import_credentials7.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
+      authenticationCode: (0, import_credentials8.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
     };
-    const ctx = new import_context3.Context({
+    const ctx = new import_context4.Context({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
@@ -1781,7 +1891,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     let authenticationCode;
     let authenticationRetry = 0;
     const createExtension = () => {
-      const complete = new import_async10.Trigger();
+      const complete = new import_async9.Trigger();
       let guestProfile;
       const hostInvitationExtension = new HostSpaceInvitationExtension({
         introduce: async ({ profile }) => {
@@ -1792,7 +1902,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
             spaceKey: space.key
           }, {
             file: "space-invitations-handler.ts",
-            line: 97,
+            line: 98,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1804,7 +1914,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
             authenticationCode: code
           }, {
             file: "space-invitations-handler.ts",
-            line: 111,
+            line: 112,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1834,14 +1944,14 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               guest: deviceKey
             }, {
               file: "space-invitations-handler.ts",
-              line: 138,
+              line: 139,
               scope: this,
               callSite: (f, a) => f(...a)
             });
-            const credentials = await (0, import_credentials7.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, deviceKey, space.key, controlFeedKey, dataFeedKey, space.inner.genesisFeedKey, guestProfile);
-            (0, import_node_assert8.default)(credentials[0]["@type"] === "dxos.echo.feed.CredentialsMessage");
-            const spaceMemberCredential = credentials[0].credential;
-            (0, import_node_assert8.default)((0, import_credentials7.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+            const credentials = await (0, import_credentials8.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
+            (0, import_node_assert9.default)(credentials[0].credential);
+            const spaceMemberCredential = credentials[0].credential.credential;
+            (0, import_node_assert9.default)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
             await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, credentials);
             complete.wake(deviceKey);
             return {
@@ -1853,14 +1963,14 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
           }
         },
         onOpen: () => {
-          (0, import_async10.scheduleTask)(ctx, async () => {
+          (0, import_async9.scheduleTask)(ctx, async () => {
             var _a, _b;
             try {
               (0, import_log8.log)("connected", {
                 host: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 172,
+                line: 170,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1873,7 +1983,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 175,
+                line: 173,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1882,7 +1992,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               if (!observable.cancelled) {
                 import_log8.log.error("failed", err, {
                   file: "space-invitations-handler.ts",
-                  line: 179,
+                  line: 177,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1890,7 +2000,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               }
             } finally {
               if (type !== import_services5.Invitation.Type.MULTIUSE_TESTING) {
-                await (0, import_async10.sleep)(ON_CLOSE_DELAY);
+                await (0, import_async9.sleep)(ON_CLOSE_DELAY);
                 await ctx.dispose();
               }
             }
@@ -1899,7 +2009,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return hostInvitationExtension;
     };
-    (0, import_async10.scheduleTask)(ctx, async () => {
+    (0, import_async9.scheduleTask)(ctx, async () => {
       var _a, _b;
       const topic = invitation.swarmKey;
       const swarmConnection2 = await this._networkManager.joinSwarm({
@@ -1922,13 +2032,13 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   */
   acceptInvitation(invitation, options) {
     const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
-    const ctx = new import_context3.Context({
+    const ctx = new import_context4.Context({
       onError: (err) => {
         void ctx.dispose();
         observable.callback.onError(err);
       }
     });
-    const authenticated = new import_async10.Trigger();
+    const authenticated = new import_async9.Trigger();
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         await ctx.dispose();
@@ -1938,11 +2048,11 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       }
     });
     let connectionCount = 0;
-    const complete = new import_async10.Trigger();
+    const complete = new import_async9.Trigger();
     const createExtension = () => {
       const extension = new GuestSpaceInvitationExtension({
         onOpen: () => {
-          (0, import_async10.scheduleTask)(ctx, async () => {
+          (0, import_async9.scheduleTask)(ctx, async () => {
             var _a, _b, _c, _d;
             try {
               if (++connectionCount > 1) {
@@ -1952,7 +2062,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 252,
+                line: 250,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1961,7 +2071,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 256,
+                line: 254,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1972,7 +2082,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
                   (0, import_log8.log)("guest waiting for authentication code...", {}, {
                     file: "space-invitations-handler.ts",
-                    line: 265,
+                    line: 263,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -1982,7 +2092,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                   });
                   (0, import_log8.log)("sending authentication request", {}, {
                     file: "space-invitations-handler.ts",
-                    line: 269,
+                    line: 267,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -2000,7 +2110,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                         attempt
                       }, {
                         file: "space-invitations-handler.ts",
-                        line: 279,
+                        line: 277,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -2015,7 +2125,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 290,
+                line: 288,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -2025,21 +2135,20 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 controlFeedKey,
                 dataFeedKey
               });
-              const assertion = (0, import_credentials7.getCredentialAssertion)(credential);
-              (0, import_node_assert8.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
-              (0, import_node_assert8.default)(credential.subject.id.equals(this._signingContext.identityKey));
+              const assertion = (0, import_credentials8.getCredentialAssertion)(credential);
+              (0, import_node_assert9.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
+              (0, import_node_assert9.default)(credential.subject.id.equals(this._signingContext.identityKey));
               const space = await this._spaceManager.acceptSpace({
                 spaceKey: assertion.spaceKey,
-                genesisFeedKey: assertion.genesisFeedKey,
-                controlFeedKey,
-                dataFeedKey
+                genesisFeedKey: assertion.genesisFeedKey
               });
+              await this._signingContext.recordCredential(credential);
               (0, import_log8.log)("admitted by host", {
                 guest: this._signingContext.deviceKey,
                 spaceKey: space.key
               }, {
                 file: "space-invitations-handler.ts",
-                line: 313,
+                line: 310,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -2048,7 +2157,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               if (!observable.cancelled) {
                 import_log8.log.warn("auth failed", err, {
                   file: "space-invitations-handler.ts",
-                  line: 317,
+                  line: 314,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -2062,9 +2171,9 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       });
       return extension;
     };
-    (0, import_async10.scheduleTask)(ctx, async () => {
+    (0, import_async9.scheduleTask)(ctx, async () => {
       var _a, _b;
-      (0, import_node_assert8.default)(invitation.swarmKey);
+      (0, import_node_assert9.default)(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -2142,7 +2251,7 @@ var SpaceInvitationsProxy = class extends AbstractInvitationsProxy {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-service.ts
-var import_node_assert9 = __toESM(require("node:assert"));
+var import_node_assert10 = __toESM(require("node:assert"));
 var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
   // prettier-ignore
   constructor(identityManager, invitationsHandler, _getSpaceManager) {
@@ -2151,36 +2260,280 @@ var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
     this._getSpaceManager = _getSpaceManager;
   }
   getContext(invitation) {
-    (0, import_node_assert9.default)(invitation.spaceKey);
+    (0, import_node_assert10.default)(invitation.spaceKey);
     const spaceManager = this._getSpaceManager();
     const space = spaceManager.spaces.get(invitation.spaceKey);
-    (0, import_node_assert9.default)(space);
+    (0, import_node_assert10.default)(space);
     return space;
   }
 };
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
 var import_async13 = require("@dxos/async");
-var import_debug4 = require("@dxos/debug");
-var import_echo_db3 = require("@dxos/echo-db");
+var import_credentials11 = require("@dxos/credentials");
+var import_debug5 = require("@dxos/debug");
+var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_keyring = require("@dxos/keyring");
-var import_log10 = require("@dxos/log");
+var import_log11 = require("@dxos/log");
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+var import_node_assert12 = __toESM(require("node:assert"));
 var import_async12 = require("@dxos/async");
+var import_context7 = require("@dxos/context");
+var import_credentials10 = require("@dxos/credentials");
+var import_echo_pipeline2 = require("@dxos/echo-pipeline");
+var import_keys8 = require("@dxos/keys");
+var import_log10 = require("@dxos/log");
+var import_teleport_extension_presence = require("@dxos/teleport-extension-presence");
+var import_util6 = require("@dxos/util");
+
+// packages/sdk/client-services/src/packlets/spaces/data-space.ts
+var import_async11 = require("@dxos/async");
+var import_context6 = require("@dxos/context");
+var import_debug4 = require("@dxos/debug");
+var import_echo_pipeline = require("@dxos/echo-pipeline");
+var import_keys7 = require("@dxos/keys");
+var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_util5 = require("@dxos/util");
+
+// packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
+var import_node_assert11 = __toESM(require("node:assert"));
+var import_async10 = require("@dxos/async");
 var import_context5 = require("@dxos/context");
-var import_echo_db2 = require("@dxos/echo-db");
 var import_keys6 = require("@dxos/keys");
 var import_log9 = require("@dxos/log");
-var import_teleport_extension_presence = require("@dxos/teleport-extension-presence");
+var import_protocols5 = require("@dxos/protocols");
+var import_teleport3 = require("@dxos/teleport");
 var import_util4 = require("@dxos/util");
+var RETRY_TIMEOUT = 1e3;
+var NOTARIZE_TIMEOUT = 1e4;
+var NotarizationPlugin = class {
+  constructor() {
+    this._ctx = new import_context5.Context();
+    this._extensionOpened = new import_async10.Event();
+    this._extensions = /* @__PURE__ */ new Set();
+    this._processedCredentials = new import_util4.ComplexSet(import_keys6.PublicKey.hash);
+    this._processCredentialsTriggers = new import_util4.ComplexMap(import_keys6.PublicKey.hash);
+  }
+  async open() {
+  }
+  async close() {
+    await this._ctx.dispose();
+  }
+  /**
+  * Request credentials to be notarized.
+  */
+  async notarize(credentials) {
+    (0, import_log9.log)("notarize", {
+      credentials
+    }, {
+      file: "notarization-plugin.ts",
+      line: 44,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    (0, import_node_assert11.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
+    const errors = new import_async10.Trigger();
+    const ctx = this._ctx.derive({
+      onError: (err) => {
+        import_log9.log.warn("Notarization error", {
+          err
+        }, {
+          file: "notarization-plugin.ts",
+          line: 53,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        void ctx.dispose();
+        errors.throw(err);
+      }
+    });
+    (0, import_async10.scheduleTask)(ctx, () => {
+      import_log9.log.warn("Notarization timeout", {}, {
+        file: "notarization-plugin.ts",
+        line: 61,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      void ctx.dispose();
+      errors.throw(new import_async10.TimeoutError(NOTARIZE_TIMEOUT, "Notarization timed out"));
+    }, NOTARIZE_TIMEOUT);
+    const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
+    const peersTried = /* @__PURE__ */ new Set();
+    const notarizeTask = new import_async10.DeferredTask(ctx, async () => {
+      try {
+        if (this._extensions.size === 0) {
+          import_log9.log.warn("No peers to notarize with", {}, {
+            file: "notarization-plugin.ts",
+            line: 76,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        const peer = [
+          ...this._extensions
+        ].find((peer2) => !peersTried.has(peer2));
+        if (!peer) {
+          import_log9.log.warn("Exhausted all peers to notarize with", {
+            retryIn: RETRY_TIMEOUT
+          }, {
+            file: "notarization-plugin.ts",
+            line: 83,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          peersTried.clear();
+          (0, import_async10.scheduleTask)(ctx, () => notarizeTask.schedule(), RETRY_TIMEOUT);
+          return;
+        }
+        peersTried.add(peer);
+        (0, import_log9.log)("try notarizing", {
+          peer: peer.localPeerId,
+          credentialId: credentials.map((credential) => credential.id)
+        }, {
+          file: "notarization-plugin.ts",
+          line: 90,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        await peer.rpc.NotarizationService.notarize({
+          credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
+        });
+        (0, import_log9.log)("success", {}, {
+          file: "notarization-plugin.ts",
+          line: 94,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+      } catch (err) {
+        import_log9.log.warn("error notarizing (recoverable)", err, {
+          file: "notarization-plugin.ts",
+          line: 96,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        notarizeTask.schedule();
+      }
+    });
+    notarizeTask.schedule();
+    this._extensionOpened.on(ctx, () => notarizeTask.schedule());
+    try {
+      await Promise.race([
+        allNotarized,
+        errors.wait()
+      ]);
+      (0, import_log9.log)("done", {}, {
+        file: "notarization-plugin.ts",
+        line: 107,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } finally {
+      await ctx.dispose();
+    }
+  }
+  /**
+  * Called with credentials arriving from the control pipeline.
+  */
+  async process(credential) {
+    var _a;
+    if (!credential.id) {
+      return;
+    }
+    (_a = this._processCredentialsTriggers.get(credential.id)) == null ? void 0 : _a.wake();
+    this._processedCredentials.add(credential.id);
+    this._processCredentialsTriggers.delete(credential.id);
+  }
+  setWriter(writer) {
+    (0, import_node_assert11.default)(!this._writer, "Writer already set.");
+    this._writer = writer;
+  }
+  async _waitUntilProcessed(id) {
+    if (this._processedCredentials.has(id)) {
+      return;
+    }
+    await (0, import_util4.entry)(this._processCredentialsTriggers, id).orInsert(new import_async10.Trigger()).value.wait();
+  }
+  /**
+  * Requests from other peers to notarize credentials.
+  */
+  async _onNotarize(request) {
+    var _a;
+    if (!this._writer) {
+      throw new Error("Writer not set");
+    }
+    for (const credential of (_a = request.credentials) != null ? _a : []) {
+      (0, import_node_assert11.default)(credential.id, "Credential must have an id");
+      if (this._processedCredentials.has(credential.id)) {
+        continue;
+      }
+      await this._writer.write(credential);
+    }
+  }
+  createExtension() {
+    const extension = new NotarizationTeleportExtension({
+      onOpen: async () => {
+        (0, import_log9.log)("extension opened", {
+          peer: extension.localPeerId
+        }, {
+          file: "notarization-plugin.ts",
+          line: 156,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        this._extensions.add(extension);
+        this._extensionOpened.emit();
+      },
+      onClose: async () => {
+        (0, import_log9.log)("extension closed", {
+          peer: extension.localPeerId
+        }, {
+          file: "notarization-plugin.ts",
+          line: 161,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        this._extensions.delete(extension);
+      },
+      onNotarize: this._onNotarize.bind(this)
+    });
+    return extension;
+  }
+};
+var NotarizationTeleportExtension = class extends import_teleport3.RpcExtension {
+  constructor(_params) {
+    super({
+      requested: {
+        NotarizationService: import_protocols5.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+      },
+      exposed: {
+        NotarizationService: import_protocols5.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+      }
+    });
+    this._params = _params;
+  }
+  async getHandlers() {
+    return {
+      NotarizationService: {
+        notarize: async (request) => {
+          await this._params.onNotarize(request);
+        }
+      }
+    };
+  }
+  async onOpen(ctx) {
+    await super.onOpen(ctx);
+    await this._params.onOpen();
+  }
+  async onClose(err) {
+    await this._params.onClose();
+    await super.onClose(err);
+  }
+};
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-var import_node_assert10 = __toESM(require("node:assert"));
-var import_async11 = require("@dxos/async");
-var import_context4 = require("@dxos/context");
-var import_echo_db = require("@dxos/echo-db");
 var __decorate = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -2191,12 +2544,18 @@ var __decorate = function(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var AUTH_TIMEOUT2 = 3e4;
+var CONTROL_PIPELINE_READY_TIMEFRAME = 3e3;
 var DataSpace = class DataSpace2 {
   constructor(params) {
-    this._ctx = new import_context4.Context();
+    this._ctx = new import_context6.Context();
     this._inner = params.inner;
     this._presence = params.presence;
-    this._dataPipelineController = new import_echo_db.DataPipelineControllerImpl({
+    this._keyring = params.keyring;
+    this._feedStore = params.feedStore;
+    this._metadataStore = params.metadataStore;
+    this._signingContext = params.signingContext;
+    this._dataPipelineController = new import_echo_pipeline.DataPipelineControllerImpl({
       modelFactory: params.modelFactory,
       metadataStore: params.metadataStore,
       snapshotManager: params.snapshotManager,
@@ -2205,39 +2564,103 @@ var DataSpace = class DataSpace2 {
       feedInfoProvider: (feedKey) => this._inner.spaceState.feeds.get(feedKey),
       snapshotId: params.snapshotId
     });
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => new import_util5.ComplexSet(import_keys7.PublicKey.hash, Array.from(this._inner.spaceState.members.keys())),
+      update: this._inner.stateUpdate,
+      authTimeout: AUTH_TIMEOUT2
+    });
+    this._notarizationPluginConsumer = this._inner.spaceState.registerProcessor(new NotarizationPlugin());
   }
   get key() {
     return this._inner.key;
   }
-  get inner() {
-    return this._inner;
-  }
   get isOpen() {
     return this._inner.isOpen;
   }
+  // TODO(burdon): Can we mark this for debugging only?
+  get inner() {
+    return this._inner;
+  }
   get dataPipelineController() {
     return this._dataPipelineController;
   }
-  get database() {
-    (0, import_node_assert10.default)(this._dataPipelineController.database);
-    return this._dataPipelineController.database;
-  }
   get stateUpdate() {
     return this._inner.stateUpdate;
   }
   get presence() {
     return this._presence;
   }
+  get notarizationPlugin() {
+    return this._notarizationPluginConsumer.processor;
+  }
   async open() {
+    await this.notarizationPlugin.open();
+    await this._notarizationPluginConsumer.open();
     await this._inner.open();
-    await this._inner.initDataPipeline(this._dataPipelineController);
   }
   async close() {
     await this._ctx.dispose();
+    await this.authVerifier.close();
     await this._inner.close();
+    await this._notarizationPluginConsumer.close();
+    await this.notarizationPlugin.close();
     await this._presence.destroy();
   }
+  async initializeDataPipeline() {
+    await this._inner.controlPipeline.state.waitUntilReachedTargetTimeframe({
+      timeout: CONTROL_PIPELINE_READY_TIMEFRAME
+    });
+    await this._createWritableFeeds();
+    this.notarizationPlugin.setWriter((0, import_echo_pipeline.createMappedFeedWriter)((credential) => ({
+      credential: {
+        credential
+      }
+    }), this._inner.controlPipeline.writer));
+    await this._inner.initDataPipeline(this._dataPipelineController);
+  }
+  async _createWritableFeeds() {
+    const credentials = [];
+    if (!this.inner.controlFeedKey) {
+      const controlFeed = await this._feedStore.openFeed(await this._keyring.createKey(), {
+        writable: true
+      });
+      this.inner.setControlFeed(controlFeed);
+      credentials.push(await this._signingContext.credentialSigner.createCredential({
+        subject: controlFeed.key,
+        assertion: {
+          "@type": "dxos.halo.credentials.AdmittedFeed",
+          spaceKey: this.key,
+          deviceKey: this._signingContext.deviceKey,
+          identityKey: this._signingContext.identityKey,
+          designation: import_credentials9.AdmittedFeed.Designation.CONTROL
+        }
+      }));
+    }
+    if (!this.inner.dataFeedKey) {
+      const dataFeed = await this._feedStore.openFeed(await this._keyring.createKey(), {
+        writable: true
+      });
+      this.inner.setDataFeed(dataFeed);
+      credentials.push(await this._signingContext.credentialSigner.createCredential({
+        subject: dataFeed.key,
+        assertion: {
+          "@type": "dxos.halo.credentials.AdmittedFeed",
+          spaceKey: this.key,
+          deviceKey: this._signingContext.deviceKey,
+          identityKey: this._signingContext.identityKey,
+          designation: import_credentials9.AdmittedFeed.Designation.DATA
+        }
+      }));
+    }
+    if (credentials.length > 0) {
+      await this.notarizationPlugin.notarize(credentials);
+    }
+    await this._metadataStore.setWritableFeedKeys(this.key, this.inner.controlFeedKey, this.inner.dataFeedKey);
+  }
 };
+__decorate([
+  (0, import_debug4.timed)(1e4)
+], DataSpace.prototype, "_createWritableFeeds", null);
 DataSpace = __decorate([
   (0, import_async11.trackLeaks)("open", "close")
 ], DataSpace);
@@ -2253,18 +2676,20 @@ var __decorate2 = function(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var DATA_PIPELINE_READY_TIMEOUT = 3e3;
 var DataSpaceManager = class DataSpaceManager2 {
-  constructor(_spaceManager, _metadataStore, _dataServiceSubscriptions, _keyring, _signingContext, _modelFactory, _snapshotStore) {
+  constructor(_spaceManager, _metadataStore, _dataServiceSubscriptions, _keyring, _signingContext, _modelFactory, _feedStore, _snapshotStore) {
     this._spaceManager = _spaceManager;
     this._metadataStore = _metadataStore;
     this._dataServiceSubscriptions = _dataServiceSubscriptions;
     this._keyring = _keyring;
     this._signingContext = _signingContext;
     this._modelFactory = _modelFactory;
+    this._feedStore = _feedStore;
     this._snapshotStore = _snapshotStore;
-    this._ctx = new import_context5.Context();
+    this._ctx = new import_context7.Context();
     this.updated = new import_async12.Event();
-    this._spaces = new import_util4.ComplexMap(import_keys6.PublicKey.hash);
+    this._spaces = new import_util6.ComplexMap(import_keys8.PublicKey.hash);
   }
   // TODO(burdon): Remove.
   get spaces() {
@@ -2272,35 +2697,40 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   async open() {
     await this._metadataStore.load();
-    (0, import_log9.log)("metadata loaded", {
+    (0, import_log10.log)("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
       file: "data-space-manager.ts",
-      line: 54,
+      line: 67,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     for (const spaceMetadata of this._metadataStore.spaces) {
-      (0, import_log9.log)("load space", {
+      (0, import_log10.log)("load space", {
         spaceMetadata
       }, {
         file: "data-space-manager.ts",
-        line: 57,
+        line: 70,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       const space = await this._constructSpace(spaceMetadata);
-      if (spaceMetadata.latestTimeframe) {
-        (0, import_log9.log)("waiting for latest timeframe", {
+      await space.initializeDataPipeline();
+      if (spaceMetadata.dataTimeframe) {
+        (0, import_log10.log)("waiting for latest timeframe", {
           spaceMetadata
         }, {
           file: "data-space-manager.ts",
-          line: 60,
+          line: 74,
           scope: this,
           callSite: (f, a) => f(...a)
         });
-        await space.dataPipelineController.waitUntilTimeframe(spaceMetadata.latestTimeframe);
+        await space.dataPipelineController.pipelineState.setTargetTimeframe(spaceMetadata.dataTimeframe);
       }
+      await space.dataPipelineController.pipelineState.waitUntilReachedTargetTimeframe({
+        timeout: DATA_PIPELINE_READY_TIMEOUT
+      });
+      this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
     }
   }
   async close() {
@@ -2322,30 +2752,36 @@ var DataSpaceManager = class DataSpaceManager2 {
       controlFeedKey,
       dataFeedKey
     };
-    (0, import_log9.log)("creating space...", {
+    (0, import_log10.log)("creating space...", {
       spaceKey
     }, {
       file: "data-space-manager.ts",
-      line: 89,
+      line: 110,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     const space = await this._constructSpace(metadata);
-    await (0, import_echo_db2.spaceGenesis)(this._keyring, this._signingContext, space.inner);
+    const credentials = await (0, import_echo_pipeline2.spaceGenesis)(this._keyring, this._signingContext, space.inner);
     await this._metadataStore.addSpace(metadata);
+    const memberCredential = credentials[1];
+    (0, import_node_assert12.default)((0, import_credentials10.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    await this._signingContext.recordCredential(memberCredential);
+    await space.initializeDataPipeline();
+    this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
     this.updated.emit();
     return space;
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
+    (0, import_node_assert12.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
     const metadata = {
       key: opts.spaceKey,
-      genesisFeedKey: opts.genesisFeedKey,
-      controlFeedKey: opts.controlFeedKey,
-      dataFeedKey: opts.dataFeedKey
+      genesisFeedKey: opts.genesisFeedKey
     };
     const space = await this._constructSpace(metadata);
     await this._metadataStore.addSpace(metadata);
+    await space.initializeDataPipeline();
+    this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
     this.updated.emit();
     return space;
   }
@@ -2356,21 +2792,30 @@ var DataSpaceManager = class DataSpaceManager2 {
       offlineTimeout: 3e4,
       identityKey: this._signingContext.identityKey
     });
-    const snapshotManager = new import_echo_db2.SnapshotManager(this._snapshotStore);
+    const snapshotManager = new import_echo_pipeline2.SnapshotManager(this._snapshotStore);
+    const controlFeed = metadata.controlFeedKey && await this._feedStore.openFeed(metadata.controlFeedKey, {
+      writable: true
+    });
+    const dataFeed = metadata.dataFeedKey && await this._feedStore.openFeed(metadata.dataFeedKey, {
+      writable: true
+    });
     const space = await this._spaceManager.constructSpace({
       metadata,
       swarmIdentity: {
         peerKey: this._signingContext.deviceKey,
-        credentialProvider: this._signingContext.credentialProvider,
-        credentialAuthenticator: this._signingContext.credentialAuthenticator
+        credentialProvider: createAuthProvider(this._signingContext.credentialSigner),
+        credentialAuthenticator: (0, import_util6.deferFunction)(() => dataSpace.authVerifier.verifier)
       },
       onNetworkConnection: (session) => {
         session.addExtension("dxos.mesh.teleport.presence", presence.createExtension({
           remotePeerId: session.remotePeerId
         }));
         session.addExtension("dxos.mesh.teleport.objectsync", snapshotManager.objectSync.createExtension());
+        session.addExtension("dxos.mesh.teleport.notarization", dataSpace.notarizationPlugin.createExtension());
       }
     });
+    controlFeed && space.setControlFeed(controlFeed);
+    dataFeed && space.setDataFeed(dataFeed);
     const dataSpace = new DataSpace({
       inner: space,
       modelFactory: this._modelFactory,
@@ -2378,10 +2823,12 @@ var DataSpaceManager = class DataSpaceManager2 {
       snapshotManager,
       presence,
       memberKey: this._signingContext.identityKey,
+      keyring: this._keyring,
+      feedStore: this._feedStore,
+      signingContext: this._signingContext,
       snapshotId: metadata.snapshot
     });
     await dataSpace.open();
-    this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.database.createDataServiceHost());
     this._spaces.set(metadata.key, dataSpace);
     return dataSpace;
   }
@@ -2410,30 +2857,38 @@ var ServiceContext = class {
     this.networkManager = networkManager;
     this.modelFactory = modelFactory;
     this.initialized = new import_async13.Trigger();
-    this.dataServiceSubscriptions = new import_echo_db3.DataServiceSubscriptions();
-    this.metadataStore = new import_echo_db3.MetadataStore(storage.createDirectory("metadata"));
-    this.snapshotStore = new import_echo_db3.SnapshotStore(storage.createDirectory("snapshots"));
+    this.dataServiceSubscriptions = new import_echo_pipeline3.DataServiceSubscriptions();
+    this.metadataStore = new import_echo_pipeline3.MetadataStore(storage.createDirectory("metadata"));
+    this.snapshotStore = new import_echo_pipeline3.SnapshotStore(storage.createDirectory("snapshots"));
     this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
     this.feedStore = new import_feed_store4.FeedStore({
       factory: new import_feed_store4.FeedFactory({
         root: storage.createDirectory("feeds"),
         signer: this.keyring,
         hypercore: {
-          valueEncoding: import_echo_db3.valueEncoding
+          valueEncoding: import_echo_pipeline3.valueEncoding
         }
       })
     });
-    this.spaceManager = new import_echo_db3.SpaceManager({
+    this.spaceManager = new import_echo_pipeline3.SpaceManager({
       feedStore: this.feedStore,
       networkManager: this.networkManager
     });
-    this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.spaceManager);
-    this.haloInvitations = new HaloInvitationsHandler(this.networkManager, this.identityManager);
+    this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
+    this.haloInvitations = new HaloInvitationsHandler({
+      networkManager: this.networkManager,
+      getIdentity: () => {
+        var _a;
+        return (_a = this.identityManager.identity) != null ? _a : (0, import_debug5.failUndefined)();
+      },
+      acceptIdentity: this._acceptIdentity.bind(this),
+      keyring: this.keyring
+    });
   }
   async open() {
-    (0, import_log10.log)("opening...", {}, {
+    (0, import_log11.log)("opening...", {}, {
       file: "service-context.ts",
-      line: 85,
+      line: 94,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2443,46 +2898,47 @@ var ServiceContext = class {
     if (this.identityManager.identity) {
       await this._initialize();
     }
-    (0, import_log10.log)("opened", {}, {
+    (0, import_log11.log)("opened", {}, {
       file: "service-context.ts",
-      line: 92,
+      line: 101,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
   async close() {
-    var _a;
-    (0, import_log10.log)("closing...", {}, {
+    var _a, _b;
+    (0, import_log11.log)("closing...", {}, {
       file: "service-context.ts",
-      line: 96,
+      line: 105,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    await ((_a = this.dataSpaceManager) == null ? void 0 : _a.close());
+    await ((_a = this._deviceSpaceSync) == null ? void 0 : _a.close());
+    await ((_b = this.dataSpaceManager) == null ? void 0 : _b.close());
     await this.identityManager.close();
     await this.spaceManager.close();
     await this.feedStore.close();
     await this.networkManager.close();
     this.dataServiceSubscriptions.clear();
-    (0, import_log10.log)("closed", {}, {
+    (0, import_log11.log)("closed", {}, {
       file: "service-context.ts",
-      line: 103,
+      line: 113,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
   async reset() {
-    (0, import_log10.log)("resetting...", {}, {
+    (0, import_log11.log)("resetting...", {}, {
       file: "service-context.ts",
-      line: 107,
+      line: 117,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this.close();
     await this.storage.reset();
-    (0, import_log10.log)("reset", {}, {
+    (0, import_log11.log)("reset", {}, {
       file: "service-context.ts",
-      line: 110,
+      line: 120,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2492,55 +2948,121 @@ var ServiceContext = class {
     await this._initialize();
     return identity;
   }
+  async _acceptIdentity(params) {
+    const identity = await this.identityManager.acceptIdentity(params);
+    await this._initialize();
+    return identity;
+  }
   // Called when identity is created.
   async _initialize() {
     var _a;
-    (0, import_log10.log)("initializing spaces...", {}, {
+    (0, import_log11.log)("initializing spaces...", {}, {
       file: "service-context.ts",
-      line: 122,
+      line: 139,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug4.failUndefined)();
+    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug5.failUndefined)();
     const signingContext = {
-      credentialProvider: import_echo_db3.MOCK_AUTH_PROVIDER,
-      credentialAuthenticator: import_echo_db3.MOCK_AUTH_VERIFIER,
       credentialSigner: identity.getIdentityCredentialSigner(),
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey,
-      profile: identity.profileDocument
+      profile: identity.profileDocument,
+      recordCredential: async (credential) => {
+        await identity.controlPipeline.writer.write({
+          credential: {
+            credential
+          }
+        });
+      }
     };
-    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.modelFactory, this.snapshotStore);
+    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.modelFactory, this.feedStore, this.snapshotStore);
     await this.dataSpaceManager.open();
     this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.dataSpaceManager, signingContext, this.keyring);
     this.initialized.wake();
+    this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
+      process: async (credential) => {
+        const assertion = (0, import_credentials11.getCredentialAssertion)(credential);
+        if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
+          return;
+        }
+        if (assertion.spaceKey.equals(identity.space.key)) {
+          return;
+        }
+        if (!this.dataSpaceManager) {
+          (0, import_log11.log)("dataSpaceManager not initialized yet, ignoring space admission", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 182,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
+          (0, import_log11.log)("space already exists, ignoring space admission", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 186,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        try {
+          (0, import_log11.log)("accepting space recorded in halo", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 191,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          await this.dataSpaceManager.acceptSpace({
+            spaceKey: assertion.spaceKey,
+            genesisFeedKey: assertion.genesisFeedKey
+          });
+        } catch (err) {
+          import_log11.log.catch(err, {}, {
+            file: "service-context.ts",
+            line: 197,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+      }
+    });
+    await this._deviceSpaceSync.open();
   }
 };
 
 // packages/sdk/client-services/src/packlets/services/service-definitions.ts
-var import_protocols5 = require("@dxos/protocols");
+var import_protocols6 = require("@dxos/protocols");
 var import_rpc = require("@dxos/rpc");
 var clientServiceBundle = (0, import_rpc.createServiceBundle)({
-  HaloInvitationsService: import_protocols5.schema.getService("dxos.client.services.HaloInvitationsService"),
-  DevicesService: import_protocols5.schema.getService("dxos.client.services.DevicesService"),
-  SpaceInvitationsService: import_protocols5.schema.getService("dxos.client.services.SpaceInvitationsService"),
-  SpacesService: import_protocols5.schema.getService("dxos.client.services.SpacesService"),
-  NetworkService: import_protocols5.schema.getService("dxos.client.services.NetworkService"),
+  HaloInvitationsService: import_protocols6.schema.getService("dxos.client.services.HaloInvitationsService"),
+  DevicesService: import_protocols6.schema.getService("dxos.client.services.DevicesService"),
+  SpaceInvitationsService: import_protocols6.schema.getService("dxos.client.services.SpaceInvitationsService"),
+  SpacesService: import_protocols6.schema.getService("dxos.client.services.SpacesService"),
+  NetworkService: import_protocols6.schema.getService("dxos.client.services.NetworkService"),
   // TODO(burdon): Deprecated.
-  SpaceService: import_protocols5.schema.getService("dxos.client.SpaceService"),
-  DataService: import_protocols5.schema.getService("dxos.echo.service.DataService"),
-  ProfileService: import_protocols5.schema.getService("dxos.client.ProfileService"),
-  SystemService: import_protocols5.schema.getService("dxos.client.SystemService"),
-  DevtoolsHost: import_protocols5.schema.getService("dxos.devtools.host.DevtoolsHost"),
-  TracingService: import_protocols5.schema.getService("dxos.devtools.host.TracingService")
+  SpaceService: import_protocols6.schema.getService("dxos.client.SpaceService"),
+  DataService: import_protocols6.schema.getService("dxos.echo.service.DataService"),
+  ProfileService: import_protocols6.schema.getService("dxos.client.ProfileService"),
+  SystemService: import_protocols6.schema.getService("dxos.client.SystemService"),
+  DevtoolsHost: import_protocols6.schema.getService("dxos.devtools.host.DevtoolsHost"),
+  TracingService: import_protocols6.schema.getService("dxos.devtools.host.TracingService")
 });
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-var import_debug6 = require("@dxos/debug");
-var import_echo_db5 = require("@dxos/echo-db");
-var import_log11 = require("@dxos/log");
+var import_debug7 = require("@dxos/debug");
+var import_document_model = require("@dxos/document-model");
+var import_echo_pipeline5 = require("@dxos/echo-pipeline");
+var import_log17 = require("@dxos/log");
 var import_model_factory = require("@dxos/model-factory");
-var import_object_model = require("@dxos/object-model");
+var import_client2 = require("@dxos/protocols/proto/dxos/client");
 var import_text_model = require("@dxos/text-model");
 
 // packages/sdk/client-services/src/packlets/identity/devices-service-impl.ts
@@ -2610,8 +3132,8 @@ var NetworkServiceImpl = class {
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
 var import_async15 = require("@dxos/async");
 var import_codec_protobuf11 = require("@dxos/codec-protobuf");
-var import_debug5 = require("@dxos/debug");
-var import_echo_db4 = require("@dxos/echo-db");
+var import_debug6 = require("@dxos/debug");
+var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var SpacesServiceImpl = class {
   constructor(_spaceManager) {
     this._spaceManager = _spaceManager;
@@ -2628,7 +3150,7 @@ var SpacesServiceImpl = class {
   queryCredentials({ spaceKey }) {
     return new import_codec_protobuf11.Stream(({ ctx, next }) => {
       var _a;
-      const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_db4.SpaceNotFoundError(spaceKey));
+      const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline4.SpaceNotFoundError(spaceKey));
       const processor = space.spaceState.registerProcessor({
         process: async (credential) => {
           next(credential);
@@ -2638,6 +3160,17 @@ var SpacesServiceImpl = class {
       (0, import_async15.scheduleTask)(ctx, () => processor.open());
     });
   }
+  async writeCredentials({ spaceKey, credentials }) {
+    var _a;
+    const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline4.SpaceNotFoundError(spaceKey));
+    for (const credential of credentials != null ? credentials : []) {
+      await space.controlPipeline.writer.write({
+        credential: {
+          credential
+        }
+      });
+    }
+  }
 };
 
 // packages/sdk/client-services/src/packlets/storage/storage.ts
@@ -2685,169 +3218,265 @@ var toStorageType = (type) => {
   }
 };
 
-// packages/sdk/client-services/src/packlets/services/service-registry.ts
-var ServiceRegistry = class {
-  // prettier-ignore
-  constructor(_serviceBundle, _handlers) {
-    this._serviceBundle = _serviceBundle;
-    this._handlers = _handlers;
+// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
+var import_async17 = require("@dxos/async");
+var import_log12 = require("@dxos/log");
+var import_messaging = require("@dxos/messaging");
+var import_network_manager3 = require("@dxos/network-manager");
+var import_rpc3 = require("@dxos/rpc");
+var import_util7 = require("@dxos/util");
+
+// packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
+var import_node_assert13 = __toESM(require("node:assert"));
+var import_async16 = require("@dxos/async");
+var import_iframe = require("@dxos/protocols/proto/dxos/iframe");
+var import_rpc2 = require("@dxos/rpc");
+
+// packages/sdk/client-services/src/packlets/vault/services.ts
+var import_protocols7 = require("@dxos/protocols");
+var iframeServiceBundle = {
+  IframeService: import_protocols7.schema.getService("dxos.iframe.IframeService"),
+  BridgeService: import_protocols7.schema.getService("dxos.mesh.bridge.BridgeService")
+};
+var workerServiceBundle = {
+  WorkerService: import_protocols7.schema.getService("dxos.iframe.WorkerService")
+};
+var appServiceBundle = {
+  AppService: import_protocols7.schema.getService("dxos.iframe.AppService")
+};
+var shellServiceBundle = {
+  ShellService: import_protocols7.schema.getService("dxos.iframe.ShellService")
+};
+
+// packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
+var ShellRuntimeImpl = class {
+  constructor(_port) {
+    this._port = _port;
+    this.layoutUpdate = new import_async16.Event();
+    this._layout = import_iframe.ShellLayout.DEFAULT;
+  }
+  get layout() {
+    return this._layout;
+  }
+  get invitationCode() {
+    return this._invitationCode;
+  }
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setLayout(layout, options = {}) {
+    this._layout = layout;
+    this._invitationCode = options.invitationCode;
+    this._spaceKey = options.spaceKey;
+    this.layoutUpdate.emit({
+      layout,
+      ...options
+    });
   }
-  get descriptors() {
-    return this._serviceBundle;
+  async setAppContext(context) {
+    (0, import_node_assert13.default)(this._appRpc, "runtime not open");
+    if (context.spaceKey) {
+      this._spaceKey = context.spaceKey;
+    }
+    if (context.invitationCode) {
+      this._invitationCode = context.invitationCode;
+    }
+    await this._appRpc.rpc.AppService.setContext({
+      ...context,
+      spaceKey: this._spaceKey,
+      invitationCode: this._invitationCode
+    });
   }
-  get services() {
-    return this._handlers;
+  async open() {
+    this._appRpc = (0, import_rpc2.createProtoRpcPeer)({
+      requested: appServiceBundle,
+      exposed: shellServiceBundle,
+      handlers: {
+        ShellService: {
+          setLayout: async (request) => {
+            this._layout = request.layout;
+            this._invitationCode = request.invitationCode;
+            this._spaceKey = request.spaceKey;
+            this.layoutUpdate.emit(request);
+          }
+        }
+      },
+      port: this._port
+    });
+    await this._appRpc.open();
+  }
+  async close() {
+    var _a;
+    await ((_a = this._appRpc) == null ? void 0 : _a.close());
+    this._appRpc = void 0;
+  }
+};
+var MemoryShellRuntime = class {
+  constructor({ layout, invitationCode, spaceKey } = {}) {
+    this.layoutUpdate = new import_async16.Event();
+    this.contextUpdate = new import_async16.Event();
+    this._layout = layout != null ? layout : import_iframe.ShellLayout.DEFAULT;
+    this._invitationCode = invitationCode;
+    this._spaceKey = spaceKey;
+  }
+  get layout() {
+    return this._layout;
+  }
+  get invitationCode() {
+    return this._invitationCode;
+  }
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setLayout(layout, options = {}) {
+    this._layout = layout;
+    this._invitationCode = options.invitationCode;
+    this._spaceKey = options.spaceKey;
+    this.layoutUpdate.emit({
+      layout,
+      ...options
+    });
+  }
+  async setAppContext(context) {
+    this.contextUpdate.emit(context);
   }
 };
 
-// packages/sdk/client-services/src/packlets/services/service-host.ts
-var createDefaultModelFactory = () => {
-  return new import_model_factory.ModelFactory().registerModel(import_object_model.ObjectModel).registerModel(import_text_model.TextModel);
+// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
+var __decorate3 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var ClientServicesHost = class {
-  constructor({
-    config,
-    modelFactory = createDefaultModelFactory(),
-    // TODO(burdon): Create ApolloLink abstraction (see Client).
-    networkManager,
-    storage = createStorageObjects(config.get("runtime.client.storage", {})).storage
-  }) {
-    this._config = config;
-    this._modelFactory = modelFactory;
-    this._networkManager = networkManager;
-    this._storage = storage;
-  }
-  get descriptors() {
-    return this._serviceRegistry.descriptors;
+var LOCK_KEY = "DXOS_RESOURCE_LOCK";
+var IFrameHostRuntime = class {
+  constructor({ configProvider, appPort, shellPort }) {
+    this._transportFactory = (0, import_network_manager3.createWebRTCTransportFactory)();
+    this._ready = new import_async17.Trigger();
+    this._configProvider = configProvider;
+    this._appPort = appPort;
+    this._shellPort = shellPort;
+    this._getService = async (find) => {
+      const error = await this._ready.wait();
+      if (error) {
+        throw error;
+      }
+      const service = await find(this._clientServices.services);
+      if (!service) {
+        throw new Error("Service not found");
+      }
+      return service;
+    };
+    if (this._shellPort) {
+      this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
+    }
   }
   get services() {
-    return this._serviceRegistry.services;
+    return this._clientServices;
   }
-  async open() {
+  get shell() {
+    return this._shellRuntime;
+  }
+  async start() {
     var _a;
-    (0, import_log11.log)("opening...", {}, {
-      file: "service-host.ts",
-      line: 73,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await this._initialize();
-    await this._serviceContext.open();
-    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    (0, import_log11.log)("opened", {
-      deviceKey
-    }, {
-      file: "service-host.ts",
-      line: 77,
+    (0, import_log12.log)("starting...", {}, {
+      file: "iframe-host-runtime.ts",
+      line: 81,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    try {
+      this._config = await (0, import_util7.getAsyncValue)(this._configProvider);
+      const signalServer = this._config.get("runtime.services.signal.server");
+      this._clientServices = new ClientServicesHost({
+        lockKey: LOCK_KEY,
+        config: this._config,
+        networkManager: new import_network_manager3.NetworkManager({
+          log: true,
+          signalManager: signalServer ? new import_messaging.WebsocketSignalManager([
+            signalServer
+          ]) : new import_messaging.MemorySignalManager(new import_messaging.MemorySignalManagerContext()),
+          transportFactory: this._transportFactory
+        })
+      });
+      this._clientRpc = (0, import_rpc3.createProtoRpcPeer)({
+        exposed: clientServiceBundle,
+        handlers: {
+          DataService: async () => await this._getService((services) => services.DataService),
+          DevicesService: async () => await this._getService((services) => services.DevicesService),
+          DevtoolsHost: async () => await this._getService((services) => services.DevtoolsHost),
+          HaloInvitationsService: async () => await this._getService((services) => services.HaloInvitationsService),
+          NetworkService: async () => await this._getService((services) => services.NetworkService),
+          ProfileService: async () => await this._getService((services) => services.ProfileService),
+          SpaceInvitationsService: async () => await this._getService((services) => services.SpaceInvitationsService),
+          SpaceService: async () => await this._getService((services) => services.SpaceService),
+          SpacesService: async () => await this._getService((services) => services.SpacesService),
+          SystemService: async () => await this._getService((services) => services.SystemService),
+          TracingService: async () => await this._getService((services) => services.TracingService)
+        },
+        port: this._appPort
+      });
+      await Promise.all([
+        this._clientServices.open(),
+        this._clientRpc.open(),
+        (_a = this._shellRuntime) == null ? void 0 : _a.open()
+      ]);
+      this._ready.wake(void 0);
+      (0, import_log12.log)("started", {}, {
+        file: "iframe-host-runtime.ts",
+        line: 117,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } catch (err) {
+      this._ready.wake(err);
+      import_log12.log.catch(err, {}, {
+        file: "iframe-host-runtime.ts",
+        line: 120,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
   }
-  async close() {
+  async stop() {
     var _a;
-    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    (0, import_log11.log)("closing...", {
-      deviceKey
-    }, {
-      file: "service-host.ts",
-      line: 82,
+    (0, import_log12.log)("stopping...", {}, {
+      file: "iframe-host-runtime.ts",
+      line: 125,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    await this._serviceContext.close();
-    (0, import_log11.log)("closed", {
-      deviceKey
-    }, {
-      file: "service-host.ts",
-      line: 84,
+    await this._clientRpc.close();
+    await this._clientServices.close();
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
+    (0, import_log12.log)("stopped", {}, {
+      file: "iframe-host-runtime.ts",
+      line: 129,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
-  // TODO(burdon): Move into open.
-  async _initialize() {
-    this._serviceContext = new ServiceContext(this._storage, this._networkManager, this._modelFactory);
-    this._serviceRegistry = new ServiceRegistry(clientServiceBundle, {
-      HaloInvitationsService: new HaloInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.haloInvitations),
-      DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
-      SpaceInvitationsService: new SpaceInvitationsServiceImpl(this._serviceContext.identityManager, () => {
-        var _a;
-        return (_a = this._serviceContext.spaceInvitations) != null ? _a : (0, import_debug6.raise)(new Error("SpaceInvitations not initialized"));
-      }, () => {
-        var _a;
-        return (_a = this._serviceContext.dataSpaceManager) != null ? _a : (0, import_debug6.raise)(new Error("SpaceManager not initialized"));
-      }),
-      SpacesService: new SpacesServiceImpl(this._serviceContext.spaceManager),
-      DataService: new import_echo_db5.DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
-      NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager),
-      // TODO(burdon): Move to new protobuf definitions.
-      ProfileService: new ProfileServiceImpl(this._serviceContext),
-      SpaceService: new SpaceServiceImpl(this._serviceContext),
-      SystemService: new SystemServiceImpl(this._config, this._serviceContext),
-      TracingService: new TracingServiceImpl(this._config),
-      DevtoolsHost: new DevtoolsServiceImpl({
-        events: new DevtoolsHostEvents(),
-        config: this._config,
-        context: this._serviceContext
-      })
-    });
-  }
-};
-
-// packages/sdk/client-services/src/packlets/services/service-proxy.ts
-var import_async16 = require("@dxos/async");
-var import_errors2 = require("@dxos/errors");
-var import_rpc2 = require("@dxos/rpc");
-var ClientServicesProxy = class {
-  // prettier-ignore
-  constructor(port, _timeout = 3e4) {
-    this._timeout = _timeout;
-    this._proxy = (0, import_rpc2.createProtoRpcPeer)({
-      requested: clientServiceBundle,
-      exposed: {},
-      handlers: {},
-      port
-    });
-  }
-  get proxy() {
-    return this._proxy;
-  }
-  get descriptors() {
-    return clientServiceBundle;
-  }
-  get services() {
-    return this._proxy.rpc;
-  }
-  async open() {
-    await (0, import_async16.asyncTimeout)(this._proxy.open(), this._timeout, new import_errors2.RemoteServiceConnectionTimeout());
-  }
-  async close() {
-    await this._proxy.close();
-  }
-};
-
-// packages/sdk/client-services/src/packlets/vault/iframe-runtime.ts
-var import_network_manager3 = require("@dxos/network-manager");
-var import_rpc3 = require("@dxos/rpc");
-
-// packages/sdk/client-services/src/packlets/vault/services.ts
-var import_protocols6 = require("@dxos/protocols");
-var iframeServiceBundle = {
-  IframeService: import_protocols6.schema.getService("dxos.iframe.IframeService"),
-  BridgeService: import_protocols6.schema.getService("dxos.mesh.bridge.BridgeService")
-};
-var workerServiceBundle = {
-  WorkerService: import_protocols6.schema.getService("dxos.iframe.WorkerService")
 };
+__decorate3([
+  import_log12.logInfo
+], IFrameHostRuntime.prototype, "origin", void 0);
 
-// packages/sdk/client-services/src/packlets/vault/iframe-runtime.ts
-var IFrameRuntime = class {
-  constructor({ systemPort, workerAppPort, windowAppPort }) {
-    this._transportService = new import_network_manager3.WebRTCTransportService();
+// packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
+var import_network_manager4 = require("@dxos/network-manager");
+var import_rpc4 = require("@dxos/rpc");
+var IFrameProxyRuntime = class {
+  constructor({ systemPort, workerAppPort, windowAppPort, shellPort }) {
+    this._transportService = new import_network_manager4.WebRTCTransportService();
     this._systemPort = systemPort;
     this._windowAppPort = windowAppPort;
     this._workerAppPort = workerAppPort;
-    this._systemRpc = (0, import_rpc3.createProtoRpcPeer)({
+    this._shellPort = shellPort;
+    this._systemRpc = (0, import_rpc4.createProtoRpcPeer)({
       requested: workerServiceBundle,
       exposed: iframeServiceBundle,
       handlers: {
@@ -2862,31 +3491,191 @@ var IFrameRuntime = class {
     });
     this._workerAppPort.subscribe((msg) => this._windowAppPort.send(msg));
     this._windowAppPort.subscribe((msg) => this._workerAppPort.send(msg));
+    if (this._shellPort) {
+      this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
+    }
+  }
+  get shell() {
+    return this._shellRuntime;
   }
   async open(origin) {
+    var _a;
     await this._systemRpc.open();
     await this._systemRpc.rpc.WorkerService.start({
       origin
     });
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.open());
   }
   async close() {
+    var _a;
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
     await this._systemRpc.rpc.WorkerService.stop();
     await this._systemRpc.close();
   }
 };
 
-// packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
+// packages/sdk/client-services/src/packlets/vault/shell-controller.ts
 var import_async18 = require("@dxos/async");
-var import_messaging = require("@dxos/messaging");
-var import_network_manager4 = require("@dxos/network-manager");
+var import_log13 = require("@dxos/log");
+var import_iframe2 = require("@dxos/protocols/proto/dxos/iframe");
+var import_rpc5 = require("@dxos/rpc");
+var ShellController = class {
+  constructor(_port) {
+    this._port = _port;
+    this.contextUpdate = new import_async18.Event();
+    this._display = import_iframe2.ShellDisplay.NONE;
+  }
+  get display() {
+    return this._display;
+  }
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setSpace(key) {
+    this._spaceKey = key;
+    this._emitUpdate();
+  }
+  async setLayout(layout, options = {}) {
+    var _a;
+    this._display = import_iframe2.ShellDisplay.FULLSCREEN;
+    this._emitUpdate();
+    await ((_a = this._shellRpc) == null ? void 0 : _a.rpc.ShellService.setLayout({
+      layout,
+      ...options
+    }));
+  }
+  async open() {
+    this._shellRpc = (0, import_rpc5.createProtoRpcPeer)({
+      requested: shellServiceBundle,
+      exposed: appServiceBundle,
+      handlers: {
+        AppService: {
+          setContext: async (request) => {
+            (0, import_log13.log)("set context", request, {
+              file: "shell-controller.ts",
+              line: 51,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            this._display = request.display;
+            this._spaceKey = request.spaceKey;
+            this._invitationCode = request.invitationCode;
+            this.contextUpdate.emit(request);
+          }
+        }
+      },
+      port: this._port
+    });
+    await this._shellRpc.open();
+  }
+  async close() {
+    var _a;
+    await ((_a = this._shellRpc) == null ? void 0 : _a.close());
+    this._shellRpc = void 0;
+  }
+  _emitUpdate() {
+    this.contextUpdate.emit({
+      display: this._display,
+      spaceKey: this._spaceKey,
+      invitationCode: this._invitationCode
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
+var import_async19 = require("@dxos/async");
+var import_log14 = require("@dxos/log");
+var Message;
+(function(Message2) {
+  Message2["ACQUIRING"] = "acquiring";
+})(Message || (Message = {}));
+var VaultResourceLock = class {
+  constructor({ lockKey, onAcquire, onRelease }) {
+    this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
+    this._releaseTrigger = new import_async19.Trigger();
+    this._lockKey = lockKey;
+    this._onAcquire = onAcquire;
+    this._onRelease = onRelease;
+    this._broadcastChannel.onmessage = this._onMessage.bind(this);
+  }
+  async acquire() {
+    this._broadcastChannel.postMessage({
+      message: Message.ACQUIRING
+    });
+    try {
+      await (0, import_async19.asyncTimeout)(this._requestLock(), 3e3);
+    } catch (e) {
+      await this._requestLock(true);
+    }
+  }
+  async release() {
+    this._releaseTrigger.wake();
+  }
+  _onMessage(event) {
+    if (event.data.message === Message.ACQUIRING) {
+      this._releaseTrigger.wake();
+    }
+  }
+  async _requestLock(steal = false) {
+    (0, import_log14.log)("requesting lock...", {
+      steal
+    }, {
+      file: "vault-resource-lock.ts",
+      line: 56,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const acquired = new import_async19.Trigger();
+    void navigator.locks.request(this._lockKey, {
+      steal
+    }, async () => {
+      var _a, _b;
+      await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
+      acquired.wake();
+      this._releaseTrigger = new import_async19.Trigger();
+      await this._releaseTrigger.wait();
+      (0, import_log14.log)("releasing lock...", {}, {
+        file: "vault-resource-lock.ts",
+        line: 65,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      await ((_b = this._onRelease) == null ? void 0 : _b.call(this));
+      (0, import_log14.log)("released lock", {}, {
+        file: "vault-resource-lock.ts",
+        line: 67,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }).catch(async () => {
+      var _a;
+      await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
+    });
+    await acquired.wait();
+    (0, import_log14.log)("recieved lock", {
+      steal
+    }, {
+      file: "vault-resource-lock.ts",
+      line: 74,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
+var import_async21 = require("@dxos/async");
+var import_log16 = require("@dxos/log");
+var import_messaging2 = require("@dxos/messaging");
+var import_network_manager5 = require("@dxos/network-manager");
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
-var import_node_assert11 = __toESM(require("node:assert"));
-var import_async17 = require("@dxos/async");
-var import_log12 = require("@dxos/log");
-var import_rpc4 = require("@dxos/rpc");
-var import_util5 = require("@dxos/util");
-var __decorate3 = function(decorators, target, key, desc) {
+var import_node_assert14 = __toESM(require("node:assert"));
+var import_async20 = require("@dxos/async");
+var import_log15 = require("@dxos/log");
+var import_rpc6 = require("@dxos/rpc");
+var import_util8 = require("@dxos/util");
+var __decorate4 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2897,33 +3686,39 @@ var __decorate3 = function(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 var WorkerSession = class {
-  constructor({ getServices, systemPort, appPort, options = {
+  constructor({ getService, systemPort, appPort, shellPort, options = {
     heartbeatInterval: 1e3
   } }) {
-    this._startTrigger = new import_async17.Trigger();
-    this.onClose = new import_util5.Callback();
-    (0, import_node_assert11.default)(options);
-    (0, import_node_assert11.default)(getServices);
+    this._startTrigger = new import_async20.Trigger();
+    this.onClose = new import_util8.Callback();
+    (0, import_node_assert14.default)(options);
+    (0, import_node_assert14.default)(getService);
     this._options = options;
-    this._getServices = getServices;
-    this._clientRpc = (0, import_rpc4.createProtoRpcPeer)({
+    this._getService = getService;
+    const handlers = {
+      DataService: async () => await this._getService((services) => services.DataService),
+      DevicesService: async () => await this._getService((services) => services.DevicesService),
+      DevtoolsHost: async () => await this._getService((services) => services.DevtoolsHost),
+      HaloInvitationsService: async () => await this._getService((services) => services.HaloInvitationsService),
+      NetworkService: async () => await this._getService((services) => services.NetworkService),
+      ProfileService: async () => await this._getService((services) => services.ProfileService),
+      SpaceInvitationsService: async () => await this._getService((services) => services.SpaceInvitationsService),
+      SpaceService: async () => await this._getService((services) => services.SpaceService),
+      SpacesService: async () => await this._getService((services) => services.SpacesService),
+      SystemService: async () => await this._getService((services) => services.SystemService),
+      TracingService: async () => await this._getService((services) => services.TracingService)
+    };
+    this._clientRpc = (0, import_rpc6.createProtoRpcPeer)({
       exposed: clientServiceBundle,
-      handlers: {
-        HaloInvitationsService: async () => (await this._getServices()).services.HaloInvitationsService,
-        DevicesService: async () => (await this._getServices()).services.DevicesService,
-        SpaceInvitationsService: async () => (await this._getServices()).services.SpaceInvitationsService,
-        SpacesService: async () => (await this._getServices()).services.SpacesService,
-        NetworkService: async () => (await this._getServices()).services.NetworkService,
-        SpaceService: async () => (await this._getServices()).services.SpaceService,
-        DataService: async () => (await this._getServices()).services.DataService,
-        ProfileService: async () => (await this._getServices()).services.ProfileService,
-        SystemService: async () => (await this._getServices()).services.SystemService,
-        DevtoolsHost: async () => (await this._getServices()).services.DevtoolsHost,
-        TracingService: async () => (await this._getServices()).services.TracingService
-      },
+      handlers,
       port: appPort
     });
-    this._iframeRpc = (0, import_rpc4.createProtoRpcPeer)({
+    this._shellClientRpc = (0, import_rpc6.createProtoRpcPeer)({
+      exposed: clientServiceBundle,
+      handlers,
+      port: shellPort
+    });
+    this._iframeRpc = (0, import_rpc6.createProtoRpcPeer)({
       requested: iframeServiceBundle,
       exposed: workerServiceBundle,
       handlers: {
@@ -2937,9 +3732,9 @@ var WorkerSession = class {
               try {
                 await this.close();
               } catch (err) {
-                import_log12.log.catch(err, {}, {
+                import_log15.log.catch(err, {}, {
                   file: "worker-session.ts",
-                  line: 90,
+                  line: 92,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -2955,15 +3750,16 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    import_log12.log.info("opening..", {}, {
+    import_log15.log.info("opening..", {}, {
       file: "worker-session.ts",
-      line: 104,
+      line: 106,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await Promise.all([
       this._clientRpc.open(),
-      this._iframeRpc.open()
+      this._iframeRpc.open(),
+      this._maybeOpenShell()
     ]);
     await this._startTrigger.wait({
       timeout: 3e3
@@ -2972,20 +3768,20 @@ var WorkerSession = class {
       try {
         await this._iframeRpc.rpc.IframeService.heartbeat();
       } catch (err1) {
-        import_log12.log.warn("Heartbeat failed", {
+        import_log15.log.warn("Heartbeat failed", {
           err: err1
         }, {
           file: "worker-session.ts",
-          line: 116,
+          line: 118,
           scope: this,
           callSite: (f, a) => f(...a)
         });
         try {
           await this.close();
         } catch (err) {
-          import_log12.log.catch(err, {}, {
+          import_log15.log.catch(err, {}, {
             file: "worker-session.ts",
-            line: 120,
+            line: 122,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -2994,18 +3790,18 @@ var WorkerSession = class {
     }, this._options.heartbeatInterval);
   }
   async close() {
-    import_log12.log.info("closing..", {}, {
+    import_log15.log.info("closing..", {}, {
       file: "worker-session.ts",
-      line: 127,
+      line: 129,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     try {
       await this.onClose.callIfSet();
     } catch (err) {
-      import_log12.log.catch(err, {}, {
+      import_log15.log.catch(err, {}, {
         file: "worker-session.ts",
-        line: 131,
+        line: 133,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3018,9 +3814,21 @@ var WorkerSession = class {
       this._iframeRpc.close()
     ]);
   }
+  async _maybeOpenShell() {
+    try {
+      await (0, import_async20.asyncTimeout)(this._shellClientRpc.open(), 1e3);
+    } catch (e) {
+      import_log15.log.info("No shell connected.", {}, {
+        file: "worker-session.ts",
+        line: 147,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
+  }
 };
-__decorate3([
-  import_log12.logInfo
+__decorate4([
+  import_log15.logInfo
 ], WorkerSession.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
@@ -3028,28 +3836,46 @@ var WorkerRuntime = class {
   // prettier-ignore
   constructor(_configProvider) {
     this._configProvider = _configProvider;
-    this._transportFactory = new import_network_manager4.WebRTCTransportProxyFactory();
-    this._ready = new import_async18.Trigger();
+    this._transportFactory = new import_network_manager5.WebRTCTransportProxyFactory();
+    this._ready = new import_async21.Trigger();
     this.sessions = /* @__PURE__ */ new Set();
   }
   async start() {
+    (0, import_log16.log)("starting...", {}, {
+      file: "worker-runtime.ts",
+      line: 42,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
     try {
       this._config = await this._configProvider();
       const signalServer = this._config.get("runtime.services.signal.server");
       this._clientServices = new ClientServicesHost({
         config: this._config,
-        networkManager: new import_network_manager4.NetworkManager({
+        networkManager: new import_network_manager5.NetworkManager({
           log: true,
-          signalManager: signalServer ? new import_messaging.WebsocketSignalManager([
+          signalManager: signalServer ? new import_messaging2.WebsocketSignalManager([
             signalServer
-          ]) : new import_messaging.MemorySignalManager(new import_messaging.MemorySignalManagerContext()),
+          ]) : new import_messaging2.MemorySignalManager(new import_messaging2.MemorySignalManagerContext()),
           transportFactory: this._transportFactory
         })
       });
       await this._clientServices.open();
       this._ready.wake(void 0);
+      (0, import_log16.log)("started", {}, {
+        file: "worker-runtime.ts",
+        line: 59,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
     } catch (err) {
       this._ready.wake(err);
+      import_log16.log.catch(err, {}, {
+        file: "worker-runtime.ts",
+        line: 62,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
     }
   }
   async stop() {
@@ -3058,17 +3884,22 @@ var WorkerRuntime = class {
   /**
   * Create a new session.
   */
-  async createSession({ appPort, systemPort }) {
+  async createSession({ appPort, systemPort, shellPort }) {
     const session = new WorkerSession({
-      getServices: async () => {
+      getService: async (find) => {
         const error = await this._ready.wait();
-        if (error !== void 0) {
+        if (error) {
           throw error;
         }
-        return this._clientServices;
+        const service = find(this._clientServices.services);
+        if (!service) {
+          throw new Error("Service not found");
+        }
+        return service;
       },
       appPort,
       systemPort,
+      shellPort,
       readySignal: this._ready
     });
     session.onClose.set(async () => {
@@ -3099,6 +3930,193 @@ var WorkerRuntime = class {
     }
   }
 };
+
+// packages/sdk/client-services/src/packlets/services/service-registry.ts
+var ServiceRegistry = class {
+  // prettier-ignore
+  constructor(_serviceBundle, _handlers) {
+    this._serviceBundle = _serviceBundle;
+    this._handlers = _handlers;
+  }
+  get descriptors() {
+    return this._serviceBundle;
+  }
+  get services() {
+    return this._handlers;
+  }
+  setServices(services) {
+    this._handlers = services;
+  }
+};
+
+// packages/sdk/client-services/src/packlets/services/service-host.ts
+var createDefaultModelFactory = () => {
+  return new import_model_factory.ModelFactory().registerModel(import_document_model.DocumentModel).registerModel(import_text_model.TextModel);
+};
+var ClientServicesHost = class {
+  constructor({
+    config,
+    modelFactory = createDefaultModelFactory(),
+    // TODO(burdon): Create ApolloLink abstraction (see Client).
+    networkManager,
+    storage = createStorageObjects(config.get("runtime.client.storage", {})).storage,
+    lockKey
+  }) {
+    this._open = false;
+    this._config = config;
+    this._modelFactory = modelFactory;
+    this._networkManager = networkManager;
+    this._storage = storage;
+    this._resourceLock = lockKey ? new VaultResourceLock({
+      lockKey,
+      onAcquire: () => this.open(),
+      onRelease: () => this.close()
+    }) : void 0;
+    this._systemService = new SystemServiceImpl({
+      config: this._config,
+      onInit: async () => {
+        var _a;
+        await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
+      },
+      onStatus: async () => {
+        if (!this.isOpen) {
+          return {
+            status: import_client2.Status.INACTIVE
+          };
+        }
+        return {
+          status: import_client2.Status.ACTIVE
+        };
+      },
+      onReset: async () => {
+        var _a;
+        await ((_a = this._serviceContext) == null ? void 0 : _a.reset());
+      }
+    });
+    this._serviceRegistry = new ServiceRegistry(clientServiceBundle, {
+      SystemService: this._systemService
+    });
+  }
+  get isOpen() {
+    return this._open;
+  }
+  get descriptors() {
+    return this._serviceRegistry.descriptors;
+  }
+  get services() {
+    return this._serviceRegistry.services;
+  }
+  async open() {
+    var _a;
+    if (this._open) {
+      return;
+    }
+    (0, import_log17.log)("opening...", {}, {
+      file: "service-host.ts",
+      line: 125,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    this._serviceContext = new ServiceContext(this._storage, this._networkManager, this._modelFactory);
+    this._serviceRegistry.setServices({
+      // TODO(burdon): Move to new protobuf definitions.
+      SystemService: this._systemService,
+      HaloInvitationsService: new HaloInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.haloInvitations),
+      DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
+      SpaceInvitationsService: new SpaceInvitationsServiceImpl(this._serviceContext.identityManager, () => {
+        var _a2;
+        return (_a2 = this._serviceContext.spaceInvitations) != null ? _a2 : (0, import_debug7.raise)(new Error("SpaceInvitations not initialized"));
+      }, () => {
+        var _a2;
+        return (_a2 = this._serviceContext.dataSpaceManager) != null ? _a2 : (0, import_debug7.raise)(new Error("SpaceManager not initialized"));
+      }),
+      SpacesService: new SpacesServiceImpl(this._serviceContext.spaceManager),
+      DataService: new import_echo_pipeline5.DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
+      NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager),
+      // TODO(burdon): Move to new protobuf definitions.
+      ProfileService: new ProfileServiceImpl(this._serviceContext),
+      // TODO(burdon): Port old SubscribeSpaces to QueryServices>
+      SpaceService: new SpaceServiceImpl(this._serviceContext),
+      TracingService: new TracingServiceImpl(this._config),
+      DevtoolsHost: new DevtoolsServiceImpl({
+        events: new DevtoolsHostEvents(),
+        config: this._config,
+        context: this._serviceContext
+      })
+    });
+    await this._serviceContext.open();
+    this._open = true;
+    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
+    (0, import_log17.log)("opened", {
+      deviceKey
+    }, {
+      file: "service-host.ts",
+      line: 172,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+  async close() {
+    var _a;
+    if (!this._open) {
+      return;
+    }
+    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
+    (0, import_log17.log)("closing...", {
+      deviceKey
+    }, {
+      file: "service-host.ts",
+      line: 181,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    this._serviceRegistry.setServices({
+      SystemService: this._systemService
+    });
+    await this._serviceContext.close();
+    this._open = false;
+    (0, import_log17.log)("closed", {
+      deviceKey
+    }, {
+      file: "service-host.ts",
+      line: 185,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/services/service-proxy.ts
+var import_async22 = require("@dxos/async");
+var import_errors2 = require("@dxos/errors");
+var import_rpc7 = require("@dxos/rpc");
+var ClientServicesProxy = class {
+  // prettier-ignore
+  constructor(port, _timeout = 3e4) {
+    this._timeout = _timeout;
+    this._proxy = (0, import_rpc7.createProtoRpcPeer)({
+      requested: clientServiceBundle,
+      exposed: {},
+      handlers: {},
+      port
+    });
+  }
+  get proxy() {
+    return this._proxy;
+  }
+  get descriptors() {
+    return clientServiceBundle;
+  }
+  get services() {
+    return this._proxy.rpc;
+  }
+  async open() {
+    await (0, import_async22.asyncTimeout)(this._proxy.open(), this._timeout, new import_errors2.RemoteServiceConnectionTimeout());
+  }
+  async close() {
+    await this._proxy.close();
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AUTHENTICATION_CODE_LENGTH,
@@ -3110,40 +4128,49 @@ var WorkerRuntime = class {
   ClientServicesProxy,
   DevtoolsHostEvents,
   DevtoolsServiceImpl,
-  HaloAuthVerifier,
   HaloInvitationsHandler,
   HaloInvitationsProxy,
   HaloInvitationsServiceImpl,
-  IFrameRuntime,
+  IFrameHostRuntime,
+  IFrameProxyRuntime,
   INVITATION_TIMEOUT,
   Identity,
   IdentityManager,
   InvitationEncoder,
   InvitationObservableProvider,
+  MemoryShellRuntime,
   ON_CLOSE_DELAY,
   ProfileServiceImpl,
   ServiceContext,
   ServiceRegistry,
+  ShellController,
+  ShellRuntimeImpl,
   SpaceInvitationsHandler,
   SpaceInvitationsProxy,
   SpaceInvitationsServiceImpl,
   SpaceServiceImpl,
   SystemServiceImpl,
   TracingServiceImpl,
+  TrustedKeySetAuthVerifier,
+  VaultResourceLock,
   WorkerRuntime,
   WorkerSession,
+  appServiceBundle,
   clientServiceBundle,
+  createAuthProvider,
   createDefaultModelFactory,
-  createHaloAuthProvider,
   createStorageObjects,
   getNetworkPeers,
+  iframeServiceBundle,
+  shellServiceBundle,
   subscribeToFeedBlocks,
   subscribeToFeeds,
   subscribeToNetworkStatus,
   subscribeToNetworkTopics,
-  subscribeToSignalTrace,
+  subscribeToSignal,
   subscribeToSpaces,
   subscribeToSwarmInfo,
+  workerServiceBundle,
   wrapObservable
 });
 //# sourceMappingURL=index.cjs.map