@dxos/client-services 0.1.23 → 0.1.24

package/dist/lib/node/packlets/testing/index.cjs

@@ -0,0 +1,3688 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// packages/sdk/client-services/src/packlets/testing/index.ts
+var testing_exports = {};
+__export(testing_exports, {
+  TestBuilder: () => TestBuilder,
+  TestPeer: () => TestPeer,
+  createIdentity: () => createIdentity,
+  createMockCredential: () => createMockCredential,
+  createPeers: () => createPeers,
+  createServiceContext: () => createServiceContext,
+  createServiceHost: () => createServiceHost,
+  createSigningContext: () => createSigningContext,
+  performInvitation: () => performInvitation,
+  syncItems: () => syncItems
+});
+module.exports = __toCommonJS(testing_exports);
+
+// packages/sdk/client-services/src/packlets/testing/credential-utils.ts
+var import_credentials = require("@dxos/credentials");
+var import_keys = require("@dxos/keys");
+var createMockCredential = async ({ signer, issuer }) => (0, import_credentials.createCredential)({
+  signer,
+  issuer,
+  subject: new import_keys.PublicKey(Buffer.from("test")),
+  assertion: {
+    "@type": "example.testing.rpc.MessageWithAny",
+    payload: {
+      "@type": "google.protobuf.Any",
+      value: Buffer.from("test")
+    }
+  }
+});
+
+// packages/sdk/client-services/src/packlets/testing/test-builder.ts
+var import_credentials13 = require("@dxos/credentials");
+var import_echo_db6 = require("@dxos/echo-db");
+var import_testing = require("@dxos/echo-db/testing");
+var import_feed_store5 = require("@dxos/feed-store");
+var import_keyring2 = require("@dxos/keyring");
+var import_messaging3 = require("@dxos/messaging");
+var import_network_manager6 = require("@dxos/network-manager");
+var import_random_access_storage2 = require("@dxos/random-access-storage");
+
+// packages/sdk/client-services/src/packlets/services/service-context.ts
+var import_async11 = require("@dxos/async");
+var import_credentials11 = require("@dxos/credentials");
+var import_debug3 = require("@dxos/debug");
+var import_echo_db3 = require("@dxos/echo-db");
+var import_feed_store3 = require("@dxos/feed-store");
+var import_keyring = require("@dxos/keyring");
+var import_log10 = require("@dxos/log");
+
+// packages/sdk/client-services/src/packlets/identity/authenticator.ts
+var import_async = require("@dxos/async");
+var import_context = require("@dxos/context");
+var import_credentials2 = require("@dxos/credentials");
+var import_log = require("@dxos/log");
+var import_protocols = require("@dxos/protocols");
+var createAuthProvider = (signer) => async (nonce) => {
+  const credential = await signer.createCredential({
+    assertion: {
+      "@type": "dxos.halo.credentials.Auth"
+    },
+    subject: signer.getIssuer(),
+    nonce
+  });
+  return import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").encode(credential);
+};
+var TrustedKeySetAuthVerifier = class {
+  // prettier-ignore
+  constructor(_params) {
+    this._params = _params;
+    this._ctx = new import_context.Context();
+  }
+  async close() {
+    await this._ctx.dispose();
+  }
+  get verifier() {
+    return async (nonce, auth) => {
+      const credential = import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
+      (0, import_log.log)("authenticating...", {
+        credential
+      }, {
+        file: "authenticator.ts",
+        line: 57,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      const result = await (0, import_credentials2.verifyCredential)(credential);
+      if (result.kind === "fail") {
+        (0, import_log.log)("Invalid credential", {
+          result
+        }, {
+          file: "authenticator.ts",
+          line: 61,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        return false;
+      }
+      if (!credential.proof.nonce || !Buffer.from(nonce).equals(credential.proof.nonce)) {
+        (0, import_log.log)("Invalid nonce", {
+          nonce,
+          credential
+        }, {
+          file: "authenticator.ts",
+          line: 66,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        return false;
+      }
+      if (this._isTrustedKey(credential.issuer)) {
+        (0, import_log.log)("key is not currently in trusted set, waiting...", {
+          key: credential.issuer
+        }, {
+          file: "authenticator.ts",
+          line: 71,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        return true;
+      }
+      const trigger = new import_async.Trigger();
+      this._ctx.onDispose(() => {
+        trigger.wake(false);
+      });
+      const clear = this._params.update.on(this._ctx, () => {
+        if (this._isTrustedKey(credential.issuer)) {
+          (0, import_log.log)("auth success", {
+            key: credential.issuer
+          }, {
+            file: "authenticator.ts",
+            line: 82,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          trigger.wake(true);
+        } else {
+          (0, import_log.log)("key is not currently in trusted set, waiting...", {
+            key: credential.issuer
+          }, {
+            file: "authenticator.ts",
+            line: 85,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+      });
+      try {
+        return await trigger.wait({
+          timeout: this._params.authTimeout
+        });
+      } catch (e) {
+        return false;
+      } finally {
+        clear();
+      }
+    };
+  }
+  _isTrustedKey(deviceKey) {
+    const deviceSet = this._params.trustedKeysProvider();
+    return deviceSet.has(deviceKey);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/identity/identity.ts
+var import_node_assert = __toESM(require("node:assert"));
+var import_async2 = require("@dxos/async");
+var import_credentials3 = require("@dxos/credentials");
+var import_debug = require("@dxos/debug");
+var import_feed_store = require("@dxos/feed-store");
+var import_log2 = require("@dxos/log");
+var import_credentials4 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var AUTH_TIMEOUT = 3e4;
+var Identity = class {
+  constructor({ space, signer, identityKey, deviceKey }) {
+    this.stateUpdate = new import_async2.Event();
+    this.space = space;
+    this._signer = signer;
+    this.identityKey = identityKey;
+    this.deviceKey = deviceKey;
+    this._deviceStateMachine = this.space.spaceState.registerProcessor(new import_credentials3.DeviceStateMachine({
+      identityKey: this.identityKey,
+      deviceKey: this.deviceKey,
+      onUpdate: () => this.stateUpdate.emit()
+    }));
+    this._profileStateMachine = this.space.spaceState.registerProcessor(new import_credentials3.ProfileStateMachine({
+      identityKey: this.identityKey,
+      onUpdate: () => this.stateUpdate.emit()
+    }));
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => this.authorizedDeviceKeys,
+      update: this.stateUpdate,
+      authTimeout: AUTH_TIMEOUT
+    });
+  }
+  // TODO(burdon): Expose state object?
+  get authorizedDeviceKeys() {
+    return this._deviceStateMachine.processor.authorizedDeviceKeys;
+  }
+  async open() {
+    await this._deviceStateMachine.open();
+    await this._profileStateMachine.open();
+    await this.space.open();
+  }
+  async close() {
+    await this.authVerifier.close();
+    await this._deviceStateMachine.close();
+    await this._profileStateMachine.close();
+    await this.space.close();
+  }
+  async ready() {
+    await this._deviceStateMachine.processor.deviceChainReady.wait();
+    await this.controlPipeline.state.waitUntilReachedTargetTimeframe({
+      timeout: 3e3
+    });
+  }
+  get profileDocument() {
+    return this._profileStateMachine.processor.profile;
+  }
+  /**
+  * @test-only
+  */
+  get controlPipeline() {
+    return this.space.controlPipeline;
+  }
+  get haloSpaceKey() {
+    return this.space.key;
+  }
+  get haloGenesisFeedKey() {
+    return this.space.genesisFeedKey;
+  }
+  get deviceCredentialChain() {
+    return this._deviceStateMachine.processor.deviceCredentialChain;
+  }
+  getAdmissionCredentials() {
+    var _a, _b;
+    return {
+      deviceKey: this.deviceKey,
+      controlFeedKey: (_a = this.space.controlFeedKey) != null ? _a : (0, import_debug.failUndefined)(),
+      dataFeedKey: (_b = this.space.dataFeedKey) != null ? _b : (0, import_debug.failUndefined)()
+    };
+  }
+  /**
+  * Issues credentials as identity.
+  * Requires identity to be ready.
+  */
+  getIdentityCredentialSigner() {
+    (0, import_node_assert.default)(this._deviceStateMachine.processor.deviceCredentialChain, "Device credential chain is not ready.");
+    return (0, import_credentials3.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.processor.deviceCredentialChain, this.deviceKey);
+  }
+  /**
+  * Issues credentials as device.
+  */
+  getDeviceCredentialSigner() {
+    return (0, import_credentials3.createCredentialSignerWithKey)(this._signer, this.deviceKey);
+  }
+  async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }) {
+    (0, import_log2.log)("Admitting device:", {
+      identityKey: this.identityKey,
+      hostDevice: this.deviceKey,
+      deviceKey,
+      controlFeedKey,
+      dataFeedKey
+    }, {
+      file: "identity.ts",
+      line: 160,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const signer = this.getIdentityCredentialSigner();
+    await (0, import_feed_store.writeMessages)(this.controlPipeline.writer, [
+      await signer.createCredential({
+        subject: deviceKey,
+        assertion: {
+          "@type": "dxos.halo.credentials.AuthorizedDevice",
+          identityKey: this.identityKey,
+          deviceKey
+        }
+      }),
+      await signer.createCredential({
+        subject: controlFeedKey,
+        assertion: {
+          "@type": "dxos.halo.credentials.AdmittedFeed",
+          spaceKey: this.haloSpaceKey,
+          deviceKey,
+          identityKey: this.identityKey,
+          designation: import_credentials4.AdmittedFeed.Designation.CONTROL
+        }
+      }),
+      await signer.createCredential({
+        subject: dataFeedKey,
+        assertion: {
+          "@type": "dxos.halo.credentials.AdmittedFeed",
+          spaceKey: this.haloSpaceKey,
+          deviceKey,
+          identityKey: this.identityKey,
+          designation: import_credentials4.AdmittedFeed.Designation.DATA
+        }
+      })
+    ].map((credential) => ({
+      credential: {
+        credential
+      }
+    })));
+  }
+};
+
+// packages/sdk/client-services/src/packlets/identity/identity-manager.ts
+var import_node_assert2 = __toESM(require("node:assert"));
+var import_async3 = require("@dxos/async");
+var import_credentials5 = require("@dxos/credentials");
+var import_log3 = require("@dxos/log");
+var import_credentials6 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_util = require("@dxos/util");
+var IdentityManager = class {
+  // TODO(burdon): IdentityManagerParams.
+  // TODO(dmaretskyi): Perhaps this should take/generate the peerKey outside of an initialized identity.
+  constructor(_metadataStore, _keyring, _feedStore, _spaceManager) {
+    this._metadataStore = _metadataStore;
+    this._keyring = _keyring;
+    this._feedStore = _feedStore;
+    this._spaceManager = _spaceManager;
+    this.stateUpdate = new import_async3.Event();
+  }
+  get identity() {
+    return this._identity;
+  }
+  async open() {
+    await this._metadataStore.load();
+    const identityRecord = this._metadataStore.getIdentityRecord();
+    (0, import_log3.log)("identity record", {
+      identityRecord
+    }, {
+      file: "identity-manager.ts",
+      line: 63,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    if (identityRecord) {
+      this._identity = await this._constructIdentity(identityRecord);
+      await this._identity.open();
+      await this._identity.ready();
+      this.stateUpdate.emit();
+    }
+  }
+  async close() {
+    var _a;
+    await ((_a = this._identity) == null ? void 0 : _a.close());
+  }
+  async createIdentity({ displayName } = {}) {
+    (0, import_node_assert2.default)(!this._identity, "Identity already exists.");
+    (0, import_log3.log)("creating identity...", {}, {
+      file: "identity-manager.ts",
+      line: 78,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const controlFeedKey = await this._keyring.createKey();
+    const identityRecord = {
+      identityKey: await this._keyring.createKey(),
+      deviceKey: await this._keyring.createKey(),
+      haloSpace: {
+        spaceKey: await this._keyring.createKey(),
+        genesisFeedKey: controlFeedKey,
+        writeControlFeedKey: controlFeedKey,
+        writeDataFeedKey: await this._keyring.createKey()
+      }
+    };
+    const identity = await this._constructIdentity(identityRecord);
+    await identity.open();
+    {
+      const generator = new import_credentials5.CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
+      const credentials = [
+        // Space genesis.
+        ...await generator.createSpaceGenesis(identityRecord.haloSpace.spaceKey, identityRecord.haloSpace.genesisFeedKey),
+        // Feed admission.
+        await generator.createFeedAdmission(identityRecord.haloSpace.spaceKey, identityRecord.haloSpace.writeDataFeedKey, import_credentials6.AdmittedFeed.Designation.DATA)
+      ];
+      if (displayName) {
+        credentials.push(await generator.createProfileCredential({
+          displayName
+        }));
+      }
+      credentials.push(await generator.createDeviceAuthorization(identityRecord.deviceKey));
+      for (const credential of credentials) {
+        await identity.controlPipeline.writer.write({
+          credential: {
+            credential
+          }
+        });
+      }
+    }
+    await this._metadataStore.setIdentityRecord(identityRecord);
+    this._identity = identity;
+    await this._identity.ready();
+    this.stateUpdate.emit();
+    (0, import_log3.log)("created identity", {
+      identityKey: identity.identityKey,
+      deviceKey: identity.deviceKey
+    }, {
+      file: "identity-manager.ts",
+      line: 136,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    return identity;
+  }
+  /**
+  * Accept an existing identity. Expects it's device key to be authorized (now or later).
+  */
+  async acceptIdentity(params) {
+    (0, import_log3.log)("accepting identity", {
+      params
+    }, {
+      file: "identity-manager.ts",
+      line: 144,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    (0, import_node_assert2.default)(!this._identity, "Identity already exists.");
+    const identityRecord = {
+      identityKey: params.identityKey,
+      deviceKey: params.deviceKey,
+      haloSpace: {
+        spaceKey: params.haloSpaceKey,
+        genesisFeedKey: params.haloGenesisFeedKey,
+        writeControlFeedKey: params.controlFeedKey,
+        writeDataFeedKey: params.dataFeedKey
+      }
+    };
+    const identity = await this._constructIdentity(identityRecord);
+    await identity.open();
+    this._identity = identity;
+    await this._metadataStore.setIdentityRecord(identityRecord);
+    await this._identity.ready();
+    this.stateUpdate.emit();
+    (0, import_log3.log)("accepted identity", {
+      identityKey: identity.identityKey,
+      deviceKey: identity.deviceKey
+    }, {
+      file: "identity-manager.ts",
+      line: 164,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    return identity;
+  }
+  async _constructIdentity(identityRecord) {
+    (0, import_node_assert2.default)(!this._identity);
+    (0, import_log3.log)("constructing identity", {
+      identityRecord
+    }, {
+      file: "identity-manager.ts",
+      line: 170,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const controlFeed = await this._feedStore.openFeed(identityRecord.haloSpace.writeControlFeedKey, {
+      writable: true
+    });
+    const dataFeed = await this._feedStore.openFeed(identityRecord.haloSpace.writeDataFeedKey, {
+      writable: true
+    });
+    const space = await this._constructSpace({
+      spaceRecord: identityRecord.haloSpace,
+      swarmIdentity: {
+        peerKey: identityRecord.deviceKey,
+        credentialProvider: createAuthProvider((0, import_credentials5.createCredentialSignerWithKey)(this._keyring, identityRecord.deviceKey)),
+        credentialAuthenticator: (0, import_util.deferFunction)(() => identity.authVerifier.verifier)
+      },
+      identityKey: identityRecord.identityKey
+    });
+    space.setControlFeed(controlFeed);
+    space.setDataFeed(dataFeed);
+    const identity = new Identity({
+      space,
+      signer: this._keyring,
+      identityKey: identityRecord.identityKey,
+      deviceKey: identityRecord.deviceKey
+    });
+    (0, import_log3.log)("done", {
+      identityKey: identityRecord.identityKey
+    }, {
+      file: "identity-manager.ts",
+      line: 196,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    return identity;
+  }
+  async _constructSpace({ spaceRecord, swarmIdentity, identityKey }) {
+    return this._spaceManager.constructSpace({
+      metadata: {
+        key: spaceRecord.spaceKey,
+        genesisFeedKey: spaceRecord.genesisFeedKey
+      },
+      swarmIdentity,
+      onNetworkConnection: () => {
+      }
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/encoder.ts
+var import_base_x = __toESM(require("base-x"));
+var import_protocols2 = require("@dxos/protocols");
+var base62 = (0, import_base_x.default)("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ");
+var codec = import_protocols2.schema.getCodecForType("dxos.client.services.Invitation");
+
+// packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
+var import_node_assert3 = __toESM(require("node:assert"));
+var import_async5 = require("@dxos/async");
+var import_context2 = require("@dxos/context");
+var import_credentials7 = require("@dxos/credentials");
+var import_keys2 = require("@dxos/keys");
+var import_log4 = require("@dxos/log");
+var import_network_manager = require("@dxos/network-manager");
+var import_protocols3 = require("@dxos/protocols");
+var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
+var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
+var import_teleport = require("@dxos/teleport");
+
+// packages/sdk/client-services/src/packlets/invitations/invitations.ts
+var import_async4 = require("@dxos/async");
+var import_services = require("@dxos/protocols/proto/dxos/client/services");
+var AUTHENTICATION_CODE_LENGTH = 6;
+var INVITATION_TIMEOUT = 3 * 6e4;
+var ON_CLOSE_DELAY = 1e3;
+var InvitationObservableProvider = class extends import_async4.CancellableObservableProvider {
+  get invitation() {
+    return this._invitation;
+  }
+  setInvitation(invitation) {
+    this._invitation = invitation;
+  }
+};
+var AuthenticatingInvitationProvider = class extends InvitationObservableProvider {
+  // prettier-ignore
+  constructor(_actions) {
+    super(() => this._actions.onCancel());
+    this._actions = _actions;
+  }
+  async authenticate(authenticationCode) {
+    return this._actions.onAuthenticate(authenticationCode);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
+var AbstractInvitationsHandler = class {
+  // prettier-ignore
+  constructor(_networkManager) {
+    this._networkManager = _networkManager;
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
+var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
+  // prettier-ignore
+  constructor(_params) {
+    super(_params.networkManager);
+    this._params = _params;
+  }
+  /**
+  * Creates an invitation and listens for a join request from the invited (guest) peer.
+  */
+  createInvitation(context, options) {
+    const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
+    (0, import_node_assert3.default)(type !== import_services2.Invitation.Type.OFFLINE);
+    const identity = this._params.getIdentity();
+    const invitation = {
+      type,
+      invitationId: import_keys2.PublicKey.random().toHex(),
+      swarmKey: swarmKey != null ? swarmKey : import_keys2.PublicKey.random(),
+      authenticationCode: (0, import_credentials7.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
+    };
+    const ctx = new import_context2.Context({
+      onError: (err) => {
+        void ctx.dispose();
+        observable.callback.onError(err);
+      }
+    });
+    const observable = new InvitationObservableProvider(async () => {
+      await ctx.dispose();
+    });
+    let authenticationCode;
+    const complete = new import_async5.Trigger();
+    const createExtension = () => new HostHaloInvitationExtension({
+      requestAdmission: async () => {
+        var _a, _b;
+        (0, import_log4.log)("responding with admission offer", {
+          host: identity.deviceKey
+        }, {
+          file: "halo-invitations-handler.ts",
+          line: 91,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        (_b = (_a = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a, invitation);
+        return {
+          identityKey: identity.identityKey,
+          haloSpaceKey: identity.haloSpaceKey,
+          genesisFeedKey: identity.haloGenesisFeedKey
+        };
+      },
+      authenticate: async ({ authenticationCode: code }) => {
+        (0, import_log4.log)("received authentication request", {
+          authenticationCode: code
+        }, {
+          file: "halo-invitations-handler.ts",
+          line: 105,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        authenticationCode = code;
+        return {
+          status: import_invitations.AuthenticationResponse.Status.OK
+        };
+      },
+      // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
+      presentAdmissionCredentials: async (credentials) => {
+        try {
+          if (invitation.type !== import_services2.Invitation.Type.INTERACTIVE_TESTING) {
+            if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
+              throw new Error(`invalid authentication code: ${authenticationCode}`);
+            }
+          }
+          (0, import_log4.log)("writing guest credentials", {
+            host: identity.deviceKey,
+            guest: credentials.deviceKey
+          }, {
+            file: "halo-invitations-handler.ts",
+            line: 120,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          await identity.admitDevice(credentials);
+          complete.wake(credentials.deviceKey);
+        } catch (err) {
+          observable.callback.onError(err);
+          throw err;
+        }
+      },
+      onOpen: () => {
+        (0, import_async5.scheduleTask)(ctx, async () => {
+          var _a, _b;
+          try {
+            (0, import_log4.log)("connected", {
+              host: identity.deviceKey
+            }, {
+              file: "halo-invitations-handler.ts",
+              line: 136,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
+            const deviceKey = await complete.wait({
+              timeout
+            });
+            (0, import_log4.log)("admitted guest", {
+              host: identity.deviceKey,
+              guest: deviceKey
+            }, {
+              file: "halo-invitations-handler.ts",
+              line: 139,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            observable.callback.onSuccess(invitation);
+          } catch (err) {
+            if (!observable.cancelled) {
+              import_log4.log.error("failed", err, {
+                file: "halo-invitations-handler.ts",
+                line: 143,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              observable.callback.onError(err);
+            }
+          } finally {
+            await (0, import_async5.sleep)(ON_CLOSE_DELAY);
+            await ctx.dispose();
+          }
+        });
+      }
+    });
+    (0, import_async5.scheduleTask)(ctx, async () => {
+      var _a, _b;
+      const topic = invitation.swarmKey;
+      const swarmConnection = await this._networkManager.joinSwarm({
+        topic,
+        peerId: topic,
+        protocolProvider: (0, import_network_manager.createTeleportProtocolFactory)(async (teleport) => {
+          teleport.addExtension("dxos.halo.invitations", createExtension());
+        }),
+        topology: new import_network_manager.StarTopology(topic)
+      });
+      ctx.onDispose(() => swarmConnection.close());
+      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
+    });
+    return observable;
+  }
+  /**
+  * Waits for the host peer (inviter) to accept our join request.
+  * The local guest peer (invitee) then sends the local halo invitation to the host,
+  * which then writes the guest's credentials to the halo.
+  */
+  acceptInvitation(invitation, options) {
+    const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
+    const ctx = new import_context2.Context({
+      onError: (err) => {
+        void ctx.dispose();
+        observable.callback.onError(err);
+      }
+    });
+    const authenticated = new import_async5.Trigger();
+    const observable = new AuthenticatingInvitationProvider({
+      onCancel: async () => {
+        await ctx.dispose();
+      },
+      // TODO(burdon): Consider retry.
+      onAuthenticate: async (code) => {
+        authenticated.wake(code);
+      }
+    });
+    let connectionCount = 0;
+    const complete = new import_async5.Trigger();
+    const createExtension = () => {
+      const extension = new GuestHaloInvitationExtension({
+        onOpen: () => {
+          (0, import_async5.scheduleTask)(ctx, async () => {
+            var _a, _b, _c, _d;
+            try {
+              if (++connectionCount > 1) {
+                throw new Error(`multiple connections detected: ${connectionCount}`);
+              }
+              (0, import_log4.log)("connected", {}, {
+                file: "halo-invitations-handler.ts",
+                line: 214,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
+              (0, import_log4.log)("sending admission request", {}, {
+                file: "halo-invitations-handler.ts",
+                line: 218,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              const { identityKey, haloSpaceKey, genesisFeedKey } = await extension.rpc.HaloHostService.requestAdmission();
+              if (invitation.type === void 0 || invitation.type === import_services2.Invitation.Type.INTERACTIVE) {
+                (0, import_log4.log)("guest waiting for authentication code...", {}, {
+                  file: "halo-invitations-handler.ts",
+                  line: 225,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
+                const authenticationCode = await authenticated.wait({
+                  timeout
+                });
+                (0, import_log4.log)("sending authentication request", {}, {
+                  file: "halo-invitations-handler.ts",
+                  line: 228,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                await extension.rpc.HaloHostService.authenticate({
+                  authenticationCode
+                });
+              }
+              const deviceKey = await this._params.keyring.createKey();
+              const controlFeedKey = await this._params.keyring.createKey();
+              const dataFeedKey = await this._params.keyring.createKey();
+              (0, import_log4.log)("presenting admission credentials", {
+                identityKey,
+                deviceKey,
+                controlFeedKey,
+                dataFeedKey
+              }, {
+                file: "halo-invitations-handler.ts",
+                line: 237,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              await extension.rpc.HaloHostService.presentAdmissionCredentials({
+                deviceKey,
+                controlFeedKey,
+                dataFeedKey
+              });
+              const identity = await this._params.acceptIdentity({
+                identityKey,
+                deviceKey,
+                haloSpaceKey,
+                haloGenesisFeedKey: genesisFeedKey,
+                controlFeedKey,
+                dataFeedKey
+              });
+              (0, import_log4.log)("admitted by host", {
+                guest: identity.deviceKey,
+                identityKey
+              }, {
+                file: "halo-invitations-handler.ts",
+                line: 256,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              complete.wake(identityKey);
+            } catch (err) {
+              if (!observable.cancelled) {
+                import_log4.log.warn("auth failed", err, {
+                  file: "halo-invitations-handler.ts",
+                  line: 260,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                observable.callback.onError(err);
+              }
+            } finally {
+              await ctx.dispose();
+            }
+          });
+        }
+      });
+      return extension;
+    };
+    (0, import_async5.scheduleTask)(ctx, async () => {
+      var _a, _b;
+      (0, import_node_assert3.default)(invitation.swarmKey);
+      const topic = invitation.swarmKey;
+      const swarmConnection = await this._networkManager.joinSwarm({
+        topic,
+        peerId: import_keys2.PublicKey.random(),
+        protocolProvider: (0, import_network_manager.createTeleportProtocolFactory)(async (teleport) => {
+          teleport.addExtension("dxos.halo.invitations", createExtension());
+        }),
+        topology: new import_network_manager.StarTopology(topic)
+      });
+      ctx.onDispose(() => swarmConnection.close());
+      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
+      invitation.identityKey = await complete.wait();
+      observable.callback.onSuccess(invitation);
+      await ctx.dispose();
+    });
+    return observable;
+  }
+};
+var HostHaloInvitationExtension = class extends import_teleport.RpcExtension {
+  constructor(_callbacks) {
+    super({
+      exposed: {
+        HaloHostService: import_protocols3.schema.getService("dxos.halo.invitations.HaloHostService")
+      }
+    });
+    this._callbacks = _callbacks;
+  }
+  async getHandlers() {
+    return {
+      // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
+      // Perhaps in the future we will have more complex logic here.
+      HaloHostService: {
+        requestAdmission: async () => {
+          return this._callbacks.requestAdmission();
+        },
+        authenticate: async (credentials) => {
+          return this._callbacks.authenticate(credentials);
+        },
+        // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
+        presentAdmissionCredentials: async (credentials) => {
+          return this._callbacks.presentAdmissionCredentials(credentials);
+        }
+      }
+    };
+  }
+  async onOpen(context) {
+    await super.onOpen(context);
+    this._callbacks.onOpen();
+  }
+};
+var GuestHaloInvitationExtension = class extends import_teleport.RpcExtension {
+  constructor(_callbacks) {
+    super({
+      requested: {
+        HaloHostService: import_protocols3.schema.getService("dxos.halo.invitations.HaloHostService")
+      }
+    });
+    this._callbacks = _callbacks;
+  }
+  async getHandlers() {
+    return {};
+  }
+  async onOpen(context) {
+    await super.onOpen(context);
+    this._callbacks.onOpen();
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts
+var import_async6 = require("@dxos/async");
+var import_log5 = require("@dxos/log");
+var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
+
+// packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
+var import_node_assert4 = __toESM(require("node:assert"));
+var import_codec_protobuf = require("@dxos/codec-protobuf");
+var import_log6 = require("@dxos/log");
+var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
+var AbstractInvitationsService = class {
+  // prettier-ignore
+  constructor(_identityManager, _getInvitationsHandler) {
+    this._identityManager = _identityManager;
+    this._getInvitationsHandler = _getInvitationsHandler;
+    this._createInvitations = /* @__PURE__ */ new Map();
+    this._acceptInvitations = /* @__PURE__ */ new Map();
+  }
+  // TODO(burdon): Guest/host label.
+  getLoggingContext() {
+    var _a;
+    return {
+      deviceKey: (_a = this._identityManager.identity) == null ? void 0 : _a.deviceKey
+    };
+  }
+  createInvitation(invitation) {
+    return new import_codec_protobuf.Stream(({ next, close }) => {
+      const invitationsHandler = this._getInvitationsHandler();
+      const context = this.getContext(invitation);
+      (0, import_log6.log)("stream opened", this.getLoggingContext(), {
+        file: "invitations-service.ts",
+        line: 43,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      let invitationId;
+      const { type, swarmKey } = invitation;
+      const observable = invitationsHandler.createInvitation(context, {
+        type,
+        swarmKey
+      });
+      observable.subscribe({
+        onConnecting: (invitation2) => {
+          (0, import_node_assert4.default)(invitation2.invitationId);
+          invitationId = invitation2.invitationId;
+          this._createInvitations.set(invitation2.invitationId, observable);
+          invitation2.state = import_services4.Invitation.State.CONNECTING;
+          next(invitation2);
+        },
+        onConnected: (invitation2) => {
+          (0, import_node_assert4.default)(invitation2.invitationId);
+          invitation2.state = import_services4.Invitation.State.CONNECTED;
+          next(invitation2);
+        },
+        onAuthenticating: (invitation2) => {
+          (0, import_node_assert4.default)(invitation2.invitationId);
+          invitation2.state = import_services4.Invitation.State.AUTHENTICATING;
+          next(invitation2);
+        },
+        onSuccess: (invitation2) => {
+          (0, import_node_assert4.default)(invitation2.invitationId);
+          invitation2.state = import_services4.Invitation.State.SUCCESS;
+          next(invitation2);
+          close();
+        },
+        onCancelled: () => {
+          (0, import_node_assert4.default)(invitationId);
+          invitation.invitationId = invitationId;
+          invitation.state = import_services4.Invitation.State.CANCELLED;
+          next(invitation);
+          close();
+        },
+        onTimeout: (err) => {
+          invitation.state = import_services4.Invitation.State.TIMEOUT;
+          close(err);
+        },
+        onError: (err) => {
+          invitation.state = import_services4.Invitation.State.ERROR;
+          close(err);
+        }
+      });
+      return (err) => {
+        const context2 = this.getLoggingContext();
+        if (err) {
+          import_log6.log.warn("stream closed", {
+            ...context2,
+            err
+          }, {
+            file: "invitations-service.ts",
+            line: 92,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        } else {
+          (0, import_log6.log)("stream closed", context2, {
+            file: "invitations-service.ts",
+            line: 94,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+        this._createInvitations.delete(invitation.invitationId);
+      };
+    });
+  }
+  acceptInvitation(invitation, options) {
+    return new import_codec_protobuf.Stream(({ next, close }) => {
+      (0, import_log6.log)("stream opened", this.getLoggingContext(), {
+        file: "invitations-service.ts",
+        line: 104,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      const invitationsHandler = this._getInvitationsHandler();
+      let invitationId;
+      const observable = invitationsHandler.acceptInvitation(invitation, options);
+      observable.subscribe({
+        onConnecting: (invitation2) => {
+          (0, import_node_assert4.default)(invitation2.invitationId);
+          invitationId = invitation2.invitationId;
+          this._acceptInvitations.set(invitation2.invitationId, observable);
+          invitation2.state = import_services4.Invitation.State.CONNECTING;
+          next(invitation2);
+        },
+        onConnected: (invitation2) => {
+          (0, import_node_assert4.default)(invitation2.invitationId);
+          invitation2.state = import_services4.Invitation.State.CONNECTED;
+          next(invitation2);
+        },
+        onAuthenticating: (invitation2) => {
+          (0, import_node_assert4.default)(invitation2.invitationId);
+          invitation2.state = import_services4.Invitation.State.AUTHENTICATING;
+          next(invitation2);
+        },
+        onSuccess: (invitation2) => {
+          invitation2.state = import_services4.Invitation.State.SUCCESS;
+          next(invitation2);
+          close();
+        },
+        onCancelled: () => {
+          (0, import_node_assert4.default)(invitationId);
+          invitation.invitationId = invitationId;
+          invitation.state = import_services4.Invitation.State.CANCELLED;
+          next(invitation);
+          close();
+        },
+        onTimeout: (err) => {
+          invitation.state = import_services4.Invitation.State.TIMEOUT;
+          close(err);
+        },
+        onError: (err) => {
+          invitation.state = import_services4.Invitation.State.ERROR;
+          close(err);
+        }
+      });
+      return (err) => {
+        const context = this.getLoggingContext();
+        if (err) {
+          import_log6.log.warn("stream closed", {
+            ...context,
+            err
+          }, {
+            file: "invitations-service.ts",
+            line: 152,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        } else {
+          (0, import_log6.log)("stream closed", context, {
+            file: "invitations-service.ts",
+            line: 154,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+        this._acceptInvitations.delete(invitation.invitationId);
+      };
+    });
+  }
+  async authenticate({ invitationId, authenticationCode }) {
+    (0, import_log6.log)("authenticating...", {}, {
+      file: "invitations-service.ts",
+      line: 163,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    (0, import_node_assert4.default)(invitationId);
+    const observable = this._acceptInvitations.get(invitationId);
+    if (!observable) {
+      import_log6.log.warn("invalid invitation", {
+        invitationId
+      }, {
+        file: "invitations-service.ts",
+        line: 167,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } else {
+      await observable.authenticate(authenticationCode);
+    }
+  }
+  async cancelInvitation(invitation) {
+    var _a;
+    (0, import_log6.log)("cancelling...", {}, {
+      file: "invitations-service.ts",
+      line: 174,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    (0, import_node_assert4.default)(invitation.invitationId);
+    const observable = (_a = this._createInvitations.get(invitation.invitationId)) != null ? _a : this._acceptInvitations.get(invitation.invitationId);
+    if (!observable) {
+      import_log6.log.warn("invalid invitation", {
+        invitationId: invitation.invitationId
+      }, {
+        file: "invitations-service.ts",
+        line: 179,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } else {
+      await (observable == null ? void 0 : observable.cancel());
+    }
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/halo-invitations-service.ts
+var HaloInvitationsServiceImpl = class extends AbstractInvitationsService {
+  // prettier-ignore
+  constructor(identityManager, invitationsHandler) {
+    super(identityManager, () => invitationsHandler);
+    this.invitationsHandler = invitationsHandler;
+  }
+  getContext(invitation) {
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts
+var import_node_assert5 = __toESM(require("node:assert"));
+var import_async7 = require("@dxos/async");
+var import_context3 = require("@dxos/context");
+var import_credentials8 = require("@dxos/credentials");
+var import_feed_store2 = require("@dxos/feed-store");
+var import_keys3 = require("@dxos/keys");
+var import_log7 = require("@dxos/log");
+var import_network_manager2 = require("@dxos/network-manager");
+var import_protocols4 = require("@dxos/protocols");
+var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
+var import_invitations4 = require("@dxos/protocols/proto/dxos/halo/invitations");
+var import_teleport2 = require("@dxos/teleport");
+var MAX_OTP_ATTEMPTS = 3;
+var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
+  constructor(networkManager, _spaceManager, _signingContext, _keyring) {
+    super(networkManager);
+    this._spaceManager = _spaceManager;
+    this._signingContext = _signingContext;
+    this._keyring = _keyring;
+  }
+  /**
+  * Creates an invitation and listens for a join request from the invited (guest) peer.
+  */
+  createInvitation(space, options) {
+    let swarmConnection;
+    const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
+    (0, import_node_assert5.default)(type !== import_services5.Invitation.Type.OFFLINE);
+    (0, import_node_assert5.default)(space);
+    const invitation = {
+      type,
+      invitationId: import_keys3.PublicKey.random().toHex(),
+      swarmKey: swarmKey != null ? swarmKey : import_keys3.PublicKey.random(),
+      spaceKey: space.key,
+      authenticationCode: (0, import_credentials8.generatePasscode)(AUTHENTICATION_CODE_LENGTH)
+    };
+    const ctx = new import_context3.Context({
+      onError: (err) => {
+        void ctx.dispose();
+        observable.callback.onError(err);
+      }
+    });
+    const observable = new InvitationObservableProvider(async () => {
+      await (swarmConnection == null ? void 0 : swarmConnection.close());
+    });
+    let authenticationCode;
+    let authenticationRetry = 0;
+    const createExtension = () => {
+      const complete = new import_async7.Trigger();
+      let guestProfile;
+      const hostInvitationExtension = new HostSpaceInvitationExtension({
+        introduce: async ({ profile }) => {
+          var _a, _b;
+          (0, import_log7.log)("guest introduced itself", {
+            guestProfile: profile,
+            host: this._signingContext.deviceKey,
+            spaceKey: space.key
+          }, {
+            file: "space-invitations-handler.ts",
+            line: 98,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          guestProfile = profile;
+          (_b = (_a = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a, invitation);
+        },
+        authenticate: async ({ authenticationCode: code }) => {
+          (0, import_log7.log)("received authentication request", {
+            authenticationCode: code
+          }, {
+            file: "space-invitations-handler.ts",
+            line: 112,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          let status = import_invitations4.AuthenticationResponse.Status.OK;
+          if (invitation.authenticationCode) {
+            if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
+              status = import_invitations4.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
+            } else if (code !== invitation.authenticationCode) {
+              status = import_invitations4.AuthenticationResponse.Status.INVALID_OTP;
+            } else {
+              authenticationCode = code;
+            }
+          }
+          return {
+            status
+          };
+        },
+        requestAdmission: async ({ identityKey, deviceKey, controlFeedKey, dataFeedKey }) => {
+          try {
+            if (invitation.type !== import_services5.Invitation.Type.INTERACTIVE_TESTING && invitation.type !== import_services5.Invitation.Type.MULTIUSE_TESTING) {
+              if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
+                throw new Error(`invalid authentication code: ${authenticationCode}`);
+              }
+            }
+            (0, import_log7.log)("writing guest credentials", {
+              host: this._signingContext.deviceKey,
+              guest: deviceKey
+            }, {
+              file: "space-invitations-handler.ts",
+              line: 139,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            const credentials = await (0, import_credentials8.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
+            (0, import_node_assert5.default)(credentials[0].credential);
+            const spaceMemberCredential = credentials[0].credential.credential;
+            (0, import_node_assert5.default)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+            await (0, import_feed_store2.writeMessages)(space.inner.controlPipeline.writer, credentials);
+            complete.wake(deviceKey);
+            return {
+              credential: spaceMemberCredential
+            };
+          } catch (err) {
+            observable.callback.onError(err);
+            throw err;
+          }
+        },
+        onOpen: () => {
+          (0, import_async7.scheduleTask)(ctx, async () => {
+            var _a, _b;
+            try {
+              (0, import_log7.log)("connected", {
+                host: this._signingContext.deviceKey
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 170,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
+              const deviceKey = await complete.wait({
+                timeout
+              });
+              (0, import_log7.log)("admitted guest", {
+                host: this._signingContext.deviceKey,
+                guest: deviceKey
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 173,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              observable.callback.onSuccess(invitation);
+            } catch (err) {
+              if (!observable.cancelled) {
+                import_log7.log.error("failed", err, {
+                  file: "space-invitations-handler.ts",
+                  line: 177,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                observable.callback.onError(err);
+              }
+            } finally {
+              if (type !== import_services5.Invitation.Type.MULTIUSE_TESTING) {
+                await (0, import_async7.sleep)(ON_CLOSE_DELAY);
+                await ctx.dispose();
+              }
+            }
+          });
+        }
+      });
+      return hostInvitationExtension;
+    };
+    (0, import_async7.scheduleTask)(ctx, async () => {
+      var _a, _b;
+      const topic = invitation.swarmKey;
+      const swarmConnection2 = await this._networkManager.joinSwarm({
+        topic,
+        peerId: topic,
+        protocolProvider: (0, import_network_manager2.createTeleportProtocolFactory)(async (teleport) => {
+          teleport.addExtension("dxos.halo.invitations", createExtension());
+        }),
+        topology: new import_network_manager2.StarTopology(topic)
+      });
+      ctx.onDispose(() => swarmConnection2.close());
+      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
+    });
+    return observable;
+  }
+  /**
+  * Waits for the host peer (inviter) to accept our join request.
+  * The local guest peer (invitee) then sends the local space invitation to the host,
+  * which then writes the guest's credentials to the space.
+  */
+  acceptInvitation(invitation, options) {
+    const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
+    const ctx = new import_context3.Context({
+      onError: (err) => {
+        void ctx.dispose();
+        observable.callback.onError(err);
+      }
+    });
+    const authenticated = new import_async7.Trigger();
+    const observable = new AuthenticatingInvitationProvider({
+      onCancel: async () => {
+        await ctx.dispose();
+      },
+      onAuthenticate: async (code) => {
+        authenticated.wake(code);
+      }
+    });
+    let connectionCount = 0;
+    const complete = new import_async7.Trigger();
+    const createExtension = () => {
+      const extension = new GuestSpaceInvitationExtension({
+        onOpen: () => {
+          (0, import_async7.scheduleTask)(ctx, async () => {
+            var _a, _b, _c, _d;
+            try {
+              if (++connectionCount > 1) {
+                throw new Error(`multiple connections detected: ${connectionCount}`);
+              }
+              (0, import_log7.log)("connected", {
+                guest: this._signingContext.deviceKey
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 250,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
+              (0, import_log7.log)("introduce", {
+                guest: this._signingContext.deviceKey
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 254,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              await extension.rpc.SpaceHostService.introduce({
+                profile: this._signingContext.profile
+              });
+              if (invitation.type === void 0 || invitation.type === import_services5.Invitation.Type.INTERACTIVE) {
+                for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
+                  (0, import_log7.log)("guest waiting for authentication code...", {}, {
+                    file: "space-invitations-handler.ts",
+                    line: 263,
+                    scope: this,
+                    callSite: (f, a) => f(...a)
+                  });
+                  (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
+                  const authenticationCode = await authenticated.wait({
+                    timeout
+                  });
+                  (0, import_log7.log)("sending authentication request", {}, {
+                    file: "space-invitations-handler.ts",
+                    line: 267,
+                    scope: this,
+                    callSite: (f, a) => f(...a)
+                  });
+                  const response = await extension.rpc.SpaceHostService.authenticate({
+                    authenticationCode
+                  });
+                  if (response.status === void 0 || response.status === import_invitations4.AuthenticationResponse.Status.OK) {
+                    break;
+                  }
+                  if (response.status === import_invitations4.AuthenticationResponse.Status.INVALID_OTP) {
+                    if (attempt === MAX_OTP_ATTEMPTS) {
+                      throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
+                    } else {
+                      (0, import_log7.log)("retrying invalid code", {
+                        attempt
+                      }, {
+                        file: "space-invitations-handler.ts",
+                        line: 277,
+                        scope: this,
+                        callSite: (f, a) => f(...a)
+                      });
+                      authenticated.reset();
+                    }
+                  }
+                }
+              }
+              const controlFeedKey = await this._keyring.createKey();
+              const dataFeedKey = await this._keyring.createKey();
+              (0, import_log7.log)("request admission", {
+                guest: this._signingContext.deviceKey
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 288,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              const { credential } = await extension.rpc.SpaceHostService.requestAdmission({
+                identityKey: this._signingContext.identityKey,
+                deviceKey: this._signingContext.deviceKey,
+                controlFeedKey,
+                dataFeedKey
+              });
+              const assertion = (0, import_credentials8.getCredentialAssertion)(credential);
+              (0, import_node_assert5.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
+              (0, import_node_assert5.default)(credential.subject.id.equals(this._signingContext.identityKey));
+              const space = await this._spaceManager.acceptSpace({
+                spaceKey: assertion.spaceKey,
+                genesisFeedKey: assertion.genesisFeedKey
+              });
+              await this._signingContext.recordCredential(credential);
+              (0, import_log7.log)("admitted by host", {
+                guest: this._signingContext.deviceKey,
+                spaceKey: space.key
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 310,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              complete.wake();
+            } catch (err) {
+              if (!observable.cancelled) {
+                import_log7.log.warn("auth failed", err, {
+                  file: "space-invitations-handler.ts",
+                  line: 314,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+                observable.callback.onError(err);
+              }
+            } finally {
+              await ctx.dispose();
+            }
+          });
+        }
+      });
+      return extension;
+    };
+    (0, import_async7.scheduleTask)(ctx, async () => {
+      var _a, _b;
+      (0, import_node_assert5.default)(invitation.swarmKey);
+      const topic = invitation.swarmKey;
+      const swarmConnection = await this._networkManager.joinSwarm({
+        topic,
+        peerId: import_keys3.PublicKey.random(),
+        protocolProvider: (0, import_network_manager2.createTeleportProtocolFactory)(async (teleport) => {
+          teleport.addExtension("dxos.halo.invitations", createExtension());
+        }),
+        topology: new import_network_manager2.StarTopology(topic)
+      });
+      ctx.onDispose(() => swarmConnection.close());
+      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
+      await complete.wait();
+      observable.callback.onSuccess(invitation);
+      await ctx.dispose();
+    });
+    return observable;
+  }
+};
+var HostSpaceInvitationExtension = class extends import_teleport2.RpcExtension {
+  constructor(_callbacks) {
+    super({
+      exposed: {
+        SpaceHostService: import_protocols4.schema.getService("dxos.halo.invitations.SpaceHostService")
+      }
+    });
+    this._callbacks = _callbacks;
+  }
+  async getHandlers() {
+    return {
+      // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
+      // Perhaps in the future we will have more complex logic here.
+      SpaceHostService: {
+        introduce: async (params) => {
+          return this._callbacks.introduce(params);
+        },
+        authenticate: async (credentials) => {
+          return this._callbacks.authenticate(credentials);
+        },
+        requestAdmission: async (credentials) => {
+          return this._callbacks.requestAdmission(credentials);
+        }
+      }
+    };
+  }
+  async onOpen(context) {
+    await super.onOpen(context);
+    this._callbacks.onOpen();
+  }
+};
+var GuestSpaceInvitationExtension = class extends import_teleport2.RpcExtension {
+  constructor(_callbacks) {
+    super({
+      requested: {
+        SpaceHostService: import_protocols4.schema.getService("dxos.halo.invitations.SpaceHostService")
+      }
+    });
+    this._callbacks = _callbacks;
+  }
+  async getHandlers() {
+    return {};
+  }
+  async onOpen(context) {
+    await super.onOpen(context);
+    this._callbacks.onOpen();
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/space-invitations-service.ts
+var import_node_assert6 = __toESM(require("node:assert"));
+var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
+  // prettier-ignore
+  constructor(identityManager, invitationsHandler, _getSpaceManager) {
+    super(identityManager, invitationsHandler);
+    this.invitationsHandler = invitationsHandler;
+    this._getSpaceManager = _getSpaceManager;
+  }
+  getContext(invitation) {
+    (0, import_node_assert6.default)(invitation.spaceKey);
+    const spaceManager = this._getSpaceManager();
+    const space = spaceManager.spaces.get(invitation.spaceKey);
+    (0, import_node_assert6.default)(space);
+    return space;
+  }
+};
+
+// packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+var import_node_assert8 = __toESM(require("node:assert"));
+var import_async10 = require("@dxos/async");
+var import_context6 = require("@dxos/context");
+var import_credentials10 = require("@dxos/credentials");
+var import_echo_db2 = require("@dxos/echo-db");
+var import_keys6 = require("@dxos/keys");
+var import_log9 = require("@dxos/log");
+var import_teleport_extension_presence = require("@dxos/teleport-extension-presence");
+var import_util4 = require("@dxos/util");
+
+// packages/sdk/client-services/src/packlets/spaces/data-space.ts
+var import_async9 = require("@dxos/async");
+var import_context5 = require("@dxos/context");
+var import_debug2 = require("@dxos/debug");
+var import_echo_db = require("@dxos/echo-db");
+var import_keys5 = require("@dxos/keys");
+var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_util3 = require("@dxos/util");
+
+// packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
+var import_node_assert7 = __toESM(require("node:assert"));
+var import_async8 = require("@dxos/async");
+var import_context4 = require("@dxos/context");
+var import_keys4 = require("@dxos/keys");
+var import_log8 = require("@dxos/log");
+var import_protocols5 = require("@dxos/protocols");
+var import_teleport3 = require("@dxos/teleport");
+var import_util2 = require("@dxos/util");
+var RETRY_TIMEOUT = 1e3;
+var NOTARIZE_TIMEOUT = 1e4;
+var NotarizationPlugin = class {
+  constructor() {
+    this._ctx = new import_context4.Context();
+    this._extensionOpened = new import_async8.Event();
+    this._extensions = /* @__PURE__ */ new Set();
+    this._processedCredentials = new import_util2.ComplexSet(import_keys4.PublicKey.hash);
+    this._processCredentialsTriggers = new import_util2.ComplexMap(import_keys4.PublicKey.hash);
+  }
+  async open() {
+  }
+  async close() {
+    await this._ctx.dispose();
+  }
+  /**
+  * Request credentials to be notarized.
+  */
+  async notarize(credentials) {
+    (0, import_log8.log)("notarize", {
+      credentials
+    }, {
+      file: "notarization-plugin.ts",
+      line: 44,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    (0, import_node_assert7.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
+    const errors = new import_async8.Trigger();
+    const ctx = this._ctx.derive({
+      onError: (err) => {
+        import_log8.log.warn("Notarization error", {
+          err
+        }, {
+          file: "notarization-plugin.ts",
+          line: 53,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        void ctx.dispose();
+        errors.throw(err);
+      }
+    });
+    (0, import_async8.scheduleTask)(ctx, () => {
+      import_log8.log.warn("Notarization timeout", {}, {
+        file: "notarization-plugin.ts",
+        line: 61,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      void ctx.dispose();
+      errors.throw(new import_async8.TimeoutError(NOTARIZE_TIMEOUT, "Notarization timed out"));
+    }, NOTARIZE_TIMEOUT);
+    const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
+    const peersTried = /* @__PURE__ */ new Set();
+    const notarizeTask = new import_async8.DeferredTask(ctx, async () => {
+      try {
+        if (this._extensions.size === 0) {
+          import_log8.log.warn("No peers to notarize with", {}, {
+            file: "notarization-plugin.ts",
+            line: 76,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        const peer = [
+          ...this._extensions
+        ].find((peer2) => !peersTried.has(peer2));
+        if (!peer) {
+          import_log8.log.warn("Exhausted all peers to notarize with", {
+            retryIn: RETRY_TIMEOUT
+          }, {
+            file: "notarization-plugin.ts",
+            line: 83,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          peersTried.clear();
+          (0, import_async8.scheduleTask)(ctx, () => notarizeTask.schedule(), RETRY_TIMEOUT);
+          return;
+        }
+        peersTried.add(peer);
+        (0, import_log8.log)("try notarizing", {
+          peer: peer.localPeerId,
+          credentialId: credentials.map((credential) => credential.id)
+        }, {
+          file: "notarization-plugin.ts",
+          line: 90,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        await peer.rpc.NotarizationService.notarize({
+          credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
+        });
+        (0, import_log8.log)("success", {}, {
+          file: "notarization-plugin.ts",
+          line: 94,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+      } catch (err) {
+        import_log8.log.warn("error notarizing (recoverable)", err, {
+          file: "notarization-plugin.ts",
+          line: 96,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        notarizeTask.schedule();
+      }
+    });
+    notarizeTask.schedule();
+    this._extensionOpened.on(ctx, () => notarizeTask.schedule());
+    try {
+      await Promise.race([
+        allNotarized,
+        errors.wait()
+      ]);
+      (0, import_log8.log)("done", {}, {
+        file: "notarization-plugin.ts",
+        line: 107,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } finally {
+      await ctx.dispose();
+    }
+  }
+  /**
+  * Called with credentials arriving from the control pipeline.
+  */
+  async process(credential) {
+    var _a;
+    if (!credential.id) {
+      return;
+    }
+    (_a = this._processCredentialsTriggers.get(credential.id)) == null ? void 0 : _a.wake();
+    this._processedCredentials.add(credential.id);
+    this._processCredentialsTriggers.delete(credential.id);
+  }
+  setWriter(writer) {
+    (0, import_node_assert7.default)(!this._writer, "Writer already set.");
+    this._writer = writer;
+  }
+  async _waitUntilProcessed(id) {
+    if (this._processedCredentials.has(id)) {
+      return;
+    }
+    await (0, import_util2.entry)(this._processCredentialsTriggers, id).orInsert(new import_async8.Trigger()).value.wait();
+  }
+  /**
+  * Requests from other peers to notarize credentials.
+  */
+  async _onNotarize(request) {
+    var _a;
+    if (!this._writer) {
+      throw new Error("Writer not set");
+    }
+    for (const credential of (_a = request.credentials) != null ? _a : []) {
+      (0, import_node_assert7.default)(credential.id, "Credential must have an id");
+      if (this._processedCredentials.has(credential.id)) {
+        continue;
+      }
+      await this._writer.write(credential);
+    }
+  }
+  createExtension() {
+    const extension = new NotarizationTeleportExtension({
+      onOpen: async () => {
+        (0, import_log8.log)("extension opened", {
+          peer: extension.localPeerId
+        }, {
+          file: "notarization-plugin.ts",
+          line: 156,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        this._extensions.add(extension);
+        this._extensionOpened.emit();
+      },
+      onClose: async () => {
+        (0, import_log8.log)("extension closed", {
+          peer: extension.localPeerId
+        }, {
+          file: "notarization-plugin.ts",
+          line: 161,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        this._extensions.delete(extension);
+      },
+      onNotarize: this._onNotarize.bind(this)
+    });
+    return extension;
+  }
+};
+var NotarizationTeleportExtension = class extends import_teleport3.RpcExtension {
+  constructor(_params) {
+    super({
+      requested: {
+        NotarizationService: import_protocols5.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+      },
+      exposed: {
+        NotarizationService: import_protocols5.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+      }
+    });
+    this._params = _params;
+  }
+  async getHandlers() {
+    return {
+      NotarizationService: {
+        notarize: async (request) => {
+          await this._params.onNotarize(request);
+        }
+      }
+    };
+  }
+  async onOpen(ctx) {
+    await super.onOpen(ctx);
+    await this._params.onOpen();
+  }
+  async onClose(err) {
+    await this._params.onClose();
+    await super.onClose(err);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/spaces/data-space.ts
+var __decorate = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var AUTH_TIMEOUT2 = 3e4;
+var CONTROL_PIPELINE_READY_TIMEFRAME = 3e3;
+var DataSpace = class DataSpace2 {
+  constructor(params) {
+    this._ctx = new import_context5.Context();
+    this._inner = params.inner;
+    this._presence = params.presence;
+    this._keyring = params.keyring;
+    this._feedStore = params.feedStore;
+    this._metadataStore = params.metadataStore;
+    this._signingContext = params.signingContext;
+    this._dataPipelineController = new import_echo_db.DataPipelineControllerImpl({
+      modelFactory: params.modelFactory,
+      metadataStore: params.metadataStore,
+      snapshotManager: params.snapshotManager,
+      memberKey: params.memberKey,
+      spaceKey: this._inner.key,
+      feedInfoProvider: (feedKey) => this._inner.spaceState.feeds.get(feedKey),
+      snapshotId: params.snapshotId
+    });
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => new import_util3.ComplexSet(import_keys5.PublicKey.hash, Array.from(this._inner.spaceState.members.keys())),
+      update: this._inner.stateUpdate,
+      authTimeout: AUTH_TIMEOUT2
+    });
+    this._notarizationPluginConsumer = this._inner.spaceState.registerProcessor(new NotarizationPlugin());
+  }
+  get key() {
+    return this._inner.key;
+  }
+  get isOpen() {
+    return this._inner.isOpen;
+  }
+  // TODO(burdon): Can we mark this for debugging only?
+  get inner() {
+    return this._inner;
+  }
+  get dataPipelineController() {
+    return this._dataPipelineController;
+  }
+  get stateUpdate() {
+    return this._inner.stateUpdate;
+  }
+  get presence() {
+    return this._presence;
+  }
+  get notarizationPlugin() {
+    return this._notarizationPluginConsumer.processor;
+  }
+  async open() {
+    await this.notarizationPlugin.open();
+    await this._notarizationPluginConsumer.open();
+    await this._inner.open();
+  }
+  async close() {
+    await this._ctx.dispose();
+    await this.authVerifier.close();
+    await this._inner.close();
+    await this._notarizationPluginConsumer.close();
+    await this.notarizationPlugin.close();
+    await this._presence.destroy();
+  }
+  async initializeDataPipeline() {
+    await this._inner.controlPipeline.state.waitUntilReachedTargetTimeframe({
+      timeout: CONTROL_PIPELINE_READY_TIMEFRAME
+    });
+    await this._createWritableFeeds();
+    this.notarizationPlugin.setWriter((0, import_echo_db.createMappedFeedWriter)((credential) => ({
+      credential: {
+        credential
+      }
+    }), this._inner.controlPipeline.writer));
+    await this._inner.initDataPipeline(this._dataPipelineController);
+  }
+  async _createWritableFeeds() {
+    const credentials = [];
+    if (!this.inner.controlFeedKey) {
+      const controlFeed = await this._feedStore.openFeed(await this._keyring.createKey(), {
+        writable: true
+      });
+      this.inner.setControlFeed(controlFeed);
+      credentials.push(await this._signingContext.credentialSigner.createCredential({
+        subject: controlFeed.key,
+        assertion: {
+          "@type": "dxos.halo.credentials.AdmittedFeed",
+          spaceKey: this.key,
+          deviceKey: this._signingContext.deviceKey,
+          identityKey: this._signingContext.identityKey,
+          designation: import_credentials9.AdmittedFeed.Designation.CONTROL
+        }
+      }));
+    }
+    if (!this.inner.dataFeedKey) {
+      const dataFeed = await this._feedStore.openFeed(await this._keyring.createKey(), {
+        writable: true
+      });
+      this.inner.setDataFeed(dataFeed);
+      credentials.push(await this._signingContext.credentialSigner.createCredential({
+        subject: dataFeed.key,
+        assertion: {
+          "@type": "dxos.halo.credentials.AdmittedFeed",
+          spaceKey: this.key,
+          deviceKey: this._signingContext.deviceKey,
+          identityKey: this._signingContext.identityKey,
+          designation: import_credentials9.AdmittedFeed.Designation.DATA
+        }
+      }));
+    }
+    if (credentials.length > 0) {
+      await this.notarizationPlugin.notarize(credentials);
+    }
+    await this._metadataStore.setWritableFeedKeys(this.key, this.inner.controlFeedKey, this.inner.dataFeedKey);
+  }
+};
+__decorate([
+  (0, import_debug2.timed)(1e4)
+], DataSpace.prototype, "_createWritableFeeds", null);
+DataSpace = __decorate([
+  (0, import_async9.trackLeaks)("open", "close")
+], DataSpace);
+
+// packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+var __decorate2 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var DATA_PIPELINE_READY_TIMEOUT = 3e3;
+var DataSpaceManager = class DataSpaceManager2 {
+  constructor(_spaceManager, _metadataStore, _dataServiceSubscriptions, _keyring, _signingContext, _modelFactory, _feedStore, _snapshotStore) {
+    this._spaceManager = _spaceManager;
+    this._metadataStore = _metadataStore;
+    this._dataServiceSubscriptions = _dataServiceSubscriptions;
+    this._keyring = _keyring;
+    this._signingContext = _signingContext;
+    this._modelFactory = _modelFactory;
+    this._feedStore = _feedStore;
+    this._snapshotStore = _snapshotStore;
+    this._ctx = new import_context6.Context();
+    this.updated = new import_async10.Event();
+    this._spaces = new import_util4.ComplexMap(import_keys6.PublicKey.hash);
+  }
+  // TODO(burdon): Remove.
+  get spaces() {
+    return this._spaces;
+  }
+  async open() {
+    await this._metadataStore.load();
+    (0, import_log9.log)("metadata loaded", {
+      spaces: this._metadataStore.spaces.length
+    }, {
+      file: "data-space-manager.ts",
+      line: 67,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    for (const spaceMetadata of this._metadataStore.spaces) {
+      (0, import_log9.log)("load space", {
+        spaceMetadata
+      }, {
+        file: "data-space-manager.ts",
+        line: 70,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      const space = await this._constructSpace(spaceMetadata);
+      await space.initializeDataPipeline();
+      if (spaceMetadata.dataTimeframe) {
+        (0, import_log9.log)("waiting for latest timeframe", {
+          spaceMetadata
+        }, {
+          file: "data-space-manager.ts",
+          line: 74,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        await space.dataPipelineController.pipelineState.setTargetTimeframe(spaceMetadata.dataTimeframe);
+      }
+      await space.dataPipelineController.pipelineState.waitUntilReachedTargetTimeframe({
+        timeout: DATA_PIPELINE_READY_TIMEOUT
+      });
+      this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
+    }
+  }
+  async close() {
+    await this._ctx.dispose();
+    for (const space of this._spaces.values()) {
+      await space.close();
+    }
+  }
+  /**
+  * Creates a new space writing the genesis credentials to the control feed.
+  */
+  async createSpace() {
+    const spaceKey = await this._keyring.createKey();
+    const controlFeedKey = await this._keyring.createKey();
+    const dataFeedKey = await this._keyring.createKey();
+    const metadata = {
+      key: spaceKey,
+      genesisFeedKey: controlFeedKey,
+      controlFeedKey,
+      dataFeedKey
+    };
+    (0, import_log9.log)("creating space...", {
+      spaceKey
+    }, {
+      file: "data-space-manager.ts",
+      line: 110,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const space = await this._constructSpace(metadata);
+    const credentials = await (0, import_echo_db2.spaceGenesis)(this._keyring, this._signingContext, space.inner);
+    await this._metadataStore.addSpace(metadata);
+    const memberCredential = credentials[1];
+    (0, import_node_assert8.default)((0, import_credentials10.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    await this._signingContext.recordCredential(memberCredential);
+    await space.initializeDataPipeline();
+    this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
+    this.updated.emit();
+    return space;
+  }
+  // TODO(burdon): Rename join space.
+  async acceptSpace(opts) {
+    (0, import_node_assert8.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
+    const metadata = {
+      key: opts.spaceKey,
+      genesisFeedKey: opts.genesisFeedKey
+    };
+    const space = await this._constructSpace(metadata);
+    await this._metadataStore.addSpace(metadata);
+    await space.initializeDataPipeline();
+    this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
+    this.updated.emit();
+    return space;
+  }
+  async _constructSpace(metadata) {
+    const presence = new import_teleport_extension_presence.Presence({
+      localPeerId: this._signingContext.deviceKey,
+      announceInterval: 1e3,
+      offlineTimeout: 3e4,
+      identityKey: this._signingContext.identityKey
+    });
+    const snapshotManager = new import_echo_db2.SnapshotManager(this._snapshotStore);
+    const controlFeed = metadata.controlFeedKey && await this._feedStore.openFeed(metadata.controlFeedKey, {
+      writable: true
+    });
+    const dataFeed = metadata.dataFeedKey && await this._feedStore.openFeed(metadata.dataFeedKey, {
+      writable: true
+    });
+    const space = await this._spaceManager.constructSpace({
+      metadata,
+      swarmIdentity: {
+        peerKey: this._signingContext.deviceKey,
+        credentialProvider: createAuthProvider(this._signingContext.credentialSigner),
+        credentialAuthenticator: (0, import_util4.deferFunction)(() => dataSpace.authVerifier.verifier)
+      },
+      onNetworkConnection: (session) => {
+        session.addExtension("dxos.mesh.teleport.presence", presence.createExtension({
+          remotePeerId: session.remotePeerId
+        }));
+        session.addExtension("dxos.mesh.teleport.objectsync", snapshotManager.objectSync.createExtension());
+        session.addExtension("dxos.mesh.teleport.notarization", dataSpace.notarizationPlugin.createExtension());
+      }
+    });
+    controlFeed && space.setControlFeed(controlFeed);
+    dataFeed && space.setDataFeed(dataFeed);
+    const dataSpace = new DataSpace({
+      inner: space,
+      modelFactory: this._modelFactory,
+      metadataStore: this._metadataStore,
+      snapshotManager,
+      presence,
+      memberKey: this._signingContext.identityKey,
+      keyring: this._keyring,
+      feedStore: this._feedStore,
+      signingContext: this._signingContext,
+      snapshotId: metadata.snapshot
+    });
+    await dataSpace.open();
+    this._spaces.set(metadata.key, dataSpace);
+    return dataSpace;
+  }
+};
+__decorate2([
+  import_async10.synchronized
+], DataSpaceManager.prototype, "open", null);
+__decorate2([
+  import_async10.synchronized
+], DataSpaceManager.prototype, "close", null);
+__decorate2([
+  import_async10.synchronized
+], DataSpaceManager.prototype, "createSpace", null);
+__decorate2([
+  import_async10.synchronized
+], DataSpaceManager.prototype, "acceptSpace", null);
+DataSpaceManager = __decorate2([
+  (0, import_async10.trackLeaks)("open", "close")
+], DataSpaceManager);
+
+// packages/sdk/client-services/src/packlets/services/service-context.ts
+var ServiceContext = class {
+  // prettier-ignore
+  constructor(storage, networkManager, modelFactory) {
+    this.storage = storage;
+    this.networkManager = networkManager;
+    this.modelFactory = modelFactory;
+    this.initialized = new import_async11.Trigger();
+    this.dataServiceSubscriptions = new import_echo_db3.DataServiceSubscriptions();
+    this.metadataStore = new import_echo_db3.MetadataStore(storage.createDirectory("metadata"));
+    this.snapshotStore = new import_echo_db3.SnapshotStore(storage.createDirectory("snapshots"));
+    this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
+    this.feedStore = new import_feed_store3.FeedStore({
+      factory: new import_feed_store3.FeedFactory({
+        root: storage.createDirectory("feeds"),
+        signer: this.keyring,
+        hypercore: {
+          valueEncoding: import_echo_db3.valueEncoding
+        }
+      })
+    });
+    this.spaceManager = new import_echo_db3.SpaceManager({
+      feedStore: this.feedStore,
+      networkManager: this.networkManager
+    });
+    this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
+    this.haloInvitations = new HaloInvitationsHandler({
+      networkManager: this.networkManager,
+      getIdentity: () => {
+        var _a;
+        return (_a = this.identityManager.identity) != null ? _a : (0, import_debug3.failUndefined)();
+      },
+      acceptIdentity: this._acceptIdentity.bind(this),
+      keyring: this.keyring
+    });
+  }
+  async open() {
+    (0, import_log10.log)("opening...", {}, {
+      file: "service-context.ts",
+      line: 94,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this.networkManager.open();
+    await this.spaceManager.open();
+    await this.identityManager.open();
+    if (this.identityManager.identity) {
+      await this._initialize();
+    }
+    (0, import_log10.log)("opened", {}, {
+      file: "service-context.ts",
+      line: 101,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+  async close() {
+    var _a, _b;
+    (0, import_log10.log)("closing...", {}, {
+      file: "service-context.ts",
+      line: 105,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await ((_a = this._deviceSpaceSync) == null ? void 0 : _a.close());
+    await ((_b = this.dataSpaceManager) == null ? void 0 : _b.close());
+    await this.identityManager.close();
+    await this.spaceManager.close();
+    await this.feedStore.close();
+    await this.networkManager.close();
+    this.dataServiceSubscriptions.clear();
+    (0, import_log10.log)("closed", {}, {
+      file: "service-context.ts",
+      line: 113,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+  async reset() {
+    (0, import_log10.log)("resetting...", {}, {
+      file: "service-context.ts",
+      line: 117,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this.close();
+    await this.storage.reset();
+    (0, import_log10.log)("reset", {}, {
+      file: "service-context.ts",
+      line: 120,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+  async createIdentity(params = {}) {
+    const identity = await this.identityManager.createIdentity(params);
+    await this._initialize();
+    return identity;
+  }
+  async _acceptIdentity(params) {
+    const identity = await this.identityManager.acceptIdentity(params);
+    await this._initialize();
+    return identity;
+  }
+  // Called when identity is created.
+  async _initialize() {
+    var _a;
+    (0, import_log10.log)("initializing spaces...", {}, {
+      file: "service-context.ts",
+      line: 139,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug3.failUndefined)();
+    const signingContext = {
+      credentialSigner: identity.getIdentityCredentialSigner(),
+      identityKey: identity.identityKey,
+      deviceKey: identity.deviceKey,
+      profile: identity.profileDocument,
+      recordCredential: async (credential) => {
+        await identity.controlPipeline.writer.write({
+          credential: {
+            credential
+          }
+        });
+      }
+    };
+    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.modelFactory, this.feedStore, this.snapshotStore);
+    await this.dataSpaceManager.open();
+    this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.dataSpaceManager, signingContext, this.keyring);
+    this.initialized.wake();
+    this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
+      process: async (credential) => {
+        const assertion = (0, import_credentials11.getCredentialAssertion)(credential);
+        if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
+          return;
+        }
+        if (assertion.spaceKey.equals(identity.space.key)) {
+          return;
+        }
+        if (!this.dataSpaceManager) {
+          (0, import_log10.log)("dataSpaceManager not initialized yet, ignoring space admission", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 182,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
+          (0, import_log10.log)("space already exists, ignoring space admission", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 186,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        try {
+          (0, import_log10.log)("accepting space recorded in halo", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 191,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          await this.dataSpaceManager.acceptSpace({
+            spaceKey: assertion.spaceKey,
+            genesisFeedKey: assertion.genesisFeedKey
+          });
+        } catch (err) {
+          import_log10.log.catch(err, {}, {
+            file: "service-context.ts",
+            line: 197,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+      }
+    });
+    await this._deviceSpaceSync.open();
+  }
+};
+
+// packages/sdk/client-services/src/packlets/services/service-definitions.ts
+var import_protocols6 = require("@dxos/protocols");
+var import_rpc = require("@dxos/rpc");
+var clientServiceBundle = (0, import_rpc.createServiceBundle)({
+  HaloInvitationsService: import_protocols6.schema.getService("dxos.client.services.HaloInvitationsService"),
+  DevicesService: import_protocols6.schema.getService("dxos.client.services.DevicesService"),
+  SpaceInvitationsService: import_protocols6.schema.getService("dxos.client.services.SpaceInvitationsService"),
+  SpacesService: import_protocols6.schema.getService("dxos.client.services.SpacesService"),
+  NetworkService: import_protocols6.schema.getService("dxos.client.services.NetworkService"),
+  // TODO(burdon): Deprecated.
+  SpaceService: import_protocols6.schema.getService("dxos.client.SpaceService"),
+  DataService: import_protocols6.schema.getService("dxos.echo.service.DataService"),
+  ProfileService: import_protocols6.schema.getService("dxos.client.ProfileService"),
+  SystemService: import_protocols6.schema.getService("dxos.client.SystemService"),
+  DevtoolsHost: import_protocols6.schema.getService("dxos.devtools.host.DevtoolsHost"),
+  TracingService: import_protocols6.schema.getService("dxos.devtools.host.TracingService")
+});
+
+// packages/sdk/client-services/src/packlets/services/service-host.ts
+var import_debug7 = require("@dxos/debug");
+var import_document_model = require("@dxos/document-model");
+var import_echo_db5 = require("@dxos/echo-db");
+var import_log16 = require("@dxos/log");
+var import_model_factory = require("@dxos/model-factory");
+var import_client2 = require("@dxos/protocols/proto/dxos/client");
+var import_text_model = require("@dxos/text-model");
+
+// packages/sdk/client-services/src/packlets/deprecated/space.ts
+var import_node_assert9 = __toESM(require("node:assert"));
+var import_codec_protobuf2 = require("@dxos/codec-protobuf");
+var import_debug4 = require("@dxos/debug");
+var import_log11 = require("@dxos/log");
+var import_client = require("@dxos/protocols/proto/dxos/client");
+var import_util5 = require("@dxos/util");
+var SpaceServiceImpl = class {
+  constructor(serviceContext) {
+    this.serviceContext = serviceContext;
+    this.inviteeInvitations = /* @__PURE__ */ new Map();
+  }
+  subscribeToSpace(request) {
+    return new import_codec_protobuf2.Stream(({ next }) => {
+      next({
+        space: {
+          publicKey: request.spaceKey,
+          isOpen: true,
+          isActive: true,
+          members: []
+        }
+      });
+    });
+  }
+  subscribeSpaces() {
+    return new import_codec_protobuf2.Stream(({ next, ctx }) => {
+      const onUpdate = () => {
+        const spaces = Array.from(this.serviceContext.dataSpaceManager.spaces.values()).filter((space) => this.serviceContext.dataServiceSubscriptions.getDataService(space.key)).map((space) => ({
+          publicKey: space.key,
+          isOpen: true,
+          isActive: true,
+          members: Array.from(space.inner.spaceState.members.values()).map((member) => {
+            var _a, _b, _c;
+            return {
+              identityKey: member.key,
+              profile: {
+                identityKey: member.key,
+                displayName: (_b = (_a = member.assertion.profile) == null ? void 0 : _a.displayName) != null ? _b : (0, import_util5.humanize)(member.key)
+              },
+              presence: ((_c = this.serviceContext.identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_client.SpaceMember.PresenceState.ONLINE : import_client.SpaceMember.PresenceState.OFFLINE
+            };
+          })
+        }));
+        (0, import_log11.log)("update", {
+          spaces
+        }, {
+          file: "space.ts",
+          line: 119,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        next({
+          spaces
+        });
+      };
+      setTimeout(async () => {
+        if (!this.serviceContext.dataSpaceManager) {
+          next({
+            spaces: []
+          });
+        }
+        await this.serviceContext.initialized.wait();
+        const subscribeSpaces = () => {
+          for (const space of this.serviceContext.dataSpaceManager.spaces.values()) {
+            if (!this.serviceContext.dataServiceSubscriptions.getDataService(space.key)) {
+              continue;
+            }
+            space.stateUpdate.on(ctx, onUpdate);
+            space.presence.updated.on(ctx, onUpdate);
+          }
+        };
+        this.serviceContext.dataSpaceManager.updated.on(ctx, () => {
+          subscribeSpaces();
+          onUpdate();
+        });
+        subscribeSpaces();
+        onUpdate();
+      });
+    });
+  }
+  async getSpaceDetails(request) {
+    return (0, import_debug4.todo)();
+  }
+  async createSpace() {
+    if (!this.serviceContext.identityManager.identity) {
+      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/halo");
+    }
+    await this.serviceContext.initialized.wait();
+    const space = await this.serviceContext.dataSpaceManager.createSpace();
+    return {
+      publicKey: space.key,
+      isOpen: true,
+      isActive: true
+    };
+  }
+  async cloneSpace(snapshot) {
+    return (0, import_debug4.todo)();
+  }
+  async setSpaceState(request) {
+    return (0, import_debug4.todo)();
+  }
+  async authenticateInvitation(request) {
+    var _a;
+    (0, import_node_assert9.default)(request.processId, "Process ID is missing.");
+    const invitation = this.inviteeInvitations.get(request.processId);
+    (0, import_node_assert9.default)(invitation, "Invitation not found.");
+    (0, import_node_assert9.default)(request.secret, "Secret not provided.");
+    invitation.secret = request.secret;
+    (_a = invitation.secretTrigger) == null ? void 0 : _a.call(invitation);
+  }
+  subscribeMembers(request) {
+    return (0, import_debug4.todo)();
+  }
+  async createSnapshot(request) {
+    return (0, import_debug4.todo)();
+  }
+};
+
+// packages/sdk/client-services/src/packlets/deprecated/profile.ts
+var import_node_assert10 = __toESM(require("node:assert"));
+var import_codec_protobuf3 = require("@dxos/codec-protobuf");
+var import_credentials12 = require("@dxos/credentials");
+var import_debug5 = require("@dxos/debug");
+var ProfileServiceImpl = class {
+  constructor(context) {
+    this.context = context;
+    this.inviteeInvitations = /* @__PURE__ */ new Map();
+  }
+  subscribeProfile() {
+    return new import_codec_protobuf3.Stream(({ next }) => {
+      const emitNext = () => {
+        var _a;
+        return next({
+          profile: this.context.identityManager.identity ? {
+            identityKey: this.context.identityManager.identity.identityKey,
+            deviceKey: this.context.identityManager.identity.deviceKey,
+            displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName,
+            haloSpace: this.context.identityManager.identity.space.key
+          } : void 0
+        });
+      };
+      emitNext();
+      return this.context.identityManager.stateUpdate.on(emitNext);
+    });
+  }
+  async createProfile(request) {
+    var _a;
+    await this.context.createIdentity({
+      displayName: request.displayName
+    });
+    return {
+      identityKey: this.context.identityManager.identity.identityKey,
+      deviceKey: this.context.identityManager.identity.deviceKey,
+      displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName,
+      haloSpace: this.context.identityManager.identity.space.key
+    };
+  }
+  async recoverProfile(request) {
+    return (0, import_debug5.todo)();
+    if (!request.seedPhrase) {
+      throw new Error("Recovery SeedPhrase not provided.");
+    }
+  }
+  async signPresentation({ presentation, nonce }) {
+    (0, import_node_assert10.default)(this.context.identityManager.identity, "Identity not initialized.");
+    return await (0, import_credentials12.signPresentation)({
+      presentation,
+      signer: this.context.keyring,
+      signerKey: this.context.identityManager.identity.deviceKey,
+      chain: this.context.identityManager.identity.deviceCredentialChain,
+      nonce
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/deprecated/system.ts
+var SystemServiceImpl = class {
+  constructor({ config, onInit, onStatus, onReset }) {
+    this._config = config;
+    this._onInit = onInit;
+    this._onStatus = onStatus;
+    this._onReset = onReset;
+  }
+  async getConfig() {
+    return this._config.values;
+  }
+  // TODO(burdon): Connect to iframe RPC heartbeat for network status?
+  async getStatus() {
+    return this._onStatus();
+  }
+  async initSession() {
+    await this._onInit();
+  }
+  async reset() {
+    await this._onReset();
+  }
+};
+
+// packages/sdk/client-services/src/packlets/deprecated/tracing.ts
+var TracingServiceImpl = class {
+  constructor(_config) {
+    this._config = _config;
+  }
+  async setTracingOptions() {
+    throw new Error("Tracing not available.");
+  }
+  subscribeToRpcTrace() {
+    throw new Error("Tracing not available.");
+  }
+};
+
+// packages/sdk/client-services/src/packlets/devtools/devtools.ts
+var import_async13 = require("@dxos/async");
+var import_codec_protobuf8 = require("@dxos/codec-protobuf");
+
+// packages/sdk/client-services/src/packlets/devtools/feeds.ts
+var import_async12 = require("@dxos/async");
+var import_codec_protobuf4 = require("@dxos/codec-protobuf");
+var import_feed_store4 = require("@dxos/feed-store");
+var import_keys7 = require("@dxos/keys");
+var import_util6 = require("@dxos/util");
+var subscribeToFeeds = ({ feedStore }, { feedKeys }) => {
+  return new import_codec_protobuf4.Stream(({ next }) => {
+    if ((feedKeys == null ? void 0 : feedKeys.length) === 0) {
+      return;
+    }
+    const subscriptions = new import_async12.EventSubscriptions();
+    const feedMap = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+    const update = () => {
+      const { feeds } = feedStore;
+      feeds.filter((feed) => !(feedKeys == null ? void 0 : feedKeys.length) || feedKeys.some((feedKey) => feedKey.equals(feed.key))).forEach((feed) => {
+        if (!feedMap.has(feed.key)) {
+          feedMap.set(feed.key, feed);
+          feed.on("close", update);
+          subscriptions.add(feed.off("close", update));
+        }
+      });
+      next({
+        feeds: Array.from(feedMap.values()).map((feed) => ({
+          feedKey: feed.key,
+          length: feed.properties.length
+        }))
+      });
+    };
+    subscriptions.add(feedStore.feedOpened.on(update));
+    update();
+    return () => {
+      subscriptions.clear();
+    };
+  });
+};
+var subscribeToFeedBlocks = ({ feedStore }, { feedKey, maxBlocks = 10 }) => {
+  return new import_codec_protobuf4.Stream(({ next }) => {
+    if (!feedKey) {
+      return;
+    }
+    const subscriptions = new import_async12.EventSubscriptions();
+    const timeout = setTimeout(async () => {
+      const feed = feedStore.getFeed(feedKey);
+      if (!feed) {
+        return;
+      }
+      const update = async () => {
+        const iterator = new import_feed_store4.FeedIterator(feed);
+        await iterator.open();
+        const blocks = [];
+        for await (const block of iterator) {
+          blocks.push(block);
+          if (blocks.length >= feed.properties.length) {
+            break;
+          }
+        }
+        next({
+          blocks: blocks.slice(-maxBlocks)
+        });
+        await iterator.close();
+      };
+      feed.on("append", update);
+      subscriptions.add(() => feed.off("append", update));
+      feed.on("truncate", update);
+      subscriptions.add(() => feed.off("truncate", update));
+      await update();
+    });
+    return () => {
+      subscriptions.clear();
+      clearTimeout(timeout);
+    };
+  });
+};
+
+// packages/sdk/client-services/src/packlets/devtools/keys.ts
+var import_codec_protobuf5 = require("@dxos/codec-protobuf");
+var subscribeToKeyringKeys = ({ keyring }) => new import_codec_protobuf5.Stream(({ next }) => {
+  const update = () => {
+    next({
+      keys: keyring.list()
+    });
+  };
+  const unsubscribe = keyring.keysUpdate.on(update);
+  update();
+  return unsubscribe;
+});
+
+// packages/sdk/client-services/src/packlets/devtools/network.ts
+var import_codec_protobuf6 = require("@dxos/codec-protobuf");
+var import_context7 = require("@dxos/context");
+var import_keys8 = require("@dxos/keys");
+var subscribeToNetworkStatus = ({ networkManager }) => new import_codec_protobuf6.Stream(({ next, close }) => {
+  const update = () => {
+    try {
+      const status = networkManager.signalManager.getStatus();
+      next({
+        servers: status
+      });
+    } catch (err) {
+      close(err);
+    }
+  };
+  networkManager.signalManager.statusChanged.on(update);
+  update();
+});
+var subscribeToSignal = ({ networkManager }) => new import_codec_protobuf6.Stream(({ next }) => {
+  const ctx = new import_context7.Context();
+  networkManager.signalManager.onMessage.on(ctx, (message) => {
+    next({
+      message: {
+        author: message.author.asUint8Array(),
+        recipient: message.recipient.asUint8Array(),
+        payload: message.payload
+      },
+      receivedAt: new Date()
+    });
+  });
+  networkManager.signalManager.swarmEvent.on(ctx, (swarmEvent) => {
+    next({
+      swarmEvent: swarmEvent.swarmEvent,
+      receivedAt: new Date()
+    });
+  });
+  return () => {
+    return ctx.dispose();
+  };
+});
+var subscribeToSwarmInfo = ({ networkManager }) => new import_codec_protobuf6.Stream(({ next }) => {
+  var _a;
+  const update = () => {
+    var _a2;
+    const info = (_a2 = networkManager.connectionLog) == null ? void 0 : _a2.swarms;
+    if (info) {
+      next({
+        data: info
+      });
+    }
+  };
+  (_a = networkManager.connectionLog) == null ? void 0 : _a.update.on(update);
+  update();
+});
+
+// packages/sdk/client-services/src/packlets/devtools/spaces.ts
+var import_codec_protobuf7 = require("@dxos/codec-protobuf");
+var subscribeToSpaces = (context, { spaceKeys = [] }) => {
+  return new import_codec_protobuf7.Stream(({ next }) => {
+    let unsubscribe;
+    const update = async () => {
+      const spaces = [
+        ...context.spaceManager.spaces.values()
+      ];
+      const filteredSpaces = spaces.filter((space) => !(spaceKeys == null ? void 0 : spaceKeys.length) || spaceKeys.some((spaceKey) => spaceKey.equals(space.key)));
+      next({
+        spaces: filteredSpaces.map((space) => {
+          const spaceMetadata = context.metadataStore.spaces.find((spaceMetadata2) => spaceMetadata2.key.equals(space.key));
+          return {
+            key: space.key,
+            isOpen: space.isOpen,
+            timeframe: spaceMetadata == null ? void 0 : spaceMetadata.dataTimeframe,
+            genesisFeed: space.genesisFeedKey,
+            controlFeed: space.controlFeedKey,
+            dataFeed: space.dataFeedKey
+          };
+        })
+      });
+    };
+    const timeout = setTimeout(async () => {
+      await context.initialized.wait();
+      unsubscribe = context.dataSpaceManager.updated.on(() => update());
+      await update();
+    });
+    return () => {
+      unsubscribe == null ? void 0 : unsubscribe();
+      clearTimeout(timeout);
+    };
+  });
+};
+
+// packages/sdk/client-services/src/packlets/devtools/devtools.ts
+var DevtoolsHostEvents = class {
+  constructor() {
+    this.ready = new import_async13.Event();
+  }
+};
+var DevtoolsServiceImpl = class {
+  constructor(params) {
+    this.params = params;
+  }
+  events(request) {
+    return new import_codec_protobuf8.Stream(({ next }) => {
+      this.params.events.ready.on(() => {
+        next({
+          ready: {}
+        });
+      });
+    });
+  }
+  getConfig(request) {
+    throw new Error();
+  }
+  resetStorage(request) {
+    throw new Error();
+  }
+  enableDebugLogging(request) {
+    throw new Error();
+  }
+  disableDebugLogging(request) {
+    throw new Error();
+  }
+  subscribeToKeyringKeys(request) {
+    return subscribeToKeyringKeys({
+      keyring: this.params.context.keyring
+    });
+  }
+  subscribeToCredentialMessages(request) {
+    throw new Error();
+  }
+  subscribeToSpaces(request) {
+    return subscribeToSpaces(this.params.context, request);
+  }
+  subscribeToItems(request) {
+    throw new Error();
+  }
+  subscribeToFeeds(request) {
+    return subscribeToFeeds({
+      feedStore: this.params.context.feedStore
+    }, request);
+  }
+  subscribeToFeedBlocks(request) {
+    return subscribeToFeedBlocks({
+      feedStore: this.params.context.feedStore
+    }, request);
+  }
+  getSpaceSnapshot(request) {
+    throw new Error();
+  }
+  saveSpaceSnapshot(request) {
+    throw new Error();
+  }
+  clearSnapshots(request) {
+    throw new Error();
+  }
+  getNetworkPeers(request) {
+    throw new Error();
+  }
+  subscribeToNetworkTopics(request) {
+    throw new Error();
+  }
+  subscribeToSignalStatus(request) {
+    return subscribeToNetworkStatus({
+      networkManager: this.params.context.networkManager
+    });
+  }
+  subscribeToSignal() {
+    return subscribeToSignal({
+      networkManager: this.params.context.networkManager
+    });
+  }
+  subscribeToSwarmInfo() {
+    return subscribeToSwarmInfo({
+      networkManager: this.params.context.networkManager
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/identity/devices-service-impl.ts
+var import_async14 = require("@dxos/async");
+var import_codec_protobuf9 = require("@dxos/codec-protobuf");
+var DevicesServiceImpl = class {
+  constructor(_identityManager) {
+    this._identityManager = _identityManager;
+  }
+  updateDevice() {
+    throw new Error("Method not implemented.");
+  }
+  queryDevices() {
+    return new import_codec_protobuf9.Stream(({ next }) => {
+      const update = () => {
+        var _a;
+        const deviceKeys = (_a = this._identityManager.identity) == null ? void 0 : _a.authorizedDeviceKeys;
+        if (!deviceKeys) {
+          next({
+            devices: []
+          });
+        } else {
+          next({
+            devices: Array.from(deviceKeys.values()).map((key) => ({
+              deviceKey: key
+            }))
+          });
+        }
+      };
+      const dispose = new import_async14.EventSubscriptions();
+      dispose.add(this._identityManager.stateUpdate.on(() => {
+        update();
+        if (this._identityManager.identity) {
+          dispose.add(this._identityManager.identity.stateUpdate.on(() => {
+            update();
+          }));
+        }
+      }));
+      update();
+      return () => dispose.clear();
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/network/network-service.ts
+var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var NetworkServiceImpl = class {
+  constructor(networkManager) {
+    this.networkManager = networkManager;
+  }
+  subscribeToNetworkStatus() {
+    return new import_codec_protobuf10.Stream(({ next }) => {
+      const unsubscribe = this.networkManager.connectionStateChanged.on((state) => next({
+        state
+      }));
+      next({
+        state: this.networkManager.connectionState
+      });
+      return unsubscribe;
+    });
+  }
+  async setNetworkOptions(request) {
+    await this.networkManager.setConnectionState(request.state);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
+var import_async15 = require("@dxos/async");
+var import_codec_protobuf11 = require("@dxos/codec-protobuf");
+var import_debug6 = require("@dxos/debug");
+var import_echo_db4 = require("@dxos/echo-db");
+var SpacesServiceImpl = class {
+  constructor(_spaceManager) {
+    this._spaceManager = _spaceManager;
+  }
+  async createSpace() {
+    throw new Error();
+  }
+  querySpaces() {
+    throw new Error();
+  }
+  queryMembers(query) {
+    throw new Error();
+  }
+  queryCredentials({ spaceKey }) {
+    return new import_codec_protobuf11.Stream(({ ctx, next }) => {
+      var _a;
+      const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_db4.SpaceNotFoundError(spaceKey));
+      const processor = space.spaceState.registerProcessor({
+        process: async (credential) => {
+          next(credential);
+        }
+      });
+      ctx.onDispose(() => processor.close());
+      (0, import_async15.scheduleTask)(ctx, () => processor.open());
+    });
+  }
+  async writeCredentials({ spaceKey, credentials }) {
+    var _a;
+    const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_db4.SpaceNotFoundError(spaceKey));
+    for (const credential of credentials != null ? credentials : []) {
+      await space.controlPipeline.writer.write({
+        credential: {
+          credential
+        }
+      });
+    }
+  }
+};
+
+// packages/sdk/client-services/src/packlets/storage/storage.ts
+var import_errors = require("@dxos/errors");
+var import_config = require("@dxos/protocols/proto/dxos/config");
+var import_random_access_storage = require("@dxos/random-access-storage");
+var StorageDriver = import_config.Runtime.Client.Storage.StorageDriver;
+var createStorageObjects = (config) => {
+  const { path = "dxos/storage", storageType, keyStorage, persistent = false } = config != null ? config : {};
+  if (persistent && storageType === StorageDriver.RAM) {
+    throw new import_errors.InvalidConfigError("RAM storage cannot be used in persistent mode.");
+  }
+  if (!persistent && storageType !== void 0 && storageType !== StorageDriver.RAM) {
+    throw new import_errors.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+  }
+  if (persistent && keyStorage === StorageDriver.RAM) {
+    throw new import_errors.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+  }
+  if (!persistent && keyStorage !== StorageDriver.RAM && keyStorage !== void 0) {
+    throw new import_errors.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+  }
+  return {
+    storage: (0, import_random_access_storage.createStorage)({
+      type: persistent ? toStorageType(storageType) : import_random_access_storage.StorageType.RAM,
+      root: `${path}/`
+    })
+  };
+};
+var toStorageType = (type) => {
+  switch (type) {
+    case void 0:
+      return void 0;
+    case StorageDriver.RAM:
+      return import_random_access_storage.StorageType.RAM;
+    case StorageDriver.CHROME:
+      return import_random_access_storage.StorageType.CHROME;
+    case StorageDriver.FIREFOX:
+      return import_random_access_storage.StorageType.FIREFOX;
+    case StorageDriver.IDB:
+      return import_random_access_storage.StorageType.IDB;
+    case StorageDriver.NODE:
+      return import_random_access_storage.StorageType.NODE;
+    default:
+      throw new Error(`Invalid storage type: ${StorageDriver[type]}`);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
+var import_async16 = require("@dxos/async");
+var import_log12 = require("@dxos/log");
+var import_messaging = require("@dxos/messaging");
+var import_network_manager3 = require("@dxos/network-manager");
+var import_rpc2 = require("@dxos/rpc");
+var __decorate3 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var LOCK_KEY = "DXOS_RESOURCE_LOCK";
+var IFrameHostRuntime = class {
+  constructor({ configProvider, appPort }) {
+    this._transportFactory = (0, import_network_manager3.createWebRTCTransportFactory)();
+    this._ready = new import_async16.Trigger();
+    this._configProvider = configProvider;
+    this._appPort = appPort;
+    this._getService = async (find) => {
+      const error = await this._ready.wait();
+      if (error) {
+        throw error;
+      }
+      const service = await find(this._clientServices.services);
+      if (!service) {
+        throw new Error("Service not found");
+      }
+      return service;
+    };
+  }
+  async start() {
+    (0, import_log12.log)("starting...", {}, {
+      file: "iframe-host-runtime.ts",
+      line: 63,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    try {
+      this._config = await this._configProvider();
+      const signalServer = this._config.get("runtime.services.signal.server");
+      this._clientServices = new ClientServicesHost({
+        lockKey: LOCK_KEY,
+        config: this._config,
+        networkManager: new import_network_manager3.NetworkManager({
+          log: true,
+          signalManager: signalServer ? new import_messaging.WebsocketSignalManager([
+            signalServer
+          ]) : new import_messaging.MemorySignalManager(new import_messaging.MemorySignalManagerContext()),
+          transportFactory: this._transportFactory
+        })
+      });
+      this._clientRpc = (0, import_rpc2.createProtoRpcPeer)({
+        exposed: clientServiceBundle,
+        handlers: {
+          DataService: async () => await this._getService((services) => services.DataService),
+          DevicesService: async () => await this._getService((services) => services.DevicesService),
+          DevtoolsHost: async () => await this._getService((services) => services.DevtoolsHost),
+          HaloInvitationsService: async () => await this._getService((services) => services.HaloInvitationsService),
+          NetworkService: async () => await this._getService((services) => services.NetworkService),
+          ProfileService: async () => await this._getService((services) => services.ProfileService),
+          SpaceInvitationsService: async () => await this._getService((services) => services.SpaceInvitationsService),
+          SpaceService: async () => await this._getService((services) => services.SpaceService),
+          SpacesService: async () => await this._getService((services) => services.SpacesService),
+          SystemService: async () => await this._getService((services) => services.SystemService),
+          TracingService: async () => await this._getService((services) => services.TracingService)
+        },
+        port: this._appPort
+      });
+      await Promise.all([
+        this._clientServices.open(),
+        this._clientRpc.open()
+      ]);
+      this._ready.wake(void 0);
+      (0, import_log12.log)("started", {}, {
+        file: "iframe-host-runtime.ts",
+        line: 99,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } catch (err) {
+      this._ready.wake(err);
+      import_log12.log.catch(err, {}, {
+        file: "iframe-host-runtime.ts",
+        line: 102,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
+  }
+  async stop() {
+    (0, import_log12.log)("stopping...", {}, {
+      file: "iframe-host-runtime.ts",
+      line: 107,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this._clientRpc.close();
+    await this._clientServices.close();
+    (0, import_log12.log)("stopped", {}, {
+      file: "iframe-host-runtime.ts",
+      line: 110,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+};
+__decorate3([
+  import_log12.logInfo
+], IFrameHostRuntime.prototype, "origin", void 0);
+
+// packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
+var import_network_manager4 = require("@dxos/network-manager");
+var import_rpc3 = require("@dxos/rpc");
+
+// packages/sdk/client-services/src/packlets/vault/services.ts
+var import_protocols7 = require("@dxos/protocols");
+var iframeServiceBundle = {
+  IframeService: import_protocols7.schema.getService("dxos.iframe.IframeService"),
+  BridgeService: import_protocols7.schema.getService("dxos.mesh.bridge.BridgeService")
+};
+var workerServiceBundle = {
+  WorkerService: import_protocols7.schema.getService("dxos.iframe.WorkerService")
+};
+
+// packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
+var import_async17 = require("@dxos/async");
+var import_log13 = require("@dxos/log");
+var Message;
+(function(Message2) {
+  Message2["ACQUIRING"] = "acquiring";
+})(Message || (Message = {}));
+var VaultResourceLock = class {
+  constructor({ lockKey, onAcquire, onRelease }) {
+    this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
+    this._releaseTrigger = new import_async17.Trigger();
+    this._lockKey = lockKey;
+    this._onAcquire = onAcquire;
+    this._onRelease = onRelease;
+    this._broadcastChannel.onmessage = this._onMessage.bind(this);
+  }
+  async acquire() {
+    this._broadcastChannel.postMessage({
+      message: Message.ACQUIRING
+    });
+    try {
+      await (0, import_async17.asyncTimeout)(this._requestLock(), 3e3);
+    } catch (e) {
+      await this._requestLock(true);
+    }
+  }
+  async release() {
+    this._releaseTrigger.wake();
+  }
+  _onMessage(event) {
+    if (event.data.message === Message.ACQUIRING) {
+      this._releaseTrigger.wake();
+    }
+  }
+  async _requestLock(steal = false) {
+    (0, import_log13.log)("requesting lock...", {
+      steal
+    }, {
+      file: "vault-resource-lock.ts",
+      line: 56,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const acquired = new import_async17.Trigger();
+    void navigator.locks.request(this._lockKey, {
+      steal
+    }, async () => {
+      var _a, _b;
+      await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
+      acquired.wake();
+      this._releaseTrigger = new import_async17.Trigger();
+      await this._releaseTrigger.wait();
+      (0, import_log13.log)("releasing lock...", {}, {
+        file: "vault-resource-lock.ts",
+        line: 65,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      await ((_b = this._onRelease) == null ? void 0 : _b.call(this));
+      (0, import_log13.log)("released lock", {}, {
+        file: "vault-resource-lock.ts",
+        line: 67,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }).catch(async () => {
+      var _a;
+      await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
+    });
+    await acquired.wait();
+    (0, import_log13.log)("recieved lock", {
+      steal
+    }, {
+      file: "vault-resource-lock.ts",
+      line: 74,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
+var import_async19 = require("@dxos/async");
+var import_log15 = require("@dxos/log");
+var import_messaging2 = require("@dxos/messaging");
+var import_network_manager5 = require("@dxos/network-manager");
+
+// packages/sdk/client-services/src/packlets/vault/worker-session.ts
+var import_node_assert11 = __toESM(require("node:assert"));
+var import_async18 = require("@dxos/async");
+var import_log14 = require("@dxos/log");
+var import_rpc4 = require("@dxos/rpc");
+var import_util7 = require("@dxos/util");
+var __decorate4 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var WorkerSession = class {
+  constructor({ getService, systemPort, appPort, options = {
+    heartbeatInterval: 1e3
+  } }) {
+    this._startTrigger = new import_async18.Trigger();
+    this.onClose = new import_util7.Callback();
+    (0, import_node_assert11.default)(options);
+    (0, import_node_assert11.default)(getService);
+    this._options = options;
+    this._getService = getService;
+    this._clientRpc = (0, import_rpc4.createProtoRpcPeer)({
+      exposed: clientServiceBundle,
+      handlers: {
+        DataService: async () => await this._getService((services) => services.DataService),
+        DevicesService: async () => await this._getService((services) => services.DevicesService),
+        DevtoolsHost: async () => await this._getService((services) => services.DevtoolsHost),
+        HaloInvitationsService: async () => await this._getService((services) => services.HaloInvitationsService),
+        NetworkService: async () => await this._getService((services) => services.NetworkService),
+        ProfileService: async () => await this._getService((services) => services.ProfileService),
+        SpaceInvitationsService: async () => await this._getService((services) => services.SpaceInvitationsService),
+        SpaceService: async () => await this._getService((services) => services.SpaceService),
+        SpacesService: async () => await this._getService((services) => services.SpacesService),
+        SystemService: async () => await this._getService((services) => services.SystemService),
+        TracingService: async () => await this._getService((services) => services.TracingService)
+      },
+      port: appPort
+    });
+    this._iframeRpc = (0, import_rpc4.createProtoRpcPeer)({
+      requested: iframeServiceBundle,
+      exposed: workerServiceBundle,
+      handlers: {
+        WorkerService: {
+          start: async (request) => {
+            this.origin = request.origin;
+            this._startTrigger.wake();
+          },
+          stop: async () => {
+            setTimeout(async () => {
+              try {
+                await this.close();
+              } catch (err) {
+                import_log14.log.catch(err, {}, {
+                  file: "worker-session.ts",
+                  line: 90,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+              }
+            });
+          }
+        }
+      },
+      port: systemPort,
+      timeout: 1e3
+      // With low timeout heartbeat may fail if the tab's thread is saturated.
+    });
+    this.bridgeService = this._iframeRpc.rpc.BridgeService;
+  }
+  async open() {
+    import_log14.log.info("opening..", {}, {
+      file: "worker-session.ts",
+      line: 104,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await Promise.all([
+      this._clientRpc.open(),
+      this._iframeRpc.open()
+    ]);
+    await this._startTrigger.wait({
+      timeout: 3e3
+    });
+    this._heartbeatTimer = setInterval(async () => {
+      try {
+        await this._iframeRpc.rpc.IframeService.heartbeat();
+      } catch (err1) {
+        import_log14.log.warn("Heartbeat failed", {
+          err: err1
+        }, {
+          file: "worker-session.ts",
+          line: 116,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        try {
+          await this.close();
+        } catch (err) {
+          import_log14.log.catch(err, {}, {
+            file: "worker-session.ts",
+            line: 120,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+      }
+    }, this._options.heartbeatInterval);
+  }
+  async close() {
+    import_log14.log.info("closing..", {}, {
+      file: "worker-session.ts",
+      line: 127,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    try {
+      await this.onClose.callIfSet();
+    } catch (err) {
+      import_log14.log.catch(err, {}, {
+        file: "worker-session.ts",
+        line: 131,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
+    if (this._heartbeatTimer !== void 0) {
+      clearInterval(this._heartbeatTimer);
+    }
+    await Promise.all([
+      this._clientRpc.close(),
+      this._iframeRpc.close()
+    ]);
+  }
+};
+__decorate4([
+  import_log14.logInfo
+], WorkerSession.prototype, "origin", void 0);
+
+// packages/sdk/client-services/src/packlets/services/service-registry.ts
+var ServiceRegistry = class {
+  // prettier-ignore
+  constructor(_serviceBundle, _handlers) {
+    this._serviceBundle = _serviceBundle;
+    this._handlers = _handlers;
+  }
+  get descriptors() {
+    return this._serviceBundle;
+  }
+  get services() {
+    return this._handlers;
+  }
+  setServices(services) {
+    this._handlers = services;
+  }
+};
+
+// packages/sdk/client-services/src/packlets/services/service-host.ts
+var createDefaultModelFactory = () => {
+  return new import_model_factory.ModelFactory().registerModel(import_document_model.DocumentModel).registerModel(import_text_model.TextModel);
+};
+var ClientServicesHost = class {
+  constructor({
+    config,
+    modelFactory = createDefaultModelFactory(),
+    // TODO(burdon): Create ApolloLink abstraction (see Client).
+    networkManager,
+    storage = createStorageObjects(config.get("runtime.client.storage", {})).storage,
+    lockKey
+  }) {
+    this._open = false;
+    this._config = config;
+    this._modelFactory = modelFactory;
+    this._networkManager = networkManager;
+    this._storage = storage;
+    this._resourceLock = lockKey ? new VaultResourceLock({
+      lockKey,
+      onAcquire: () => this.open(),
+      onRelease: () => this.close()
+    }) : void 0;
+    this._systemService = new SystemServiceImpl({
+      config: this._config,
+      onInit: async () => {
+        var _a;
+        await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
+      },
+      onStatus: async () => {
+        if (!this.isOpen) {
+          return {
+            status: import_client2.Status.INACTIVE
+          };
+        }
+        return {
+          status: import_client2.Status.ACTIVE
+        };
+      },
+      onReset: async () => {
+        var _a;
+        await ((_a = this._serviceContext) == null ? void 0 : _a.reset());
+      }
+    });
+    this._serviceRegistry = new ServiceRegistry(clientServiceBundle, {
+      SystemService: this._systemService
+    });
+  }
+  get isOpen() {
+    return this._open;
+  }
+  get descriptors() {
+    return this._serviceRegistry.descriptors;
+  }
+  get services() {
+    return this._serviceRegistry.services;
+  }
+  async open() {
+    var _a;
+    if (this._open) {
+      return;
+    }
+    (0, import_log16.log)("opening...", {}, {
+      file: "service-host.ts",
+      line: 125,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    this._serviceContext = new ServiceContext(this._storage, this._networkManager, this._modelFactory);
+    this._serviceRegistry.setServices({
+      // TODO(burdon): Move to new protobuf definitions.
+      SystemService: this._systemService,
+      HaloInvitationsService: new HaloInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.haloInvitations),
+      DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
+      SpaceInvitationsService: new SpaceInvitationsServiceImpl(this._serviceContext.identityManager, () => {
+        var _a2;
+        return (_a2 = this._serviceContext.spaceInvitations) != null ? _a2 : (0, import_debug7.raise)(new Error("SpaceInvitations not initialized"));
+      }, () => {
+        var _a2;
+        return (_a2 = this._serviceContext.dataSpaceManager) != null ? _a2 : (0, import_debug7.raise)(new Error("SpaceManager not initialized"));
+      }),
+      SpacesService: new SpacesServiceImpl(this._serviceContext.spaceManager),
+      DataService: new import_echo_db5.DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
+      NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager),
+      // TODO(burdon): Move to new protobuf definitions.
+      ProfileService: new ProfileServiceImpl(this._serviceContext),
+      // TODO(burdon): Port old SubscribeSpaces to QueryServices>
+      SpaceService: new SpaceServiceImpl(this._serviceContext),
+      TracingService: new TracingServiceImpl(this._config),
+      DevtoolsHost: new DevtoolsServiceImpl({
+        events: new DevtoolsHostEvents(),
+        config: this._config,
+        context: this._serviceContext
+      })
+    });
+    await this._serviceContext.open();
+    this._open = true;
+    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
+    (0, import_log16.log)("opened", {
+      deviceKey
+    }, {
+      file: "service-host.ts",
+      line: 172,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+  async close() {
+    var _a;
+    if (!this._open) {
+      return;
+    }
+    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
+    (0, import_log16.log)("closing...", {
+      deviceKey
+    }, {
+      file: "service-host.ts",
+      line: 181,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    this._serviceRegistry.setServices({
+      SystemService: this._systemService
+    });
+    await this._serviceContext.close();
+    this._open = false;
+    (0, import_log16.log)("closed", {
+      deviceKey
+    }, {
+      file: "service-host.ts",
+      line: 185,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/services/service-proxy.ts
+var import_async20 = require("@dxos/async");
+var import_errors2 = require("@dxos/errors");
+var import_rpc5 = require("@dxos/rpc");
+
+// packages/sdk/client-services/src/packlets/testing/test-builder.ts
+var createServiceHost = (config, signalManagerContext) => {
+  const networkManager = new import_network_manager6.NetworkManager({
+    signalManager: new import_messaging3.MemorySignalManager(signalManagerContext),
+    transportFactory: import_network_manager6.MemoryTransportFactory
+  });
+  return new ClientServicesHost({
+    config,
+    networkManager
+  });
+};
+var createServiceContext = ({ signalContext = new import_messaging3.MemorySignalManagerContext(), storage = (0, import_random_access_storage2.createStorage)({
+  type: import_random_access_storage2.StorageType.RAM
+}) } = {}) => {
+  const networkManager = new import_network_manager6.NetworkManager({
+    signalManager: new import_messaging3.MemorySignalManager(signalContext),
+    transportFactory: import_network_manager6.MemoryTransportFactory
+  });
+  const modelFactory = createDefaultModelFactory();
+  return new ServiceContext(storage, networkManager, modelFactory);
+};
+var createPeers = async (numPeers) => {
+  const signalContext = new import_messaging3.MemorySignalManagerContext();
+  return await Promise.all(Array.from(Array(numPeers)).map(async () => {
+    const peer = createServiceContext({
+      signalContext
+    });
+    await peer.open();
+    return peer;
+  }));
+};
+var createIdentity = async (peer) => {
+  await peer.createIdentity();
+  return peer;
+};
+var syncItems = async (db1, db2) => {
+  await (0, import_testing.testLocalDatabase)(db1, db2);
+  await (0, import_testing.testLocalDatabase)(db2, db1);
+};
+var TestBuilder = class {
+  constructor() {
+    this.signalContext = new import_messaging3.MemorySignalManagerContext();
+  }
+  createPeer() {
+    return new TestPeer(this.signalContext);
+  }
+};
+var TestPeer = class {
+  constructor(signalContext) {
+    this.signalContext = signalContext;
+    this._props = {};
+  }
+  get storage() {
+    var _a, _b;
+    return (_b = (_a = this._props).storage) != null ? _b : _a.storage = (0, import_random_access_storage2.createStorage)({
+      type: import_random_access_storage2.StorageType.RAM
+    });
+  }
+  get keyring() {
+    var _a, _b;
+    return (_b = (_a = this._props).keyring) != null ? _b : _a.keyring = new import_keyring2.Keyring(this.storage.createDirectory("keyring"));
+  }
+  get feedStore() {
+    var _a, _b;
+    return (_b = (_a = this._props).feedStore) != null ? _b : _a.feedStore = new import_feed_store5.FeedStore({
+      factory: new import_feed_store5.FeedFactory({
+        root: this.storage.createDirectory("feeds"),
+        signer: this.keyring,
+        hypercore: {
+          valueEncoding: import_echo_db6.valueEncoding
+        }
+      })
+    });
+  }
+  get metadataStore() {
+    var _a, _b;
+    return (_b = (_a = this._props).metadataStore) != null ? _b : _a.metadataStore = new import_echo_db6.MetadataStore(this.storage.createDirectory("metadata"));
+  }
+  get snapshotStore() {
+    var _a, _b;
+    return (_b = (_a = this._props).snapshotStore) != null ? _b : _a.snapshotStore = new import_echo_db6.SnapshotStore(this.storage.createDirectory("snapshots"));
+  }
+  get networkManager() {
+    var _a, _b;
+    return (_b = (_a = this._props).networkManager) != null ? _b : _a.networkManager = new import_network_manager6.NetworkManager({
+      signalManager: new import_messaging3.MemorySignalManager(this.signalContext),
+      transportFactory: import_network_manager6.MemoryTransportFactory
+    });
+  }
+  get spaceManager() {
+    var _a, _b;
+    return (_b = (_a = this._props).spaceManager) != null ? _b : _a.spaceManager = new import_echo_db6.SpaceManager({
+      feedStore: this.feedStore,
+      networkManager: this.networkManager
+    });
+  }
+};
+var createSigningContext = async (keyring) => {
+  const identityKey = await keyring.createKey();
+  const deviceKey = await keyring.createKey();
+  return {
+    identityKey,
+    deviceKey,
+    credentialSigner: (0, import_credentials13.createCredentialSignerWithChain)(keyring, {
+      credential: await new import_credentials13.CredentialGenerator(keyring, identityKey, deviceKey).createDeviceAuthorization(deviceKey)
+    }, deviceKey),
+    recordCredential: async () => {
+    }
+    // No-op.
+  };
+};
+
+// packages/sdk/client-services/src/packlets/testing/invitation-utils.ts
+var import_node_assert12 = __toESM(require("node:assert"));
+var import_async21 = require("@dxos/async");
+var import_debug8 = require("@dxos/debug");
+var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
+var performInvitation = async (host, guest, context) => {
+  const done1 = new import_async21.Trigger();
+  const done2 = new import_async21.Trigger();
+  const observable1 = await host.createInvitation(context, {
+    type: import_services12.Invitation.Type.INTERACTIVE_TESTING
+  });
+  observable1.subscribe({
+    onConnecting: async (invitation1) => {
+      const observable2 = await guest.acceptInvitation(invitation1, {
+        type: import_services12.Invitation.Type.INTERACTIVE_TESTING
+      });
+      observable2.subscribe({
+        onConnecting: async (invitation2) => {
+          (0, import_node_assert12.default)(invitation1.swarmKey.equals(invitation2.swarmKey));
+        },
+        onConnected: async (invitation2) => {
+        },
+        onSuccess: (invitation) => {
+          done2.wake(invitation);
+        },
+        onCancelled: () => (0, import_debug8.raise)(new Error()),
+        onTimeout: (err) => (0, import_debug8.raise)(err),
+        onError: (err) => (0, import_debug8.raise)(err)
+      });
+    },
+    onConnected: async (invitation1) => {
+    },
+    onCancelled: () => (0, import_debug8.raise)(new Error("cancelled")),
+    onSuccess: (invitation) => {
+      done1.wake(invitation);
+    },
+    onTimeout: (err) => (0, import_debug8.raise)(err),
+    onError: (err) => (0, import_debug8.raise)(err)
+  });
+  await done1.wait();
+  await done2.wait();
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  TestBuilder,
+  TestPeer,
+  createIdentity,
+  createMockCredential,
+  createPeers,
+  createServiceContext,
+  createServiceHost,
+  createSigningContext,
+  performInvitation,
+  syncItems
+});
+//# sourceMappingURL=index.cjs.map