@dxos/client-services 0.1.26 → 0.1.27-next.a0dff21

package/dist/lib/browser/{chunk-R2FEBB66.mjs → chunk-OTSGRZZI.mjs}

@@ -1,224 +1,13 @@
 import "@dxos/node-std/globals"
 
-// packages/sdk/client-services/src/packlets/deprecated/space.ts
-import assert from "@dxos/node-std/assert";
-import { Stream } from "@dxos/codec-protobuf";
-import { todo } from "@dxos/debug";
-import { log } from "@dxos/log";
-import { SpaceMember } from "@dxos/protocols/proto/dxos/client";
-import { humanize } from "@dxos/util";
-var SpaceServiceImpl = class {
-  constructor(serviceContext) {
-    this.serviceContext = serviceContext;
-    this.inviteeInvitations = /* @__PURE__ */ new Map();
-  }
-  subscribeToSpace(request) {
-    return new Stream(({ next }) => {
-      next({
-        space: {
-          publicKey: request.spaceKey,
-          isOpen: true,
-          isActive: true,
-          members: []
-        }
-      });
-    });
-  }
-  subscribeSpaces() {
-    return new Stream(({ next, ctx }) => {
-      const onUpdate = () => {
-        const spaces = Array.from(this.serviceContext.dataSpaceManager.spaces.values()).filter((space) => this.serviceContext.dataServiceSubscriptions.getDataService(space.key)).map((space) => ({
-          publicKey: space.key,
-          isOpen: true,
-          isActive: true,
-          members: Array.from(space.inner.spaceState.members.values()).map((member) => {
-            var _a, _b, _c;
-            return {
-              identityKey: member.key,
-              profile: {
-                identityKey: member.key,
-                displayName: (_b = (_a = member.assertion.profile) == null ? void 0 : _a.displayName) != null ? _b : humanize(member.key)
-              },
-              presence: ((_c = this.serviceContext.identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember.PresenceState.ONLINE : SpaceMember.PresenceState.OFFLINE
-            };
-          })
-        }));
-        log("update", {
-          spaces
-        }, {
-          file: "space.ts",
-          line: 119,
-          scope: this,
-          callSite: (f, a) => f(...a)
-        });
-        next({
-          spaces
-        });
-      };
-      setTimeout(async () => {
-        if (!this.serviceContext.dataSpaceManager) {
-          next({
-            spaces: []
-          });
-        }
-        await this.serviceContext.initialized.wait();
-        const subscribeSpaces = () => {
-          for (const space of this.serviceContext.dataSpaceManager.spaces.values()) {
-            if (!this.serviceContext.dataServiceSubscriptions.getDataService(space.key)) {
-              continue;
-            }
-            space.stateUpdate.on(ctx, onUpdate);
-            space.presence.updated.on(ctx, onUpdate);
-          }
-        };
-        this.serviceContext.dataSpaceManager.updated.on(ctx, () => {
-          subscribeSpaces();
-          onUpdate();
-        });
-        subscribeSpaces();
-        onUpdate();
-      });
-    });
-  }
-  async getSpaceDetails(request) {
-    return todo();
-  }
-  async createSpace() {
-    if (!this.serviceContext.identityManager.identity) {
-      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/halo");
-    }
-    await this.serviceContext.initialized.wait();
-    const space = await this.serviceContext.dataSpaceManager.createSpace();
-    return {
-      publicKey: space.key,
-      isOpen: true,
-      isActive: true
-    };
-  }
-  async cloneSpace(snapshot) {
-    return todo();
-  }
-  async setSpaceState(request) {
-    return todo();
-  }
-  async authenticateInvitation(request) {
-    var _a;
-    assert(request.processId, "Process ID is missing.");
-    const invitation = this.inviteeInvitations.get(request.processId);
-    assert(invitation, "Invitation not found.");
-    assert(request.secret, "Secret not provided.");
-    invitation.secret = request.secret;
-    (_a = invitation.secretTrigger) == null ? void 0 : _a.call(invitation);
-  }
-  subscribeMembers(request) {
-    return todo();
-  }
-  async createSnapshot(request) {
-    return todo();
-  }
-};
-
-// packages/sdk/client-services/src/packlets/deprecated/profile.ts
-import assert2 from "@dxos/node-std/assert";
-import { Stream as Stream2 } from "@dxos/codec-protobuf";
-import { signPresentation } from "@dxos/credentials";
-import { todo as todo2 } from "@dxos/debug";
-var ProfileServiceImpl = class {
-  constructor(context) {
-    this.context = context;
-    this.inviteeInvitations = /* @__PURE__ */ new Map();
-  }
-  subscribeProfile() {
-    return new Stream2(({ next }) => {
-      const emitNext = () => {
-        var _a;
-        return next({
-          profile: this.context.identityManager.identity ? {
-            identityKey: this.context.identityManager.identity.identityKey,
-            deviceKey: this.context.identityManager.identity.deviceKey,
-            displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName,
-            haloSpace: this.context.identityManager.identity.space.key
-          } : void 0
-        });
-      };
-      emitNext();
-      return this.context.identityManager.stateUpdate.on(emitNext);
-    });
-  }
-  async createProfile(request) {
-    var _a;
-    await this.context.createIdentity({
-      displayName: request.displayName
-    });
-    return {
-      identityKey: this.context.identityManager.identity.identityKey,
-      deviceKey: this.context.identityManager.identity.deviceKey,
-      displayName: (_a = this.context.identityManager.identity.profileDocument) == null ? void 0 : _a.displayName,
-      haloSpace: this.context.identityManager.identity.space.key
-    };
-  }
-  async recoverProfile(request) {
-    return todo2();
-    if (!request.seedPhrase) {
-      throw new Error("Recovery SeedPhrase not provided.");
-    }
-  }
-  async signPresentation({ presentation, nonce }) {
-    assert2(this.context.identityManager.identity, "Identity not initialized.");
-    return await signPresentation({
-      presentation,
-      signer: this.context.keyring,
-      signerKey: this.context.identityManager.identity.deviceKey,
-      chain: this.context.identityManager.identity.deviceCredentialChain,
-      nonce
-    });
-  }
-};
-
-// packages/sdk/client-services/src/packlets/deprecated/system.ts
-var SystemServiceImpl = class {
-  constructor({ config, onInit, onStatus, onReset }) {
-    this._config = config;
-    this._onInit = onInit;
-    this._onStatus = onStatus;
-    this._onReset = onReset;
-  }
-  async getConfig() {
-    return this._config.values;
-  }
-  // TODO(burdon): Connect to iframe RPC heartbeat for network status?
-  async getStatus() {
-    return this._onStatus();
-  }
-  async initSession() {
-    await this._onInit();
-  }
-  async reset() {
-    await this._onReset();
-  }
-};
-
-// packages/sdk/client-services/src/packlets/deprecated/tracing.ts
-var TracingServiceImpl = class {
-  constructor(_config) {
-    this._config = _config;
-  }
-  async setTracingOptions() {
-    throw new Error("Tracing not available.");
-  }
-  subscribeToRpcTrace() {
-    throw new Error("Tracing not available.");
-  }
-};
-
 // packages/sdk/client-services/src/packlets/devtools/feeds.ts
 import { EventSubscriptions } from "@dxos/async";
-import { Stream as Stream3 } from "@dxos/codec-protobuf";
+import { Stream } from "@dxos/codec-protobuf";
 import { FeedIterator } from "@dxos/feed-store";
 import { PublicKey } from "@dxos/keys";
 import { ComplexMap } from "@dxos/util";
 var subscribeToFeeds = ({ feedStore }, { feedKeys }) => {
-  return new Stream3(({ next }) => {
+  return new Stream(({ next }) => {
     if ((feedKeys == null ? void 0 : feedKeys.length) === 0) {
       return;
     }
@@ -248,7 +37,7 @@ var subscribeToFeeds = ({ feedStore }, { feedKeys }) => {
   });
 };
 var subscribeToFeedBlocks = ({ feedStore }, { feedKey, maxBlocks = 10 }) => {
-  return new Stream3(({ next }) => {
+  return new Stream(({ next }) => {
     if (!feedKey) {
       return;
     }
@@ -287,10 +76,10 @@ var subscribeToFeedBlocks = ({ feedStore }, { feedKey, maxBlocks = 10 }) => {
 };
 
 // packages/sdk/client-services/src/packlets/devtools/network.ts
-import { Stream as Stream4 } from "@dxos/codec-protobuf";
+import { Stream as Stream2 } from "@dxos/codec-protobuf";
 import { Context } from "@dxos/context";
 import { PublicKey as PublicKey2 } from "@dxos/keys";
-var subscribeToNetworkStatus = ({ networkManager }) => new Stream4(({ next, close }) => {
+var subscribeToNetworkStatus = ({ networkManager }) => new Stream2(({ next, close }) => {
   const update = () => {
     try {
       const status = networkManager.signalManager.getStatus();
@@ -304,7 +93,7 @@ var subscribeToNetworkStatus = ({ networkManager }) => new Stream4(({ next, clos
   networkManager.signalManager.statusChanged.on(update);
   update();
 });
-var subscribeToSignal = ({ networkManager }) => new Stream4(({ next }) => {
+var subscribeToSignal = ({ networkManager }) => new Stream2(({ next }) => {
   const ctx = new Context();
   networkManager.signalManager.onMessage.on(ctx, (message) => {
     next({
@@ -326,7 +115,7 @@ var subscribeToSignal = ({ networkManager }) => new Stream4(({ next }) => {
     return ctx.dispose();
   };
 });
-var subscribeToNetworkTopics = ({ networkManager }) => new Stream4(({ next, close }) => {
+var subscribeToNetworkTopics = ({ networkManager }) => new Stream2(({ next, close }) => {
   const update = () => {
     try {
       const topics = networkManager.topics;
@@ -347,7 +136,7 @@ var subscribeToNetworkTopics = ({ networkManager }) => new Stream4(({ next, clos
   networkManager.topicsUpdated.on(update);
   update();
 });
-var subscribeToSwarmInfo = ({ networkManager }) => new Stream4(({ next }) => {
+var subscribeToSwarmInfo = ({ networkManager }) => new Stream2(({ next }) => {
   var _a;
   const update = () => {
     var _a2;
@@ -375,9 +164,9 @@ var getNetworkPeers = ({ networkManager }, request) => {
 };
 
 // packages/sdk/client-services/src/packlets/devtools/spaces.ts
-import { Stream as Stream5 } from "@dxos/codec-protobuf";
+import { Stream as Stream3 } from "@dxos/codec-protobuf";
 var subscribeToSpaces = (context, { spaceKeys = [] }) => {
-  return new Stream5(({ next }) => {
+  return new Stream3(({ next }) => {
     let unsubscribe;
     const update = async () => {
       const spaces = [
@@ -412,11 +201,11 @@ var subscribeToSpaces = (context, { spaceKeys = [] }) => {
 
 // packages/sdk/client-services/src/packlets/devtools/devtools.ts
 import { Event as AsyncEvent } from "@dxos/async";
-import { Stream as Stream7 } from "@dxos/codec-protobuf";
+import { Stream as Stream5 } from "@dxos/codec-protobuf";
 
 // packages/sdk/client-services/src/packlets/devtools/keys.ts
-import { Stream as Stream6 } from "@dxos/codec-protobuf";
-var subscribeToKeyringKeys = ({ keyring }) => new Stream6(({ next }) => {
+import { Stream as Stream4 } from "@dxos/codec-protobuf";
+var subscribeToKeyringKeys = ({ keyring }) => new Stream4(({ next }) => {
   const update = () => {
     next({
       keys: keyring.list()
@@ -438,7 +227,7 @@ var DevtoolsServiceImpl = class {
     this.params = params;
   }
   events(request) {
-    return new Stream7(({ next }) => {
+    return new Stream5(({ next }) => {
       this.params.events.ready.on(() => {
         next({
           ready: {}
@@ -518,7 +307,7 @@ var DevtoolsServiceImpl = class {
 import { Trigger } from "@dxos/async";
 import { Context as Context2 } from "@dxos/context";
 import { verifyCredential } from "@dxos/credentials";
-import { log as log2 } from "@dxos/log";
+import { log } from "@dxos/log";
 import { schema } from "@dxos/protocols";
 var createAuthProvider = (signer) => async (nonce) => {
   const credential = await signer.createCredential({
@@ -542,7 +331,7 @@ var TrustedKeySetAuthVerifier = class {
   get verifier() {
     return async (nonce, auth) => {
       const credential = schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
-      log2("authenticating...", {
+      log("authenticating...", {
         credential
       }, {
         file: "authenticator.ts",
@@ -552,7 +341,7 @@ var TrustedKeySetAuthVerifier = class {
       });
       const result = await verifyCredential(credential);
       if (result.kind === "fail") {
-        log2("Invalid credential", {
+        log("Invalid credential", {
           result
         }, {
           file: "authenticator.ts",
@@ -563,7 +352,7 @@ var TrustedKeySetAuthVerifier = class {
         return false;
       }
       if (!credential.proof.nonce || !Buffer.from(nonce).equals(credential.proof.nonce)) {
-        log2("Invalid nonce", {
+        log("Invalid nonce", {
           nonce,
           credential
         }, {
@@ -575,7 +364,7 @@ var TrustedKeySetAuthVerifier = class {
         return false;
       }
       if (this._isTrustedKey(credential.issuer)) {
-        log2("key is not currently in trusted set, waiting...", {
+        log("key is not currently in trusted set, waiting...", {
           key: credential.issuer
         }, {
           file: "authenticator.ts",
@@ -591,7 +380,7 @@ var TrustedKeySetAuthVerifier = class {
       });
       const clear = this._params.update.on(this._ctx, () => {
         if (this._isTrustedKey(credential.issuer)) {
-          log2("auth success", {
+          log("auth success", {
             key: credential.issuer
           }, {
             file: "authenticator.ts",
@@ -601,7 +390,7 @@ var TrustedKeySetAuthVerifier = class {
           });
           trigger.wake(true);
         } else {
-          log2("key is not currently in trusted set, waiting...", {
+          log("key is not currently in trusted set, waiting...", {
             key: credential.issuer
           }, {
             file: "authenticator.ts",
@@ -629,12 +418,12 @@ var TrustedKeySetAuthVerifier = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity.ts
-import assert3 from "@dxos/node-std/assert";
+import assert from "@dxos/node-std/assert";
 import { Event } from "@dxos/async";
 import { DeviceStateMachine, createCredentialSignerWithKey, createCredentialSignerWithChain, ProfileStateMachine } from "@dxos/credentials";
 import { failUndefined } from "@dxos/debug";
 import { writeMessages } from "@dxos/feed-store";
-import { log as log3 } from "@dxos/log";
+import { log as log2 } from "@dxos/log";
 import { AdmittedFeed } from "@dxos/protocols/proto/dxos/halo/credentials";
 var AUTH_TIMEOUT = 3e4;
 var Identity = class {
@@ -711,7 +500,7 @@ var Identity = class {
   * Requires identity to be ready.
   */
   getIdentityCredentialSigner() {
-    assert3(this._deviceStateMachine.processor.deviceCredentialChain, "Device credential chain is not ready.");
+    assert(this._deviceStateMachine.processor.deviceCredentialChain, "Device credential chain is not ready.");
     return createCredentialSignerWithChain(this._signer, this._deviceStateMachine.processor.deviceCredentialChain, this.deviceKey);
   }
   /**
@@ -721,7 +510,7 @@ var Identity = class {
     return createCredentialSignerWithKey(this._signer, this.deviceKey);
   }
   async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }) {
-    log3("Admitting device:", {
+    log2("Admitting device:", {
       identityKey: this.identityKey,
       hostDevice: this.deviceKey,
       deviceKey,
@@ -772,10 +561,10 @@ var Identity = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity-manager.ts
-import assert4 from "@dxos/node-std/assert";
+import assert2 from "@dxos/node-std/assert";
 import { Event as Event2 } from "@dxos/async";
 import { createCredentialSignerWithKey as createCredentialSignerWithKey2, CredentialGenerator } from "@dxos/credentials";
-import { log as log4 } from "@dxos/log";
+import { log as log3 } from "@dxos/log";
 import { AdmittedFeed as AdmittedFeed2 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { deferFunction } from "@dxos/util";
 var IdentityManager = class {
@@ -794,7 +583,7 @@ var IdentityManager = class {
   async open() {
     await this._metadataStore.load();
     const identityRecord = this._metadataStore.getIdentityRecord();
-    log4("identity record", {
+    log3("identity record", {
       identityRecord
     }, {
       file: "identity-manager.ts",
@@ -814,8 +603,8 @@ var IdentityManager = class {
     await ((_a = this._identity) == null ? void 0 : _a.close());
   }
   async createIdentity({ displayName } = {}) {
-    assert4(!this._identity, "Identity already exists.");
-    log4("creating identity...", {}, {
+    assert2(!this._identity, "Identity already exists.");
+    log3("creating identity...", {}, {
       file: "identity-manager.ts",
       line: 78,
       scope: this,
@@ -860,7 +649,7 @@ var IdentityManager = class {
     this._identity = identity;
     await this._identity.ready();
     this.stateUpdate.emit();
-    log4("created identity", {
+    log3("created identity", {
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey
     }, {
@@ -875,7 +664,7 @@ var IdentityManager = class {
   * Accept an existing identity. Expects it's device key to be authorized (now or later).
   */
   async acceptIdentity(params) {
-    log4("accepting identity", {
+    log3("accepting identity", {
       params
     }, {
       file: "identity-manager.ts",
@@ -883,7 +672,7 @@ var IdentityManager = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    assert4(!this._identity, "Identity already exists.");
+    assert2(!this._identity, "Identity already exists.");
     const identityRecord = {
       identityKey: params.identityKey,
       deviceKey: params.deviceKey,
@@ -900,7 +689,7 @@ var IdentityManager = class {
     await this._metadataStore.setIdentityRecord(identityRecord);
     await this._identity.ready();
     this.stateUpdate.emit();
-    log4("accepted identity", {
+    log3("accepted identity", {
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey
     }, {
@@ -912,8 +701,8 @@ var IdentityManager = class {
     return identity;
   }
   async _constructIdentity(identityRecord) {
-    assert4(!this._identity);
-    log4("constructing identity", {
+    assert2(!this._identity);
+    log3("constructing identity", {
       identityRecord
     }, {
       file: "identity-manager.ts",
@@ -944,7 +733,7 @@ var IdentityManager = class {
       identityKey: identityRecord.identityKey,
       deviceKey: identityRecord.deviceKey
     });
-    log4("done", {
+    log3("done", {
       identityKey: identityRecord.identityKey
     }, {
       file: "identity-manager.ts",
@@ -967,6 +756,54 @@ var IdentityManager = class {
   }
 };
 
+// packages/sdk/client-services/src/packlets/identity/identity-service.ts
+import assert3 from "@dxos/node-std/assert";
+import { Stream as Stream6 } from "@dxos/codec-protobuf";
+import { signPresentation } from "@dxos/credentials";
+import { todo } from "@dxos/debug";
+var IdentityServiceImpl = class {
+  // TODO(wittjosiah): Remove dependency on service context.
+  constructor(_serviceContext) {
+    this._serviceContext = _serviceContext;
+  }
+  async createIdentity(request) {
+    await this._serviceContext.createIdentity(request);
+    return this._getIdentity();
+  }
+  async recoverIdentity(request) {
+    return todo();
+  }
+  queryIdentity() {
+    return new Stream6(({ next }) => {
+      const emitNext = () => next({
+        identity: this._getIdentity()
+      });
+      emitNext();
+      return this._serviceContext.identityManager.stateUpdate.on(emitNext);
+    });
+  }
+  _getIdentity() {
+    if (!this._serviceContext.identityManager.identity) {
+      return void 0;
+    }
+    return {
+      identityKey: this._serviceContext.identityManager.identity.identityKey,
+      spaceKey: this._serviceContext.identityManager.identity.space.key,
+      profile: this._serviceContext.identityManager.identity.profileDocument
+    };
+  }
+  async signPresentation({ presentation, nonce }) {
+    assert3(this._serviceContext.identityManager.identity, "Identity not initialized.");
+    return await signPresentation({
+      presentation,
+      signer: this._serviceContext.keyring,
+      signerKey: this._serviceContext.identityManager.identity.deviceKey,
+      chain: this._serviceContext.identityManager.identity.deviceCredentialChain,
+      nonce
+    });
+  }
+};
+
 // packages/sdk/client-services/src/packlets/invitations/encoder.ts
 import base from "base-x";
 import { schema as schema2 } from "@dxos/protocols";
@@ -982,7 +819,7 @@ var InvitationEncoder = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations.ts
-import assert5 from "@dxos/node-std/assert";
+import assert4 from "@dxos/node-std/assert";
 import { CancellableObservableProvider } from "@dxos/async";
 import { Invitation } from "@dxos/protocols/proto/dxos/client/services";
 var AUTHENTICATION_CODE_LENGTH = 6;
@@ -1010,7 +847,7 @@ var wrapObservable = async (observable) => {
   return new Promise((resolve, reject) => {
     const unsubscribe = observable.subscribe({
       onSuccess: (invitation) => {
-        assert5(invitation.state === Invitation.State.SUCCESS);
+        assert4(invitation.state === Invitation.State.SUCCESS);
         unsubscribe();
         resolve(invitation);
       },
@@ -1030,19 +867,19 @@ var AbstractInvitationsHandler = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/halo-invitations-handler.ts
-import assert6 from "@dxos/node-std/assert";
+// packages/sdk/client-services/src/packlets/invitations/device-invitations-handler.ts
+import assert5 from "@dxos/node-std/assert";
 import { scheduleTask, sleep, Trigger as Trigger2 } from "@dxos/async";
 import { Context as Context3 } from "@dxos/context";
 import { generatePasscode } from "@dxos/credentials";
 import { PublicKey as PublicKey3 } from "@dxos/keys";
-import { log as log5 } from "@dxos/log";
+import { log as log4 } from "@dxos/log";
 import { createTeleportProtocolFactory, StarTopology } from "@dxos/network-manager";
 import { schema as schema3 } from "@dxos/protocols";
 import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
 import { AuthenticationResponse } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { RpcExtension } from "@dxos/teleport";
-var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
+var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
   // prettier-ignore
   constructor(_params) {
     super(_params.networkManager);
@@ -1053,7 +890,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
   */
   createInvitation(context, options) {
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    assert6(type !== Invitation2.Type.OFFLINE);
+    assert5(type !== Invitation2.Type.OFFLINE);
     const identity = this._params.getIdentity();
     const invitation = {
       type,
@@ -1075,10 +912,10 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
     const createExtension = () => new HostHaloInvitationExtension({
       requestAdmission: async () => {
         var _a, _b;
-        log5("responding with admission offer", {
+        log4("responding with admission offer", {
           host: identity.deviceKey
         }, {
-          file: "halo-invitations-handler.ts",
+          file: "device-invitations-handler.ts",
           line: 91,
           scope: this,
           callSite: (f, a) => f(...a)
@@ -1091,10 +928,10 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
         };
       },
       authenticate: async ({ authenticationCode: code }) => {
-        log5("received authentication request", {
+        log4("received authentication request", {
           authenticationCode: code
         }, {
-          file: "halo-invitations-handler.ts",
+          file: "device-invitations-handler.ts",
           line: 105,
           scope: this,
           callSite: (f, a) => f(...a)
@@ -1112,11 +949,11 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               throw new Error(`invalid authentication code: ${authenticationCode}`);
             }
           }
-          log5("writing guest credentials", {
+          log4("writing guest credentials", {
             host: identity.deviceKey,
             guest: credentials.deviceKey
           }, {
-            file: "halo-invitations-handler.ts",
+            file: "device-invitations-handler.ts",
             line: 120,
             scope: this,
             callSite: (f, a) => f(...a)
@@ -1132,10 +969,10 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
         scheduleTask(ctx, async () => {
           var _a, _b;
           try {
-            log5("connected", {
+            log4("connected", {
               host: identity.deviceKey
             }, {
-              file: "halo-invitations-handler.ts",
+              file: "device-invitations-handler.ts",
               line: 136,
               scope: this,
               callSite: (f, a) => f(...a)
@@ -1144,11 +981,11 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
             const deviceKey = await complete.wait({
               timeout
             });
-            log5("admitted guest", {
+            log4("admitted guest", {
               host: identity.deviceKey,
               guest: deviceKey
             }, {
-              file: "halo-invitations-handler.ts",
+              file: "device-invitations-handler.ts",
               line: 139,
               scope: this,
               callSite: (f, a) => f(...a)
@@ -1156,8 +993,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
             observable.callback.onSuccess(invitation);
           } catch (err) {
             if (!observable.cancelled) {
-              log5.error("failed", err, {
-                file: "halo-invitations-handler.ts",
+              log4.error("failed", err, {
+                file: "device-invitations-handler.ts",
                 line: 143,
                 scope: this,
                 callSite: (f, a) => f(...a)
@@ -1221,23 +1058,23 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
               }
-              log5("connected", {}, {
-                file: "halo-invitations-handler.ts",
+              log4("connected", {}, {
+                file: "device-invitations-handler.ts",
                 line: 214,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
-              log5("sending admission request", {}, {
-                file: "halo-invitations-handler.ts",
+              log4("sending admission request", {}, {
+                file: "device-invitations-handler.ts",
                 line: 218,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               const { identityKey, haloSpaceKey, genesisFeedKey } = await extension.rpc.HaloHostService.requestAdmission();
               if (invitation.type === void 0 || invitation.type === Invitation2.Type.INTERACTIVE) {
-                log5("guest waiting for authentication code...", {}, {
-                  file: "halo-invitations-handler.ts",
+                log4("guest waiting for authentication code...", {}, {
+                  file: "device-invitations-handler.ts",
                   line: 225,
                   scope: this,
                   callSite: (f, a) => f(...a)
@@ -1246,8 +1083,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 const authenticationCode = await authenticated.wait({
                   timeout
                 });
-                log5("sending authentication request", {}, {
-                  file: "halo-invitations-handler.ts",
+                log4("sending authentication request", {}, {
+                  file: "device-invitations-handler.ts",
                   line: 228,
                   scope: this,
                   callSite: (f, a) => f(...a)
@@ -1259,13 +1096,13 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               const deviceKey = await this._params.keyring.createKey();
               const controlFeedKey = await this._params.keyring.createKey();
               const dataFeedKey = await this._params.keyring.createKey();
-              log5("presenting admission credentials", {
+              log4("presenting admission credentials", {
                 identityKey,
                 deviceKey,
                 controlFeedKey,
                 dataFeedKey
               }, {
-                file: "halo-invitations-handler.ts",
+                file: "device-invitations-handler.ts",
                 line: 237,
                 scope: this,
                 callSite: (f, a) => f(...a)
@@ -1283,11 +1120,11 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
                 controlFeedKey,
                 dataFeedKey
               });
-              log5("admitted by host", {
+              log4("admitted by host", {
                 guest: identity.deviceKey,
                 identityKey
               }, {
-                file: "halo-invitations-handler.ts",
+                file: "device-invitations-handler.ts",
                 line: 256,
                 scope: this,
                 callSite: (f, a) => f(...a)
@@ -1295,8 +1132,8 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
               complete.wake(identityKey);
             } catch (err) {
               if (!observable.cancelled) {
-                log5.warn("auth failed", err, {
-                  file: "halo-invitations-handler.ts",
+                log4.warn("auth failed", err, {
+                  file: "device-invitations-handler.ts",
                   line: 260,
                   scope: this,
                   callSite: (f, a) => f(...a)
@@ -1313,7 +1150,7 @@ var HaloInvitationsHandler = class extends AbstractInvitationsHandler {
     };
     scheduleTask(ctx, async () => {
       var _a, _b;
-      assert6(invitation.swarmKey);
+      assert5(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1383,9 +1220,9 @@ var GuestHaloInvitationExtension = class extends RpcExtension {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts
-import assert7 from "@dxos/node-std/assert";
+import assert6 from "@dxos/node-std/assert";
 import { observableError } from "@dxos/async";
-import { log as log6 } from "@dxos/log";
+import { log as log5 } from "@dxos/log";
 import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
 var AbstractInvitationsProxy = class {
   // prettier-ignore
@@ -1411,7 +1248,7 @@ var AbstractInvitationsProxy = class {
       observable.setInvitation(invitation2);
       switch (invitation2.state) {
         case Invitation3.State.CONNECTING: {
-          assert7(invitation2.invitationId);
+          assert6(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation2);
           break;
@@ -1433,7 +1270,7 @@ var AbstractInvitationsProxy = class {
           break;
         }
         default: {
-          log6.error(`Invalid state: ${invitation2.state}`, {}, {
+          log5.error(`Invalid state: ${invitation2.state}`, {}, {
             file: "invitations-proxy.ts",
             line: 81,
             scope: this,
@@ -1449,12 +1286,12 @@ var AbstractInvitationsProxy = class {
     return observable;
   }
   acceptInvitation(invitation, options) {
-    assert7(invitation && invitation.swarmKey);
+    assert6(invitation && invitation.swarmKey);
     const observable = new AuthenticatingInvitationProvider({
       onCancel: async () => {
         var _a;
         const invitationId = (_a = observable.invitation) == null ? void 0 : _a.invitationId;
-        assert7(invitationId);
+        assert6(invitationId);
         await this._invitationsService.cancelInvitation({
           invitationId
         });
@@ -1462,7 +1299,7 @@ var AbstractInvitationsProxy = class {
       onAuthenticate: async (authenticationCode) => {
         var _a;
         const invitationId = (_a = observable.invitation) == null ? void 0 : _a.invitationId;
-        assert7(invitationId);
+        assert6(invitationId);
         await this._invitationsService.authenticate({
           invitationId,
           authenticationCode
@@ -1475,7 +1312,7 @@ var AbstractInvitationsProxy = class {
     });
     stream.subscribe((invitation2) => {
       var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
-      assert7(invitation2.invitationId);
+      assert6(invitation2.invitationId);
       observable.setInvitation(invitation2);
       switch (invitation2.state) {
         case Invitation3.State.CONNECTING: {
@@ -1499,7 +1336,7 @@ var AbstractInvitationsProxy = class {
           break;
         }
         default: {
-          log6.error(`Invalid state: ${invitation2.state}`, {}, {
+          log5.error(`Invalid state: ${invitation2.state}`, {}, {
             file: "invitations-proxy.ts",
             line: 146,
             scope: this,
@@ -1516,17 +1353,17 @@ var AbstractInvitationsProxy = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/halo-invitations-proxy.ts
-var HaloInvitationsProxy = class extends AbstractInvitationsProxy {
+// packages/sdk/client-services/src/packlets/invitations/device-invitations-proxy.ts
+var DeviceInvitationsProxy = class extends AbstractInvitationsProxy {
   getInvitationOptions() {
     return {};
   }
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
-import assert8 from "@dxos/node-std/assert";
-import { Stream as Stream8 } from "@dxos/codec-protobuf";
-import { log as log7 } from "@dxos/log";
+import assert7 from "@dxos/node-std/assert";
+import { Stream as Stream7 } from "@dxos/codec-protobuf";
+import { log as log6 } from "@dxos/log";
 import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
 var AbstractInvitationsService = class {
   // prettier-ignore
@@ -1544,47 +1381,48 @@ var AbstractInvitationsService = class {
     };
   }
   createInvitation(invitation) {
-    return new Stream8(({ next, close }) => {
+    return new Stream7(({ next, close }) => {
       const invitationsHandler = this._getInvitationsHandler();
       const context = this.getContext(invitation);
-      log7("stream opened", this.getLoggingContext(), {
+      log6("stream opened", this.getLoggingContext(), {
         file: "invitations-service.ts",
         line: 43,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       let invitationId;
-      const { type, swarmKey } = invitation;
+      const { type, swarmKey, authMethod } = invitation;
       const observable = invitationsHandler.createInvitation(context, {
         type,
-        swarmKey
+        swarmKey,
+        authMethod
       });
       observable.subscribe({
         onConnecting: (invitation2) => {
-          assert8(invitation2.invitationId);
+          assert7(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           this._createInvitations.set(invitation2.invitationId, observable);
           invitation2.state = Invitation4.State.CONNECTING;
           next(invitation2);
         },
         onConnected: (invitation2) => {
-          assert8(invitation2.invitationId);
+          assert7(invitation2.invitationId);
           invitation2.state = Invitation4.State.CONNECTED;
           next(invitation2);
         },
         onAuthenticating: (invitation2) => {
-          assert8(invitation2.invitationId);
+          assert7(invitation2.invitationId);
           invitation2.state = Invitation4.State.AUTHENTICATING;
           next(invitation2);
         },
         onSuccess: (invitation2) => {
-          assert8(invitation2.invitationId);
+          assert7(invitation2.invitationId);
           invitation2.state = Invitation4.State.SUCCESS;
           next(invitation2);
           close();
         },
         onCancelled: () => {
-          assert8(invitationId);
+          assert7(invitationId);
           invitation.invitationId = invitationId;
           invitation.state = Invitation4.State.CANCELLED;
           next(invitation);
@@ -1602,7 +1440,7 @@ var AbstractInvitationsService = class {
       return (err) => {
         const context2 = this.getLoggingContext();
         if (err) {
-          log7.warn("stream closed", {
+          log6.warn("stream closed", {
             ...context2,
             err
           }, {
@@ -1612,7 +1450,7 @@ var AbstractInvitationsService = class {
             callSite: (f, a) => f(...a)
           });
         } else {
-          log7("stream closed", context2, {
+          log6("stream closed", context2, {
             file: "invitations-service.ts",
             line: 94,
             scope: this,
@@ -1624,8 +1462,8 @@ var AbstractInvitationsService = class {
     });
   }
   acceptInvitation(invitation, options) {
-    return new Stream8(({ next, close }) => {
-      log7("stream opened", this.getLoggingContext(), {
+    return new Stream7(({ next, close }) => {
+      log6("stream opened", this.getLoggingContext(), {
         file: "invitations-service.ts",
         line: 104,
         scope: this,
@@ -1636,19 +1474,19 @@ var AbstractInvitationsService = class {
       const observable = invitationsHandler.acceptInvitation(invitation, options);
       observable.subscribe({
         onConnecting: (invitation2) => {
-          assert8(invitation2.invitationId);
+          assert7(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           this._acceptInvitations.set(invitation2.invitationId, observable);
           invitation2.state = Invitation4.State.CONNECTING;
           next(invitation2);
         },
         onConnected: (invitation2) => {
-          assert8(invitation2.invitationId);
+          assert7(invitation2.invitationId);
           invitation2.state = Invitation4.State.CONNECTED;
           next(invitation2);
         },
         onAuthenticating: (invitation2) => {
-          assert8(invitation2.invitationId);
+          assert7(invitation2.invitationId);
           invitation2.state = Invitation4.State.AUTHENTICATING;
           next(invitation2);
         },
@@ -1658,7 +1496,7 @@ var AbstractInvitationsService = class {
           close();
         },
         onCancelled: () => {
-          assert8(invitationId);
+          assert7(invitationId);
           invitation.invitationId = invitationId;
           invitation.state = Invitation4.State.CANCELLED;
           next(invitation);
@@ -1676,7 +1514,7 @@ var AbstractInvitationsService = class {
       return (err) => {
         const context = this.getLoggingContext();
         if (err) {
-          log7.warn("stream closed", {
+          log6.warn("stream closed", {
             ...context,
             err
           }, {
@@ -1686,7 +1524,7 @@ var AbstractInvitationsService = class {
             callSite: (f, a) => f(...a)
           });
         } else {
-          log7("stream closed", context, {
+          log6("stream closed", context, {
             file: "invitations-service.ts",
             line: 154,
             scope: this,
@@ -1698,16 +1536,16 @@ var AbstractInvitationsService = class {
     });
   }
   async authenticate({ invitationId, authenticationCode }) {
-    log7("authenticating...", {}, {
+    log6("authenticating...", {}, {
       file: "invitations-service.ts",
       line: 163,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    assert8(invitationId);
+    assert7(invitationId);
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
-      log7.warn("invalid invitation", {
+      log6.warn("invalid invitation", {
         invitationId
       }, {
         file: "invitations-service.ts",
@@ -1721,16 +1559,16 @@ var AbstractInvitationsService = class {
   }
   async cancelInvitation(invitation) {
     var _a;
-    log7("cancelling...", {}, {
+    log6("cancelling...", {}, {
       file: "invitations-service.ts",
       line: 174,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    assert8(invitation.invitationId);
+    assert7(invitation.invitationId);
     const observable = (_a = this._createInvitations.get(invitation.invitationId)) != null ? _a : this._acceptInvitations.get(invitation.invitationId);
     if (!observable) {
-      log7.warn("invalid invitation", {
+      log6.warn("invalid invitation", {
         invitationId: invitation.invitationId
       }, {
         file: "invitations-service.ts",
@@ -1744,8 +1582,8 @@ var AbstractInvitationsService = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/halo-invitations-service.ts
-var HaloInvitationsServiceImpl = class extends AbstractInvitationsService {
+// packages/sdk/client-services/src/packlets/invitations/device-invitations-service.ts
+var DeviceInvitationsServiceImpl = class extends AbstractInvitationsService {
   // prettier-ignore
   constructor(identityManager, invitationsHandler) {
     super(identityManager, () => invitationsHandler);
@@ -1756,17 +1594,17 @@ var HaloInvitationsServiceImpl = class extends AbstractInvitationsService {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts
-import assert9 from "@dxos/node-std/assert";
+import assert8 from "@dxos/node-std/assert";
 import { scheduleTask as scheduleTask2, sleep as sleep2, Trigger as Trigger3 } from "@dxos/async";
 import { Context as Context4 } from "@dxos/context";
 import { createAdmissionCredentials, generatePasscode as generatePasscode2, getCredentialAssertion } from "@dxos/credentials";
 import { writeMessages as writeMessages2 } from "@dxos/feed-store";
 import { PublicKey as PublicKey4 } from "@dxos/keys";
-import { log as log8 } from "@dxos/log";
+import { log as log7 } from "@dxos/log";
 import { createTeleportProtocolFactory as createTeleportProtocolFactory2, StarTopology as StarTopology2 } from "@dxos/network-manager";
 import { schema as schema4 } from "@dxos/protocols";
 import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
-import { AuthenticationResponse as AuthenticationResponse2 } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { AuthenticationResponse as AuthenticationResponse2, AuthMethod } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
 var MAX_OTP_ATTEMPTS = 3;
 var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
@@ -1780,16 +1618,19 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   * Creates an invitation and listens for a join request from the invited (guest) peer.
   */
   createInvitation(space, options) {
+    var _a;
     let swarmConnection;
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    assert9(type !== Invitation5.Type.OFFLINE);
-    assert9(space);
+    assert8(type !== Invitation5.Type.OFFLINE);
+    assert8(space);
     const invitation = {
       type,
       invitationId: PublicKey4.random().toHex(),
       swarmKey: swarmKey != null ? swarmKey : PublicKey4.random(),
       spaceKey: space.key,
+      authMethod: (_a = options == null ? void 0 : options.authMethod) != null ? _a : AuthMethod.SHARED_SECRET,
       authenticationCode: generatePasscode2(AUTHENTICATION_CODE_LENGTH)
+      // TODO(dmaretskyi): Don't generate if authMethod === NONE .
     };
     const ctx = new Context4({
       onError: (err) => {
@@ -1800,44 +1641,76 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     const observable = new InvitationObservableProvider(async () => {
       await (swarmConnection == null ? void 0 : swarmConnection.close());
     });
-    let authenticationCode;
+    let authenticationPassed = false;
     let authenticationRetry = 0;
     const createExtension = () => {
       const complete = new Trigger3();
       let guestProfile;
       const hostInvitationExtension = new HostSpaceInvitationExtension({
         introduce: async ({ profile }) => {
-          var _a, _b;
-          log8("guest introduced itself", {
+          var _a2, _b;
+          log7("guest introduced itself", {
             guestProfile: profile,
             host: this._signingContext.deviceKey,
             spaceKey: space.key
           }, {
             file: "space-invitations-handler.ts",
-            line: 98,
+            line: 101,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           guestProfile = profile;
-          (_b = (_a = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a, invitation);
+          (_b = (_a2 = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a2, invitation);
+          return {
+            spaceKey: type === Invitation5.Type.INTERACTIVE_TESTING || type === Invitation5.Type.MULTIUSE_TESTING ? space.key : void 0,
+            authMethod: invitation.authMethod
+          };
         },
         authenticate: async ({ authenticationCode: code }) => {
-          log8("received authentication request", {
+          log7("received authentication request", {
             authenticationCode: code
           }, {
             file: "space-invitations-handler.ts",
-            line: 112,
+            line: 123,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           let status = AuthenticationResponse2.Status.OK;
-          if (invitation.authenticationCode) {
-            if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
-              status = AuthenticationResponse2.Status.INVALID_OPT_ATTEMPTS;
-            } else if (code !== invitation.authenticationCode) {
-              status = AuthenticationResponse2.Status.INVALID_OTP;
-            } else {
-              authenticationCode = code;
+          switch (invitation.authMethod) {
+            case AuthMethod.NONE: {
+              log7("authentication not required", {}, {
+                file: "space-invitations-handler.ts",
+                line: 128,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              return {
+                status: AuthenticationResponse2.Status.OK
+              };
+            }
+            case AuthMethod.SHARED_SECRET: {
+              if (invitation.authenticationCode) {
+                if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
+                  status = AuthenticationResponse2.Status.INVALID_OPT_ATTEMPTS;
+                } else if (code !== invitation.authenticationCode) {
+                  status = AuthenticationResponse2.Status.INVALID_OTP;
+                } else {
+                  authenticationPassed = true;
+                }
+              }
+              break;
+            }
+            default: {
+              log7.error("invalid authentication method", {
+                authMethod: invitation.authMethod
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 144,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              status = AuthenticationResponse2.Status.INTERNAL_ERROR;
+              break;
             }
           }
           return {
@@ -1846,24 +1719,22 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
         },
         requestAdmission: async ({ identityKey, deviceKey, controlFeedKey, dataFeedKey }) => {
           try {
-            if (invitation.type !== Invitation5.Type.INTERACTIVE_TESTING && invitation.type !== Invitation5.Type.MULTIUSE_TESTING) {
-              if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
-                throw new Error(`invalid authentication code: ${authenticationCode}`);
-              }
+            if (isAuthenticationRequired(invitation) && !authenticationPassed) {
+              throw new Error("Not authenticated");
             }
-            log8("writing guest credentials", {
+            log7("writing guest credentials", {
               host: this._signingContext.deviceKey,
               guest: deviceKey
             }, {
               file: "space-invitations-handler.ts",
-              line: 139,
+              line: 160,
               scope: this,
               callSite: (f, a) => f(...a)
             });
             const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
-            assert9(credentials[0].credential);
+            assert8(credentials[0].credential);
             const spaceMemberCredential = credentials[0].credential.credential;
-            assert9(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+            assert8(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
             await writeMessages2(space.inner.controlPipeline.writer, credentials);
             complete.wake(deviceKey);
             return {
@@ -1876,35 +1747,35 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
         },
         onOpen: () => {
           scheduleTask2(ctx, async () => {
-            var _a, _b;
+            var _a2, _b;
             try {
-              log8("connected", {
+              log7("connected", {
                 host: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 170,
+                line: 191,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
+              (_b = (_a2 = observable.callback).onConnected) == null ? void 0 : _b.call(_a2, invitation);
               const deviceKey = await complete.wait({
                 timeout
               });
-              log8("admitted guest", {
+              log7("admitted guest", {
                 host: this._signingContext.deviceKey,
                 guest: deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 173,
+                line: 194,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               observable.callback.onSuccess(invitation);
             } catch (err) {
               if (!observable.cancelled) {
-                log8.error("failed", err, {
+                log7.error("failed", err, {
                   file: "space-invitations-handler.ts",
-                  line: 177,
+                  line: 198,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1922,7 +1793,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       return hostInvitationExtension;
     };
     scheduleTask2(ctx, async () => {
-      var _a, _b;
+      var _a2, _b;
       const topic = invitation.swarmKey;
       const swarmConnection2 = await this._networkManager.joinSwarm({
         topic,
@@ -1933,7 +1804,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
         topology: new StarTopology2(topic)
       });
       ctx.onDispose(() => swarmConnection2.close());
-      (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation);
+      (_b = (_a2 = observable.callback).onConnecting) == null ? void 0 : _b.call(_a2, invitation);
     });
     return observable;
   }
@@ -1965,46 +1836,60 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       const extension = new GuestSpaceInvitationExtension({
         onOpen: () => {
           scheduleTask2(ctx, async () => {
-            var _a, _b, _c, _d;
+            var _a, _b, _c, _d, _e, _f;
             try {
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
               }
-              log8("connected", {
+              log7("connected", {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 250,
+                line: 271,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
-              log8("introduce", {
+              log7("introduce", {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 254,
+                line: 275,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              await extension.rpc.SpaceHostService.introduce({
+              const introductionResponse = await extension.rpc.SpaceHostService.introduce({
                 profile: this._signingContext.profile
               });
-              if (invitation.type === void 0 || invitation.type === Invitation5.Type.INTERACTIVE) {
+              log7("introduce response", {
+                guest: this._signingContext.deviceKey,
+                response: introductionResponse
+              }, {
+                file: "space-invitations-handler.ts",
+                line: 279,
+                scope: this,
+                callSite: (f, a) => f(...a)
+              });
+              invitation.authMethod = introductionResponse.authMethod;
+              if (introductionResponse.spaceKey) {
+                invitation.spaceKey = introductionResponse.spaceKey;
+              }
+              if (isAuthenticationRequired(invitation)) {
+                (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  log8("guest waiting for authentication code...", {}, {
+                  log7("guest waiting for authentication code...", {}, {
                     file: "space-invitations-handler.ts",
-                    line: 263,
+                    line: 293,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
-                  (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
+                  (_f = (_e = observable.callback).onAuthenticating) == null ? void 0 : _f.call(_e, invitation);
                   const authenticationCode = await authenticated.wait({
                     timeout
                   });
-                  log8("sending authentication request", {}, {
+                  log7("sending authentication request", {}, {
                     file: "space-invitations-handler.ts",
-                    line: 267,
+                    line: 297,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -2018,11 +1903,11 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                     if (attempt === MAX_OTP_ATTEMPTS) {
                       throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
                     } else {
-                      log8("retrying invalid code", {
+                      log7("retrying invalid code", {
                         attempt
                       }, {
                         file: "space-invitations-handler.ts",
-                        line: 277,
+                        line: 307,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -2033,11 +1918,11 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               }
               const controlFeedKey = await this._keyring.createKey();
               const dataFeedKey = await this._keyring.createKey();
-              log8("request admission", {
+              log7("request admission", {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 288,
+                line: 318,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -2048,28 +1933,28 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 dataFeedKey
               });
               const assertion = getCredentialAssertion(credential);
-              assert9(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
-              assert9(credential.subject.id.equals(this._signingContext.identityKey));
+              assert8(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
+              assert8(credential.subject.id.equals(this._signingContext.identityKey));
               const space = await this._spaceManager.acceptSpace({
                 spaceKey: assertion.spaceKey,
                 genesisFeedKey: assertion.genesisFeedKey
               });
               await this._signingContext.recordCredential(credential);
-              log8("admitted by host", {
+              log7("admitted by host", {
                 guest: this._signingContext.deviceKey,
                 spaceKey: space.key
               }, {
                 file: "space-invitations-handler.ts",
-                line: 310,
+                line: 340,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               complete.wake();
             } catch (err) {
               if (!observable.cancelled) {
-                log8.warn("auth failed", err, {
+                log7.warn("auth failed", err, {
                   file: "space-invitations-handler.ts",
-                  line: 314,
+                  line: 344,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -2085,7 +1970,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     };
     scheduleTask2(ctx, async () => {
       var _a, _b;
-      assert9(invitation.swarmKey);
+      assert8(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -2104,6 +1989,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     return observable;
   }
 };
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== AuthMethod.NONE && invitation.type !== Invitation5.Type.INTERACTIVE_TESTING && invitation.type !== Invitation5.Type.MULTIUSE_TESTING;
 var HostSpaceInvitationExtension = class extends RpcExtension2 {
   constructor(_callbacks) {
     super({
@@ -2163,7 +2049,7 @@ var SpaceInvitationsProxy = class extends AbstractInvitationsProxy {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-service.ts
-import assert10 from "@dxos/node-std/assert";
+import assert9 from "@dxos/node-std/assert";
 var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
   // prettier-ignore
   constructor(identityManager, invitationsHandler, _getSpaceManager) {
@@ -2172,10 +2058,10 @@ var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
     this._getSpaceManager = _getSpaceManager;
   }
   getContext(invitation) {
-    assert10(invitation.spaceKey);
+    assert9(invitation.spaceKey);
     const spaceManager = this._getSpaceManager();
     const space = spaceManager.spaces.get(invitation.spaceKey);
-    assert10(space);
+    assert9(space);
     return space;
   }
 };
@@ -2184,19 +2070,19 @@ var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
 import { Trigger as Trigger5 } from "@dxos/async";
 import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
 import { failUndefined as failUndefined2 } from "@dxos/debug";
-import { valueEncoding, DataServiceSubscriptions, MetadataStore, SpaceManager, SnapshotStore } from "@dxos/echo-db";
+import { valueEncoding, MetadataStore, SpaceManager, DataServiceSubscriptions, SnapshotStore } from "@dxos/echo-pipeline";
 import { FeedFactory, FeedStore } from "@dxos/feed-store";
 import { Keyring } from "@dxos/keyring";
-import { log as log11 } from "@dxos/log";
+import { log as log10 } from "@dxos/log";
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
-import assert12 from "@dxos/node-std/assert";
+import assert11 from "@dxos/node-std/assert";
 import { Event as Event4, synchronized, trackLeaks as trackLeaks2 } from "@dxos/async";
 import { Context as Context7 } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
-import { spaceGenesis, SnapshotManager } from "@dxos/echo-db";
+import { spaceGenesis, SnapshotManager } from "@dxos/echo-pipeline";
 import { PublicKey as PublicKey7 } from "@dxos/keys";
-import { log as log10 } from "@dxos/log";
+import { log as log9 } from "@dxos/log";
 import { Presence } from "@dxos/teleport-extension-presence";
 import { ComplexMap as ComplexMap3, deferFunction as deferFunction2 } from "@dxos/util";
 
@@ -2204,17 +2090,17 @@ import { ComplexMap as ComplexMap3, deferFunction as deferFunction2 } from "@dxo
 import { trackLeaks } from "@dxos/async";
 import { Context as Context6 } from "@dxos/context";
 import { timed } from "@dxos/debug";
-import { DataPipelineControllerImpl, createMappedFeedWriter } from "@dxos/echo-db";
+import { DataPipelineControllerImpl, createMappedFeedWriter } from "@dxos/echo-pipeline";
 import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { AdmittedFeed as AdmittedFeed3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { ComplexSet as ComplexSet2 } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
-import assert11 from "@dxos/node-std/assert";
+import assert10 from "@dxos/node-std/assert";
 import { DeferredTask, Event as Event3, scheduleTask as scheduleTask3, TimeoutError, Trigger as Trigger4 } from "@dxos/async";
 import { Context as Context5 } from "@dxos/context";
 import { PublicKey as PublicKey5 } from "@dxos/keys";
-import { log as log9 } from "@dxos/log";
+import { log as log8 } from "@dxos/log";
 import { schema as schema5 } from "@dxos/protocols";
 import { RpcExtension as RpcExtension3 } from "@dxos/teleport";
 import { ComplexMap as ComplexMap2, ComplexSet, entry } from "@dxos/util";
@@ -2237,7 +2123,7 @@ var NotarizationPlugin = class {
   * Request credentials to be notarized.
   */
   async notarize(credentials) {
-    log9("notarize", {
+    log8("notarize", {
       credentials
     }, {
       file: "notarization-plugin.ts",
@@ -2245,11 +2131,11 @@ var NotarizationPlugin = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    assert11(credentials.every((credential) => credential.id), "Credentials must have an id");
+    assert10(credentials.every((credential) => credential.id), "Credentials must have an id");
     const errors = new Trigger4();
     const ctx = this._ctx.derive({
       onError: (err) => {
-        log9.warn("Notarization error", {
+        log8.warn("Notarization error", {
           err
         }, {
           file: "notarization-plugin.ts",
@@ -2262,7 +2148,7 @@ var NotarizationPlugin = class {
       }
     });
     scheduleTask3(ctx, () => {
-      log9.warn("Notarization timeout", {}, {
+      log8.warn("Notarization timeout", {}, {
         file: "notarization-plugin.ts",
         line: 61,
         scope: this,
@@ -2276,7 +2162,7 @@ var NotarizationPlugin = class {
     const notarizeTask = new DeferredTask(ctx, async () => {
       try {
         if (this._extensions.size === 0) {
-          log9.warn("No peers to notarize with", {}, {
+          log8.warn("No peers to notarize with", {}, {
             file: "notarization-plugin.ts",
             line: 76,
             scope: this,
@@ -2288,7 +2174,7 @@ var NotarizationPlugin = class {
           ...this._extensions
         ].find((peer2) => !peersTried.has(peer2));
         if (!peer) {
-          log9.warn("Exhausted all peers to notarize with", {
+          log8.warn("Exhausted all peers to notarize with", {
             retryIn: RETRY_TIMEOUT
           }, {
             file: "notarization-plugin.ts",
@@ -2301,7 +2187,7 @@ var NotarizationPlugin = class {
           return;
         }
         peersTried.add(peer);
-        log9("try notarizing", {
+        log8("try notarizing", {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
@@ -2313,14 +2199,14 @@ var NotarizationPlugin = class {
         await peer.rpc.NotarizationService.notarize({
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
-        log9("success", {}, {
+        log8("success", {}, {
           file: "notarization-plugin.ts",
           line: 94,
           scope: this,
           callSite: (f, a) => f(...a)
         });
       } catch (err) {
-        log9.warn("error notarizing (recoverable)", err, {
+        log8.warn("error notarizing (recoverable)", err, {
           file: "notarization-plugin.ts",
           line: 96,
           scope: this,
@@ -2336,7 +2222,7 @@ var NotarizationPlugin = class {
         allNotarized,
         errors.wait()
       ]);
-      log9("done", {}, {
+      log8("done", {}, {
         file: "notarization-plugin.ts",
         line: 107,
         scope: this,
@@ -2359,7 +2245,7 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    assert11(!this._writer, "Writer already set.");
+    assert10(!this._writer, "Writer already set.");
     this._writer = writer;
   }
   async _waitUntilProcessed(id) {
@@ -2377,7 +2263,7 @@ var NotarizationPlugin = class {
       throw new Error("Writer not set");
     }
     for (const credential of (_a = request.credentials) != null ? _a : []) {
-      assert11(credential.id, "Credential must have an id");
+      assert10(credential.id, "Credential must have an id");
       if (this._processedCredentials.has(credential.id)) {
         continue;
       }
@@ -2387,7 +2273,7 @@ var NotarizationPlugin = class {
   createExtension() {
     const extension = new NotarizationTeleportExtension({
       onOpen: async () => {
-        log9("extension opened", {
+        log8("extension opened", {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
@@ -2399,7 +2285,7 @@ var NotarizationPlugin = class {
         this._extensionOpened.emit();
       },
       onClose: async () => {
-        log9("extension closed", {
+        log8("extension closed", {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
@@ -2609,7 +2495,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   async open() {
     await this._metadataStore.load();
-    log10("metadata loaded", {
+    log9("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
       file: "data-space-manager.ts",
@@ -2618,7 +2504,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       callSite: (f, a) => f(...a)
     });
     for (const spaceMetadata of this._metadataStore.spaces) {
-      log10("load space", {
+      log9("load space", {
         spaceMetadata
       }, {
         file: "data-space-manager.ts",
@@ -2629,7 +2515,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       const space = await this._constructSpace(spaceMetadata);
       await space.initializeDataPipeline();
       if (spaceMetadata.dataTimeframe) {
-        log10("waiting for latest timeframe", {
+        log9("waiting for latest timeframe", {
           spaceMetadata
         }, {
           file: "data-space-manager.ts",
@@ -2664,7 +2550,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       controlFeedKey,
       dataFeedKey
     };
-    log10("creating space...", {
+    log9("creating space...", {
       spaceKey
     }, {
       file: "data-space-manager.ts",
@@ -2676,7 +2562,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    assert12(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    assert11(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
     await this._signingContext.recordCredential(memberCredential);
     await space.initializeDataPipeline();
     this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
@@ -2685,7 +2571,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
-    assert12(!this._spaces.has(opts.spaceKey), "Space already exists.");
+    assert11(!this._spaces.has(opts.spaceKey), "Space already exists.");
     const metadata = {
       key: opts.spaceKey,
       genesisFeedKey: opts.genesisFeedKey
@@ -2787,7 +2673,7 @@ var ServiceContext = class {
       networkManager: this.networkManager
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
-    this.haloInvitations = new HaloInvitationsHandler({
+    this.deviceInvitations = new DeviceInvitationsHandler({
       networkManager: this.networkManager,
       getIdentity: () => {
         var _a;
@@ -2798,7 +2684,7 @@ var ServiceContext = class {
     });
   }
   async open() {
-    log11("opening...", {}, {
+    log10("opening...", {}, {
       file: "service-context.ts",
       line: 94,
       scope: this,
@@ -2810,7 +2696,7 @@ var ServiceContext = class {
     if (this.identityManager.identity) {
       await this._initialize();
     }
-    log11("opened", {}, {
+    log10("opened", {}, {
       file: "service-context.ts",
       line: 101,
       scope: this,
@@ -2819,7 +2705,7 @@ var ServiceContext = class {
   }
   async close() {
     var _a, _b;
-    log11("closing...", {}, {
+    log10("closing...", {}, {
       file: "service-context.ts",
       line: 105,
       scope: this,
@@ -2832,7 +2718,7 @@ var ServiceContext = class {
     await this.feedStore.close();
     await this.networkManager.close();
     this.dataServiceSubscriptions.clear();
-    log11("closed", {}, {
+    log10("closed", {}, {
       file: "service-context.ts",
       line: 113,
       scope: this,
@@ -2840,7 +2726,7 @@ var ServiceContext = class {
     });
   }
   async reset() {
-    log11("resetting...", {}, {
+    log10("resetting...", {}, {
       file: "service-context.ts",
       line: 117,
       scope: this,
@@ -2848,7 +2734,7 @@ var ServiceContext = class {
     });
     await this.close();
     await this.storage.reset();
-    log11("reset", {}, {
+    log10("reset", {}, {
       file: "service-context.ts",
       line: 120,
       scope: this,
@@ -2868,7 +2754,7 @@ var ServiceContext = class {
   // Called when identity is created.
   async _initialize() {
     var _a;
-    log11("initializing spaces...", {}, {
+    log10("initializing spaces...", {}, {
       file: "service-context.ts",
       line: 139,
       scope: this,
@@ -2902,7 +2788,7 @@ var ServiceContext = class {
           return;
         }
         if (!this.dataSpaceManager) {
-          log11("dataSpaceManager not initialized yet, ignoring space admission", {
+          log10("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
             file: "service-context.ts",
@@ -2913,7 +2799,7 @@ var ServiceContext = class {
           return;
         }
         if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
-          log11("space already exists, ignoring space admission", {
+          log10("space already exists, ignoring space admission", {
             details: assertion
           }, {
             file: "service-context.ts",
@@ -2924,7 +2810,7 @@ var ServiceContext = class {
           return;
         }
         try {
-          log11("accepting space recorded in halo", {
+          log10("accepting space recorded in halo", {
             details: assertion
           }, {
             file: "service-context.ts",
@@ -2937,7 +2823,7 @@ var ServiceContext = class {
             genesisFeedKey: assertion.genesisFeedKey
           });
         } catch (err) {
-          log11.catch(err, {}, {
+          log10.catch(err, {}, {
             file: "service-context.ts",
             line: 197,
             scope: this,
@@ -2954,16 +2840,15 @@ var ServiceContext = class {
 import { schema as schema6 } from "@dxos/protocols";
 import { createServiceBundle } from "@dxos/rpc";
 var clientServiceBundle = createServiceBundle({
-  HaloInvitationsService: schema6.getService("dxos.client.services.HaloInvitationsService"),
+  SystemService: schema6.getService("dxos.client.services.SystemService"),
+  IdentityService: schema6.getService("dxos.client.services.IdentityService"),
+  DeviceInvitationsService: schema6.getService("dxos.client.services.DeviceInvitationsService"),
   DevicesService: schema6.getService("dxos.client.services.DevicesService"),
   SpaceInvitationsService: schema6.getService("dxos.client.services.SpaceInvitationsService"),
   SpacesService: schema6.getService("dxos.client.services.SpacesService"),
+  DataService: schema6.getService("dxos.echo.service.DataService"),
   NetworkService: schema6.getService("dxos.client.services.NetworkService"),
   // TODO(burdon): Deprecated.
-  SpaceService: schema6.getService("dxos.client.SpaceService"),
-  DataService: schema6.getService("dxos.echo.service.DataService"),
-  ProfileService: schema6.getService("dxos.client.ProfileService"),
-  SystemService: schema6.getService("dxos.client.SystemService"),
   DevtoolsHost: schema6.getService("dxos.devtools.host.DevtoolsHost"),
   TracingService: schema6.getService("dxos.devtools.host.TracingService")
 });
@@ -3013,34 +2898,155 @@ var toStorageType = (type) => {
   }
 };
 
+// packages/sdk/client-services/src/packlets/vault/services.ts
+import { schema as schema7 } from "@dxos/protocols";
+var iframeServiceBundle = {
+  IframeService: schema7.getService("dxos.iframe.IframeService"),
+  BridgeService: schema7.getService("dxos.mesh.bridge.BridgeService")
+};
+var workerServiceBundle = {
+  WorkerService: schema7.getService("dxos.iframe.WorkerService")
+};
+var appServiceBundle = {
+  AppService: schema7.getService("dxos.iframe.AppService")
+};
+var shellServiceBundle = {
+  ShellService: schema7.getService("dxos.iframe.ShellService")
+};
+
+// packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
+import assert12 from "@dxos/node-std/assert";
+import { Event as Event5 } from "@dxos/async";
+import { ShellLayout } from "@dxos/protocols/proto/dxos/iframe";
+import { createProtoRpcPeer } from "@dxos/rpc";
+var ShellRuntimeImpl = class {
+  constructor(_port) {
+    this._port = _port;
+    this.layoutUpdate = new Event5();
+    this._layout = ShellLayout.DEFAULT;
+  }
+  get layout() {
+    return this._layout;
+  }
+  get invitationCode() {
+    return this._invitationCode;
+  }
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setLayout(layout, options = {}) {
+    this._layout = layout;
+    this._invitationCode = options.invitationCode;
+    this._spaceKey = options.spaceKey;
+    this.layoutUpdate.emit({
+      layout,
+      ...options
+    });
+  }
+  async setAppContext(context) {
+    assert12(this._appRpc, "runtime not open");
+    await this._appRpc.rpc.AppService.setContext(context);
+  }
+  async open() {
+    this._appRpc = createProtoRpcPeer({
+      requested: appServiceBundle,
+      exposed: shellServiceBundle,
+      handlers: {
+        ShellService: {
+          setLayout: async (request) => {
+            this._layout = request.layout;
+            this._invitationCode = request.invitationCode;
+            this._spaceKey = request.spaceKey;
+            this.layoutUpdate.emit(request);
+          }
+        }
+      },
+      port: this._port
+    });
+    await this._appRpc.open();
+  }
+  async close() {
+    var _a;
+    await ((_a = this._appRpc) == null ? void 0 : _a.close());
+    this._appRpc = void 0;
+  }
+};
+var MemoryShellRuntime = class {
+  constructor({ layout, invitationCode, spaceKey } = {}) {
+    this.layoutUpdate = new Event5();
+    this.contextUpdate = new Event5();
+    this._layout = layout != null ? layout : ShellLayout.DEFAULT;
+    this._invitationCode = invitationCode;
+    this._spaceKey = spaceKey;
+  }
+  get layout() {
+    return this._layout;
+  }
+  get invitationCode() {
+    return this._invitationCode;
+  }
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setLayout(layout, options = {}) {
+    this._layout = layout;
+    this._invitationCode = options.invitationCode;
+    this._spaceKey = options.spaceKey;
+    this.layoutUpdate.emit({
+      layout,
+      ...options
+    });
+  }
+  async setAppContext(context) {
+    this.contextUpdate.emit(context);
+  }
+};
+
 // packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
 import { Trigger as Trigger9 } from "@dxos/async";
-import { log as log16, logInfo as logInfo2 } from "@dxos/log";
+import { log as log17, logInfo as logInfo2 } from "@dxos/log";
 import { MemorySignalManager as MemorySignalManager2, MemorySignalManagerContext as MemorySignalManagerContext2, WebsocketSignalManager as WebsocketSignalManager2 } from "@dxos/messaging";
 import { createWebRTCTransportFactory, NetworkManager as NetworkManager2 } from "@dxos/network-manager";
-import { createProtoRpcPeer as createProtoRpcPeer4 } from "@dxos/rpc";
+import { createProtoRpcPeer as createProtoRpcPeer6 } from "@dxos/rpc";
+import { getAsyncValue } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
+import assert14 from "@dxos/node-std/assert";
+import { Event as Event7 } from "@dxos/async";
 import { raise as raise2 } from "@dxos/debug";
 import { DocumentModel } from "@dxos/document-model";
-import { DataServiceImpl } from "@dxos/echo-db";
-import { log as log15 } from "@dxos/log";
+import { DataServiceImpl } from "@dxos/echo-pipeline";
+import { log as log16 } from "@dxos/log";
 import { ModelFactory } from "@dxos/model-factory";
-import { Status } from "@dxos/protocols/proto/dxos/client";
+import { SystemStatus } from "@dxos/protocols/proto/dxos/client/services";
 import { TextModel } from "@dxos/text-model";
 
-// packages/sdk/client-services/src/packlets/identity/devices-service-impl.ts
+// packages/sdk/client-services/src/packlets/deprecated/tracing.ts
+var TracingServiceImpl = class {
+  constructor(_config) {
+    this._config = _config;
+  }
+  async setTracingOptions() {
+    throw new Error("Tracing not available.");
+  }
+  subscribeToRpcTrace() {
+    throw new Error("Tracing not available.");
+  }
+};
+
+// packages/sdk/client-services/src/packlets/devices/devices-service.ts
 import { EventSubscriptions as EventSubscriptions2 } from "@dxos/async";
-import { Stream as Stream9 } from "@dxos/codec-protobuf";
+import { Stream as Stream8 } from "@dxos/codec-protobuf";
+import { DeviceKind } from "@dxos/protocols/proto/dxos/client/services";
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
     this._identityManager = _identityManager;
   }
-  updateDevice() {
+  updateDevice(request) {
     throw new Error("Method not implemented.");
   }
   queryDevices() {
-    return new Stream9(({ next }) => {
+    return new Stream8(({ next }) => {
       const update = () => {
         var _a;
         const deviceKeys = (_a = this._identityManager.identity) == null ? void 0 : _a.authorizedDeviceKeys;
@@ -3050,35 +3056,39 @@ var DevicesServiceImpl = class {
           });
         } else {
           next({
-            devices: Array.from(deviceKeys.values()).map((key) => ({
-              deviceKey: key
-            }))
+            devices: Array.from(deviceKeys.values()).map((key) => {
+              var _a2;
+              return {
+                deviceKey: key,
+                kind: ((_a2 = this._identityManager.identity) == null ? void 0 : _a2.deviceKey.equals(key)) ? DeviceKind.CURRENT : DeviceKind.TRUSTED
+              };
+            })
           });
         }
       };
-      const dispose = new EventSubscriptions2();
-      dispose.add(this._identityManager.stateUpdate.on(() => {
+      const subscriptions = new EventSubscriptions2();
+      subscriptions.add(this._identityManager.stateUpdate.on(() => {
         update();
         if (this._identityManager.identity) {
-          dispose.add(this._identityManager.identity.stateUpdate.on(() => {
+          subscriptions.add(this._identityManager.identity.stateUpdate.on(() => {
             update();
           }));
         }
       }));
       update();
-      return () => dispose.clear();
+      return () => subscriptions.clear();
     });
   }
 };
 
 // packages/sdk/client-services/src/packlets/network/network-service.ts
-import { Stream as Stream10 } from "@dxos/codec-protobuf";
+import { Stream as Stream9 } from "@dxos/codec-protobuf";
 var NetworkServiceImpl = class {
   constructor(networkManager) {
     this.networkManager = networkManager;
   }
   subscribeToNetworkStatus() {
-    return new Stream10(({ next }) => {
+    return new Stream9(({ next }) => {
       const unsubscribe = this.networkManager.connectionStateChanged.on((state) => next({
         state
       }));
@@ -3094,25 +3104,80 @@ var NetworkServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
-import { scheduleTask as scheduleTask4 } from "@dxos/async";
-import { Stream as Stream11 } from "@dxos/codec-protobuf";
-import { raise } from "@dxos/debug";
-import { SpaceNotFoundError } from "@dxos/echo-db";
+import { EventSubscriptions as EventSubscriptions3, scheduleTask as scheduleTask4 } from "@dxos/async";
+import { Stream as Stream10 } from "@dxos/codec-protobuf";
+import { raise, todo as todo2 } from "@dxos/debug";
+import { SpaceNotFoundError } from "@dxos/echo-pipeline";
+import { log as log11 } from "@dxos/log";
+import { SpaceMember, SpaceStatus } from "@dxos/protocols/proto/dxos/client/services";
+import { humanize } from "@dxos/util";
 var SpacesServiceImpl = class {
-  constructor(_spaceManager) {
+  constructor(_identityManager, _spaceManager, _dataServiceSubscriptions, _getDataSpaceManager) {
+    this._identityManager = _identityManager;
     this._spaceManager = _spaceManager;
+    this._dataServiceSubscriptions = _dataServiceSubscriptions;
+    this._getDataSpaceManager = _getDataSpaceManager;
   }
   async createSpace() {
-    throw new Error();
+    if (!this._identityManager.identity) {
+      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/halo");
+    }
+    const dataSpaceManager = await this._getDataSpaceManager();
+    const space = await dataSpaceManager.createSpace();
+    return this._transformSpace(space);
   }
-  querySpaces() {
-    throw new Error();
+  async updateSpace(request) {
+    todo2();
   }
-  queryMembers(query) {
-    throw new Error();
+  querySpaces() {
+    return new Stream10(({ next, ctx }) => {
+      const onUpdate = async () => {
+        const dataSpaceManager = await this._getDataSpaceManager();
+        const spaces = Array.from(dataSpaceManager.spaces.values()).filter((space) => this._dataServiceSubscriptions.getDataService(space.key)).map((space) => this._transformSpace(space));
+        log11("update", {
+          spaces
+        }, {
+          file: "spaces-service.ts",
+          line: 59,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        next({
+          spaces
+        });
+      };
+      setTimeout(async () => {
+        const dataSpaceManager = await this._getDataSpaceManager();
+        const subscriptions = new EventSubscriptions3();
+        const subscribeSpaces = () => {
+          subscriptions.clear();
+          for (const space of dataSpaceManager.spaces.values()) {
+            if (!this._dataServiceSubscriptions.getDataService(space.key)) {
+              continue;
+            }
+            subscriptions.add(space.stateUpdate.on(ctx, onUpdate));
+            subscriptions.add(space.presence.updated.on(ctx, onUpdate));
+          }
+        };
+        dataSpaceManager.updated.on(ctx, () => {
+          subscribeSpaces();
+          void onUpdate();
+        });
+        ctx.onDispose(() => subscriptions.clear());
+        scheduleTask4(ctx, () => {
+          subscribeSpaces();
+          void onUpdate();
+        });
+      });
+      if (!this._identityManager.identity) {
+        next({
+          spaces: []
+        });
+      }
+    });
   }
   queryCredentials({ spaceKey }) {
-    return new Stream11(({ ctx, next }) => {
+    return new Stream10(({ ctx, next }) => {
       var _a;
       const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : raise(new SpaceNotFoundError(spaceKey));
       const processor = space.spaceState.registerProcessor({
@@ -3135,30 +3200,74 @@ var SpacesServiceImpl = class {
       });
     }
   }
+  _transformSpace(space) {
+    return {
+      spaceKey: space.key,
+      status: space.isOpen ? SpaceStatus.ACTIVE : SpaceStatus.INACTIVE,
+      members: Array.from(space.inner.spaceState.members.values()).map((member) => {
+        var _a, _b, _c;
+        return {
+          identity: {
+            identityKey: member.key,
+            profile: {
+              displayName: (_b = (_a = member.assertion.profile) == null ? void 0 : _a.displayName) != null ? _b : humanize(member.key)
+            }
+          },
+          presence: ((_c = this._identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember.PresenceState.ONLINE : SpaceMember.PresenceState.OFFLINE
+        };
+      })
+    };
+  }
 };
 
-// packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
-import { WebRTCTransportService } from "@dxos/network-manager";
-import { createProtoRpcPeer } from "@dxos/rpc";
-
-// packages/sdk/client-services/src/packlets/vault/services.ts
-import { schema as schema7 } from "@dxos/protocols";
-var iframeServiceBundle = {
-  IframeService: schema7.getService("dxos.iframe.IframeService"),
-  BridgeService: schema7.getService("dxos.mesh.bridge.BridgeService")
-};
-var workerServiceBundle = {
-  WorkerService: schema7.getService("dxos.iframe.WorkerService")
+// packages/sdk/client-services/src/packlets/system/system-service.ts
+import { Stream as Stream11 } from "@dxos/codec-protobuf";
+var SystemServiceImpl = class {
+  constructor({ config, statusUpdate, onUpdateStatus, getCurrentStatus, onReset }) {
+    this._config = config;
+    this._statusUpdate = statusUpdate;
+    this._getCurrentStatus = getCurrentStatus;
+    this._onUpdateStatus = onUpdateStatus;
+    this._onReset = onReset;
+  }
+  async getConfig() {
+    return this._config.values;
+  }
+  async updateStatus({ status }) {
+    await this._onUpdateStatus(status);
+  }
+  queryStatus() {
+    return new Stream11(({ next }) => {
+      const update = () => {
+        next({
+          status: this._getCurrentStatus()
+        });
+      };
+      update();
+      const unsubscribe = this._statusUpdate.on(() => update());
+      const interval = setInterval(update, 3e3);
+      return () => {
+        clearInterval(interval);
+        unsubscribe();
+      };
+    });
+  }
+  async reset() {
+    await this._onReset();
+  }
 };
 
 // packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
+import { WebRTCTransportService } from "@dxos/network-manager";
+import { createProtoRpcPeer as createProtoRpcPeer2 } from "@dxos/rpc";
 var IFrameProxyRuntime = class {
-  constructor({ systemPort, workerAppPort, windowAppPort }) {
+  constructor({ systemPort, workerAppPort, windowAppPort, shellPort }) {
     this._transportService = new WebRTCTransportService();
     this._systemPort = systemPort;
     this._windowAppPort = windowAppPort;
     this._workerAppPort = workerAppPort;
-    this._systemRpc = createProtoRpcPeer({
+    this._shellPort = shellPort;
+    this._systemRpc = createProtoRpcPeer2({
       requested: workerServiceBundle,
       exposed: iframeServiceBundle,
       handlers: {
@@ -3173,22 +3282,95 @@ var IFrameProxyRuntime = class {
     });
     this._workerAppPort.subscribe((msg) => this._windowAppPort.send(msg));
     this._windowAppPort.subscribe((msg) => this._workerAppPort.send(msg));
+    if (this._shellPort) {
+      this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
+    }
+  }
+  get shell() {
+    return this._shellRuntime;
   }
   async open(origin) {
+    var _a;
     await this._systemRpc.open();
     await this._systemRpc.rpc.WorkerService.start({
       origin
     });
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.open());
   }
   async close() {
+    var _a;
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
     await this._systemRpc.rpc.WorkerService.stop();
     await this._systemRpc.close();
   }
 };
 
+// packages/sdk/client-services/src/packlets/vault/shell-controller.ts
+import { Event as Event6 } from "@dxos/async";
+import { log as log12 } from "@dxos/log";
+import { ShellDisplay } from "@dxos/protocols/proto/dxos/iframe";
+import { createProtoRpcPeer as createProtoRpcPeer3 } from "@dxos/rpc";
+var ShellController = class {
+  constructor(_port) {
+    this._port = _port;
+    this.contextUpdate = new Event6();
+    this._display = ShellDisplay.NONE;
+  }
+  get display() {
+    return this._display;
+  }
+  async setLayout(layout, options = {}) {
+    var _a;
+    log12("set layout", {
+      layout,
+      ...options
+    }, {
+      file: "shell-controller.ts",
+      line: 27,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    this._display = ShellDisplay.FULLSCREEN;
+    this.contextUpdate.emit({
+      display: this._display
+    });
+    await ((_a = this._shellRpc) == null ? void 0 : _a.rpc.ShellService.setLayout({
+      layout,
+      ...options
+    }));
+  }
+  async open() {
+    this._shellRpc = createProtoRpcPeer3({
+      requested: shellServiceBundle,
+      exposed: appServiceBundle,
+      handlers: {
+        AppService: {
+          setContext: async (request) => {
+            log12("set context", request, {
+              file: "shell-controller.ts",
+              line: 40,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            this._display = request.display;
+            this.contextUpdate.emit(request);
+          }
+        }
+      },
+      port: this._port
+    });
+    await this._shellRpc.open();
+  }
+  async close() {
+    var _a;
+    await ((_a = this._shellRpc) == null ? void 0 : _a.close());
+    this._shellRpc = void 0;
+  }
+};
+
 // packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
 import { asyncTimeout, Trigger as Trigger6 } from "@dxos/async";
-import { log as log12 } from "@dxos/log";
+import { log as log13 } from "@dxos/log";
 var Message;
 (function(Message2) {
   Message2["ACQUIRING"] = "acquiring";
@@ -3221,7 +3403,7 @@ var VaultResourceLock = class {
     }
   }
   async _requestLock(steal = false) {
-    log12("requesting lock...", {
+    log13("requesting lock...", {
       steal
     }, {
       file: "vault-resource-lock.ts",
@@ -3238,14 +3420,14 @@ var VaultResourceLock = class {
       acquired.wake();
       this._releaseTrigger = new Trigger6();
       await this._releaseTrigger.wait();
-      log12("releasing lock...", {}, {
+      log13("releasing lock...", {}, {
         file: "vault-resource-lock.ts",
         line: 65,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       await ((_b = this._onRelease) == null ? void 0 : _b.call(this));
-      log12("released lock", {}, {
+      log13("released lock", {}, {
         file: "vault-resource-lock.ts",
         line: 67,
         scope: this,
@@ -3256,7 +3438,7 @@ var VaultResourceLock = class {
       await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
     });
     await acquired.wait();
-    log12("recieved lock", {
+    log13("recieved lock", {
       steal
     }, {
       file: "vault-resource-lock.ts",
@@ -3269,15 +3451,15 @@ var VaultResourceLock = class {
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
 import { Trigger as Trigger8 } from "@dxos/async";
-import { log as log14 } from "@dxos/log";
+import { log as log15 } from "@dxos/log";
 import { MemorySignalManager, MemorySignalManagerContext, WebsocketSignalManager } from "@dxos/messaging";
 import { NetworkManager, WebRTCTransportProxyFactory } from "@dxos/network-manager";
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
 import assert13 from "@dxos/node-std/assert";
-import { Trigger as Trigger7 } from "@dxos/async";
-import { log as log13, logInfo } from "@dxos/log";
-import { createProtoRpcPeer as createProtoRpcPeer2 } from "@dxos/rpc";
+import { asyncTimeout as asyncTimeout2, Trigger as Trigger7 } from "@dxos/async";
+import { log as log14, logInfo } from "@dxos/log";
+import { createProtoRpcPeer as createProtoRpcPeer4 } from "@dxos/rpc";
 import { Callback } from "@dxos/util";
 var __decorate3 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3290,7 +3472,7 @@ var __decorate3 = function(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 var WorkerSession = class {
-  constructor({ getService, systemPort, appPort, options = {
+  constructor({ getService, systemPort, appPort, shellPort, options = {
     heartbeatInterval: 1e3
   } }) {
     this._startTrigger = new Trigger7();
@@ -3299,24 +3481,29 @@ var WorkerSession = class {
     assert13(getService);
     this._options = options;
     this._getService = getService;
-    this._clientRpc = createProtoRpcPeer2({
+    const handlers = {
+      DataService: () => this._getService((services) => services.DataService),
+      DeviceInvitationsService: () => this._getService((services) => services.DeviceInvitationsService),
+      DevicesService: () => this._getService((services) => services.DevicesService),
+      DevtoolsHost: () => this._getService((services) => services.DevtoolsHost),
+      NetworkService: () => this._getService((services) => services.NetworkService),
+      IdentityService: () => this._getService((services) => services.IdentityService),
+      SpaceInvitationsService: () => this._getService((services) => services.SpaceInvitationsService),
+      SpacesService: () => this._getService((services) => services.SpacesService),
+      SystemService: () => this._getService((services) => services.SystemService),
+      TracingService: () => this._getService((services) => services.TracingService)
+    };
+    this._clientRpc = createProtoRpcPeer4({
       exposed: clientServiceBundle,
-      handlers: {
-        DataService: async () => await this._getService((services) => services.DataService),
-        DevicesService: async () => await this._getService((services) => services.DevicesService),
-        DevtoolsHost: async () => await this._getService((services) => services.DevtoolsHost),
-        HaloInvitationsService: async () => await this._getService((services) => services.HaloInvitationsService),
-        NetworkService: async () => await this._getService((services) => services.NetworkService),
-        ProfileService: async () => await this._getService((services) => services.ProfileService),
-        SpaceInvitationsService: async () => await this._getService((services) => services.SpaceInvitationsService),
-        SpaceService: async () => await this._getService((services) => services.SpaceService),
-        SpacesService: async () => await this._getService((services) => services.SpacesService),
-        SystemService: async () => await this._getService((services) => services.SystemService),
-        TracingService: async () => await this._getService((services) => services.TracingService)
-      },
+      handlers,
       port: appPort
     });
-    this._iframeRpc = createProtoRpcPeer2({
+    this._shellClientRpc = createProtoRpcPeer4({
+      exposed: clientServiceBundle,
+      handlers,
+      port: shellPort
+    });
+    this._iframeRpc = createProtoRpcPeer4({
       requested: iframeServiceBundle,
       exposed: workerServiceBundle,
       handlers: {
@@ -3330,9 +3517,9 @@ var WorkerSession = class {
               try {
                 await this.close();
               } catch (err) {
-                log13.catch(err, {}, {
+                log14.catch(err, {}, {
                   file: "worker-session.ts",
-                  line: 90,
+                  line: 91,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -3348,15 +3535,16 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    log13.info("opening..", {}, {
+    log14.info("opening..", {}, {
       file: "worker-session.ts",
-      line: 104,
+      line: 105,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await Promise.all([
       this._clientRpc.open(),
-      this._iframeRpc.open()
+      this._iframeRpc.open(),
+      this._maybeOpenShell()
     ]);
     await this._startTrigger.wait({
       timeout: 3e3
@@ -3365,20 +3553,20 @@ var WorkerSession = class {
       try {
         await this._iframeRpc.rpc.IframeService.heartbeat();
       } catch (err1) {
-        log13.warn("Heartbeat failed", {
+        log14.warn("Heartbeat failed", {
           err: err1
         }, {
           file: "worker-session.ts",
-          line: 116,
+          line: 117,
           scope: this,
           callSite: (f, a) => f(...a)
         });
         try {
           await this.close();
         } catch (err) {
-          log13.catch(err, {}, {
+          log14.catch(err, {}, {
             file: "worker-session.ts",
-            line: 120,
+            line: 121,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3387,18 +3575,18 @@ var WorkerSession = class {
     }, this._options.heartbeatInterval);
   }
   async close() {
-    log13.info("closing..", {}, {
+    log14.info("closing..", {}, {
       file: "worker-session.ts",
-      line: 127,
+      line: 128,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     try {
       await this.onClose.callIfSet();
     } catch (err) {
-      log13.catch(err, {}, {
+      log14.catch(err, {}, {
         file: "worker-session.ts",
-        line: 131,
+        line: 132,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3411,6 +3599,18 @@ var WorkerSession = class {
       this._iframeRpc.close()
     ]);
   }
+  async _maybeOpenShell() {
+    try {
+      await asyncTimeout2(this._shellClientRpc.open(), 1e3);
+    } catch (e) {
+      log14.info("No shell connected.", {}, {
+        file: "worker-session.ts",
+        line: 146,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
+  }
 };
 __decorate3([
   logInfo
@@ -3426,9 +3626,9 @@ var WorkerRuntime = class {
     this.sessions = /* @__PURE__ */ new Set();
   }
   async start() {
-    log14("starting...", {}, {
+    log15("starting...", {}, {
       file: "worker-runtime.ts",
-      line: 41,
+      line: 42,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3447,17 +3647,17 @@ var WorkerRuntime = class {
       });
       await this._clientServices.open();
       this._ready.wake(void 0);
-      log14("started", {}, {
+      log15("started", {}, {
         file: "worker-runtime.ts",
-        line: 58,
+        line: 59,
         scope: this,
         callSite: (f, a) => f(...a)
       });
     } catch (err) {
       this._ready.wake(err);
-      log14.catch(err, {}, {
+      log15.catch(err, {}, {
         file: "worker-runtime.ts",
-        line: 61,
+        line: 62,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3469,7 +3669,7 @@ var WorkerRuntime = class {
   /**
   * Create a new session.
   */
-  async createSession({ appPort, systemPort }) {
+  async createSession({ appPort, systemPort, shellPort }) {
     const session = new WorkerSession({
       getService: async (find) => {
         const error = await this._ready.wait();
@@ -3484,6 +3684,7 @@ var WorkerRuntime = class {
       },
       appPort,
       systemPort,
+      shellPort,
       readySignal: this._ready
     });
     session.onClose.set(async () => {
@@ -3544,8 +3745,10 @@ var ClientServicesHost = class {
     // TODO(burdon): Create ApolloLink abstraction (see Client).
     networkManager,
     storage = createStorageObjects(config.get("runtime.client.storage", {})).storage,
+    // TODO(wittjosiah): Turn this on by default.
     lockKey
   }) {
+    this._statusUpdate = new Event7();
     this._open = false;
     this._config = config;
     this._modelFactory = modelFactory;
@@ -3558,23 +3761,19 @@ var ClientServicesHost = class {
     }) : void 0;
     this._systemService = new SystemServiceImpl({
       config: this._config,
-      onInit: async () => {
-        var _a;
-        await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
-      },
-      onStatus: async () => {
-        if (!this.isOpen) {
-          return {
-            status: Status.INACTIVE
-          };
+      statusUpdate: this._statusUpdate,
+      getCurrentStatus: () => this.isOpen ? SystemStatus.ACTIVE : SystemStatus.INACTIVE,
+      onUpdateStatus: async (status) => {
+        var _a, _b;
+        if (!this.isOpen && status === SystemStatus.ACTIVE) {
+          await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
+        } else if (this.isOpen && status === SystemStatus.INACTIVE) {
+          await ((_b = this._resourceLock) == null ? void 0 : _b.release());
         }
-        return {
-          status: Status.ACTIVE
-        };
       },
       onReset: async () => {
-        var _a;
-        await ((_a = this._serviceContext) == null ? void 0 : _a.reset());
+        assert14(this._serviceContext, "service host is closed");
+        await this._serviceContext.reset();
       }
     });
     this._serviceRegistry = new ServiceRegistry(clientServiceBundle, {
@@ -3591,22 +3790,23 @@ var ClientServicesHost = class {
     return this._serviceRegistry.services;
   }
   async open() {
-    var _a;
+    var _a, _b;
     if (this._open) {
       return;
     }
-    log15("opening...", {}, {
+    log16("opening...", {}, {
       file: "service-host.ts",
-      line: 125,
+      line: 133,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
     this._serviceContext = new ServiceContext(this._storage, this._networkManager, this._modelFactory);
     this._serviceRegistry.setServices({
-      // TODO(burdon): Move to new protobuf definitions.
       SystemService: this._systemService,
-      HaloInvitationsService: new HaloInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.haloInvitations),
+      IdentityService: new IdentityServiceImpl(this._serviceContext),
       DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
+      DeviceInvitationsService: new DeviceInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.deviceInvitations),
       SpaceInvitationsService: new SpaceInvitationsServiceImpl(this._serviceContext.identityManager, () => {
         var _a2;
         return (_a2 = this._serviceContext.spaceInvitations) != null ? _a2 : raise2(new Error("SpaceInvitations not initialized"));
@@ -3614,13 +3814,13 @@ var ClientServicesHost = class {
         var _a2;
         return (_a2 = this._serviceContext.dataSpaceManager) != null ? _a2 : raise2(new Error("SpaceManager not initialized"));
       }),
-      SpacesService: new SpacesServiceImpl(this._serviceContext.spaceManager),
+      SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, this._serviceContext.dataServiceSubscriptions, async () => {
+        await this._serviceContext.initialized.wait();
+        return this._serviceContext.dataSpaceManager;
+      }),
       DataService: new DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
       NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager),
       // TODO(burdon): Move to new protobuf definitions.
-      ProfileService: new ProfileServiceImpl(this._serviceContext),
-      // TODO(burdon): Port old SubscribeSpaces to QueryServices>
-      SpaceService: new SpaceServiceImpl(this._serviceContext),
       TracingService: new TracingServiceImpl(this._config),
       DevtoolsHost: new DevtoolsServiceImpl({
         events: new DevtoolsHostEvents(),
@@ -3630,12 +3830,13 @@ var ClientServicesHost = class {
     });
     await this._serviceContext.open();
     this._open = true;
-    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    log15("opened", {
+    this._statusUpdate.emit();
+    const deviceKey = (_b = this._serviceContext.identityManager.identity) == null ? void 0 : _b.deviceKey;
+    log16("opened", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 172,
+      line: 186,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3646,11 +3847,11 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    log15("closing...", {
+    log16("closing...", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 181,
+      line: 195,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3659,11 +3860,12 @@ var ClientServicesHost = class {
     });
     await this._serviceContext.close();
     this._open = false;
-    log15("closed", {
+    this._statusUpdate.emit();
+    log16("closed", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 185,
+      line: 200,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3671,14 +3873,14 @@ var ClientServicesHost = class {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-proxy.ts
-import { asyncTimeout as asyncTimeout2 } from "@dxos/async";
+import { asyncTimeout as asyncTimeout3 } from "@dxos/async";
 import { RemoteServiceConnectionTimeout } from "@dxos/errors";
-import { createProtoRpcPeer as createProtoRpcPeer3 } from "@dxos/rpc";
+import { createProtoRpcPeer as createProtoRpcPeer5 } from "@dxos/rpc";
 var ClientServicesProxy = class {
   // prettier-ignore
   constructor(port, _timeout = 3e4) {
     this._timeout = _timeout;
-    this._proxy = createProtoRpcPeer3({
+    this._proxy = createProtoRpcPeer5({
       requested: clientServiceBundle,
       exposed: {},
       handlers: {},
@@ -3695,7 +3897,7 @@ var ClientServicesProxy = class {
     return this._proxy.rpc;
   }
   async open() {
-    await asyncTimeout2(this._proxy.open(), this._timeout, new RemoteServiceConnectionTimeout());
+    await asyncTimeout3(this._proxy.open(), this._timeout, new RemoteServiceConnectionTimeout());
   }
   async close() {
     await this._proxy.close();
@@ -3715,11 +3917,12 @@ var __decorate4 = function(decorators, target, key, desc) {
 };
 var LOCK_KEY = "DXOS_RESOURCE_LOCK";
 var IFrameHostRuntime = class {
-  constructor({ configProvider, appPort }) {
+  constructor({ configProvider, appPort, shellPort }) {
     this._transportFactory = createWebRTCTransportFactory();
     this._ready = new Trigger9();
     this._configProvider = configProvider;
     this._appPort = appPort;
+    this._shellPort = shellPort;
     this._getService = async (find) => {
       const error = await this._ready.wait();
       if (error) {
@@ -3731,16 +3934,26 @@ var IFrameHostRuntime = class {
       }
       return service;
     };
+    if (this._shellPort) {
+      this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
+    }
+  }
+  get services() {
+    return this._clientServices;
+  }
+  get shell() {
+    return this._shellRuntime;
   }
   async start() {
-    log16("starting...", {}, {
+    var _a;
+    log17("starting...", {}, {
       file: "iframe-host-runtime.ts",
-      line: 63,
+      line: 81,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     try {
-      this._config = await this._configProvider();
+      this._config = await getAsyncValue(this._configProvider);
       const signalServer = this._config.get("runtime.services.signal.server");
       this._clientServices = new ClientServicesHost({
         lockKey: LOCK_KEY,
@@ -3753,17 +3966,16 @@ var IFrameHostRuntime = class {
           transportFactory: this._transportFactory
         })
       });
-      this._clientRpc = createProtoRpcPeer4({
+      this._clientRpc = createProtoRpcPeer6({
         exposed: clientServiceBundle,
         handlers: {
           DataService: async () => await this._getService((services) => services.DataService),
+          DeviceInvitationsService: async () => await this._getService((services) => services.DeviceInvitationsService),
           DevicesService: async () => await this._getService((services) => services.DevicesService),
           DevtoolsHost: async () => await this._getService((services) => services.DevtoolsHost),
-          HaloInvitationsService: async () => await this._getService((services) => services.HaloInvitationsService),
           NetworkService: async () => await this._getService((services) => services.NetworkService),
-          ProfileService: async () => await this._getService((services) => services.ProfileService),
+          IdentityService: async () => await this._getService((services) => services.IdentityService),
           SpaceInvitationsService: async () => await this._getService((services) => services.SpaceInvitationsService),
-          SpaceService: async () => await this._getService((services) => services.SpaceService),
           SpacesService: async () => await this._getService((services) => services.SpacesService),
           SystemService: async () => await this._getService((services) => services.SystemService),
           TracingService: async () => await this._getService((services) => services.TracingService)
@@ -3772,37 +3984,40 @@ var IFrameHostRuntime = class {
       });
       await Promise.all([
         this._clientServices.open(),
-        this._clientRpc.open()
+        this._clientRpc.open(),
+        (_a = this._shellRuntime) == null ? void 0 : _a.open()
       ]);
       this._ready.wake(void 0);
-      log16("started", {}, {
+      log17("started", {}, {
         file: "iframe-host-runtime.ts",
-        line: 99,
+        line: 116,
         scope: this,
         callSite: (f, a) => f(...a)
       });
     } catch (err) {
       this._ready.wake(err);
-      log16.catch(err, {}, {
+      log17.catch(err, {}, {
         file: "iframe-host-runtime.ts",
-        line: 102,
+        line: 119,
         scope: this,
         callSite: (f, a) => f(...a)
       });
     }
   }
   async stop() {
-    log16("stopping...", {}, {
+    var _a;
+    log17("stopping...", {}, {
       file: "iframe-host-runtime.ts",
-      line: 107,
+      line: 124,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._clientRpc.close();
     await this._clientServices.close();
-    log16("stopped", {}, {
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
+    log17("stopped", {}, {
       file: "iframe-host-runtime.ts",
-      line: 110,
+      line: 128,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3813,10 +4028,6 @@ __decorate4([
 ], IFrameHostRuntime.prototype, "origin", void 0);
 
 export {
-  SpaceServiceImpl,
-  ProfileServiceImpl,
-  SystemServiceImpl,
-  TracingServiceImpl,
   subscribeToFeeds,
   subscribeToFeedBlocks,
   subscribeToNetworkStatus,
@@ -3831,6 +4042,7 @@ export {
   TrustedKeySetAuthVerifier,
   Identity,
   IdentityManager,
+  IdentityServiceImpl,
   InvitationEncoder,
   AUTHENTICATION_CODE_LENGTH,
   INVITATION_TIMEOUT,
@@ -3839,21 +4051,26 @@ export {
   AuthenticatingInvitationProvider,
   wrapObservable,
   AbstractInvitationsHandler,
-  HaloInvitationsHandler,
+  DeviceInvitationsHandler,
   AbstractInvitationsProxy,
-  HaloInvitationsProxy,
+  DeviceInvitationsProxy,
   AbstractInvitationsService,
-  HaloInvitationsServiceImpl,
+  DeviceInvitationsServiceImpl,
   SpaceInvitationsHandler,
   SpaceInvitationsProxy,
   SpaceInvitationsServiceImpl,
   ServiceContext,
   clientServiceBundle,
   createStorageObjects,
-  IFrameHostRuntime,
   iframeServiceBundle,
   workerServiceBundle,
+  appServiceBundle,
+  shellServiceBundle,
+  ShellRuntimeImpl,
+  MemoryShellRuntime,
+  IFrameHostRuntime,
   IFrameProxyRuntime,
+  ShellController,
   VaultResourceLock,
   WorkerSession,
   WorkerRuntime,
@@ -3862,4 +4079,4 @@ export {
   ClientServicesHost,
   ClientServicesProxy
 };
-//# sourceMappingURL=chunk-R2FEBB66.mjs.map
+//# sourceMappingURL=chunk-OTSGRZZI.mjs.map