@dxos/client-services 0.1.30-next.7c60cd3 → 0.1.31-next.ea8f0bc

package/dist/lib/browser/{chunk-JLLUQQXD.mjs → chunk-ZIQUYEJS.mjs}

@@ -804,79 +804,17 @@ var IdentityServiceImpl = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/encoder.ts
-import base from "base-x";
-import { schema as schema2 } from "@dxos/protocols";
-var base62 = base("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ");
-var codec = schema2.getCodecForType("dxos.client.services.Invitation");
-var InvitationEncoder = class {
-  static decode(text) {
-    return codec.decode(base62.decode(text));
-  }
-  static encode(invitation) {
-    return base62.encode(codec.encode(invitation));
-  }
-};
-
-// packages/sdk/client-services/src/packlets/invitations/invitations.ts
-import assert4 from "@dxos/node-std/assert";
-import { CancellableObservableProvider } from "@dxos/async";
-import { Invitation } from "@dxos/protocols/proto/dxos/client/services";
-var AUTHENTICATION_CODE_LENGTH = 6;
-var INVITATION_TIMEOUT = 3 * 6e4;
-var ON_CLOSE_DELAY = 1e3;
-var InvitationObservableProvider = class extends CancellableObservableProvider {
-  get invitation() {
-    return this._invitation;
-  }
-  setInvitation(invitation) {
-    this._invitation = invitation;
-  }
-};
-var AuthenticatingInvitationProvider = class extends InvitationObservableProvider {
-  // prettier-ignore
-  constructor(_actions) {
-    super(() => this._actions.onCancel());
-    this._actions = _actions;
-  }
-  async authenticate(authenticationCode) {
-    return this._actions.onAuthenticate(authenticationCode);
-  }
-};
-var wrapObservable = async (observable) => {
-  return new Promise((resolve, reject) => {
-    const unsubscribe = observable.subscribe({
-      onSuccess: (invitation) => {
-        assert4(invitation.state === Invitation.State.SUCCESS);
-        unsubscribe();
-        resolve(invitation);
-      },
-      onError: (err) => {
-        unsubscribe();
-        reject(err);
-      }
-    });
-  });
-};
-
-// packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-var AbstractInvitationsHandler = class {
-  // prettier-ignore
-  constructor(_networkManager) {
-    this._networkManager = _networkManager;
-  }
-};
-
 // packages/sdk/client-services/src/packlets/invitations/device-invitations-handler.ts
-import assert5 from "@dxos/node-std/assert";
+import assert4 from "@dxos/node-std/assert";
 import { scheduleTask, sleep, Trigger as Trigger2 } from "@dxos/async";
+import { AbstractInvitationsHandler, AuthenticatingInvitationProvider, AUTHENTICATION_CODE_LENGTH, InvitationObservableProvider, INVITATION_TIMEOUT, ON_CLOSE_DELAY } from "@dxos/client";
 import { Context as Context3 } from "@dxos/context";
 import { generatePasscode } from "@dxos/credentials";
 import { PublicKey as PublicKey3 } from "@dxos/keys";
 import { log as log4 } from "@dxos/log";
 import { createTeleportProtocolFactory, StarTopology } from "@dxos/network-manager";
-import { schema as schema3 } from "@dxos/protocols";
-import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
+import { schema as schema2 } from "@dxos/protocols";
+import { Invitation } from "@dxos/protocols/proto/dxos/client/services";
 import { AuthenticationResponse } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { RpcExtension } from "@dxos/teleport";
 var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
@@ -890,7 +828,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
   */
   createInvitation(context, options) {
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    assert5(type !== Invitation2.Type.OFFLINE);
+    assert4(type !== Invitation.Type.OFFLINE);
     const identity = this._params.getIdentity();
     const invitation = {
       type,
@@ -916,7 +854,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
           host: identity.deviceKey
         }, {
           file: "device-invitations-handler.ts",
-          line: 91,
+          line: 92,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -932,7 +870,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
           authenticationCode: code
         }, {
           file: "device-invitations-handler.ts",
-          line: 105,
+          line: 106,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -944,7 +882,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
       // TODO(burdon): Not used: controlFeedKey, dataFeedKey.
       presentAdmissionCredentials: async (credentials) => {
         try {
-          if (invitation.type !== Invitation2.Type.INTERACTIVE_TESTING) {
+          if (invitation.type !== Invitation.Type.INTERACTIVE_TESTING) {
             if (invitation.authenticationCode === void 0 || invitation.authenticationCode !== authenticationCode) {
               throw new Error(`invalid authentication code: ${authenticationCode}`);
             }
@@ -954,7 +892,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
             guest: credentials.deviceKey
           }, {
             file: "device-invitations-handler.ts",
-            line: 120,
+            line: 121,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -973,7 +911,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
               host: identity.deviceKey
             }, {
               file: "device-invitations-handler.ts",
-              line: 136,
+              line: 137,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -986,7 +924,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
               guest: deviceKey
             }, {
               file: "device-invitations-handler.ts",
-              line: 139,
+              line: 140,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -995,7 +933,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
             if (!observable.cancelled) {
               log4.error("failed", err, {
                 file: "device-invitations-handler.ts",
-                line: 143,
+                line: 144,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1060,22 +998,22 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
               }
               log4("connected", {}, {
                 file: "device-invitations-handler.ts",
-                line: 214,
+                line: 215,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
               log4("sending admission request", {}, {
                 file: "device-invitations-handler.ts",
-                line: 218,
+                line: 219,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               const { identityKey, haloSpaceKey, genesisFeedKey } = await extension.rpc.HaloHostService.requestAdmission();
-              if (invitation.type === void 0 || invitation.type === Invitation2.Type.INTERACTIVE) {
+              if (invitation.type === void 0 || invitation.type === Invitation.Type.INTERACTIVE) {
                 log4("guest waiting for authentication code...", {}, {
                   file: "device-invitations-handler.ts",
-                  line: 225,
+                  line: 226,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1085,7 +1023,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
                 });
                 log4("sending authentication request", {}, {
                   file: "device-invitations-handler.ts",
-                  line: 228,
+                  line: 229,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1103,7 +1041,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
                 dataFeedKey
               }, {
                 file: "device-invitations-handler.ts",
-                line: 237,
+                line: 238,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1125,7 +1063,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
                 identityKey
               }, {
                 file: "device-invitations-handler.ts",
-                line: 256,
+                line: 257,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1134,7 +1072,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
               if (!observable.cancelled) {
                 log4.warn("auth failed", err, {
                   file: "device-invitations-handler.ts",
-                  line: 260,
+                  line: 261,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1150,7 +1088,7 @@ var DeviceInvitationsHandler = class extends AbstractInvitationsHandler {
     };
     scheduleTask(ctx, async () => {
       var _a, _b;
-      assert5(invitation.swarmKey);
+      assert4(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1173,7 +1111,7 @@ var HostHaloInvitationExtension = class extends RpcExtension {
   constructor(_callbacks) {
     super({
       exposed: {
-        HaloHostService: schema3.getService("dxos.halo.invitations.HaloHostService")
+        HaloHostService: schema2.getService("dxos.halo.invitations.HaloHostService")
       }
     });
     this._callbacks = _callbacks;
@@ -1205,7 +1143,7 @@ var GuestHaloInvitationExtension = class extends RpcExtension {
   constructor(_callbacks) {
     super({
       requested: {
-        HaloHostService: schema3.getService("dxos.halo.invitations.HaloHostService")
+        HaloHostService: schema2.getService("dxos.halo.invitations.HaloHostService")
       }
     });
     this._callbacks = _callbacks;
@@ -1219,152 +1157,11 @@ var GuestHaloInvitationExtension = class extends RpcExtension {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/invitations-proxy.ts
-import assert6 from "@dxos/node-std/assert";
-import { observableError } from "@dxos/async";
-import { log as log5 } from "@dxos/log";
-import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
-var AbstractInvitationsProxy = class {
-  // prettier-ignore
-  constructor(_invitationsService) {
-    this._invitationsService = _invitationsService;
-  }
-  createInvitation(context, options) {
-    let invitationId;
-    const observable = new InvitationObservableProvider(async () => {
-      if (invitationId) {
-        await this._invitationsService.cancelInvitation({
-          invitationId
-        });
-      }
-    });
-    const invitation = {
-      ...this.getInvitationOptions(context),
-      ...options
-    };
-    const stream = this._invitationsService.createInvitation(invitation);
-    stream.subscribe((invitation2) => {
-      var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
-      observable.setInvitation(invitation2);
-      switch (invitation2.state) {
-        case Invitation3.State.CONNECTING: {
-          assert6(invitation2.invitationId);
-          invitationId = invitation2.invitationId;
-          (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation2);
-          break;
-        }
-        case Invitation3.State.CONNECTED: {
-          (_d = (_c = observable.callback).onConnected) == null ? void 0 : _d.call(_c, invitation2);
-          break;
-        }
-        case Invitation3.State.AUTHENTICATING: {
-          (_f = (_e = observable.callback).onAuthenticating) == null ? void 0 : _f.call(_e, invitation2);
-          break;
-        }
-        case Invitation3.State.SUCCESS: {
-          (_h = (_g = observable.callback).onSuccess) == null ? void 0 : _h.call(_g, invitation2);
-          break;
-        }
-        case Invitation3.State.CANCELLED: {
-          (_j = (_i = observable.callback).onCancelled) == null ? void 0 : _j.call(_i);
-          break;
-        }
-        default: {
-          log5.error(`Invalid state: ${invitation2.state}`, {}, {
-            file: "invitations-proxy.ts",
-            line: 81,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        }
-      }
-    }, (err) => {
-      if (err) {
-        observableError(observable, err);
-      }
-    });
-    return observable;
-  }
-  acceptInvitation(invitation, options) {
-    assert6(invitation && invitation.swarmKey);
-    const observable = new AuthenticatingInvitationProvider({
-      onCancel: async () => {
-        var _a;
-        const invitationId = (_a = observable.invitation) == null ? void 0 : _a.invitationId;
-        assert6(invitationId);
-        await this._invitationsService.cancelInvitation({
-          invitationId
-        });
-      },
-      onAuthenticate: async (authenticationCode) => {
-        var _a;
-        const invitationId = (_a = observable.invitation) == null ? void 0 : _a.invitationId;
-        assert6(invitationId);
-        await this._invitationsService.authenticate({
-          invitationId,
-          authenticationCode
-        });
-      }
-    });
-    const stream = this._invitationsService.acceptInvitation({
-      ...invitation,
-      ...options
-    });
-    stream.subscribe((invitation2) => {
-      var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
-      assert6(invitation2.invitationId);
-      observable.setInvitation(invitation2);
-      switch (invitation2.state) {
-        case Invitation3.State.CONNECTING: {
-          (_b = (_a = observable.callback).onConnecting) == null ? void 0 : _b.call(_a, invitation2);
-          break;
-        }
-        case Invitation3.State.CONNECTED: {
-          (_d = (_c = observable.callback).onConnected) == null ? void 0 : _d.call(_c, invitation2);
-          break;
-        }
-        case Invitation3.State.AUTHENTICATING: {
-          (_f = (_e = observable.callback).onAuthenticating) == null ? void 0 : _f.call(_e, invitation2);
-          break;
-        }
-        case Invitation3.State.SUCCESS: {
-          (_h = (_g = observable.callback).onSuccess) == null ? void 0 : _h.call(_g, invitation2);
-          break;
-        }
-        case Invitation3.State.CANCELLED: {
-          (_j = (_i = observable.callback).onCancelled) == null ? void 0 : _j.call(_i);
-          break;
-        }
-        default: {
-          log5.error(`Invalid state: ${invitation2.state}`, {}, {
-            file: "invitations-proxy.ts",
-            line: 146,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        }
-      }
-    }, (err) => {
-      if (err) {
-        observableError(observable, err);
-      }
-    });
-    return observable;
-  }
-};
-
-// packages/sdk/client-services/src/packlets/invitations/device-invitations-proxy.ts
-var DeviceInvitationsProxy = class extends AbstractInvitationsProxy {
-  getInvitationOptions() {
-    return {};
-  }
-};
-
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
-import assert7 from "@dxos/node-std/assert";
+import assert5 from "@dxos/node-std/assert";
 import { Stream as Stream7 } from "@dxos/codec-protobuf";
-import { log as log6 } from "@dxos/log";
-import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
+import { log as log5 } from "@dxos/log";
+import { Invitation as Invitation2 } from "@dxos/protocols/proto/dxos/client/services";
 var AbstractInvitationsService = class {
   // prettier-ignore
   constructor(_identityManager, _getInvitationsHandler) {
@@ -1384,9 +1181,9 @@ var AbstractInvitationsService = class {
     return new Stream7(({ next, close }) => {
       const invitationsHandler = this._getInvitationsHandler();
       const context = this.getContext(invitation);
-      log6("stream opened", this.getLoggingContext(), {
+      log5("stream opened", this.getLoggingContext(), {
         file: "invitations-service.ts",
-        line: 43,
+        line: 48,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1399,60 +1196,60 @@ var AbstractInvitationsService = class {
       });
       observable.subscribe({
         onConnecting: (invitation2) => {
-          assert7(invitation2.invitationId);
+          assert5(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           this._createInvitations.set(invitation2.invitationId, observable);
-          invitation2.state = Invitation4.State.CONNECTING;
+          invitation2.state = Invitation2.State.CONNECTING;
           next(invitation2);
         },
         onConnected: (invitation2) => {
-          assert7(invitation2.invitationId);
-          invitation2.state = Invitation4.State.CONNECTED;
+          assert5(invitation2.invitationId);
+          invitation2.state = Invitation2.State.CONNECTED;
           next(invitation2);
         },
         onAuthenticating: (invitation2) => {
-          assert7(invitation2.invitationId);
-          invitation2.state = Invitation4.State.AUTHENTICATING;
+          assert5(invitation2.invitationId);
+          invitation2.state = Invitation2.State.AUTHENTICATING;
           next(invitation2);
         },
         onSuccess: (invitation2) => {
-          assert7(invitation2.invitationId);
-          invitation2.state = Invitation4.State.SUCCESS;
+          assert5(invitation2.invitationId);
+          invitation2.state = Invitation2.State.SUCCESS;
           next(invitation2);
           close();
         },
         onCancelled: () => {
-          assert7(invitationId);
+          assert5(invitationId);
           invitation.invitationId = invitationId;
-          invitation.state = Invitation4.State.CANCELLED;
+          invitation.state = Invitation2.State.CANCELLED;
           next(invitation);
           close();
         },
         onTimeout: (err) => {
-          invitation.state = Invitation4.State.TIMEOUT;
+          invitation.state = Invitation2.State.TIMEOUT;
           close(err);
         },
         onError: (err) => {
-          invitation.state = Invitation4.State.ERROR;
+          invitation.state = Invitation2.State.ERROR;
           close(err);
         }
       });
       return (err) => {
         const context2 = this.getLoggingContext();
         if (err) {
-          log6.warn("stream closed", {
+          log5.warn("stream closed", {
             ...context2,
             err
           }, {
             file: "invitations-service.ts",
-            line: 92,
+            line: 97,
             scope: this,
             callSite: (f, a) => f(...a)
           });
         } else {
-          log6("stream closed", context2, {
+          log5("stream closed", context2, {
             file: "invitations-service.ts",
-            line: 94,
+            line: 99,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1463,9 +1260,9 @@ var AbstractInvitationsService = class {
   }
   acceptInvitation(invitation, options) {
     return new Stream7(({ next, close }) => {
-      log6("stream opened", this.getLoggingContext(), {
+      log5("stream opened", this.getLoggingContext(), {
         file: "invitations-service.ts",
-        line: 104,
+        line: 109,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1474,59 +1271,59 @@ var AbstractInvitationsService = class {
       const observable = invitationsHandler.acceptInvitation(invitation, options);
       observable.subscribe({
         onConnecting: (invitation2) => {
-          assert7(invitation2.invitationId);
+          assert5(invitation2.invitationId);
           invitationId = invitation2.invitationId;
           this._acceptInvitations.set(invitation2.invitationId, observable);
-          invitation2.state = Invitation4.State.CONNECTING;
+          invitation2.state = Invitation2.State.CONNECTING;
           next(invitation2);
         },
         onConnected: (invitation2) => {
-          assert7(invitation2.invitationId);
-          invitation2.state = Invitation4.State.CONNECTED;
+          assert5(invitation2.invitationId);
+          invitation2.state = Invitation2.State.CONNECTED;
           next(invitation2);
         },
         onAuthenticating: (invitation2) => {
-          assert7(invitation2.invitationId);
-          invitation2.state = Invitation4.State.AUTHENTICATING;
+          assert5(invitation2.invitationId);
+          invitation2.state = Invitation2.State.AUTHENTICATING;
           next(invitation2);
         },
         onSuccess: (invitation2) => {
-          invitation2.state = Invitation4.State.SUCCESS;
+          invitation2.state = Invitation2.State.SUCCESS;
           next(invitation2);
           close();
         },
         onCancelled: () => {
-          assert7(invitationId);
+          assert5(invitationId);
           invitation.invitationId = invitationId;
-          invitation.state = Invitation4.State.CANCELLED;
+          invitation.state = Invitation2.State.CANCELLED;
           next(invitation);
           close();
         },
         onTimeout: (err) => {
-          invitation.state = Invitation4.State.TIMEOUT;
+          invitation.state = Invitation2.State.TIMEOUT;
           close(err);
         },
         onError: (err) => {
-          invitation.state = Invitation4.State.ERROR;
+          invitation.state = Invitation2.State.ERROR;
           close(err);
         }
       });
       return (err) => {
         const context = this.getLoggingContext();
         if (err) {
-          log6.warn("stream closed", {
+          log5.warn("stream closed", {
             ...context,
             err
           }, {
             file: "invitations-service.ts",
-            line: 152,
+            line: 157,
             scope: this,
             callSite: (f, a) => f(...a)
           });
         } else {
-          log6("stream closed", context, {
+          log5("stream closed", context, {
             file: "invitations-service.ts",
-            line: 154,
+            line: 159,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1536,20 +1333,20 @@ var AbstractInvitationsService = class {
     });
   }
   async authenticate({ invitationId, authenticationCode }) {
-    log6("authenticating...", {}, {
+    log5("authenticating...", {}, {
       file: "invitations-service.ts",
-      line: 163,
+      line: 168,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    assert7(invitationId);
+    assert5(invitationId);
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
-      log6.warn("invalid invitation", {
+      log5.warn("invalid invitation", {
         invitationId
       }, {
         file: "invitations-service.ts",
-        line: 167,
+        line: 172,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1559,20 +1356,20 @@ var AbstractInvitationsService = class {
   }
   async cancelInvitation(invitation) {
     var _a;
-    log6("cancelling...", {}, {
+    log5("cancelling...", {}, {
       file: "invitations-service.ts",
-      line: 174,
+      line: 179,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    assert7(invitation.invitationId);
+    assert5(invitation.invitationId);
     const observable = (_a = this._createInvitations.get(invitation.invitationId)) != null ? _a : this._acceptInvitations.get(invitation.invitationId);
     if (!observable) {
-      log6.warn("invalid invitation", {
+      log5.warn("invalid invitation", {
         invitationId: invitation.invitationId
       }, {
         file: "invitations-service.ts",
-        line: 179,
+        line: 184,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1594,20 +1391,21 @@ var DeviceInvitationsServiceImpl = class extends AbstractInvitationsService {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-handler.ts
-import assert8 from "@dxos/node-std/assert";
+import assert6 from "@dxos/node-std/assert";
 import { scheduleTask as scheduleTask2, sleep as sleep2, Trigger as Trigger3 } from "@dxos/async";
+import { AuthenticatingInvitationProvider as AuthenticatingInvitationProvider2, AUTHENTICATION_CODE_LENGTH as AUTHENTICATION_CODE_LENGTH2, InvitationObservableProvider as InvitationObservableProvider2, INVITATION_TIMEOUT as INVITATION_TIMEOUT2, ON_CLOSE_DELAY as ON_CLOSE_DELAY2, AbstractInvitationsHandler as AbstractInvitationsHandler2 } from "@dxos/client";
 import { Context as Context4 } from "@dxos/context";
 import { createAdmissionCredentials, generatePasscode as generatePasscode2, getCredentialAssertion } from "@dxos/credentials";
 import { writeMessages as writeMessages2 } from "@dxos/feed-store";
 import { PublicKey as PublicKey4 } from "@dxos/keys";
-import { log as log7 } from "@dxos/log";
+import { log as log6 } from "@dxos/log";
 import { createTeleportProtocolFactory as createTeleportProtocolFactory2, StarTopology as StarTopology2 } from "@dxos/network-manager";
-import { schema as schema4 } from "@dxos/protocols";
-import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
+import { schema as schema3 } from "@dxos/protocols";
+import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
 import { AuthenticationResponse as AuthenticationResponse2, AuthMethod } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
 var MAX_OTP_ATTEMPTS = 3;
-var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
+var SpaceInvitationsHandler = class extends AbstractInvitationsHandler2 {
   constructor(networkManager, _spaceManager, _signingContext, _keyring) {
     super(networkManager);
     this._spaceManager = _spaceManager;
@@ -1620,16 +1418,16 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   createInvitation(space, options) {
     var _a;
     let swarmConnection;
-    const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options != null ? options : {};
-    assert8(type !== Invitation5.Type.OFFLINE);
-    assert8(space);
+    const { type, timeout = INVITATION_TIMEOUT2, swarmKey } = options != null ? options : {};
+    assert6(type !== Invitation3.Type.OFFLINE);
+    assert6(space);
     const invitation = {
       type,
       invitationId: PublicKey4.random().toHex(),
       swarmKey: swarmKey != null ? swarmKey : PublicKey4.random(),
       spaceKey: space.key,
       authMethod: (_a = options == null ? void 0 : options.authMethod) != null ? _a : AuthMethod.SHARED_SECRET,
-      authenticationCode: generatePasscode2(AUTHENTICATION_CODE_LENGTH)
+      authenticationCode: generatePasscode2(AUTHENTICATION_CODE_LENGTH2)
       // TODO(dmaretskyi): Don't generate if authMethod === NONE .
     };
     const ctx = new Context4({
@@ -1638,7 +1436,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
         observable.callback.onError(err);
       }
     });
-    const observable = new InvitationObservableProvider(async () => {
+    const observable = new InvitationObservableProvider2(async () => {
       await (swarmConnection == null ? void 0 : swarmConnection.close());
     });
     let authenticationPassed = false;
@@ -1649,7 +1447,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       const hostInvitationExtension = new HostSpaceInvitationExtension({
         introduce: async ({ profile }) => {
           var _a2, _b;
-          log7("guest introduced itself", {
+          log6("guest introduced itself", {
             guestProfile: profile,
             host: this._signingContext.deviceKey,
             spaceKey: space.key
@@ -1662,12 +1460,12 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
           guestProfile = profile;
           (_b = (_a2 = observable.callback).onAuthenticating) == null ? void 0 : _b.call(_a2, invitation);
           return {
-            spaceKey: type === Invitation5.Type.INTERACTIVE_TESTING || type === Invitation5.Type.MULTIUSE_TESTING ? space.key : void 0,
+            spaceKey: type === Invitation3.Type.INTERACTIVE_TESTING || type === Invitation3.Type.MULTIUSE_TESTING ? space.key : void 0,
             authMethod: invitation.authMethod
           };
         },
         authenticate: async ({ authenticationCode: code }) => {
-          log7("received authentication request", {
+          log6("received authentication request", {
             authenticationCode: code
           }, {
             file: "space-invitations-handler.ts",
@@ -1678,7 +1476,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
           let status = AuthenticationResponse2.Status.OK;
           switch (invitation.authMethod) {
             case AuthMethod.NONE: {
-              log7("authentication not required", {}, {
+              log6("authentication not required", {}, {
                 file: "space-invitations-handler.ts",
                 line: 128,
                 scope: this,
@@ -1701,7 +1499,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               break;
             }
             default: {
-              log7.error("invalid authentication method", {
+              log6.error("invalid authentication method", {
                 authMethod: invitation.authMethod
               }, {
                 file: "space-invitations-handler.ts",
@@ -1722,7 +1520,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
             if (isAuthenticationRequired(invitation) && !authenticationPassed) {
               throw new Error("Not authenticated");
             }
-            log7("writing guest credentials", {
+            log6("writing guest credentials", {
               host: this._signingContext.deviceKey,
               guest: deviceKey
             }, {
@@ -1732,9 +1530,9 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               callSite: (f, a) => f(...a)
             });
             const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
-            assert8(credentials[0].credential);
+            assert6(credentials[0].credential);
             const spaceMemberCredential = credentials[0].credential.credential;
-            assert8(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+            assert6(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
             await writeMessages2(space.inner.controlPipeline.writer, credentials);
             complete.wake(deviceKey);
             return {
@@ -1749,7 +1547,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
           scheduleTask2(ctx, async () => {
             var _a2, _b;
             try {
-              log7("connected", {
+              log6("connected", {
                 host: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
@@ -1761,7 +1559,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               const deviceKey = await complete.wait({
                 timeout
               });
-              log7("admitted guest", {
+              log6("admitted guest", {
                 host: this._signingContext.deviceKey,
                 guest: deviceKey
               }, {
@@ -1773,7 +1571,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               observable.callback.onSuccess(invitation);
             } catch (err) {
               if (!observable.cancelled) {
-                log7.error("failed", err, {
+                log6.error("failed", err, {
                   file: "space-invitations-handler.ts",
                   line: 198,
                   scope: this,
@@ -1782,8 +1580,8 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 observable.callback.onError(err);
               }
             } finally {
-              if (type !== Invitation5.Type.MULTIUSE_TESTING) {
-                await sleep2(ON_CLOSE_DELAY);
+              if (type !== Invitation3.Type.MULTIUSE_TESTING) {
+                await sleep2(ON_CLOSE_DELAY2);
                 await ctx.dispose();
               }
             }
@@ -1814,7 +1612,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
   * which then writes the guest's credentials to the space.
   */
   acceptInvitation(invitation, options) {
-    const { timeout = INVITATION_TIMEOUT } = options != null ? options : {};
+    const { timeout = INVITATION_TIMEOUT2 } = options != null ? options : {};
     const ctx = new Context4({
       onError: (err) => {
         void ctx.dispose();
@@ -1822,7 +1620,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
       }
     });
     const authenticated = new Trigger3();
-    const observable = new AuthenticatingInvitationProvider({
+    const observable = new AuthenticatingInvitationProvider2({
       onCancel: async () => {
         await ctx.dispose();
       },
@@ -1841,7 +1639,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
               }
-              log7("connected", {
+              log6("connected", {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
@@ -1850,7 +1648,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 callSite: (f, a) => f(...a)
               });
               (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
-              log7("introduce", {
+              log6("introduce", {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
@@ -1861,7 +1659,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               const introductionResponse = await extension.rpc.SpaceHostService.introduce({
                 profile: this._signingContext.profile
               });
-              log7("introduce response", {
+              log6("introduce response", {
                 guest: this._signingContext.deviceKey,
                 response: introductionResponse
               }, {
@@ -1877,7 +1675,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               if (isAuthenticationRequired(invitation)) {
                 (_d = (_c = observable.callback).onAuthenticating) == null ? void 0 : _d.call(_c, invitation);
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  log7("guest waiting for authentication code...", {}, {
+                  log6("guest waiting for authentication code...", {}, {
                     file: "space-invitations-handler.ts",
                     line: 293,
                     scope: this,
@@ -1887,7 +1685,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                   const authenticationCode = await authenticated.wait({
                     timeout
                   });
-                  log7("sending authentication request", {}, {
+                  log6("sending authentication request", {}, {
                     file: "space-invitations-handler.ts",
                     line: 297,
                     scope: this,
@@ -1903,7 +1701,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                     if (attempt === MAX_OTP_ATTEMPTS) {
                       throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
                     } else {
-                      log7("retrying invalid code", {
+                      log6("retrying invalid code", {
                         attempt
                       }, {
                         file: "space-invitations-handler.ts",
@@ -1918,7 +1716,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               }
               const controlFeedKey = await this._keyring.createKey();
               const dataFeedKey = await this._keyring.createKey();
-              log7("request admission", {
+              log6("request admission", {
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
@@ -1933,14 +1731,14 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
                 dataFeedKey
               });
               const assertion = getCredentialAssertion(credential);
-              assert8(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
-              assert8(credential.subject.id.equals(this._signingContext.identityKey));
+              assert6(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
+              assert6(credential.subject.id.equals(this._signingContext.identityKey));
               const space = await this._spaceManager.acceptSpace({
                 spaceKey: assertion.spaceKey,
                 genesisFeedKey: assertion.genesisFeedKey
               });
               await this._signingContext.recordCredential(credential);
-              log7("admitted by host", {
+              log6("admitted by host", {
                 guest: this._signingContext.deviceKey,
                 spaceKey: space.key
               }, {
@@ -1952,7 +1750,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
               complete.wake();
             } catch (err) {
               if (!observable.cancelled) {
-                log7.warn("auth failed", err, {
+                log6.warn("auth failed", err, {
                   file: "space-invitations-handler.ts",
                   line: 344,
                   scope: this,
@@ -1970,7 +1768,7 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     };
     scheduleTask2(ctx, async () => {
       var _a, _b;
-      assert8(invitation.swarmKey);
+      assert6(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1989,12 +1787,12 @@ var SpaceInvitationsHandler = class extends AbstractInvitationsHandler {
     return observable;
   }
 };
-var isAuthenticationRequired = (invitation) => invitation.authMethod !== AuthMethod.NONE && invitation.type !== Invitation5.Type.INTERACTIVE_TESTING && invitation.type !== Invitation5.Type.MULTIUSE_TESTING;
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== AuthMethod.NONE && invitation.type !== Invitation3.Type.INTERACTIVE_TESTING && invitation.type !== Invitation3.Type.MULTIUSE_TESTING;
 var HostSpaceInvitationExtension = class extends RpcExtension2 {
   constructor(_callbacks) {
     super({
       exposed: {
-        SpaceHostService: schema4.getService("dxos.halo.invitations.SpaceHostService")
+        SpaceHostService: schema3.getService("dxos.halo.invitations.SpaceHostService")
       }
     });
     this._callbacks = _callbacks;
@@ -2025,7 +1823,7 @@ var GuestSpaceInvitationExtension = class extends RpcExtension2 {
   constructor(_callbacks) {
     super({
       requested: {
-        SpaceHostService: schema4.getService("dxos.halo.invitations.SpaceHostService")
+        SpaceHostService: schema3.getService("dxos.halo.invitations.SpaceHostService")
       }
     });
     this._callbacks = _callbacks;
@@ -2039,17 +1837,8 @@ var GuestSpaceInvitationExtension = class extends RpcExtension2 {
   }
 };
 
-// packages/sdk/client-services/src/packlets/invitations/space-invitations-proxy.ts
-var SpaceInvitationsProxy = class extends AbstractInvitationsProxy {
-  getInvitationOptions(context) {
-    return {
-      spaceKey: context
-    };
-  }
-};
-
 // packages/sdk/client-services/src/packlets/invitations/space-invitations-service.ts
-import assert9 from "@dxos/node-std/assert";
+import assert7 from "@dxos/node-std/assert";
 var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
   // prettier-ignore
   constructor(identityManager, invitationsHandler, _getSpaceManager) {
@@ -2058,72 +1847,295 @@ var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
     this._getSpaceManager = _getSpaceManager;
   }
   getContext(invitation) {
-    assert9(invitation.spaceKey);
+    assert7(invitation.spaceKey);
     const spaceManager = this._getSpaceManager();
     const space = spaceManager.spaces.get(invitation.spaceKey);
-    assert9(space);
+    assert7(space);
     return space;
   }
 };
 
-// packages/sdk/client-services/src/packlets/services/service-context.ts
-import { Trigger as Trigger5 } from "@dxos/async";
-import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
-import { failUndefined as failUndefined2 } from "@dxos/debug";
-import { valueEncoding, MetadataStore, SpaceManager, DataServiceSubscriptions, SnapshotStore } from "@dxos/echo-pipeline";
-import { FeedFactory, FeedStore } from "@dxos/feed-store";
-import { Keyring } from "@dxos/keyring";
-import { log as log10 } from "@dxos/log";
-
-// packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
-import assert11 from "@dxos/node-std/assert";
-import { Event as Event4, synchronized, trackLeaks as trackLeaks2 } from "@dxos/async";
-import { Context as Context7 } from "@dxos/context";
-import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
-import { spaceGenesis, SnapshotManager } from "@dxos/echo-pipeline";
-import { PublicKey as PublicKey7 } from "@dxos/keys";
-import { log as log9 } from "@dxos/log";
-import { Presence } from "@dxos/teleport-extension-presence";
-import { ComplexMap as ComplexMap3, deferFunction as deferFunction2 } from "@dxos/util";
-
-// packages/sdk/client-services/src/packlets/spaces/data-space.ts
-import { trackLeaks } from "@dxos/async";
-import { Context as Context6 } from "@dxos/context";
-import { timed } from "@dxos/debug";
-import { DataPipelineControllerImpl, createMappedFeedWriter } from "@dxos/echo-pipeline";
-import { PublicKey as PublicKey6 } from "@dxos/keys";
-import { AdmittedFeed as AdmittedFeed3 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { ComplexSet as ComplexSet2 } from "@dxos/util";
+// packages/sdk/client-services/src/packlets/storage/storage.ts
+import { InvalidConfigError } from "@dxos/errors";
+import { Runtime } from "@dxos/protocols/proto/dxos/config";
+import { createStorage, StorageType } from "@dxos/random-access-storage";
+var StorageDriver = Runtime.Client.Storage.StorageDriver;
+var createStorageObjects = (config) => {
+  const { path = "dxos/storage", storageType, keyStorage, persistent = false } = config != null ? config : {};
+  if (persistent && storageType === StorageDriver.RAM) {
+    throw new InvalidConfigError("RAM storage cannot be used in persistent mode.");
+  }
+  if (!persistent && storageType !== void 0 && storageType !== StorageDriver.RAM) {
+    throw new InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+  }
+  if (persistent && keyStorage === StorageDriver.RAM) {
+    throw new InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+  }
+  if (!persistent && keyStorage !== StorageDriver.RAM && keyStorage !== void 0) {
+    throw new InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+  }
+  return {
+    storage: createStorage({
+      type: persistent ? toStorageType(storageType) : StorageType.RAM,
+      root: `${path}/`
+    })
+  };
+};
+var toStorageType = (type) => {
+  switch (type) {
+    case void 0:
+      return void 0;
+    case StorageDriver.RAM:
+      return StorageType.RAM;
+    case StorageDriver.CHROME:
+      return StorageType.CHROME;
+    case StorageDriver.FIREFOX:
+      return StorageType.FIREFOX;
+    case StorageDriver.IDB:
+      return StorageType.IDB;
+    case StorageDriver.NODE:
+      return StorageType.NODE;
+    default:
+      throw new Error(`Invalid storage type: ${StorageDriver[type]}`);
+  }
+};
 
-// packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
-import assert10 from "@dxos/node-std/assert";
-import { DeferredTask, Event as Event3, scheduleTask as scheduleTask3, TimeoutError, Trigger as Trigger4 } from "@dxos/async";
-import { Context as Context5 } from "@dxos/context";
-import { PublicKey as PublicKey5 } from "@dxos/keys";
-import { log as log8 } from "@dxos/log";
-import { schema as schema5 } from "@dxos/protocols";
-import { RpcExtension as RpcExtension3 } from "@dxos/teleport";
-import { ComplexMap as ComplexMap2, ComplexSet, entry } from "@dxos/util";
-var RETRY_TIMEOUT = 1e3;
-var NOTARIZE_TIMEOUT = 1e4;
-var NotarizationPlugin = class {
-  constructor() {
-    this._ctx = new Context5();
-    this._extensionOpened = new Event3();
-    this._extensions = /* @__PURE__ */ new Set();
-    this._processedCredentials = new ComplexSet(PublicKey5.hash);
-    this._processCredentialsTriggers = new ComplexMap2(PublicKey5.hash);
+// packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
+import assert8 from "@dxos/node-std/assert";
+import { Event as Event3 } from "@dxos/async";
+import { appServiceBundle, shellServiceBundle } from "@dxos/client";
+import { ShellLayout } from "@dxos/protocols/proto/dxos/iframe";
+import { createProtoRpcPeer } from "@dxos/rpc";
+var ShellRuntimeImpl = class {
+  constructor(_port) {
+    this._port = _port;
+    this.layoutUpdate = new Event3();
+    this._layout = ShellLayout.DEFAULT;
+  }
+  get layout() {
+    return this._layout;
+  }
+  get invitationCode() {
+    return this._invitationCode;
+  }
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setLayout(layout, options = {}) {
+    this._layout = layout;
+    this._invitationCode = options.invitationCode;
+    this._spaceKey = options.spaceKey;
+    this.layoutUpdate.emit({
+      layout,
+      ...options
+    });
+  }
+  async setAppContext(context) {
+    assert8(this._appRpc, "runtime not open");
+    await this._appRpc.rpc.AppService.setContext(context);
   }
   async open() {
+    this._appRpc = createProtoRpcPeer({
+      requested: appServiceBundle,
+      exposed: shellServiceBundle,
+      handlers: {
+        ShellService: {
+          setLayout: async (request) => {
+            this._layout = request.layout;
+            this._invitationCode = request.invitationCode;
+            this._spaceKey = request.spaceKey;
+            this.layoutUpdate.emit(request);
+          }
+        }
+      },
+      port: this._port
+    });
+    await this._appRpc.open();
   }
   async close() {
-    await this._ctx.dispose();
+    var _a;
+    await ((_a = this._appRpc) == null ? void 0 : _a.close());
+    this._appRpc = void 0;
   }
-  /**
-  * Request credentials to be notarized.
-  */
-  async notarize(credentials) {
-    log8("notarize", {
+};
+var MemoryShellRuntime = class {
+  constructor({ layout, invitationCode, spaceKey } = {}) {
+    this.layoutUpdate = new Event3();
+    this.contextUpdate = new Event3();
+    this._layout = layout != null ? layout : ShellLayout.DEFAULT;
+    this._invitationCode = invitationCode;
+    this._spaceKey = spaceKey;
+  }
+  get layout() {
+    return this._layout;
+  }
+  get invitationCode() {
+    return this._invitationCode;
+  }
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setLayout(layout, options = {}) {
+    this._layout = layout;
+    this._invitationCode = options.invitationCode;
+    this._spaceKey = options.spaceKey;
+    this.layoutUpdate.emit({
+      layout,
+      ...options
+    });
+  }
+  async setAppContext(context) {
+    this.contextUpdate.emit(context);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
+import { Trigger as Trigger9 } from "@dxos/async";
+import { log as log16, logInfo as logInfo2 } from "@dxos/log";
+import { MemorySignalManager as MemorySignalManager3, MemorySignalManagerContext as MemorySignalManagerContext3, WebsocketSignalManager as WebsocketSignalManager3 } from "@dxos/messaging";
+import { createWebRTCTransportFactory as createWebRTCTransportFactory2, NetworkManager as NetworkManager3 } from "@dxos/network-manager";
+import { getAsyncValue } from "@dxos/util";
+
+// packages/sdk/client-services/src/packlets/services/service-host.ts
+import assert12 from "@dxos/node-std/assert";
+import { Event as Event6 } from "@dxos/async";
+import { clientServiceBundle, createDefaultModelFactory } from "@dxos/client";
+import { raise as raise3 } from "@dxos/debug";
+import { DataServiceImpl } from "@dxos/echo-pipeline";
+import { log as log14 } from "@dxos/log";
+import { SystemStatus } from "@dxos/protocols/proto/dxos/client/services";
+
+// packages/sdk/client-services/src/packlets/deprecated/tracing.ts
+var TracingServiceImpl = class {
+  constructor(_config) {
+    this._config = _config;
+  }
+  async setTracingOptions() {
+    throw new Error("Tracing not available.");
+  }
+  subscribeToRpcTrace() {
+    throw new Error("Tracing not available.");
+  }
+};
+
+// packages/sdk/client-services/src/packlets/devices/devices-service.ts
+import { EventSubscriptions as EventSubscriptions2 } from "@dxos/async";
+import { Stream as Stream8 } from "@dxos/codec-protobuf";
+import { DeviceKind } from "@dxos/protocols/proto/dxos/client/services";
+var DevicesServiceImpl = class {
+  constructor(_identityManager) {
+    this._identityManager = _identityManager;
+  }
+  updateDevice(request) {
+    throw new Error("Method not implemented.");
+  }
+  queryDevices() {
+    return new Stream8(({ next }) => {
+      const update = () => {
+        var _a;
+        const deviceKeys = (_a = this._identityManager.identity) == null ? void 0 : _a.authorizedDeviceKeys;
+        if (!deviceKeys) {
+          next({
+            devices: []
+          });
+        } else {
+          next({
+            devices: Array.from(deviceKeys.values()).map((key) => {
+              var _a2;
+              return {
+                deviceKey: key,
+                kind: ((_a2 = this._identityManager.identity) == null ? void 0 : _a2.deviceKey.equals(key)) ? DeviceKind.CURRENT : DeviceKind.TRUSTED
+              };
+            })
+          });
+        }
+      };
+      const subscriptions = new EventSubscriptions2();
+      subscriptions.add(this._identityManager.stateUpdate.on(() => {
+        update();
+        if (this._identityManager.identity) {
+          subscriptions.add(this._identityManager.identity.stateUpdate.on(() => {
+            update();
+          }));
+        }
+      }));
+      update();
+      return () => subscriptions.clear();
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/network/network-service.ts
+import { Stream as Stream9 } from "@dxos/codec-protobuf";
+var NetworkServiceImpl = class {
+  constructor(networkManager) {
+    this.networkManager = networkManager;
+  }
+  subscribeToNetworkStatus() {
+    return new Stream9(({ next }) => {
+      const unsubscribe = this.networkManager.connectionStateChanged.on((state) => next({
+        state
+      }));
+      next({
+        state: this.networkManager.connectionState
+      });
+      return unsubscribe;
+    });
+  }
+  async setNetworkOptions(request) {
+    await this.networkManager.setConnectionState(request.state);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+import assert10 from "@dxos/node-std/assert";
+import { Event as Event5, synchronized, trackLeaks as trackLeaks2 } from "@dxos/async";
+import { Context as Context7 } from "@dxos/context";
+import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
+import { spaceGenesis, SnapshotManager } from "@dxos/echo-pipeline";
+import { PublicKey as PublicKey7 } from "@dxos/keys";
+import { log as log8 } from "@dxos/log";
+import { Presence } from "@dxos/teleport-extension-presence";
+import { ComplexMap as ComplexMap3, deferFunction as deferFunction2 } from "@dxos/util";
+
+// packages/sdk/client-services/src/packlets/spaces/data-space.ts
+import { trackLeaks } from "@dxos/async";
+import { Context as Context6 } from "@dxos/context";
+import { timed } from "@dxos/debug";
+import { DataPipelineControllerImpl, createMappedFeedWriter } from "@dxos/echo-pipeline";
+import { PublicKey as PublicKey6 } from "@dxos/keys";
+import { AdmittedFeed as AdmittedFeed3 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { ComplexSet as ComplexSet2 } from "@dxos/util";
+
+// packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
+import assert9 from "@dxos/node-std/assert";
+import { DeferredTask, Event as Event4, scheduleTask as scheduleTask3, TimeoutError, Trigger as Trigger4 } from "@dxos/async";
+import { Context as Context5 } from "@dxos/context";
+import { PublicKey as PublicKey5 } from "@dxos/keys";
+import { log as log7 } from "@dxos/log";
+import { schema as schema4 } from "@dxos/protocols";
+import { RpcExtension as RpcExtension3 } from "@dxos/teleport";
+import { ComplexMap as ComplexMap2, ComplexSet, entry } from "@dxos/util";
+var RETRY_TIMEOUT = 1e3;
+var NOTARIZE_TIMEOUT = 1e4;
+var NotarizationPlugin = class {
+  constructor() {
+    this._ctx = new Context5();
+    this._extensionOpened = new Event4();
+    this._extensions = /* @__PURE__ */ new Set();
+    this._processedCredentials = new ComplexSet(PublicKey5.hash);
+    this._processCredentialsTriggers = new ComplexMap2(PublicKey5.hash);
+  }
+  async open() {
+  }
+  async close() {
+    await this._ctx.dispose();
+  }
+  /**
+  * Request credentials to be notarized.
+  */
+  async notarize(credentials) {
+    log7("notarize", {
       credentials
     }, {
       file: "notarization-plugin.ts",
@@ -2131,11 +2143,11 @@ var NotarizationPlugin = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    assert10(credentials.every((credential) => credential.id), "Credentials must have an id");
+    assert9(credentials.every((credential) => credential.id), "Credentials must have an id");
     const errors = new Trigger4();
     const ctx = this._ctx.derive({
       onError: (err) => {
-        log8.warn("Notarization error", {
+        log7.warn("Notarization error", {
           err
         }, {
           file: "notarization-plugin.ts",
@@ -2148,7 +2160,7 @@ var NotarizationPlugin = class {
       }
     });
     scheduleTask3(ctx, () => {
-      log8.warn("Notarization timeout", {}, {
+      log7.warn("Notarization timeout", {}, {
         file: "notarization-plugin.ts",
         line: 61,
         scope: this,
@@ -2162,7 +2174,7 @@ var NotarizationPlugin = class {
     const notarizeTask = new DeferredTask(ctx, async () => {
       try {
         if (this._extensions.size === 0) {
-          log8.warn("No peers to notarize with", {}, {
+          log7.warn("No peers to notarize with", {}, {
             file: "notarization-plugin.ts",
             line: 76,
             scope: this,
@@ -2174,7 +2186,7 @@ var NotarizationPlugin = class {
           ...this._extensions
         ].find((peer2) => !peersTried.has(peer2));
         if (!peer) {
-          log8.warn("Exhausted all peers to notarize with", {
+          log7.warn("Exhausted all peers to notarize with", {
             retryIn: RETRY_TIMEOUT
           }, {
             file: "notarization-plugin.ts",
@@ -2187,7 +2199,7 @@ var NotarizationPlugin = class {
           return;
         }
         peersTried.add(peer);
-        log8("try notarizing", {
+        log7("try notarizing", {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
@@ -2199,14 +2211,14 @@ var NotarizationPlugin = class {
         await peer.rpc.NotarizationService.notarize({
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
-        log8("success", {}, {
+        log7("success", {}, {
           file: "notarization-plugin.ts",
           line: 94,
           scope: this,
           callSite: (f, a) => f(...a)
         });
       } catch (err) {
-        log8.warn("error notarizing (recoverable)", err, {
+        log7.warn("error notarizing (recoverable)", err, {
           file: "notarization-plugin.ts",
           line: 96,
           scope: this,
@@ -2222,7 +2234,7 @@ var NotarizationPlugin = class {
         allNotarized,
         errors.wait()
       ]);
-      log8("done", {}, {
+      log7("done", {}, {
         file: "notarization-plugin.ts",
         line: 107,
         scope: this,
@@ -2245,7 +2257,7 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    assert10(!this._writer, "Writer already set.");
+    assert9(!this._writer, "Writer already set.");
     this._writer = writer;
   }
   async _waitUntilProcessed(id) {
@@ -2263,7 +2275,7 @@ var NotarizationPlugin = class {
       throw new Error("Writer not set");
     }
     for (const credential of (_a = request.credentials) != null ? _a : []) {
-      assert10(credential.id, "Credential must have an id");
+      assert9(credential.id, "Credential must have an id");
       if (this._processedCredentials.has(credential.id)) {
         continue;
       }
@@ -2273,7 +2285,7 @@ var NotarizationPlugin = class {
   createExtension() {
     const extension = new NotarizationTeleportExtension({
       onOpen: async () => {
-        log8("extension opened", {
+        log7("extension opened", {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
@@ -2285,7 +2297,7 @@ var NotarizationPlugin = class {
         this._extensionOpened.emit();
       },
       onClose: async () => {
-        log8("extension closed", {
+        log7("extension closed", {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
@@ -2304,10 +2316,10 @@ var NotarizationTeleportExtension = class extends RpcExtension3 {
   constructor(_params) {
     super({
       requested: {
-        NotarizationService: schema5.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: schema4.getService("dxos.mesh.teleport.notarization.NotarizationService")
       },
       exposed: {
-        NotarizationService: schema5.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: schema4.getService("dxos.mesh.teleport.notarization.NotarizationService")
       }
     });
     this._params = _params;
@@ -2486,7 +2498,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     this._feedStore = _feedStore;
     this._snapshotStore = _snapshotStore;
     this._ctx = new Context7();
-    this.updated = new Event4();
+    this.updated = new Event5();
     this._spaces = new ComplexMap3(PublicKey7.hash);
   }
   // TODO(burdon): Remove.
@@ -2495,7 +2507,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   async open() {
     await this._metadataStore.load();
-    log9("metadata loaded", {
+    log8("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
       file: "data-space-manager.ts",
@@ -2504,7 +2516,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       callSite: (f, a) => f(...a)
     });
     for (const spaceMetadata of this._metadataStore.spaces) {
-      log9("load space", {
+      log8("load space", {
         spaceMetadata
       }, {
         file: "data-space-manager.ts",
@@ -2515,7 +2527,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       const space = await this._constructSpace(spaceMetadata);
       await space.initializeDataPipeline();
       if (spaceMetadata.dataTimeframe) {
-        log9("waiting for latest timeframe", {
+        log8("waiting for latest timeframe", {
           spaceMetadata
         }, {
           file: "data-space-manager.ts",
@@ -2550,7 +2562,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       controlFeedKey,
       dataFeedKey
     };
-    log9("creating space...", {
+    log8("creating space...", {
       spaceKey
     }, {
       file: "data-space-manager.ts",
@@ -2562,7 +2574,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    assert11(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    assert10(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
     await this._signingContext.recordCredential(memberCredential);
     await space.initializeDataPipeline();
     this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
@@ -2571,7 +2583,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
-    assert11(!this._spaces.has(opts.spaceKey), "Space already exists.");
+    assert10(!this._spaces.has(opts.spaceKey), "Space already exists.");
     const metadata = {
       key: opts.spaceKey,
       genesisFeedKey: opts.genesisFeedKey
@@ -2647,484 +2659,28 @@ DataSpaceManager = __decorate2([
   trackLeaks2("open", "close")
 ], DataSpaceManager);
 
-// packages/sdk/client-services/src/packlets/services/service-context.ts
-var ServiceContext = class {
-  // prettier-ignore
-  constructor(storage, networkManager, modelFactory) {
-    this.storage = storage;
-    this.networkManager = networkManager;
-    this.modelFactory = modelFactory;
-    this.initialized = new Trigger5();
-    this.dataServiceSubscriptions = new DataServiceSubscriptions();
-    this.metadataStore = new MetadataStore(storage.createDirectory("metadata"));
-    this.snapshotStore = new SnapshotStore(storage.createDirectory("snapshots"));
-    this.keyring = new Keyring(storage.createDirectory("keyring"));
-    this.feedStore = new FeedStore({
-      factory: new FeedFactory({
-        root: storage.createDirectory("feeds"),
-        signer: this.keyring,
-        hypercore: {
-          valueEncoding
-        }
-      })
-    });
-    this.spaceManager = new SpaceManager({
-      feedStore: this.feedStore,
-      networkManager: this.networkManager
-    });
-    this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
-    this.deviceInvitations = new DeviceInvitationsHandler({
-      networkManager: this.networkManager,
-      getIdentity: () => {
-        var _a;
-        return (_a = this.identityManager.identity) != null ? _a : failUndefined2();
-      },
-      acceptIdentity: this._acceptIdentity.bind(this),
-      keyring: this.keyring
-    });
+// packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
+import { EventSubscriptions as EventSubscriptions3, scheduleTask as scheduleTask4 } from "@dxos/async";
+import { Stream as Stream10 } from "@dxos/codec-protobuf";
+import { raise, todo as todo2 } from "@dxos/debug";
+import { SpaceNotFoundError } from "@dxos/echo-pipeline";
+import { log as log9 } from "@dxos/log";
+import { SpaceMember, SpaceStatus } from "@dxos/protocols/proto/dxos/client/services";
+import { humanize } from "@dxos/util";
+var SpacesServiceImpl = class {
+  constructor(_identityManager, _spaceManager, _dataServiceSubscriptions, _getDataSpaceManager) {
+    this._identityManager = _identityManager;
+    this._spaceManager = _spaceManager;
+    this._dataServiceSubscriptions = _dataServiceSubscriptions;
+    this._getDataSpaceManager = _getDataSpaceManager;
   }
-  async open() {
-    log10("opening...", {}, {
-      file: "service-context.ts",
-      line: 94,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await this.networkManager.open();
-    await this.spaceManager.open();
-    await this.identityManager.open();
-    if (this.identityManager.identity) {
-      await this._initialize();
+  async createSpace() {
+    if (!this._identityManager.identity) {
+      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/halo");
     }
-    log10("opened", {}, {
-      file: "service-context.ts",
-      line: 101,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-  }
-  async close() {
-    var _a, _b;
-    log10("closing...", {}, {
-      file: "service-context.ts",
-      line: 105,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await ((_a = this._deviceSpaceSync) == null ? void 0 : _a.close());
-    await ((_b = this.dataSpaceManager) == null ? void 0 : _b.close());
-    await this.identityManager.close();
-    await this.spaceManager.close();
-    await this.feedStore.close();
-    await this.networkManager.close();
-    this.dataServiceSubscriptions.clear();
-    log10("closed", {}, {
-      file: "service-context.ts",
-      line: 113,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-  }
-  async reset() {
-    log10("resetting...", {}, {
-      file: "service-context.ts",
-      line: 117,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await this.close();
-    await this.storage.reset();
-    log10("reset", {}, {
-      file: "service-context.ts",
-      line: 120,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-  }
-  async createIdentity(params = {}) {
-    const identity = await this.identityManager.createIdentity(params);
-    await this._initialize();
-    return identity;
-  }
-  async _acceptIdentity(params) {
-    const identity = await this.identityManager.acceptIdentity(params);
-    await this._initialize();
-    return identity;
-  }
-  // Called when identity is created.
-  async _initialize() {
-    var _a;
-    log10("initializing spaces...", {}, {
-      file: "service-context.ts",
-      line: 139,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    const identity = (_a = this.identityManager.identity) != null ? _a : failUndefined2();
-    const signingContext = {
-      credentialSigner: identity.getIdentityCredentialSigner(),
-      identityKey: identity.identityKey,
-      deviceKey: identity.deviceKey,
-      profile: identity.profileDocument,
-      recordCredential: async (credential) => {
-        await identity.controlPipeline.writer.write({
-          credential: {
-            credential
-          }
-        });
-      }
-    };
-    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.modelFactory, this.feedStore, this.snapshotStore);
-    await this.dataSpaceManager.open();
-    this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.dataSpaceManager, signingContext, this.keyring);
-    this.initialized.wake();
-    this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
-      process: async (credential) => {
-        const assertion = getCredentialAssertion3(credential);
-        if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
-          return;
-        }
-        if (assertion.spaceKey.equals(identity.space.key)) {
-          return;
-        }
-        if (!this.dataSpaceManager) {
-          log10("dataSpaceManager not initialized yet, ignoring space admission", {
-            details: assertion
-          }, {
-            file: "service-context.ts",
-            line: 182,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          return;
-        }
-        if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
-          log10("space already exists, ignoring space admission", {
-            details: assertion
-          }, {
-            file: "service-context.ts",
-            line: 186,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          return;
-        }
-        try {
-          log10("accepting space recorded in halo", {
-            details: assertion
-          }, {
-            file: "service-context.ts",
-            line: 191,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          await this.dataSpaceManager.acceptSpace({
-            spaceKey: assertion.spaceKey,
-            genesisFeedKey: assertion.genesisFeedKey
-          });
-        } catch (err) {
-          log10.catch(err, {}, {
-            file: "service-context.ts",
-            line: 197,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        }
-      }
-    });
-    await this._deviceSpaceSync.open();
-  }
-};
-
-// packages/sdk/client-services/src/packlets/services/service-definitions.ts
-import { schema as schema6 } from "@dxos/protocols";
-import { createServiceBundle } from "@dxos/rpc";
-var clientServiceBundle = createServiceBundle({
-  SystemService: schema6.getService("dxos.client.services.SystemService"),
-  IdentityService: schema6.getService("dxos.client.services.IdentityService"),
-  DeviceInvitationsService: schema6.getService("dxos.client.services.DeviceInvitationsService"),
-  DevicesService: schema6.getService("dxos.client.services.DevicesService"),
-  SpaceInvitationsService: schema6.getService("dxos.client.services.SpaceInvitationsService"),
-  SpacesService: schema6.getService("dxos.client.services.SpacesService"),
-  DataService: schema6.getService("dxos.echo.service.DataService"),
-  NetworkService: schema6.getService("dxos.client.services.NetworkService"),
-  // TODO(burdon): Deprecated.
-  DevtoolsHost: schema6.getService("dxos.devtools.host.DevtoolsHost"),
-  TracingService: schema6.getService("dxos.devtools.host.TracingService")
-});
-
-// packages/sdk/client-services/src/packlets/storage/storage.ts
-import { InvalidConfigError } from "@dxos/errors";
-import { Runtime } from "@dxos/protocols/proto/dxos/config";
-import { createStorage, StorageType } from "@dxos/random-access-storage";
-var StorageDriver = Runtime.Client.Storage.StorageDriver;
-var createStorageObjects = (config) => {
-  const { path = "dxos/storage", storageType, keyStorage, persistent = false } = config != null ? config : {};
-  if (persistent && storageType === StorageDriver.RAM) {
-    throw new InvalidConfigError("RAM storage cannot be used in persistent mode.");
-  }
-  if (!persistent && storageType !== void 0 && storageType !== StorageDriver.RAM) {
-    throw new InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
-  }
-  if (persistent && keyStorage === StorageDriver.RAM) {
-    throw new InvalidConfigError("RAM key storage cannot be used in persistent mode.");
-  }
-  if (!persistent && keyStorage !== StorageDriver.RAM && keyStorage !== void 0) {
-    throw new InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
-  }
-  return {
-    storage: createStorage({
-      type: persistent ? toStorageType(storageType) : StorageType.RAM,
-      root: `${path}/`
-    })
-  };
-};
-var toStorageType = (type) => {
-  switch (type) {
-    case void 0:
-      return void 0;
-    case StorageDriver.RAM:
-      return StorageType.RAM;
-    case StorageDriver.CHROME:
-      return StorageType.CHROME;
-    case StorageDriver.FIREFOX:
-      return StorageType.FIREFOX;
-    case StorageDriver.IDB:
-      return StorageType.IDB;
-    case StorageDriver.NODE:
-      return StorageType.NODE;
-    default:
-      throw new Error(`Invalid storage type: ${StorageDriver[type]}`);
-  }
-};
-
-// packages/sdk/client-services/src/packlets/vault/services.ts
-import { schema as schema7 } from "@dxos/protocols";
-var iframeServiceBundle = {
-  IframeService: schema7.getService("dxos.iframe.IframeService"),
-  BridgeService: schema7.getService("dxos.mesh.bridge.BridgeService")
-};
-var workerServiceBundle = {
-  WorkerService: schema7.getService("dxos.iframe.WorkerService")
-};
-var appServiceBundle = {
-  AppService: schema7.getService("dxos.iframe.AppService")
-};
-var shellServiceBundle = {
-  ShellService: schema7.getService("dxos.iframe.ShellService")
-};
-
-// packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
-import assert12 from "@dxos/node-std/assert";
-import { Event as Event5 } from "@dxos/async";
-import { ShellLayout } from "@dxos/protocols/proto/dxos/iframe";
-import { createProtoRpcPeer } from "@dxos/rpc";
-var ShellRuntimeImpl = class {
-  constructor(_port) {
-    this._port = _port;
-    this.layoutUpdate = new Event5();
-    this._layout = ShellLayout.DEFAULT;
-  }
-  get layout() {
-    return this._layout;
-  }
-  get invitationCode() {
-    return this._invitationCode;
-  }
-  get spaceKey() {
-    return this._spaceKey;
-  }
-  setLayout(layout, options = {}) {
-    this._layout = layout;
-    this._invitationCode = options.invitationCode;
-    this._spaceKey = options.spaceKey;
-    this.layoutUpdate.emit({
-      layout,
-      ...options
-    });
-  }
-  async setAppContext(context) {
-    assert12(this._appRpc, "runtime not open");
-    await this._appRpc.rpc.AppService.setContext(context);
-  }
-  async open() {
-    this._appRpc = createProtoRpcPeer({
-      requested: appServiceBundle,
-      exposed: shellServiceBundle,
-      handlers: {
-        ShellService: {
-          setLayout: async (request) => {
-            this._layout = request.layout;
-            this._invitationCode = request.invitationCode;
-            this._spaceKey = request.spaceKey;
-            this.layoutUpdate.emit(request);
-          }
-        }
-      },
-      port: this._port
-    });
-    await this._appRpc.open();
-  }
-  async close() {
-    var _a;
-    await ((_a = this._appRpc) == null ? void 0 : _a.close());
-    this._appRpc = void 0;
-  }
-};
-var MemoryShellRuntime = class {
-  constructor({ layout, invitationCode, spaceKey } = {}) {
-    this.layoutUpdate = new Event5();
-    this.contextUpdate = new Event5();
-    this._layout = layout != null ? layout : ShellLayout.DEFAULT;
-    this._invitationCode = invitationCode;
-    this._spaceKey = spaceKey;
-  }
-  get layout() {
-    return this._layout;
-  }
-  get invitationCode() {
-    return this._invitationCode;
-  }
-  get spaceKey() {
-    return this._spaceKey;
-  }
-  setLayout(layout, options = {}) {
-    this._layout = layout;
-    this._invitationCode = options.invitationCode;
-    this._spaceKey = options.spaceKey;
-    this.layoutUpdate.emit({
-      layout,
-      ...options
-    });
-  }
-  async setAppContext(context) {
-    this.contextUpdate.emit(context);
-  }
-};
-
-// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
-import { Trigger as Trigger9 } from "@dxos/async";
-import { log as log17, logInfo as logInfo2 } from "@dxos/log";
-import { MemorySignalManager as MemorySignalManager2, MemorySignalManagerContext as MemorySignalManagerContext2, WebsocketSignalManager as WebsocketSignalManager2 } from "@dxos/messaging";
-import { createWebRTCTransportFactory, NetworkManager as NetworkManager2 } from "@dxos/network-manager";
-import { createProtoRpcPeer as createProtoRpcPeer6 } from "@dxos/rpc";
-import { getAsyncValue } from "@dxos/util";
-
-// packages/sdk/client-services/src/packlets/services/service-host.ts
-import assert14 from "@dxos/node-std/assert";
-import { Event as Event7 } from "@dxos/async";
-import { raise as raise2 } from "@dxos/debug";
-import { DocumentModel } from "@dxos/document-model";
-import { DataServiceImpl } from "@dxos/echo-pipeline";
-import { log as log16 } from "@dxos/log";
-import { ModelFactory } from "@dxos/model-factory";
-import { SystemStatus } from "@dxos/protocols/proto/dxos/client/services";
-import { TextModel } from "@dxos/text-model";
-
-// packages/sdk/client-services/src/packlets/deprecated/tracing.ts
-var TracingServiceImpl = class {
-  constructor(_config) {
-    this._config = _config;
-  }
-  async setTracingOptions() {
-    throw new Error("Tracing not available.");
-  }
-  subscribeToRpcTrace() {
-    throw new Error("Tracing not available.");
-  }
-};
-
-// packages/sdk/client-services/src/packlets/devices/devices-service.ts
-import { EventSubscriptions as EventSubscriptions2 } from "@dxos/async";
-import { Stream as Stream8 } from "@dxos/codec-protobuf";
-import { DeviceKind } from "@dxos/protocols/proto/dxos/client/services";
-var DevicesServiceImpl = class {
-  constructor(_identityManager) {
-    this._identityManager = _identityManager;
-  }
-  updateDevice(request) {
-    throw new Error("Method not implemented.");
-  }
-  queryDevices() {
-    return new Stream8(({ next }) => {
-      const update = () => {
-        var _a;
-        const deviceKeys = (_a = this._identityManager.identity) == null ? void 0 : _a.authorizedDeviceKeys;
-        if (!deviceKeys) {
-          next({
-            devices: []
-          });
-        } else {
-          next({
-            devices: Array.from(deviceKeys.values()).map((key) => {
-              var _a2;
-              return {
-                deviceKey: key,
-                kind: ((_a2 = this._identityManager.identity) == null ? void 0 : _a2.deviceKey.equals(key)) ? DeviceKind.CURRENT : DeviceKind.TRUSTED
-              };
-            })
-          });
-        }
-      };
-      const subscriptions = new EventSubscriptions2();
-      subscriptions.add(this._identityManager.stateUpdate.on(() => {
-        update();
-        if (this._identityManager.identity) {
-          subscriptions.add(this._identityManager.identity.stateUpdate.on(() => {
-            update();
-          }));
-        }
-      }));
-      update();
-      return () => subscriptions.clear();
-    });
-  }
-};
-
-// packages/sdk/client-services/src/packlets/network/network-service.ts
-import { Stream as Stream9 } from "@dxos/codec-protobuf";
-var NetworkServiceImpl = class {
-  constructor(networkManager) {
-    this.networkManager = networkManager;
-  }
-  subscribeToNetworkStatus() {
-    return new Stream9(({ next }) => {
-      const unsubscribe = this.networkManager.connectionStateChanged.on((state) => next({
-        state
-      }));
-      next({
-        state: this.networkManager.connectionState
-      });
-      return unsubscribe;
-    });
-  }
-  async setNetworkOptions(request) {
-    await this.networkManager.setConnectionState(request.state);
-  }
-};
-
-// packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
-import { EventSubscriptions as EventSubscriptions3, scheduleTask as scheduleTask4 } from "@dxos/async";
-import { Stream as Stream10 } from "@dxos/codec-protobuf";
-import { raise, todo as todo2 } from "@dxos/debug";
-import { SpaceNotFoundError } from "@dxos/echo-pipeline";
-import { log as log11 } from "@dxos/log";
-import { SpaceMember, SpaceStatus } from "@dxos/protocols/proto/dxos/client/services";
-import { humanize } from "@dxos/util";
-var SpacesServiceImpl = class {
-  constructor(_identityManager, _spaceManager, _dataServiceSubscriptions, _getDataSpaceManager) {
-    this._identityManager = _identityManager;
-    this._spaceManager = _spaceManager;
-    this._dataServiceSubscriptions = _dataServiceSubscriptions;
-    this._getDataSpaceManager = _getDataSpaceManager;
-  }
-  async createSpace() {
-    if (!this._identityManager.identity) {
-      throw new Error("This device has no HALO identity available. See https://docs.dxos.org/guide/halo");
-    }
-    const dataSpaceManager = await this._getDataSpaceManager();
-    const space = await dataSpaceManager.createSpace();
-    return this._transformSpace(space);
+    const dataSpaceManager = await this._getDataSpaceManager();
+    const space = await dataSpaceManager.createSpace();
+    return this._transformSpace(space);
   }
   async updateSpace(request) {
     todo2();
@@ -3134,7 +2690,7 @@ var SpacesServiceImpl = class {
       const onUpdate = async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const spaces = Array.from(dataSpaceManager.spaces.values()).filter((space) => this._dataServiceSubscriptions.getDataService(space.key)).map((space) => this._transformSpace(space));
-        log11("update", {
+        log9("update", {
           spaces
         }, {
           file: "spaces-service.ts",
@@ -3231,7 +2787,8 @@ var SystemServiceImpl = class {
     this._onReset = onReset;
   }
   async getConfig() {
-    return this._config.values;
+    var _a, _b;
+    return (_b = (_a = this._config) == null ? void 0 : _a.values) != null ? _b : {};
   }
   async updateStatus({ status }) {
     await this._onUpdateStatus(status);
@@ -3258,6 +2815,7 @@ var SystemServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
+import { iframeServiceBundle, workerServiceBundle } from "@dxos/client";
 import { WebRTCTransportService } from "@dxos/network-manager";
 import { createProtoRpcPeer as createProtoRpcPeer2 } from "@dxos/rpc";
 var IFrameProxyRuntime = class {
@@ -3305,72 +2863,9 @@ var IFrameProxyRuntime = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/vault/shell-controller.ts
-import { Event as Event6 } from "@dxos/async";
-import { log as log12 } from "@dxos/log";
-import { ShellDisplay } from "@dxos/protocols/proto/dxos/iframe";
-import { createProtoRpcPeer as createProtoRpcPeer3 } from "@dxos/rpc";
-var ShellController = class {
-  constructor(_port) {
-    this._port = _port;
-    this.contextUpdate = new Event6();
-    this._display = ShellDisplay.NONE;
-  }
-  get display() {
-    return this._display;
-  }
-  async setLayout(layout, options = {}) {
-    var _a;
-    log12("set layout", {
-      layout,
-      ...options
-    }, {
-      file: "shell-controller.ts",
-      line: 27,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    this._display = ShellDisplay.FULLSCREEN;
-    this.contextUpdate.emit({
-      display: this._display
-    });
-    await ((_a = this._shellRpc) == null ? void 0 : _a.rpc.ShellService.setLayout({
-      layout,
-      ...options
-    }));
-  }
-  async open() {
-    this._shellRpc = createProtoRpcPeer3({
-      requested: shellServiceBundle,
-      exposed: appServiceBundle,
-      handlers: {
-        AppService: {
-          setContext: async (request) => {
-            log12("set context", request, {
-              file: "shell-controller.ts",
-              line: 40,
-              scope: this,
-              callSite: (f, a) => f(...a)
-            });
-            this._display = request.display;
-            this.contextUpdate.emit(request);
-          }
-        }
-      },
-      port: this._port
-    });
-    await this._shellRpc.open();
-  }
-  async close() {
-    var _a;
-    await ((_a = this._shellRpc) == null ? void 0 : _a.close());
-    this._shellRpc = void 0;
-  }
-};
-
 // packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
-import { asyncTimeout, Trigger as Trigger6 } from "@dxos/async";
-import { log as log13 } from "@dxos/log";
+import { asyncTimeout, Trigger as Trigger5 } from "@dxos/async";
+import { log as log10 } from "@dxos/log";
 var Message;
 (function(Message2) {
   Message2["ACQUIRING"] = "acquiring";
@@ -3378,7 +2873,7 @@ var Message;
 var VaultResourceLock = class {
   constructor({ lockKey, onAcquire, onRelease }) {
     this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
-    this._releaseTrigger = new Trigger6();
+    this._releaseTrigger = new Trigger5();
     this._lockKey = lockKey;
     this._onAcquire = onAcquire;
     this._onRelease = onRelease;
@@ -3403,7 +2898,7 @@ var VaultResourceLock = class {
     }
   }
   async _requestLock(steal = false) {
-    log13("requesting lock...", {
+    log10("requesting lock...", {
       steal
     }, {
       file: "vault-resource-lock.ts",
@@ -3411,23 +2906,23 @@ var VaultResourceLock = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const acquired = new Trigger6();
+    const acquired = new Trigger5();
     void navigator.locks.request(this._lockKey, {
       steal
     }, async () => {
       var _a, _b;
       await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
       acquired.wake();
-      this._releaseTrigger = new Trigger6();
+      this._releaseTrigger = new Trigger5();
       await this._releaseTrigger.wait();
-      log13("releasing lock...", {}, {
+      log10("releasing lock...", {}, {
         file: "vault-resource-lock.ts",
         line: 65,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       await ((_b = this._onRelease) == null ? void 0 : _b.call(this));
-      log13("released lock", {}, {
+      log10("released lock", {}, {
         file: "vault-resource-lock.ts",
         line: 67,
         scope: this,
@@ -3438,7 +2933,7 @@ var VaultResourceLock = class {
       await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
     });
     await acquired.wait();
-    log13("recieved lock", {
+    log10("recieved lock", {
       steal
     }, {
       file: "vault-resource-lock.ts",
@@ -3450,17 +2945,73 @@ var VaultResourceLock = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
-import { Trigger as Trigger8 } from "@dxos/async";
-import { log as log15 } from "@dxos/log";
+import { Trigger as Trigger7 } from "@dxos/async";
+import { log as log12 } from "@dxos/log";
 import { MemorySignalManager, MemorySignalManagerContext, WebsocketSignalManager } from "@dxos/messaging";
 import { NetworkManager, WebRTCTransportProxyFactory } from "@dxos/network-manager";
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
-import assert13 from "@dxos/node-std/assert";
-import { asyncTimeout as asyncTimeout2, Trigger as Trigger7 } from "@dxos/async";
-import { log as log14, logInfo } from "@dxos/log";
-import { createProtoRpcPeer as createProtoRpcPeer4 } from "@dxos/rpc";
+import assert11 from "@dxos/node-std/assert";
+import { asyncTimeout as asyncTimeout2, Trigger as Trigger6 } from "@dxos/async";
+import { iframeServiceBundle as iframeServiceBundle2, workerServiceBundle as workerServiceBundle2 } from "@dxos/client";
+import { log as log11, logInfo } from "@dxos/log";
+import { createProtoRpcPeer as createProtoRpcPeer3 } from "@dxos/rpc";
 import { Callback } from "@dxos/util";
+
+// packages/sdk/client-services/src/packlets/services/client-rpc-server.ts
+import { Stream as Stream12 } from "@dxos/codec-protobuf";
+import { raise as raise2 } from "@dxos/debug";
+import { parseMethodName, RpcPeer } from "@dxos/rpc";
+var ClientRpcServer = class {
+  constructor(params) {
+    this._handlerCache = /* @__PURE__ */ new Map();
+    const { serviceRegistry, handleCall, handleStream, ...rpcOptions } = params;
+    this._handleCall = handleCall;
+    this._handleStream = handleStream;
+    this._serviceRegistry = serviceRegistry;
+    this._rpcPeer = new RpcPeer({
+      ...rpcOptions,
+      callHandler: (method, params2) => {
+        const [serviceName, methodName] = parseMethodName(method);
+        const handler = (method2, params3) => this._getServiceHandler(serviceName).call(method2, params3);
+        if (this._handleCall) {
+          return this._handleCall(methodName, params2, handler);
+        } else {
+          return handler(methodName, params2);
+        }
+      },
+      streamHandler: (method, params2) => {
+        const [serviceName, methodName] = parseMethodName(method);
+        const handler = (method2, params3) => this._getServiceHandler(serviceName).callStream(method2, params3);
+        if (this._handleStream) {
+          return Stream12.unwrapPromise(this._handleStream(methodName, params2, handler));
+        } else {
+          return handler(methodName, params2);
+        }
+      }
+    });
+  }
+  async open() {
+    await this._rpcPeer.open();
+  }
+  async close() {
+    await this._rpcPeer.close();
+  }
+  _getServiceHandler(serviceName) {
+    var _a;
+    if (!this._handlerCache.has(serviceName)) {
+      const [key, descriptor] = (_a = Object.entries(this._serviceRegistry.descriptors).find(([key2, descriptor2]) => descriptor2.name === serviceName)) != null ? _a : raise2(new Error(`Service not available: ${serviceName}`));
+      const service = this._serviceRegistry.services[key];
+      if (!service) {
+        throw new Error(`Service not available: ${serviceName}`);
+      }
+      this._handlerCache.set(serviceName, descriptor.createServer(service));
+    }
+    return this._handlerCache.get(serviceName);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/worker-session.ts
 var __decorate3 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -3472,40 +3023,48 @@ var __decorate3 = function(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 var WorkerSession = class {
-  constructor({ getService, systemPort, appPort, shellPort, options = {
+  constructor({ serviceHost, systemPort, appPort, shellPort, readySignal, options = {
     heartbeatInterval: 1e3
   } }) {
-    this._startTrigger = new Trigger7();
+    this._startTrigger = new Trigger6();
     this.onClose = new Callback();
-    assert13(options);
-    assert13(getService);
+    assert11(options);
+    assert11(serviceHost);
     this._options = options;
-    this._getService = getService;
-    const handlers = {
-      DataService: () => this._getService((services) => services.DataService),
-      DeviceInvitationsService: () => this._getService((services) => services.DeviceInvitationsService),
-      DevicesService: () => this._getService((services) => services.DevicesService),
-      DevtoolsHost: () => this._getService((services) => services.DevtoolsHost),
-      NetworkService: () => this._getService((services) => services.NetworkService),
-      IdentityService: () => this._getService((services) => services.IdentityService),
-      SpaceInvitationsService: () => this._getService((services) => services.SpaceInvitationsService),
-      SpacesService: () => this._getService((services) => services.SpacesService),
-      SystemService: () => this._getService((services) => services.SystemService),
-      TracingService: () => this._getService((services) => services.TracingService)
+    this._serviceHost = serviceHost;
+    const middleware = {
+      handleCall: async (method, params, handler) => {
+        const error = await readySignal.wait({
+          timeout: 3e3
+        });
+        if (error) {
+          throw error;
+        }
+        return handler(method, params);
+      },
+      handleStream: async (method, params, handler) => {
+        const error = await readySignal.wait({
+          timeout: 3e3
+        });
+        if (error) {
+          throw error;
+        }
+        return handler(method, params);
+      }
     };
-    this._clientRpc = createProtoRpcPeer4({
-      exposed: clientServiceBundle,
-      handlers,
-      port: appPort
-    });
-    this._shellClientRpc = createProtoRpcPeer4({
-      exposed: clientServiceBundle,
-      handlers,
-      port: shellPort
-    });
-    this._iframeRpc = createProtoRpcPeer4({
-      requested: iframeServiceBundle,
-      exposed: workerServiceBundle,
+    this._clientRpc = new ClientRpcServer({
+      serviceRegistry: this._serviceHost.serviceRegistry,
+      port: appPort,
+      ...middleware
+    });
+    this._shellClientRpc = new ClientRpcServer({
+      serviceRegistry: this._serviceHost.serviceRegistry,
+      port: shellPort,
+      ...middleware
+    });
+    this._iframeRpc = createProtoRpcPeer3({
+      requested: iframeServiceBundle2,
+      exposed: workerServiceBundle2,
       handlers: {
         WorkerService: {
           start: async (request) => {
@@ -3517,9 +3076,9 @@ var WorkerSession = class {
               try {
                 await this.close();
               } catch (err) {
-                log14.catch(err, {}, {
+                log11.catch(err, {}, {
                   file: "worker-session.ts",
-                  line: 91,
+                  line: 107,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -3535,9 +3094,9 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    log14.info("opening..", {}, {
+    log11.info("opening..", {}, {
       file: "worker-session.ts",
-      line: 105,
+      line: 121,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3553,20 +3112,20 @@ var WorkerSession = class {
       try {
         await this._iframeRpc.rpc.IframeService.heartbeat();
       } catch (err1) {
-        log14.warn("Heartbeat failed", {
+        log11.warn("Heartbeat failed", {
           err: err1
         }, {
           file: "worker-session.ts",
-          line: 117,
+          line: 133,
           scope: this,
           callSite: (f, a) => f(...a)
         });
         try {
           await this.close();
         } catch (err) {
-          log14.catch(err, {}, {
+          log11.catch(err, {}, {
             file: "worker-session.ts",
-            line: 121,
+            line: 137,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -3575,18 +3134,18 @@ var WorkerSession = class {
     }, this._options.heartbeatInterval);
   }
   async close() {
-    log14.info("closing..", {}, {
+    log11.info("closing..", {}, {
       file: "worker-session.ts",
-      line: 128,
+      line: 144,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     try {
       await this.onClose.callIfSet();
     } catch (err) {
-      log14.catch(err, {}, {
+      log11.catch(err, {}, {
         file: "worker-session.ts",
-        line: 132,
+        line: 148,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3603,9 +3162,9 @@ var WorkerSession = class {
     try {
       await asyncTimeout2(this._shellClientRpc.open(), 1e3);
     } catch (e) {
-      log14.info("No shell connected.", {}, {
+      log11.info("No shell connected.", {}, {
         file: "worker-session.ts",
-        line: 146,
+        line: 162,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3622,20 +3181,21 @@ var WorkerRuntime = class {
   constructor(_configProvider) {
     this._configProvider = _configProvider;
     this._transportFactory = new WebRTCTransportProxyFactory();
-    this._ready = new Trigger8();
+    this._ready = new Trigger7();
     this.sessions = /* @__PURE__ */ new Set();
+    this._clientServices = new ClientServicesHost();
   }
   async start() {
-    log15("starting...", {}, {
+    log12("starting...", {}, {
       file: "worker-runtime.ts",
-      line: 42,
+      line: 44,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     try {
       this._config = await this._configProvider();
       const signalServer = this._config.get("runtime.services.signal.server");
-      this._clientServices = new ClientServicesHost({
+      this._clientServices.initialize({
         config: this._config,
         networkManager: new NetworkManager({
           log: true,
@@ -3647,17 +3207,17 @@ var WorkerRuntime = class {
       });
       await this._clientServices.open();
       this._ready.wake(void 0);
-      log15("started", {}, {
+      log12("started", {}, {
         file: "worker-runtime.ts",
-        line: 59,
+        line: 61,
         scope: this,
         callSite: (f, a) => f(...a)
       });
     } catch (err) {
       this._ready.wake(err);
-      log15.catch(err, {}, {
+      log12.catch(err, {}, {
         file: "worker-runtime.ts",
-        line: 62,
+        line: 64,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3671,17 +3231,7 @@ var WorkerRuntime = class {
   */
   async createSession({ appPort, systemPort, shellPort }) {
     const session = new WorkerSession({
-      getService: async (find) => {
-        const error = await this._ready.wait();
-        if (error) {
-          throw error;
-        }
-        const service = find(this._clientServices.services);
-        if (!service) {
-          throw new Error("Service not found");
-        }
-        return service;
-      },
+      serviceHost: this._clientServices,
       appPort,
       systemPort,
       shellPort,
@@ -3716,10 +3266,206 @@ var WorkerRuntime = class {
   }
 };
 
+// packages/sdk/client-services/src/packlets/services/service-context.ts
+import { Trigger as Trigger8 } from "@dxos/async";
+import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
+import { failUndefined as failUndefined2 } from "@dxos/debug";
+import { valueEncoding, MetadataStore, SpaceManager, DataServiceSubscriptions, SnapshotStore } from "@dxos/echo-pipeline";
+import { FeedFactory, FeedStore } from "@dxos/feed-store";
+import { Keyring } from "@dxos/keyring";
+import { log as log13 } from "@dxos/log";
+var ServiceContext = class {
+  // prettier-ignore
+  constructor(storage, networkManager, modelFactory) {
+    this.storage = storage;
+    this.networkManager = networkManager;
+    this.modelFactory = modelFactory;
+    this.initialized = new Trigger8();
+    this.dataServiceSubscriptions = new DataServiceSubscriptions();
+    this.metadataStore = new MetadataStore(storage.createDirectory("metadata"));
+    this.snapshotStore = new SnapshotStore(storage.createDirectory("snapshots"));
+    this.keyring = new Keyring(storage.createDirectory("keyring"));
+    this.feedStore = new FeedStore({
+      factory: new FeedFactory({
+        root: storage.createDirectory("feeds"),
+        signer: this.keyring,
+        hypercore: {
+          valueEncoding
+        }
+      })
+    });
+    this.spaceManager = new SpaceManager({
+      feedStore: this.feedStore,
+      networkManager: this.networkManager
+    });
+    this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
+    this.deviceInvitations = new DeviceInvitationsHandler({
+      networkManager: this.networkManager,
+      getIdentity: () => {
+        var _a;
+        return (_a = this.identityManager.identity) != null ? _a : failUndefined2();
+      },
+      acceptIdentity: this._acceptIdentity.bind(this),
+      keyring: this.keyring
+    });
+  }
+  async open() {
+    log13("opening...", {}, {
+      file: "service-context.ts",
+      line: 94,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this.networkManager.open();
+    await this.spaceManager.open();
+    await this.identityManager.open();
+    if (this.identityManager.identity) {
+      await this._initialize();
+    }
+    log13("opened", {}, {
+      file: "service-context.ts",
+      line: 101,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+  async close() {
+    var _a, _b;
+    log13("closing...", {}, {
+      file: "service-context.ts",
+      line: 105,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await ((_a = this._deviceSpaceSync) == null ? void 0 : _a.close());
+    await ((_b = this.dataSpaceManager) == null ? void 0 : _b.close());
+    await this.identityManager.close();
+    await this.spaceManager.close();
+    await this.feedStore.close();
+    await this.networkManager.close();
+    this.dataServiceSubscriptions.clear();
+    log13("closed", {}, {
+      file: "service-context.ts",
+      line: 113,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+  async reset() {
+    log13("resetting...", {}, {
+      file: "service-context.ts",
+      line: 117,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this.close();
+    await this.storage.reset();
+    log13("reset", {}, {
+      file: "service-context.ts",
+      line: 120,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+  async createIdentity(params = {}) {
+    const identity = await this.identityManager.createIdentity(params);
+    await this._initialize();
+    return identity;
+  }
+  async _acceptIdentity(params) {
+    const identity = await this.identityManager.acceptIdentity(params);
+    await this._initialize();
+    return identity;
+  }
+  // Called when identity is created.
+  async _initialize() {
+    var _a;
+    log13("initializing spaces...", {}, {
+      file: "service-context.ts",
+      line: 139,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    const identity = (_a = this.identityManager.identity) != null ? _a : failUndefined2();
+    const signingContext = {
+      credentialSigner: identity.getIdentityCredentialSigner(),
+      identityKey: identity.identityKey,
+      deviceKey: identity.deviceKey,
+      profile: identity.profileDocument,
+      recordCredential: async (credential) => {
+        await identity.controlPipeline.writer.write({
+          credential: {
+            credential
+          }
+        });
+      }
+    };
+    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.modelFactory, this.feedStore, this.snapshotStore);
+    await this.dataSpaceManager.open();
+    this.spaceInvitations = new SpaceInvitationsHandler(this.networkManager, this.dataSpaceManager, signingContext, this.keyring);
+    this.initialized.wake();
+    this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
+      process: async (credential) => {
+        const assertion = getCredentialAssertion3(credential);
+        if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
+          return;
+        }
+        if (assertion.spaceKey.equals(identity.space.key)) {
+          return;
+        }
+        if (!this.dataSpaceManager) {
+          log13("dataSpaceManager not initialized yet, ignoring space admission", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 182,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
+          log13("space already exists, ignoring space admission", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 186,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        try {
+          log13("accepting space recorded in halo", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 191,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          await this.dataSpaceManager.acceptSpace({
+            spaceKey: assertion.spaceKey,
+            genesisFeedKey: assertion.genesisFeedKey
+          });
+        } catch (err) {
+          log13.catch(err, {}, {
+            file: "service-context.ts",
+            line: 197,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+      }
+    });
+    await this._deviceSpaceSync.open();
+  }
+};
+
 // packages/sdk/client-services/src/packlets/services/service-registry.ts
 var ServiceRegistry = class {
   // prettier-ignore
-  constructor(_serviceBundle, _handlers) {
+  constructor(_serviceBundle, _handlers = {}) {
     this._serviceBundle = _serviceBundle;
     this._handlers = _handlers;
   }
@@ -3732,28 +3478,35 @@ var ServiceRegistry = class {
   setServices(services) {
     this._handlers = services;
   }
+  addService(name, service) {
+    this._handlers[name] = service;
+  }
+  removeService(name) {
+    delete this._handlers[name];
+  }
 };
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-var createDefaultModelFactory = () => {
-  return new ModelFactory().registerModel(DocumentModel).registerModel(TextModel);
-};
 var ClientServicesHost = class {
   constructor({
     config,
     modelFactory = createDefaultModelFactory(),
     // TODO(burdon): Create ApolloLink abstraction (see Client).
     networkManager,
-    storage = createStorageObjects(config.get("runtime.client.storage", {})).storage,
+    storage,
     // TODO(wittjosiah): Turn this on by default.
     lockKey
-  }) {
-    this._statusUpdate = new Event7();
+  } = {}) {
+    this._statusUpdate = new Event6();
     this._open = false;
-    this._config = config;
-    this._modelFactory = modelFactory;
-    this._networkManager = networkManager;
     this._storage = storage;
+    this._modelFactory = modelFactory;
+    if (config) {
+      this.initialize({
+        config,
+        networkManager
+      });
+    }
     this._resourceLock = lockKey ? new VaultResourceLock({
       lockKey,
       onAcquire: () => this.open(),
@@ -3772,7 +3525,7 @@ var ClientServicesHost = class {
         }
       },
       onReset: async () => {
-        assert14(this._serviceContext, "service host is closed");
+        assert12(this._serviceContext, "service host is closed");
         await this._serviceContext.reset();
       }
     });
@@ -3783,20 +3536,45 @@ var ClientServicesHost = class {
   get isOpen() {
     return this._open;
   }
+  get serviceRegistry() {
+    return this._serviceRegistry;
+  }
   get descriptors() {
     return this._serviceRegistry.descriptors;
   }
   get services() {
     return this._serviceRegistry.services;
   }
+  /**
+  * Initialize the service host with the config.
+  * Config can also be provided in the constructor.
+  * Can only be called once.
+  */
+  initialize({ config, networkManager }) {
+    assert12(!this._open, "service host is open");
+    if (config) {
+      assert12(!this._config, "config already set");
+      this._config = config;
+      if (!this._storage) {
+        this._storage = createStorageObjects(config.get("runtime.client.storage", {})).storage;
+      }
+    }
+    if (networkManager) {
+      assert12(!this._networkManager, "network manager already set");
+      this._networkManager = networkManager;
+    }
+  }
   async open() {
     var _a, _b;
     if (this._open) {
       return;
     }
-    log16("opening...", {}, {
+    assert12(this._config, "config not set");
+    assert12(this._storage, "storage not set");
+    assert12(this._networkManager, "network manager not set");
+    log14("opening...", {}, {
       file: "service-host.ts",
-      line: 133,
+      line: 166,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3809,10 +3587,10 @@ var ClientServicesHost = class {
       DeviceInvitationsService: new DeviceInvitationsServiceImpl(this._serviceContext.identityManager, this._serviceContext.deviceInvitations),
       SpaceInvitationsService: new SpaceInvitationsServiceImpl(this._serviceContext.identityManager, () => {
         var _a2;
-        return (_a2 = this._serviceContext.spaceInvitations) != null ? _a2 : raise2(new Error("SpaceInvitations not initialized"));
+        return (_a2 = this._serviceContext.spaceInvitations) != null ? _a2 : raise3(new Error("SpaceInvitations not initialized"));
       }, () => {
         var _a2;
-        return (_a2 = this._serviceContext.dataSpaceManager) != null ? _a2 : raise2(new Error("SpaceManager not initialized"));
+        return (_a2 = this._serviceContext.dataSpaceManager) != null ? _a2 : raise3(new Error("SpaceManager not initialized"));
       }),
       SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, this._serviceContext.dataServiceSubscriptions, async () => {
         await this._serviceContext.initialized.wait();
@@ -3832,11 +3610,11 @@ var ClientServicesHost = class {
     this._open = true;
     this._statusUpdate.emit();
     const deviceKey = (_b = this._serviceContext.identityManager.identity) == null ? void 0 : _b.deviceKey;
-    log16("opened", {
+    log14("opened", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 186,
+      line: 219,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3847,11 +3625,11 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    log16("closing...", {
+    log14("closing...", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 195,
+      line: 228,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3861,49 +3639,17 @@ var ClientServicesHost = class {
     await this._serviceContext.close();
     this._open = false;
     this._statusUpdate.emit();
-    log16("closed", {
+    log14("closed", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 200,
+      line: 233,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
 };
 
-// packages/sdk/client-services/src/packlets/services/service-proxy.ts
-import { asyncTimeout as asyncTimeout3 } from "@dxos/async";
-import { RemoteServiceConnectionTimeout } from "@dxos/errors";
-import { createProtoRpcPeer as createProtoRpcPeer5 } from "@dxos/rpc";
-var ClientServicesProxy = class {
-  // prettier-ignore
-  constructor(port, _timeout = 3e4) {
-    this._timeout = _timeout;
-    this._proxy = createProtoRpcPeer5({
-      requested: clientServiceBundle,
-      exposed: {},
-      handlers: {},
-      port
-    });
-  }
-  get proxy() {
-    return this._proxy;
-  }
-  get descriptors() {
-    return clientServiceBundle;
-  }
-  get services() {
-    return this._proxy.rpc;
-  }
-  async open() {
-    await asyncTimeout3(this._proxy.open(), this._timeout, new RemoteServiceConnectionTimeout());
-  }
-  async close() {
-    await this._proxy.close();
-  }
-};
-
 // packages/sdk/client-services/src/packlets/services/local-client-services.ts
 var LocalClientServices = class {
   constructor(params) {
@@ -3915,6 +3661,9 @@ var LocalClientServices = class {
   get services() {
     return this._host.services;
   }
+  get host() {
+    return this._host;
+  }
   async open() {
     await this._host.open();
   }
@@ -3923,6 +3672,43 @@ var LocalClientServices = class {
   }
 };
 
+// packages/sdk/client-services/src/packlets/services/utils.ts
+import { Config } from "@dxos/config";
+import { log as log15 } from "@dxos/log";
+import { MemorySignalManager as MemorySignalManager2, MemorySignalManagerContext as MemorySignalManagerContext2, WebsocketSignalManager as WebsocketSignalManager2 } from "@dxos/messaging";
+import { createWebRTCTransportFactory, MemoryTransportFactory, NetworkManager as NetworkManager2 } from "@dxos/network-manager";
+var fromHost = (config = new Config()) => {
+  return new LocalClientServices({
+    config,
+    networkManager: createNetworkManager(config)
+  });
+};
+var createNetworkManager = (config, options = {}) => {
+  const signalServer = config.get("runtime.services.signal.server");
+  if (signalServer) {
+    const { log: log1 = true, signalManager = new WebsocketSignalManager2([
+      signalServer
+    ]), transportFactory = createWebRTCTransportFactory({
+      iceServers: config.get("runtime.services.ice")
+    }) } = options;
+    return new NetworkManager2({
+      log: log1,
+      signalManager,
+      transportFactory
+    });
+  }
+  log15.warn("P2P network is not configured.", {}, {
+    file: "utils.ts",
+    line: 48,
+    scope: void 0,
+    callSite: (f, a) => f(...a)
+  });
+  return new NetworkManager2({
+    signalManager: new MemorySignalManager2(new MemorySignalManagerContext2()),
+    transportFactory: MemoryTransportFactory
+  });
+};
+
 // packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
 var __decorate4 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3937,22 +3723,11 @@ var __decorate4 = function(decorators, target, key, desc) {
 var LOCK_KEY = "DXOS_RESOURCE_LOCK";
 var IFrameHostRuntime = class {
   constructor({ configProvider, appPort, shellPort }) {
-    this._transportFactory = createWebRTCTransportFactory();
+    this._transportFactory = createWebRTCTransportFactory2();
     this._ready = new Trigger9();
     this._configProvider = configProvider;
     this._appPort = appPort;
     this._shellPort = shellPort;
-    this._getService = async (find) => {
-      const error = await this._ready.wait();
-      if (error) {
-        throw error;
-      }
-      const service = await find(this._clientServices.services);
-      if (!service) {
-        throw new Error("Service not found");
-      }
-      return service;
-    };
     if (this._shellPort) {
       this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
     }
@@ -3965,9 +3740,9 @@ var IFrameHostRuntime = class {
   }
   async start() {
     var _a;
-    log17("starting...", {}, {
+    log16("starting...", {}, {
       file: "iframe-host-runtime.ts",
-      line: 83,
+      line: 67,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3977,29 +3752,38 @@ var IFrameHostRuntime = class {
       this._clientServices = new LocalClientServices({
         lockKey: LOCK_KEY,
         config: this._config,
-        networkManager: new NetworkManager2({
+        networkManager: new NetworkManager3({
           log: true,
-          signalManager: signalServer ? new WebsocketSignalManager2([
+          signalManager: signalServer ? new WebsocketSignalManager3([
             signalServer
-          ]) : new MemorySignalManager2(new MemorySignalManagerContext2()),
+          ]) : new MemorySignalManager3(new MemorySignalManagerContext3()),
           transportFactory: this._transportFactory
         })
       });
-      this._clientRpc = createProtoRpcPeer6({
-        exposed: clientServiceBundle,
-        handlers: {
-          DataService: async () => await this._getService((services) => services.DataService),
-          DeviceInvitationsService: async () => await this._getService((services) => services.DeviceInvitationsService),
-          DevicesService: async () => await this._getService((services) => services.DevicesService),
-          DevtoolsHost: async () => await this._getService((services) => services.DevtoolsHost),
-          NetworkService: async () => await this._getService((services) => services.NetworkService),
-          IdentityService: async () => await this._getService((services) => services.IdentityService),
-          SpaceInvitationsService: async () => await this._getService((services) => services.SpaceInvitationsService),
-          SpacesService: async () => await this._getService((services) => services.SpacesService),
-          SystemService: async () => await this._getService((services) => services.SystemService),
-          TracingService: async () => await this._getService((services) => services.TracingService)
+      const middleware = {
+        handleCall: async (method, params, handler) => {
+          const error = await this._ready.wait({
+            timeout: 3e3
+          });
+          if (error) {
+            throw error;
+          }
+          return handler(method, params);
         },
-        port: this._appPort
+        handleStream: async (method, params, handler) => {
+          const error = await this._ready.wait({
+            timeout: 3e3
+          });
+          if (error) {
+            throw error;
+          }
+          return handler(method, params);
+        }
+      };
+      this._clientRpc = new ClientRpcServer({
+        serviceRegistry: this._clientServices.host.serviceRegistry,
+        port: this._appPort,
+        ...middleware
       });
       await Promise.all([
         this._clientServices.open(),
@@ -4007,17 +3791,17 @@ var IFrameHostRuntime = class {
         (_a = this._shellRuntime) == null ? void 0 : _a.open()
       ]);
       this._ready.wake(void 0);
-      log17("started", {}, {
+      log16("started", {}, {
         file: "iframe-host-runtime.ts",
-        line: 118,
+        line: 110,
         scope: this,
         callSite: (f, a) => f(...a)
       });
     } catch (err) {
       this._ready.wake(err);
-      log17.catch(err, {}, {
+      log16.catch(err, {}, {
         file: "iframe-host-runtime.ts",
-        line: 121,
+        line: 113,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -4025,18 +3809,18 @@ var IFrameHostRuntime = class {
   }
   async stop() {
     var _a;
-    log17("stopping...", {}, {
+    log16("stopping...", {}, {
       file: "iframe-host-runtime.ts",
-      line: 126,
+      line: 118,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._clientRpc.close();
     await this._clientServices.close();
     await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
-    log17("stopped", {}, {
+    log16("stopped", {}, {
       file: "iframe-host-runtime.ts",
-      line: 130,
+      line: 122,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -4062,41 +3846,23 @@ export {
   Identity,
   IdentityManager,
   IdentityServiceImpl,
-  InvitationEncoder,
-  AUTHENTICATION_CODE_LENGTH,
-  INVITATION_TIMEOUT,
-  ON_CLOSE_DELAY,
-  InvitationObservableProvider,
-  AuthenticatingInvitationProvider,
-  wrapObservable,
-  AbstractInvitationsHandler,
   DeviceInvitationsHandler,
-  AbstractInvitationsProxy,
-  DeviceInvitationsProxy,
   AbstractInvitationsService,
   DeviceInvitationsServiceImpl,
   SpaceInvitationsHandler,
-  SpaceInvitationsProxy,
   SpaceInvitationsServiceImpl,
-  ServiceContext,
-  clientServiceBundle,
   createStorageObjects,
-  iframeServiceBundle,
-  workerServiceBundle,
-  appServiceBundle,
-  shellServiceBundle,
   ShellRuntimeImpl,
   MemoryShellRuntime,
   IFrameHostRuntime,
   IFrameProxyRuntime,
-  ShellController,
   VaultResourceLock,
   WorkerSession,
   WorkerRuntime,
+  ServiceContext,
   ServiceRegistry,
-  createDefaultModelFactory,
   ClientServicesHost,
-  ClientServicesProxy,
-  LocalClientServices
+  LocalClientServices,
+  fromHost
 };
-//# sourceMappingURL=chunk-JLLUQQXD.mjs.map
+//# sourceMappingURL=chunk-ZIQUYEJS.mjs.map