@dxos/client-services 0.1.31 → 0.1.32-next.77d513e

package/dist/lib/node/index.cjs

@@ -653,7 +653,7 @@ var IdentityManager = class {
       identityRecord
     }, {
       file: "identity-manager.ts",
-      line: 63,
+      line: 71,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -672,7 +672,7 @@ var IdentityManager = class {
     (0, import_node_assert2.default)(!this._identity, "Identity already exists.");
     (0, import_log3.log)("creating identity...", {}, {
       file: "identity-manager.ts",
-      line: 78,
+      line: 86,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -681,21 +681,23 @@ var IdentityManager = class {
       identityKey: await this._keyring.createKey(),
       deviceKey: await this._keyring.createKey(),
       haloSpace: {
-        spaceKey: await this._keyring.createKey(),
+        key: await this._keyring.createKey(),
         genesisFeedKey: controlFeedKey,
-        writeControlFeedKey: controlFeedKey,
-        writeDataFeedKey: await this._keyring.createKey()
+        controlFeedKey,
+        dataFeedKey: await this._keyring.createKey()
       }
     };
     const identity = await this._constructIdentity(identityRecord);
     await identity.open();
     {
       const generator = new import_credentials4.CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
+      (0, import_node_assert2.default)(identityRecord.haloSpace.genesisFeedKey, "Genesis feed key is required.");
+      (0, import_node_assert2.default)(identityRecord.haloSpace.dataFeedKey, "Data feed key is required.");
       const credentials = [
         // Space genesis.
-        ...await generator.createSpaceGenesis(identityRecord.haloSpace.spaceKey, identityRecord.haloSpace.genesisFeedKey),
+        ...await generator.createSpaceGenesis(identityRecord.haloSpace.key, identityRecord.haloSpace.genesisFeedKey),
         // Feed admission.
-        await generator.createFeedAdmission(identityRecord.haloSpace.spaceKey, identityRecord.haloSpace.writeDataFeedKey, import_credentials5.AdmittedFeed.Designation.DATA)
+        await generator.createFeedAdmission(identityRecord.haloSpace.key, identityRecord.haloSpace.dataFeedKey, import_credentials5.AdmittedFeed.Designation.DATA)
       ];
       if (displayName) {
         credentials.push(await generator.createProfileCredential({
@@ -720,7 +722,7 @@ var IdentityManager = class {
       deviceKey: identity.deviceKey
     }, {
       file: "identity-manager.ts",
-      line: 136,
+      line: 143,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -734,7 +736,7 @@ var IdentityManager = class {
       params
     }, {
       file: "identity-manager.ts",
-      line: 144,
+      line: 151,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -743,10 +745,11 @@ var IdentityManager = class {
       identityKey: params.identityKey,
       deviceKey: params.deviceKey,
       haloSpace: {
-        spaceKey: params.haloSpaceKey,
+        key: params.haloSpaceKey,
         genesisFeedKey: params.haloGenesisFeedKey,
-        writeControlFeedKey: params.controlFeedKey,
-        writeDataFeedKey: params.dataFeedKey
+        controlFeedKey: params.controlFeedKey,
+        dataFeedKey: params.dataFeedKey,
+        controlTimeframe: params.controlTimeframe
       }
     };
     const identity = await this._constructIdentity(identityRecord);
@@ -760,7 +763,7 @@ var IdentityManager = class {
       deviceKey: identity.deviceKey
     }, {
       file: "identity-manager.ts",
-      line: 164,
+      line: 172,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -772,14 +775,16 @@ var IdentityManager = class {
       identityRecord
     }, {
       file: "identity-manager.ts",
-      line: 170,
+      line: 178,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const controlFeed = await this._feedStore.openFeed(identityRecord.haloSpace.writeControlFeedKey, {
+    (0, import_node_assert2.default)(identityRecord.haloSpace.controlFeedKey);
+    const controlFeed = await this._feedStore.openFeed(identityRecord.haloSpace.controlFeedKey, {
       writable: true
     });
-    const dataFeed = await this._feedStore.openFeed(identityRecord.haloSpace.writeDataFeedKey, {
+    (0, import_node_assert2.default)(identityRecord.haloSpace.dataFeedKey);
+    const dataFeed = await this._feedStore.openFeed(identityRecord.haloSpace.dataFeedKey, {
       writable: true
     });
     const space = await this._constructSpace({
@@ -803,16 +808,19 @@ var IdentityManager = class {
       identityKey: identityRecord.identityKey
     }, {
       file: "identity-manager.ts",
-      line: 196,
+      line: 206,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    if (identityRecord.haloSpace.controlTimeframe) {
+      identity.controlPipeline.state.setTargetTimeframe(identityRecord.haloSpace.controlTimeframe);
+    }
     return identity;
   }
   async _constructSpace({ spaceRecord, swarmIdentity, identityKey }) {
     return this._spaceManager.constructSpace({
       metadata: {
-        key: spaceRecord.spaceKey,
+        key: spaceRecord.key,
         genesisFeedKey: spaceRecord.genesisFeedKey
       },
       swarmIdentity,
@@ -928,7 +936,8 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
         return {
           identityKey: identity.identityKey,
           haloSpaceKey: identity.haloSpaceKey,
-          genesisFeedKey: identity.haloGenesisFeedKey
+          genesisFeedKey: identity.haloGenesisFeedKey,
+          controlTimeframe: identity.controlPipeline.state.timeframe
         };
       },
       authenticate: async ({ authenticationCode: code }) => {
@@ -936,7 +945,7 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
           authenticationCode: code
         }, {
           file: "device-invitations-handler.ts",
-          line: 106,
+          line: 107,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -958,7 +967,7 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
             guest: credentials.deviceKey
           }, {
             file: "device-invitations-handler.ts",
-            line: 121,
+            line: 122,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -977,7 +986,7 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
               host: identity.deviceKey
             }, {
               file: "device-invitations-handler.ts",
-              line: 137,
+              line: 138,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -990,7 +999,7 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
               guest: deviceKey
             }, {
               file: "device-invitations-handler.ts",
-              line: 140,
+              line: 141,
               scope: this,
               callSite: (f, a) => f(...a)
             });
@@ -999,7 +1008,7 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
             if (!observable.cancelled) {
               import_log4.log.error("failed", err, {
                 file: "device-invitations-handler.ts",
-                line: 144,
+                line: 145,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1064,22 +1073,22 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
               }
               (0, import_log4.log)("connected", {}, {
                 file: "device-invitations-handler.ts",
-                line: 215,
+                line: 216,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               (_b = (_a = observable.callback).onConnected) == null ? void 0 : _b.call(_a, invitation);
               (0, import_log4.log)("sending admission request", {}, {
                 file: "device-invitations-handler.ts",
-                line: 219,
+                line: 220,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              const { identityKey, haloSpaceKey, genesisFeedKey } = await extension.rpc.HaloHostService.requestAdmission();
+              const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = await extension.rpc.HaloHostService.requestAdmission();
               if (invitation.type === void 0 || invitation.type === import_services.Invitation.Type.INTERACTIVE) {
                 (0, import_log4.log)("guest waiting for authentication code...", {}, {
                   file: "device-invitations-handler.ts",
-                  line: 226,
+                  line: 227,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1089,7 +1098,7 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
                 });
                 (0, import_log4.log)("sending authentication request", {}, {
                   file: "device-invitations-handler.ts",
-                  line: 229,
+                  line: 230,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1107,7 +1116,7 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
                 dataFeedKey
               }, {
                 file: "device-invitations-handler.ts",
-                line: 238,
+                line: 239,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1122,14 +1131,15 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
                 haloSpaceKey,
                 haloGenesisFeedKey: genesisFeedKey,
                 controlFeedKey,
-                dataFeedKey
+                dataFeedKey,
+                controlTimeframe
               });
               (0, import_log4.log)("admitted by host", {
                 guest: identity.deviceKey,
                 identityKey
               }, {
                 file: "device-invitations-handler.ts",
-                line: 257,
+                line: 259,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1138,7 +1148,7 @@ var DeviceInvitationsHandler = class extends import_client.AbstractInvitationsHa
               if (!observable.cancelled) {
                 import_log4.log.warn("auth failed", err, {
                   file: "device-invitations-handler.ts",
-                  line: 261,
+                  line: 263,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1582,6 +1592,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
           };
         },
         requestAdmission: async ({ identityKey, deviceKey, controlFeedKey, dataFeedKey }) => {
+          var _a2;
           try {
             if (isAuthenticationRequired(invitation) && !authenticationPassed) {
               throw new Error("Not authenticated");
@@ -1602,7 +1613,9 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
             await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, credentials);
             complete.wake(deviceKey);
             return {
-              credential: spaceMemberCredential
+              credential: spaceMemberCredential,
+              controlTimeframe: space.inner.controlPipeline.state.timeframe,
+              dataTimeframe: (_a2 = space.dataPipeline.pipelineState) == null ? void 0 : _a2.timeframe
             };
           } catch (err) {
             observable.callback.onError(err);
@@ -1617,7 +1630,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                 host: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 191,
+                line: 195,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1630,7 +1643,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                 guest: deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 194,
+                line: 198,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1639,7 +1652,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
               if (!observable.cancelled) {
                 import_log6.log.error("failed", err, {
                   file: "space-invitations-handler.ts",
-                  line: 198,
+                  line: 202,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1709,7 +1722,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 271,
+                line: 275,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1718,7 +1731,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 275,
+                line: 279,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1730,7 +1743,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                 response: introductionResponse
               }, {
                 file: "space-invitations-handler.ts",
-                line: 279,
+                line: 283,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1743,7 +1756,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
                   (0, import_log6.log)("guest waiting for authentication code...", {}, {
                     file: "space-invitations-handler.ts",
-                    line: 293,
+                    line: 297,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -1753,7 +1766,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                   });
                   (0, import_log6.log)("sending authentication request", {}, {
                     file: "space-invitations-handler.ts",
-                    line: 297,
+                    line: 301,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
@@ -1771,7 +1784,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                         attempt
                       }, {
                         file: "space-invitations-handler.ts",
-                        line: 307,
+                        line: 311,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -1786,11 +1799,11 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                 guest: this._signingContext.deviceKey
               }, {
                 file: "space-invitations-handler.ts",
-                line: 318,
+                line: 322,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              const { credential } = await extension.rpc.SpaceHostService.requestAdmission({
+              const { credential, controlTimeframe, dataTimeframe } = await extension.rpc.SpaceHostService.requestAdmission({
                 identityKey: this._signingContext.identityKey,
                 deviceKey: this._signingContext.deviceKey,
                 controlFeedKey,
@@ -1801,7 +1814,9 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
               (0, import_node_assert6.default)(credential.subject.id.equals(this._signingContext.identityKey));
               const space = await this._spaceManager.acceptSpace({
                 spaceKey: assertion.spaceKey,
-                genesisFeedKey: assertion.genesisFeedKey
+                genesisFeedKey: assertion.genesisFeedKey,
+                controlTimeframe,
+                dataTimeframe
               });
               await this._signingContext.recordCredential(credential);
               (0, import_log6.log)("admitted by host", {
@@ -1809,7 +1824,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
                 spaceKey: space.key
               }, {
                 file: "space-invitations-handler.ts",
-                line: 340,
+                line: 347,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1818,7 +1833,7 @@ var SpaceInvitationsHandler = class extends import_client2.AbstractInvitationsHa
               if (!observable.cancelled) {
                 import_log6.log.warn("auth failed", err, {
                   file: "space-invitations-handler.ts",
-                  line: 344,
+                  line: 351,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1924,10 +1939,10 @@ var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
 // packages/sdk/client-services/src/packlets/services/service-host.ts
 var import_node_assert12 = __toESM(require("node:assert"));
 var import_async19 = require("@dxos/async");
-var import_client6 = require("@dxos/client");
+var import_client8 = require("@dxos/client");
 var import_debug7 = require("@dxos/debug");
 var import_echo_pipeline5 = require("@dxos/echo-pipeline");
-var import_log15 = require("@dxos/log");
+var import_log16 = require("@dxos/log");
 var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
 
 // packages/sdk/client-services/src/packlets/deprecated/tracing.ts
@@ -2015,20 +2030,24 @@ var NetworkServiceImpl = class {
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
 var import_node_assert9 = __toESM(require("node:assert"));
 var import_async11 = require("@dxos/async");
+var import_client4 = require("@dxos/client");
 var import_context7 = require("@dxos/context");
 var import_credentials10 = require("@dxos/credentials");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
 var import_keys8 = require("@dxos/keys");
-var import_log8 = require("@dxos/log");
+var import_log9 = require("@dxos/log");
 var import_teleport_extension_gossip = require("@dxos/teleport-extension-gossip");
 var import_util5 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
 var import_async10 = require("@dxos/async");
+var import_client3 = require("@dxos/client");
 var import_context6 = require("@dxos/context");
 var import_debug3 = require("@dxos/debug");
 var import_echo_pipeline = require("@dxos/echo-pipeline");
+var import_errors = require("@dxos/errors");
 var import_keys7 = require("@dxos/keys");
+var import_log8 = require("@dxos/log");
 var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util4 = require("@dxos/util");
 
@@ -2041,9 +2060,9 @@ var import_log7 = require("@dxos/log");
 var import_protocols4 = require("@dxos/protocols");
 var import_teleport3 = require("@dxos/teleport");
 var import_util3 = require("@dxos/util");
-var RETRY_TIMEOUT = 1e3;
-var SUCCESS_DELAY = 1e3;
-var NOTARIZE_TIMEOUT = 1e4;
+var DEFAULT_RETRY_TIMEOUT = 1e3;
+var DEFAULT_SUCCESS_DELAY = 1e3;
+var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
 var NotarizationPlugin = class {
   constructor() {
     this._ctx = new import_context5.Context();
@@ -2060,12 +2079,12 @@ var NotarizationPlugin = class {
   /**
   * Request credentials to be notarized.
   */
-  async notarize(credentials) {
+  async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
     (0, import_log7.log)("notarize", {
       credentials
     }, {
       file: "notarization-plugin.ts",
-      line: 50,
+      line: 85,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2077,7 +2096,7 @@ var NotarizationPlugin = class {
           err
         }, {
           file: "notarization-plugin.ts",
-          line: 59,
+          line: 94,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2085,27 +2104,27 @@ var NotarizationPlugin = class {
         errors.throw(err);
       }
     });
-    (0, import_async9.scheduleTask)(ctx, () => {
-      import_log7.log.warn("Notarization timeout", {}, {
-        file: "notarization-plugin.ts",
-        line: 67,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      void ctx.dispose();
-      errors.throw(new import_async9.TimeoutError(NOTARIZE_TIMEOUT, "Notarization timed out"));
-    }, NOTARIZE_TIMEOUT);
+    opCtx == null ? void 0 : opCtx.onDispose(() => ctx.dispose());
+    if (timeout !== 0) {
+      (0, import_async9.scheduleTask)(ctx, () => {
+        import_log7.log.warn("Notarization timeout", {
+          timeout,
+          peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
+        }, {
+          file: "notarization-plugin.ts",
+          line: 106,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+        void ctx.dispose();
+        errors.throw(new import_async9.TimeoutError(timeout, "Notarization timed out"));
+      }, timeout);
+    }
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
     const peersTried = /* @__PURE__ */ new Set();
     const notarizeTask = new import_async9.DeferredTask(ctx, async () => {
       try {
         if (this._extensions.size === 0) {
-          import_log7.log.warn("No peers to notarize with", {}, {
-            file: "notarization-plugin.ts",
-            line: 82,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
           return;
         }
         const peer = [
@@ -2113,15 +2132,15 @@ var NotarizationPlugin = class {
         ].find((peer2) => !peersTried.has(peer2));
         if (!peer) {
           import_log7.log.warn("Exhausted all peers to notarize with", {
-            retryIn: RETRY_TIMEOUT
+            retryIn: retryTimeout
           }, {
             file: "notarization-plugin.ts",
-            line: 89,
+            line: 131,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           peersTried.clear();
-          (0, import_async9.scheduleTask)(ctx, () => notarizeTask.schedule(), RETRY_TIMEOUT);
+          (0, import_async9.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
           return;
         }
         peersTried.add(peer);
@@ -2130,7 +2149,7 @@ var NotarizationPlugin = class {
           credentialId: credentials.map((credential) => credential.id)
         }, {
           file: "notarization-plugin.ts",
-          line: 96,
+          line: 138,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2139,15 +2158,15 @@ var NotarizationPlugin = class {
         });
         (0, import_log7.log)("success", {}, {
           file: "notarization-plugin.ts",
-          line: 100,
+          line: 142,
           scope: this,
           callSite: (f, a) => f(...a)
         });
-        await (0, import_async9.sleep)(SUCCESS_DELAY);
+        await (0, import_async9.sleep)(successDelay);
       } catch (err) {
         import_log7.log.warn("error notarizing (recoverable)", err, {
           file: "notarization-plugin.ts",
-          line: 103,
+          line: 145,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2158,12 +2177,13 @@ var NotarizationPlugin = class {
     this._extensionOpened.on(ctx, () => notarizeTask.schedule());
     try {
       await Promise.race([
+        (0, import_context5.rejectOnDispose)(ctx),
         allNotarized,
         errors.wait()
       ]);
       (0, import_log7.log)("done", {}, {
         file: "notarization-plugin.ts",
-        line: 114,
+        line: 155,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -2216,7 +2236,7 @@ var NotarizationPlugin = class {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
-          line: 163,
+          line: 204,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2228,7 +2248,7 @@ var NotarizationPlugin = class {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
-          line: 168,
+          line: 209,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2282,18 +2302,22 @@ var __decorate = function(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 var AUTH_TIMEOUT2 = 3e4;
-var CONTROL_PIPELINE_READY_TIMEFRAME = 3e3;
 var DataSpace = class DataSpace2 {
   constructor(params) {
     this._ctx = new import_context6.Context();
+    this._state = import_client3.SpaceState.CLOSED;
+    this.stateUpdate = new import_async10.Event();
+    var _a;
     this._inner = params.inner;
+    this._inner.stateUpdate.on(this._ctx, () => this.stateUpdate.emit());
     this._gossip = params.gossip;
     this._presence = params.presence;
     this._keyring = params.keyring;
     this._feedStore = params.feedStore;
     this._metadataStore = params.metadataStore;
     this._signingContext = params.signingContext;
-    this._dataPipelineController = new import_echo_pipeline.DataPipelineControllerImpl({
+    this._callbacks = (_a = params.callbacks) != null ? _a : {};
+    this._dataPipeline = new import_echo_pipeline.DataPipeline({
       modelFactory: params.modelFactory,
       metadataStore: params.metadataStore,
       snapshotManager: params.snapshotManager,
@@ -2315,15 +2339,15 @@ var DataSpace = class DataSpace2 {
   get isOpen() {
     return this._inner.isOpen;
   }
+  get state() {
+    return this._state;
+  }
   // TODO(burdon): Can we mark this for debugging only?
   get inner() {
     return this._inner;
   }
-  get dataPipelineController() {
-    return this._dataPipelineController;
-  }
-  get stateUpdate() {
-    return this._inner.stateUpdate;
+  get dataPipeline() {
+    return this._dataPipeline;
   }
   get presence() {
     return this._presence;
@@ -2335,9 +2359,12 @@ var DataSpace = class DataSpace2 {
     await this.notarizationPlugin.open();
     await this._notarizationPluginConsumer.open();
     await this._inner.open();
+    this._state = import_client3.SpaceState.INACTIVE;
   }
   async close() {
+    this._state = import_client3.SpaceState.CLOSED;
     await this._ctx.dispose();
+    await this._dataPipeline.close();
     await this.authVerifier.close();
     await this._inner.close();
     await this._notarizationPluginConsumer.close();
@@ -2350,17 +2377,84 @@ var DataSpace = class DataSpace2 {
   listen(channel, callback) {
     return this._gossip.listen(channel, callback);
   }
+  /**
+  * Initialize the data pipeline in a separate task.
+  */
+  initializeDataPipelineAsync() {
+    (0, import_async10.scheduleTask)(this._ctx, async () => {
+      try {
+        await this.initializeDataPipeline();
+      } catch (err) {
+        if (err instanceof import_errors.CancelledError) {
+          (0, import_log8.log)("Data pipeline initialization cancelled", err, {
+            file: "data-space.ts",
+            line: 178,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        import_log8.log.error("Error initializing data pipeline", err, {
+          file: "data-space.ts",
+          line: 182,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
+      }
+    });
+  }
   async initializeDataPipeline() {
+    var _a, _b, _c, _d;
+    if (this._state !== import_client3.SpaceState.INACTIVE) {
+      throw new import_errors.SystemError("Invalid operation");
+    }
+    this._state = import_client3.SpaceState.INITIALIZING;
     await this._inner.controlPipeline.state.waitUntilReachedTargetTimeframe({
-      timeout: CONTROL_PIPELINE_READY_TIMEFRAME
+      ctx: this._ctx,
+      breakOnStall: false
     });
     await this._createWritableFeeds();
+    (0, import_log8.log)("Writable feeds created", {}, {
+      file: "data-space.ts",
+      line: 200,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    this.stateUpdate.emit();
     this.notarizationPlugin.setWriter((0, import_echo_pipeline.createMappedFeedWriter)((credential) => ({
       credential: {
         credential
       }
     }), this._inner.controlPipeline.writer));
-    await this._inner.initDataPipeline(this._dataPipelineController);
+    await this._dataPipeline.open({
+      openPipeline: async (start) => {
+        const pipeline = await this._inner.createDataPipeline({
+          start
+        });
+        await pipeline.start();
+        return pipeline;
+      }
+    });
+    (0, import_log8.log)("waiting for data pipeline to reach target timeframe", {}, {
+      file: "data-space.ts",
+      line: 220,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this._dataPipeline.pipelineState.waitUntilReachedTargetTimeframe({
+      ctx: this._ctx,
+      breakOnStall: false
+    });
+    (0, import_log8.log)("data pipeline ready", {}, {
+      file: "data-space.ts",
+      line: 227,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await ((_b = (_a = this._callbacks).beforeReady) == null ? void 0 : _b.call(_a));
+    this._state = import_client3.SpaceState.READY;
+    this.stateUpdate.emit();
+    await ((_d = (_c = this._callbacks).afterReady) == null ? void 0 : _d.call(_c));
   }
   async _createWritableFeeds() {
     const credentials = [];
@@ -2397,7 +2491,11 @@ var DataSpace = class DataSpace2 {
       }));
     }
     if (credentials.length > 0) {
-      await this.notarizationPlugin.notarize(credentials);
+      await this.notarizationPlugin.notarize({
+        ctx: this._ctx,
+        credentials,
+        timeout: 0
+      });
     }
     await this._metadataStore.setWritableFeedKeys(this.key, this.inner.controlFeedKey, this.inner.dataFeedKey);
   }
@@ -2420,7 +2518,6 @@ var __decorate2 = function(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var DATA_PIPELINE_READY_TIMEOUT = 3e3;
 var DataSpaceManager = class DataSpaceManager2 {
   constructor(_spaceManager, _metadataStore, _dataServiceSubscriptions, _keyring, _signingContext, _modelFactory, _feedStore, _snapshotStore) {
     this._spaceManager = _spaceManager;
@@ -2434,50 +2531,51 @@ var DataSpaceManager = class DataSpaceManager2 {
     this._ctx = new import_context7.Context();
     this.updated = new import_async11.Event();
     this._spaces = new import_util5.ComplexMap(import_keys8.PublicKey.hash);
+    this._isOpen = false;
   }
   // TODO(burdon): Remove.
   get spaces() {
     return this._spaces;
   }
   async open() {
+    (0, import_log9.log)("open", {}, {
+      file: "data-space-manager.ts",
+      line: 80,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
     await this._metadataStore.load();
-    (0, import_log8.log)("metadata loaded", {
+    (0, import_log9.log)("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
       file: "data-space-manager.ts",
-      line: 67,
+      line: 82,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     for (const spaceMetadata of this._metadataStore.spaces) {
-      (0, import_log8.log)("load space", {
+      (0, import_log9.log)("load space", {
         spaceMetadata
       }, {
         file: "data-space-manager.ts",
-        line: 70,
+        line: 85,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       const space = await this._constructSpace(spaceMetadata);
-      await space.initializeDataPipeline();
-      if (spaceMetadata.dataTimeframe) {
-        (0, import_log8.log)("waiting for latest timeframe", {
-          spaceMetadata
-        }, {
-          file: "data-space-manager.ts",
-          line: 74,
-          scope: this,
-          callSite: (f, a) => f(...a)
-        });
-        await space.dataPipelineController.pipelineState.setTargetTimeframe(spaceMetadata.dataTimeframe);
-      }
-      await space.dataPipelineController.pipelineState.waitUntilReachedTargetTimeframe({
-        timeout: DATA_PIPELINE_READY_TIMEOUT
-      });
-      this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
+      space.initializeDataPipelineAsync();
     }
+    this._isOpen = true;
+    this.updated.emit();
   }
   async close() {
+    (0, import_log9.log)("close", {}, {
+      file: "data-space-manager.ts",
+      line: 96,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    this._isOpen = false;
     await this._ctx.dispose();
     for (const space of this._spaces.values()) {
       await space.close();
@@ -2487,6 +2585,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   * Creates a new space writing the genesis credentials to the control feed.
   */
   async createSpace() {
+    (0, import_node_assert9.default)(this._isOpen, "Not open.");
     const spaceKey = await this._keyring.createKey();
     const controlFeedKey = await this._keyring.createKey();
     const dataFeedKey = await this._keyring.createKey();
@@ -2496,11 +2595,11 @@ var DataSpaceManager = class DataSpaceManager2 {
       controlFeedKey,
       dataFeedKey
     };
-    (0, import_log8.log)("creating space...", {
+    (0, import_log9.log)("creating space...", {
       spaceKey
     }, {
       file: "data-space-manager.ts",
-      line: 110,
+      line: 120,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2511,25 +2610,53 @@ var DataSpaceManager = class DataSpaceManager2 {
     (0, import_node_assert9.default)((0, import_credentials10.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
     await this._signingContext.recordCredential(memberCredential);
     await space.initializeDataPipeline();
-    this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
     this.updated.emit();
     return space;
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
+    (0, import_log9.log)("accept space", {
+      opts
+    }, {
+      file: "data-space-manager.ts",
+      line: 139,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    (0, import_node_assert9.default)(this._isOpen, "Not open.");
     (0, import_node_assert9.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
     const metadata = {
       key: opts.spaceKey,
-      genesisFeedKey: opts.genesisFeedKey
+      genesisFeedKey: opts.genesisFeedKey,
+      controlTimeframe: opts.controlTimeframe,
+      dataTimeframe: opts.dataTimeframe
     };
     const space = await this._constructSpace(metadata);
     await this._metadataStore.addSpace(metadata);
-    await space.initializeDataPipeline();
-    this._dataServiceSubscriptions.registerSpace(space.key, space.dataPipelineController.databaseBackend.createDataServiceHost());
+    space.initializeDataPipelineAsync();
     this.updated.emit();
     return space;
   }
+  /**
+  * Wait until the space data pipeline is fully initialized.
+  * Used by invitation handler.
+  * TODO(dmaretskyi): Consider removing.
+  */
+  async waitUntilSpaceReady(spaceKey) {
+    await (0, import_context7.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
+      const space = this._spaces.get(spaceKey);
+      return !!space && space.state === import_client4.SpaceState.READY;
+    }));
+  }
   async _constructSpace(metadata) {
+    (0, import_log9.log)("construct space", {
+      metadata
+    }, {
+      file: "data-space-manager.ts",
+      line: 175,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
     const gossip = new import_teleport_extension_gossip.Gossip({
       localPeerId: this._signingContext.deviceKey
     });
@@ -2574,9 +2701,42 @@ var DataSpaceManager = class DataSpaceManager2 {
       keyring: this._keyring,
       feedStore: this._feedStore,
       signingContext: this._signingContext,
-      snapshotId: metadata.snapshot
+      snapshotId: metadata.snapshot,
+      callbacks: {
+        beforeReady: async () => {
+          (0, import_log9.log)("before space ready", {
+            space: space.key
+          }, {
+            file: "data-space-manager.ts",
+            line: 224,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.dataPipeline.databaseBackend.createDataServiceHost());
+        },
+        afterReady: async () => {
+          (0, import_log9.log)("after space ready", {
+            space: space.key,
+            open: this._isOpen
+          }, {
+            file: "data-space-manager.ts",
+            line: 231,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          if (this._isOpen) {
+            this.updated.emit();
+          }
+        }
+      }
     });
     await dataSpace.open();
+    if (metadata.controlTimeframe) {
+      dataSpace.inner.controlPipeline.state.setTargetTimeframe(metadata.controlTimeframe);
+    }
+    if (metadata.dataTimeframe) {
+      dataSpace.dataPipeline.setTargetTimeframe(metadata.dataTimeframe);
+    }
     this._spaces.set(metadata.key, dataSpace);
     return dataSpace;
   }
@@ -2602,9 +2762,10 @@ var import_async12 = require("@dxos/async");
 var import_codec_protobuf10 = require("@dxos/codec-protobuf");
 var import_debug4 = require("@dxos/debug");
 var import_echo_pipeline3 = require("@dxos/echo-pipeline");
-var import_log9 = require("@dxos/log");
+var import_log10 = require("@dxos/log");
 var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util6 = require("@dxos/util");
+var TIMEFRAME_UPDATE_DEBOUNCE_TIME = 500;
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _dataServiceSubscriptions, _getDataSpaceManager) {
     this._identityManager = _identityManager;
@@ -2627,12 +2788,12 @@ var SpacesServiceImpl = class {
     return new import_codec_protobuf10.Stream(({ next, ctx }) => {
       const onUpdate = async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const spaces = Array.from(dataSpaceManager.spaces.values()).filter((space) => this._dataServiceSubscriptions.getDataService(space.key)).map((space) => this._transformSpace(space));
-        (0, import_log9.log)("update", {
+        const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._transformSpace(space));
+        (0, import_log10.log)("update", {
           spaces
         }, {
           file: "spaces-service.ts",
-          line: 62,
+          line: 60,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2640,28 +2801,27 @@ var SpacesServiceImpl = class {
           spaces
         });
       };
-      setTimeout(async () => {
+      (0, import_async12.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const subscriptions = new import_async12.EventSubscriptions();
+        ctx.onDispose(() => subscriptions.clear());
         const subscribeSpaces = () => {
           subscriptions.clear();
           for (const space of dataSpaceManager.spaces.values()) {
-            if (!this._dataServiceSubscriptions.getDataService(space.key)) {
-              continue;
-            }
             subscriptions.add(space.stateUpdate.on(ctx, onUpdate));
             subscriptions.add(space.presence.updated.on(ctx, onUpdate));
+            space.inner.controlPipeline.state.timeframeUpdate.debounce(TIMEFRAME_UPDATE_DEBOUNCE_TIME).on(ctx, onUpdate);
+            if (space.dataPipeline.pipelineState) {
+              subscriptions.add(space.dataPipeline.pipelineState.timeframeUpdate.debounce(TIMEFRAME_UPDATE_DEBOUNCE_TIME).on(ctx, onUpdate));
+            }
           }
         };
         dataSpaceManager.updated.on(ctx, () => {
           subscribeSpaces();
           void onUpdate();
         });
-        ctx.onDispose(() => subscriptions.clear());
-        (0, import_async12.scheduleTask)(ctx, () => {
-          subscribeSpaces();
-          void onUpdate();
-        });
+        subscribeSpaces();
+        void onUpdate();
       });
       if (!this._identityManager.identity) {
         next({
@@ -2714,16 +2874,23 @@ var SpacesServiceImpl = class {
     }
   }
   _transformSpace(space) {
+    var _a, _b;
     return {
       spaceKey: space.key,
-      status: space.isOpen ? import_services5.SpaceStatus.ACTIVE : import_services5.SpaceStatus.INACTIVE,
+      state: space.state,
+      pipeline: {
+        targetControlTimeframe: space.inner.controlPipeline.state.targetTimeframe,
+        currentControlTimeframe: space.inner.controlPipeline.state.timeframe,
+        currentDataTimeframe: (_a = space.dataPipeline.pipelineState) == null ? void 0 : _a.timeframe,
+        targetDataTimeframe: (_b = space.dataPipeline.pipelineState) == null ? void 0 : _b.targetTimeframe
+      },
       members: Array.from(space.inner.spaceState.members.values()).map((member) => {
-        var _a, _b, _c;
+        var _a2, _b2, _c;
         return {
           identity: {
             identityKey: member.key,
             profile: {
-              displayName: (_b = (_a = member.assertion.profile) == null ? void 0 : _a.displayName) != null ? _b : (0, import_util6.humanize)(member.key)
+              displayName: (_b2 = (_a2 = member.assertion.profile) == null ? void 0 : _a2.displayName) != null ? _b2 : (0, import_util6.humanize)(member.key)
             }
           },
           presence: ((_c = this._identityManager.identity) == null ? void 0 : _c.identityKey.equals(member.key)) || space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services5.SpaceMember.PresenceState.ONLINE : import_services5.SpaceMember.PresenceState.OFFLINE
@@ -2735,23 +2902,23 @@ var SpacesServiceImpl = class {
 var getChannelId = (channel) => `user-channel/${channel}`;
 
 // packages/sdk/client-services/src/packlets/storage/storage.ts
-var import_errors = require("@dxos/errors");
+var import_errors2 = require("@dxos/errors");
 var import_config = require("@dxos/protocols/proto/dxos/config");
 var import_random_access_storage = require("@dxos/random-access-storage");
 var StorageDriver = import_config.Runtime.Client.Storage.StorageDriver;
 var createStorageObjects = (config) => {
   const { path = "dxos/storage", storageType, keyStorage, persistent = false } = config != null ? config : {};
   if (persistent && storageType === StorageDriver.RAM) {
-    throw new import_errors.InvalidConfigError("RAM storage cannot be used in persistent mode.");
+    throw new import_errors2.InvalidConfigError("RAM storage cannot be used in persistent mode.");
   }
   if (!persistent && storageType !== void 0 && storageType !== StorageDriver.RAM) {
-    throw new import_errors.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+    throw new import_errors2.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
   }
   if (persistent && keyStorage === StorageDriver.RAM) {
-    throw new import_errors.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+    throw new import_errors2.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
   }
   if (!persistent && keyStorage !== StorageDriver.RAM && keyStorage !== void 0) {
-    throw new import_errors.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+    throw new import_errors2.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
   }
   return {
     storage: (0, import_random_access_storage.createStorage)({
@@ -2819,7 +2986,7 @@ var SystemServiceImpl = class {
 
 // packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
 var import_async14 = require("@dxos/async");
-var import_log10 = require("@dxos/log");
+var import_log11 = require("@dxos/log");
 var import_messaging = require("@dxos/messaging");
 var import_network_manager3 = require("@dxos/network-manager");
 var import_util7 = require("@dxos/util");
@@ -2880,7 +3047,7 @@ var ClientRpcServer = class {
 // packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
 var import_node_assert10 = __toESM(require("node:assert"));
 var import_async13 = require("@dxos/async");
-var import_client3 = require("@dxos/client");
+var import_client5 = require("@dxos/client");
 var import_iframe = require("@dxos/protocols/proto/dxos/iframe");
 var import_rpc2 = require("@dxos/rpc");
 var ShellRuntimeImpl = class {
@@ -2913,8 +3080,8 @@ var ShellRuntimeImpl = class {
   }
   async open() {
     this._appRpc = (0, import_rpc2.createProtoRpcPeer)({
-      requested: import_client3.appServiceBundle,
-      exposed: import_client3.shellServiceBundle,
+      requested: import_client5.appServiceBundle,
+      exposed: import_client5.shellServiceBundle,
       handlers: {
         ShellService: {
           setLayout: async (request) => {
@@ -2997,7 +3164,7 @@ var IFrameHostRuntime = class {
   }
   async start() {
     var _a;
-    (0, import_log10.log)("starting...", {}, {
+    (0, import_log11.log)("starting...", {}, {
       file: "iframe-host-runtime.ts",
       line: 67,
       scope: this,
@@ -3048,7 +3215,7 @@ var IFrameHostRuntime = class {
         (_a = this._shellRuntime) == null ? void 0 : _a.open()
       ]);
       this._ready.wake(void 0);
-      (0, import_log10.log)("started", {}, {
+      (0, import_log11.log)("started", {}, {
         file: "iframe-host-runtime.ts",
         line: 110,
         scope: this,
@@ -3056,7 +3223,7 @@ var IFrameHostRuntime = class {
       });
     } catch (err) {
       this._ready.wake(err);
-      import_log10.log.catch(err, {}, {
+      import_log11.log.catch(err, {}, {
         file: "iframe-host-runtime.ts",
         line: 113,
         scope: this,
@@ -3066,7 +3233,7 @@ var IFrameHostRuntime = class {
   }
   async stop() {
     var _a;
-    (0, import_log10.log)("stopping...", {}, {
+    (0, import_log11.log)("stopping...", {}, {
       file: "iframe-host-runtime.ts",
       line: 118,
       scope: this,
@@ -3075,7 +3242,7 @@ var IFrameHostRuntime = class {
     await this._clientRpc.close();
     await this._clientServices.close();
     await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
-    (0, import_log10.log)("stopped", {}, {
+    (0, import_log11.log)("stopped", {}, {
       file: "iframe-host-runtime.ts",
       line: 122,
       scope: this,
@@ -3084,11 +3251,11 @@ var IFrameHostRuntime = class {
   }
 };
 __decorate3([
-  import_log10.logInfo
+  import_log11.logInfo
 ], IFrameHostRuntime.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
-var import_client4 = require("@dxos/client");
+var import_client6 = require("@dxos/client");
 var import_network_manager4 = require("@dxos/network-manager");
 var import_rpc3 = require("@dxos/rpc");
 var IFrameProxyRuntime = class {
@@ -3099,8 +3266,8 @@ var IFrameProxyRuntime = class {
     this._workerAppPort = workerAppPort;
     this._shellPort = shellPort;
     this._systemRpc = (0, import_rpc3.createProtoRpcPeer)({
-      requested: import_client4.workerServiceBundle,
-      exposed: import_client4.iframeServiceBundle,
+      requested: import_client6.workerServiceBundle,
+      exposed: import_client6.iframeServiceBundle,
       handlers: {
         BridgeService: this._transportService,
         IframeService: {
@@ -3138,7 +3305,17 @@ var IFrameProxyRuntime = class {
 
 // packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
 var import_async15 = require("@dxos/async");
-var import_log11 = require("@dxos/log");
+var import_log12 = require("@dxos/log");
+var __decorate4 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
 var Message;
 (function(Message2) {
   Message2["ACQUIRING"] = "acquiring";
@@ -3152,14 +3329,41 @@ var VaultResourceLock = class {
     this._onRelease = onRelease;
     this._broadcastChannel.onmessage = this._onMessage.bind(this);
   }
+  get lockKey() {
+    return this._lockKey;
+  }
   async acquire() {
     this._broadcastChannel.postMessage({
       message: Message.ACQUIRING
     });
     try {
+      (0, import_log12.log)("aquiring lock...", {}, {
+        file: "vault-resource-lock.ts",
+        line: 44,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
       await (0, import_async15.asyncTimeout)(this._requestLock(), 3e3);
+      (0, import_log12.log)("acquired lock", {}, {
+        file: "vault-resource-lock.ts",
+        line: 46,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
     } catch (e) {
+      (0, import_log12.log)("stealing lock...", {}, {
+        file: "vault-resource-lock.ts",
+        line: 48,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
       await this._requestLock(true);
+      (0, import_log12.log)("stolen lock", {}, {
+        file: "vault-resource-lock.ts",
+        line: 50,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
     }
   }
   async release() {
@@ -3171,11 +3375,11 @@ var VaultResourceLock = class {
     }
   }
   async _requestLock(steal = false) {
-    (0, import_log11.log)("requesting lock...", {
+    (0, import_log12.log)("requesting lock...", {
       steal
     }, {
       file: "vault-resource-lock.ts",
-      line: 56,
+      line: 65,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3188,16 +3392,16 @@ var VaultResourceLock = class {
       acquired.wake();
       this._releaseTrigger = new import_async15.Trigger();
       await this._releaseTrigger.wait();
-      (0, import_log11.log)("releasing lock...", {}, {
+      (0, import_log12.log)("releasing lock...", {}, {
         file: "vault-resource-lock.ts",
-        line: 65,
+        line: 74,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       await ((_b = this._onRelease) == null ? void 0 : _b.call(this));
-      (0, import_log11.log)("released lock", {}, {
+      (0, import_log12.log)("released lock", {}, {
         file: "vault-resource-lock.ts",
-        line: 67,
+        line: 76,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3206,31 +3410,34 @@ var VaultResourceLock = class {
       await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
     });
     await acquired.wait();
-    (0, import_log11.log)("recieved lock", {
+    (0, import_log12.log)("recieved lock", {
       steal
     }, {
       file: "vault-resource-lock.ts",
-      line: 74,
+      line: 83,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
 };
+__decorate4([
+  import_log12.logInfo
+], VaultResourceLock.prototype, "lockKey", null);
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
 var import_async17 = require("@dxos/async");
-var import_log13 = require("@dxos/log");
+var import_log14 = require("@dxos/log");
 var import_messaging2 = require("@dxos/messaging");
 var import_network_manager5 = require("@dxos/network-manager");
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
 var import_node_assert11 = __toESM(require("node:assert"));
 var import_async16 = require("@dxos/async");
-var import_client5 = require("@dxos/client");
-var import_log12 = require("@dxos/log");
+var import_client7 = require("@dxos/client");
+var import_log13 = require("@dxos/log");
 var import_rpc4 = require("@dxos/rpc");
 var import_util8 = require("@dxos/util");
-var __decorate4 = function(decorators, target, key, desc) {
+var __decorate5 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -3281,8 +3488,8 @@ var WorkerSession = class {
       ...middleware
     });
     this._iframeRpc = (0, import_rpc4.createProtoRpcPeer)({
-      requested: import_client5.iframeServiceBundle,
-      exposed: import_client5.workerServiceBundle,
+      requested: import_client7.iframeServiceBundle,
+      exposed: import_client7.workerServiceBundle,
       handlers: {
         WorkerService: {
           start: async (request) => {
@@ -3294,7 +3501,7 @@ var WorkerSession = class {
               try {
                 await this.close();
               } catch (err) {
-                import_log12.log.catch(err, {}, {
+                import_log13.log.catch(err, {}, {
                   file: "worker-session.ts",
                   line: 107,
                   scope: this,
@@ -3312,7 +3519,7 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    import_log12.log.info("opening..", {}, {
+    import_log13.log.info("opening..", {}, {
       file: "worker-session.ts",
       line: 121,
       scope: this,
@@ -3330,7 +3537,7 @@ var WorkerSession = class {
       try {
         await this._iframeRpc.rpc.IframeService.heartbeat();
       } catch (err1) {
-        import_log12.log.warn("Heartbeat failed", {
+        import_log13.log.warn("Heartbeat failed", {
           err: err1
         }, {
           file: "worker-session.ts",
@@ -3341,7 +3548,7 @@ var WorkerSession = class {
         try {
           await this.close();
         } catch (err) {
-          import_log12.log.catch(err, {}, {
+          import_log13.log.catch(err, {}, {
             file: "worker-session.ts",
             line: 137,
             scope: this,
@@ -3352,7 +3559,7 @@ var WorkerSession = class {
     }, this._options.heartbeatInterval);
   }
   async close() {
-    import_log12.log.info("closing..", {}, {
+    import_log13.log.info("closing..", {}, {
       file: "worker-session.ts",
       line: 144,
       scope: this,
@@ -3361,7 +3568,7 @@ var WorkerSession = class {
     try {
       await this.onClose.callIfSet();
     } catch (err) {
-      import_log12.log.catch(err, {}, {
+      import_log13.log.catch(err, {}, {
         file: "worker-session.ts",
         line: 148,
         scope: this,
@@ -3380,7 +3587,7 @@ var WorkerSession = class {
     try {
       await (0, import_async16.asyncTimeout)(this._shellClientRpc.open(), 1e3);
     } catch (e) {
-      import_log12.log.info("No shell connected.", {}, {
+      import_log13.log.info("No shell connected.", {}, {
         file: "worker-session.ts",
         line: 162,
         scope: this,
@@ -3389,8 +3596,8 @@ var WorkerSession = class {
     }
   }
 };
-__decorate4([
-  import_log12.logInfo
+__decorate5([
+  import_log13.logInfo
 ], WorkerSession.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
@@ -3404,7 +3611,7 @@ var WorkerRuntime = class {
     this._clientServices = new ClientServicesHost();
   }
   async start() {
-    (0, import_log13.log)("starting...", {}, {
+    (0, import_log14.log)("starting...", {}, {
       file: "worker-runtime.ts",
       line: 44,
       scope: this,
@@ -3425,7 +3632,7 @@ var WorkerRuntime = class {
       });
       await this._clientServices.open();
       this._ready.wake(void 0);
-      (0, import_log13.log)("started", {}, {
+      (0, import_log14.log)("started", {}, {
         file: "worker-runtime.ts",
         line: 61,
         scope: this,
@@ -3433,7 +3640,7 @@ var WorkerRuntime = class {
       });
     } catch (err) {
       this._ready.wake(err);
-      import_log13.log.catch(err, {}, {
+      import_log14.log.catch(err, {}, {
         file: "worker-runtime.ts",
         line: 64,
         scope: this,
@@ -3491,7 +3698,7 @@ var import_debug6 = require("@dxos/debug");
 var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_keyring = require("@dxos/keyring");
-var import_log14 = require("@dxos/log");
+var import_log15 = require("@dxos/log");
 var ServiceContext = class {
   // prettier-ignore
   constructor(storage, networkManager, modelFactory) {
@@ -3528,7 +3735,7 @@ var ServiceContext = class {
     });
   }
   async open() {
-    (0, import_log14.log)("opening...", {}, {
+    (0, import_log15.log)("opening...", {}, {
       file: "service-context.ts",
       line: 94,
       scope: this,
@@ -3540,7 +3747,7 @@ var ServiceContext = class {
     if (this.identityManager.identity) {
       await this._initialize();
     }
-    (0, import_log14.log)("opened", {}, {
+    (0, import_log15.log)("opened", {}, {
       file: "service-context.ts",
       line: 101,
       scope: this,
@@ -3549,7 +3756,7 @@ var ServiceContext = class {
   }
   async close() {
     var _a, _b;
-    (0, import_log14.log)("closing...", {}, {
+    (0, import_log15.log)("closing...", {}, {
       file: "service-context.ts",
       line: 105,
       scope: this,
@@ -3562,7 +3769,7 @@ var ServiceContext = class {
     await this.feedStore.close();
     await this.networkManager.close();
     this.dataServiceSubscriptions.clear();
-    (0, import_log14.log)("closed", {}, {
+    (0, import_log15.log)("closed", {}, {
       file: "service-context.ts",
       line: 113,
       scope: this,
@@ -3570,7 +3777,7 @@ var ServiceContext = class {
     });
   }
   async reset() {
-    (0, import_log14.log)("resetting...", {}, {
+    (0, import_log15.log)("resetting...", {}, {
       file: "service-context.ts",
       line: 117,
       scope: this,
@@ -3578,7 +3785,7 @@ var ServiceContext = class {
     });
     await this.close();
     await this.storage.reset();
-    (0, import_log14.log)("reset", {}, {
+    (0, import_log15.log)("reset", {}, {
       file: "service-context.ts",
       line: 120,
       scope: this,
@@ -3598,7 +3805,7 @@ var ServiceContext = class {
   // Called when identity is created.
   async _initialize() {
     var _a;
-    (0, import_log14.log)("initializing spaces...", {}, {
+    (0, import_log15.log)("initializing spaces...", {}, {
       file: "service-context.ts",
       line: 139,
       scope: this,
@@ -3632,7 +3839,7 @@ var ServiceContext = class {
           return;
         }
         if (!this.dataSpaceManager) {
-          (0, import_log14.log)("dataSpaceManager not initialized yet, ignoring space admission", {
+          (0, import_log15.log)("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
             file: "service-context.ts",
@@ -3643,7 +3850,7 @@ var ServiceContext = class {
           return;
         }
         if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
-          (0, import_log14.log)("space already exists, ignoring space admission", {
+          (0, import_log15.log)("space already exists, ignoring space admission", {
             details: assertion
           }, {
             file: "service-context.ts",
@@ -3654,7 +3861,7 @@ var ServiceContext = class {
           return;
         }
         try {
-          (0, import_log14.log)("accepting space recorded in halo", {
+          (0, import_log15.log)("accepting space recorded in halo", {
             details: assertion
           }, {
             file: "service-context.ts",
@@ -3667,7 +3874,7 @@ var ServiceContext = class {
             genesisFeedKey: assertion.genesisFeedKey
           });
         } catch (err) {
-          import_log14.log.catch(err, {}, {
+          import_log15.log.catch(err, {}, {
             file: "service-context.ts",
             line: 197,
             scope: this,
@@ -3708,7 +3915,7 @@ var ServiceRegistry = class {
 var ClientServicesHost = class {
   constructor({
     config,
-    modelFactory = (0, import_client6.createDefaultModelFactory)(),
+    modelFactory = (0, import_client8.createDefaultModelFactory)(),
     // TODO(burdon): Create ApolloLink abstraction (see Client).
     networkManager,
     storage,
@@ -3716,6 +3923,7 @@ var ClientServicesHost = class {
     lockKey
   } = {}) {
     this._statusUpdate = new import_async19.Event();
+    this._opening = false;
     this._open = false;
     this._storage = storage;
     this._modelFactory = modelFactory;
@@ -3727,7 +3935,9 @@ var ClientServicesHost = class {
     }
     this._resourceLock = lockKey ? new VaultResourceLock({
       lockKey,
-      onAcquire: () => this.open(),
+      onAcquire: () => {
+        this._opening || this.open();
+      },
       onRelease: () => this.close()
     }) : void 0;
     this._systemService = new SystemServiceImpl({
@@ -3747,7 +3957,7 @@ var ClientServicesHost = class {
         await this._serviceContext.reset();
       }
     });
-    this._serviceRegistry = new ServiceRegistry(import_client6.clientServiceBundle, {
+    this._serviceRegistry = new ServiceRegistry(import_client8.clientServiceBundle, {
       SystemService: this._systemService
     });
   }
@@ -3783,20 +3993,23 @@ var ClientServicesHost = class {
     }
   }
   async open() {
-    var _a, _b;
+    var _a, _b, _c;
     if (this._open) {
       return;
     }
     (0, import_node_assert12.default)(this._config, "config not set");
     (0, import_node_assert12.default)(this._storage, "storage not set");
     (0, import_node_assert12.default)(this._networkManager, "network manager not set");
-    (0, import_log15.log)("opening...", {}, {
+    this._opening = true;
+    (0, import_log16.log)("opening...", {
+      lockKey: (_a = this._resourceLock) == null ? void 0 : _a.lockKey
+    }, {
       file: "service-host.ts",
-      line: 166,
+      line: 170,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
+    await ((_b = this._resourceLock) == null ? void 0 : _b.acquire());
     this._serviceContext = new ServiceContext(this._storage, this._networkManager, this._modelFactory);
     this._serviceRegistry.setServices({
       SystemService: this._systemService,
@@ -3825,14 +4038,15 @@ var ClientServicesHost = class {
       })
     });
     await this._serviceContext.open();
+    this._opening = false;
     this._open = true;
     this._statusUpdate.emit();
-    const deviceKey = (_b = this._serviceContext.identityManager.identity) == null ? void 0 : _b.deviceKey;
-    (0, import_log15.log)("opened", {
+    const deviceKey = (_c = this._serviceContext.identityManager.identity) == null ? void 0 : _c.deviceKey;
+    (0, import_log16.log)("opened", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 219,
+      line: 224,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3843,11 +4057,11 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    (0, import_log15.log)("closing...", {
+    (0, import_log16.log)("closing...", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 228,
+      line: 233,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3857,11 +4071,11 @@ var ClientServicesHost = class {
     await this._serviceContext.close();
     this._open = false;
     this._statusUpdate.emit();
-    (0, import_log15.log)("closed", {
+    (0, import_log16.log)("closed", {
       deviceKey
     }, {
       file: "service-host.ts",
-      line: 233,
+      line: 238,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -3892,7 +4106,7 @@ var LocalClientServices = class {
 
 // packages/sdk/client-services/src/packlets/services/utils.ts
 var import_config2 = require("@dxos/config");
-var import_log16 = require("@dxos/log");
+var import_log17 = require("@dxos/log");
 var import_messaging3 = require("@dxos/messaging");
 var import_network_manager6 = require("@dxos/network-manager");
 var fromHost = (config = new import_config2.Config()) => {
@@ -3915,7 +4129,7 @@ var createNetworkManager = (config, options = {}) => {
       transportFactory
     });
   }
-  import_log16.log.warn("P2P network is not configured.", {}, {
+  import_log17.log.warn("P2P network is not configured.", {}, {
     file: "utils.ts",
     line: 48,
     scope: void 0,