@dxos/client-services 0.1.39-next.90cb9b6 → 0.1.40

package/dist/lib/node/index.cjs

@@ -993,18 +993,236 @@ var DeviceInvitationProtocol = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
+var import_node_assert6 = __toESM(require("node:assert"));
+var import_async7 = require("@dxos/async");
+var import_client = require("@dxos/client");
+var import_context4 = require("@dxos/context");
+var import_credentials7 = require("@dxos/credentials");
+var import_errors2 = require("@dxos/errors");
+var import_keys6 = require("@dxos/keys");
+var import_log5 = require("@dxos/log");
+var import_network_manager = require("@dxos/network-manager");
+var import_protocols4 = require("@dxos/protocols");
+var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
+var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations");
+
+// packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts
 var import_node_assert5 = __toESM(require("node:assert"));
 var import_async6 = require("@dxos/async");
-var import_client = require("@dxos/client");
 var import_context3 = require("@dxos/context");
-var import_credentials7 = require("@dxos/credentials");
+var import_errors = require("@dxos/errors");
 var import_keys5 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
-var import_network_manager = require("@dxos/network-manager");
 var import_protocols3 = require("@dxos/protocols");
-var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport = require("@dxos/teleport");
+var OPTIONS_TIMEOUT = 1e4;
+var InvitationHostExtension = class extends import_teleport.RpcExtension {
+  constructor(_callbacks) {
+    super({
+      requested: {
+        InvitationHostService: import_protocols3.schema.getService("dxos.halo.invitations.InvitationHostService")
+      },
+      exposed: {
+        InvitationHostService: import_protocols3.schema.getService("dxos.halo.invitations.InvitationHostService")
+      }
+    });
+    this._callbacks = _callbacks;
+    this._ctx = new import_context3.Context();
+    this._remoteOptionsTrigger = new import_async6.Trigger();
+  }
+  async getHandlers() {
+    return {
+      // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
+      // Perhaps in the future we will have more complex logic here.
+      InvitationHostService: {
+        options: async (options) => {
+          (0, import_node_assert5.default)(!this._remoteOptions, "Remote options already set.");
+          this._remoteOptions = options;
+          this._remoteOptionsTrigger.wake();
+        },
+        introduce: async (request) => {
+          const traceId = import_keys5.PublicKey.random().toHex();
+          import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.begin({
+            id: traceId,
+            parentId: this._traceParent
+          }), {
+            file: "invitation-extension.ts",
+            line: 78,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          const response = await this._callbacks.introduce(request);
+          import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.end({
+            id: traceId
+          }), {
+            file: "invitation-extension.ts",
+            line: 83,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return response;
+        },
+        authenticate: async (request) => {
+          const traceId = import_keys5.PublicKey.random().toHex();
+          import_log4.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols3.trace.begin({
+            id: traceId,
+            parentId: this._traceParent
+          }), {
+            file: "invitation-extension.ts",
+            line: 89,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          const response = await this._callbacks.authenticate(request);
+          import_log4.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols3.trace.end({
+            id: traceId,
+            data: {
+              ...response
+            }
+          }), {
+            file: "invitation-extension.ts",
+            line: 94,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return response;
+        },
+        admit: async (request) => {
+          const traceId = import_keys5.PublicKey.random().toHex();
+          import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.begin({
+            id: traceId,
+            parentId: this._traceParent
+          }), {
+            file: "invitation-extension.ts",
+            line: 100,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          const response = await this._callbacks.admit(request);
+          import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.end({
+            id: traceId
+          }), {
+            file: "invitation-extension.ts",
+            line: 105,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return response;
+        }
+      }
+    };
+  }
+  async onOpen(context) {
+    var _a;
+    await super.onOpen(context);
+    try {
+      await this.rpc.InvitationHostService.options({
+        role: import_invitations.Options.Role.HOST
+      });
+      await (0, import_context3.cancelWithContext)(this._ctx, this._remoteOptionsTrigger.wait({
+        timeout: OPTIONS_TIMEOUT
+      }));
+      if (((_a = this._remoteOptions) == null ? void 0 : _a.role) !== import_invitations.Options.Role.GUEST) {
+        throw new import_errors.InvalidInvitationExtensionRoleError(void 0, {
+          expected: import_invitations.Options.Role.GUEST,
+          remoteOptions: this._remoteOptions
+        });
+      }
+      this._callbacks.onOpen();
+    } catch (err) {
+      this._callbacks.onError(err);
+    }
+  }
+  async onClose() {
+    await this._ctx.dispose();
+  }
+};
+var InvitationGuestExtension = class extends import_teleport.RpcExtension {
+  constructor(_callbacks) {
+    super({
+      requested: {
+        InvitationHostService: import_protocols3.schema.getService("dxos.halo.invitations.InvitationHostService")
+      },
+      exposed: {
+        InvitationHostService: import_protocols3.schema.getService("dxos.halo.invitations.InvitationHostService")
+      }
+    });
+    this._callbacks = _callbacks;
+    this._ctx = new import_context3.Context();
+    this._remoteOptionsTrigger = new import_async6.Trigger();
+  }
+  async getHandlers() {
+    return {
+      InvitationHostService: {
+        options: async (options) => {
+          (0, import_node_assert5.default)(!this._remoteOptions, "Remote options already set.");
+          this._remoteOptions = options;
+          this._remoteOptionsTrigger.wake();
+        },
+        introduce: () => {
+          throw new Error("Method not allowed.");
+        },
+        authenticate: () => {
+          throw new Error("Method not allowed.");
+        },
+        admit: () => {
+          throw new Error("Method not allowed.");
+        }
+      }
+    };
+  }
+  async onOpen(context) {
+    var _a;
+    await super.onOpen(context);
+    try {
+      (0, import_log4.log)("begin options", {}, {
+        file: "invitation-extension.ts",
+        line: 189,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      await (0, import_context3.cancelWithContext)(this._ctx, this.rpc.InvitationHostService.options({
+        role: import_invitations.Options.Role.GUEST
+      }));
+      await (0, import_context3.cancelWithContext)(this._ctx, this._remoteOptionsTrigger.wait({
+        timeout: OPTIONS_TIMEOUT
+      }));
+      (0, import_log4.log)("end options", {}, {
+        file: "invitation-extension.ts",
+        line: 192,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      if (((_a = this._remoteOptions) == null ? void 0 : _a.role) !== import_invitations.Options.Role.HOST) {
+        throw new import_errors.InvalidInvitationExtensionRoleError(void 0, {
+          expected: import_invitations.Options.Role.HOST,
+          remoteOptions: this._remoteOptions
+        });
+      }
+      this._callbacks.onOpen(this._ctx);
+    } catch (err) {
+      (0, import_log4.log)("openError", err, {
+        file: "invitation-extension.ts",
+        line: 202,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      this._callbacks.onError(err);
+    }
+  }
+  async onClose() {
+    (0, import_log4.log)("onClose", {}, {
+      file: "invitation-extension.ts",
+      line: 208,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this._ctx.dispose();
+  }
+};
+
+// packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
 var MAX_OTP_ATTEMPTS = 3;
 var InvitationsHandler = class {
   constructor(_networkManager) {
@@ -1012,9 +1230,9 @@ var InvitationsHandler = class {
   }
   createInvitation(protocol, options) {
     var _a;
-    const { invitationId = import_keys5.PublicKey.random().toHex(), type = import_services2.Invitation.Type.INTERACTIVE, authMethod = import_services2.Invitation.AuthMethod.SHARED_SECRET, state = import_services2.Invitation.State.INIT, timeout = import_client.INVITATION_TIMEOUT, swarmKey = import_keys5.PublicKey.random() } = options != null ? options : {};
+    const { invitationId = import_keys6.PublicKey.random().toHex(), type = import_services2.Invitation.Type.INTERACTIVE, authMethod = import_services2.Invitation.AuthMethod.SHARED_SECRET, state = import_services2.Invitation.State.INIT, timeout = import_client.INVITATION_TIMEOUT, swarmKey = import_keys6.PublicKey.random() } = options != null ? options : {};
     const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === import_services2.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials7.generatePasscode)(import_client.AUTHENTICATION_CODE_LENGTH) : void 0;
-    (0, import_node_assert5.default)(protocol);
+    (0, import_node_assert6.default)(protocol);
     const invitation = {
       invitationId,
       type,
@@ -1025,37 +1243,37 @@ var InvitationsHandler = class {
       timeout,
       ...protocol.getInvitationContext()
     };
-    const stream = new import_async6.PushStream();
-    const ctx = new import_context3.Context({
+    const stream = new import_async7.PushStream();
+    const ctx = new import_context4.Context({
       onError: (err) => {
         void ctx.dispose();
         stream.error(err);
       }
     });
     ctx.onDispose(() => {
-      (0, import_log4.log)("complete", {
+      (0, import_log5.log)("complete", {
         ...protocol.toJSON()
       }, {
         file: "invitations-handler.ts",
-        line: 106,
+        line: 99,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       stream.complete();
     });
     const createExtension = () => {
-      const success = new import_async6.Trigger();
+      const success = new import_async7.Trigger();
       let guestProfile;
       let authenticationPassed = false;
       let authenticationRetry = 0;
       const extension = new InvitationHostExtension({
         introduce: async ({ profile }) => {
-          (0, import_log4.log)("guest introduced itself", {
+          (0, import_log5.log)("guest introduced itself", {
             guestProfile: profile,
             ...protocol.toJSON()
           }, {
             file: "invitations-handler.ts",
-            line: 119,
+            line: 112,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1070,33 +1288,33 @@ var InvitationsHandler = class {
           };
         },
         authenticate: async ({ authCode: code }) => {
-          (0, import_log4.log)("received authentication request", {
+          (0, import_log5.log)("received authentication request", {
             authCode: code
           }, {
             file: "invitations-handler.ts",
-            line: 138,
+            line: 131,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          let status = import_invitations.AuthenticationResponse.Status.OK;
+          let status = import_invitations2.AuthenticationResponse.Status.OK;
           switch (invitation.authMethod) {
             case import_services2.Invitation.AuthMethod.NONE: {
-              (0, import_log4.log)("authentication not required", {}, {
+              (0, import_log5.log)("authentication not required", {}, {
                 file: "invitations-handler.ts",
-                line: 143,
+                line: 136,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               return {
-                status: import_invitations.AuthenticationResponse.Status.OK
+                status: import_invitations2.AuthenticationResponse.Status.OK
               };
             }
             case import_services2.Invitation.AuthMethod.SHARED_SECRET: {
               if (invitation.authCode) {
                 if (authenticationRetry++ > MAX_OTP_ATTEMPTS) {
-                  status = import_invitations.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
+                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
                 } else if (code !== invitation.authCode) {
-                  status = import_invitations.AuthenticationResponse.Status.INVALID_OTP;
+                  status = import_invitations2.AuthenticationResponse.Status.INVALID_OTP;
                 } else {
                   authenticationPassed = true;
                 }
@@ -1104,15 +1322,15 @@ var InvitationsHandler = class {
               break;
             }
             default: {
-              import_log4.log.error("invalid authentication method", {
+              import_log5.log.error("invalid authentication method", {
                 authMethod: invitation.authMethod
               }, {
                 file: "invitations-handler.ts",
-                line: 161,
+                line: 154,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              status = import_invitations.AuthenticationResponse.Status.INTERNAL_ERROR;
+              status = import_invitations2.AuthenticationResponse.Status.INTERNAL_ERROR;
               break;
             }
           }
@@ -1127,7 +1345,7 @@ var InvitationsHandler = class {
               throw new Error("Not authenticated");
             }
             const deviceKey = (_c = (_a2 = admissionRequest.device) == null ? void 0 : _a2.deviceKey) != null ? _c : (_b = admissionRequest.space) == null ? void 0 : _b.deviceKey;
-            (0, import_node_assert5.default)(deviceKey);
+            (0, import_node_assert6.default)(deviceKey);
             const admissionResponse = await protocol.admit(admissionRequest, guestProfile);
             success.wake(deviceKey);
             return admissionResponse;
@@ -1137,23 +1355,23 @@ var InvitationsHandler = class {
           }
         },
         onOpen: () => {
-          (0, import_async6.scheduleTask)(ctx, async () => {
-            const traceId = import_keys5.PublicKey.random().toHex();
+          (0, import_async7.scheduleTask)(ctx, async () => {
+            const traceId = import_keys6.PublicKey.random().toHex();
             try {
-              import_log4.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols3.trace.begin({
+              import_log5.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.begin({
                 id: traceId,
                 parentId: this._traceParent
               }), {
                 file: "invitations-handler.ts",
-                line: 196,
+                line: 189,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              (0, import_log4.log)("connected", {
+              (0, import_log5.log)("connected", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 200,
+                line: 193,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1164,12 +1382,12 @@ var InvitationsHandler = class {
               const deviceKey = await success.wait({
                 timeout
               });
-              (0, import_log4.log)("admitted guest", {
+              (0, import_log5.log)("admitted guest", {
                 guest: deviceKey,
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 203,
+                line: 196,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1177,21 +1395,21 @@ var InvitationsHandler = class {
                 ...invitation,
                 state: import_services2.Invitation.State.SUCCESS
               });
-              import_log4.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols3.trace.end({
+              import_log5.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 205,
+                line: 198,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
             } catch (err) {
-              if (err instanceof import_async6.TimeoutError) {
-                (0, import_log4.log)("timeout", {
+              if (err instanceof import_async7.TimeoutError) {
+                (0, import_log5.log)("timeout", {
                   ...protocol.toJSON()
                 }, {
                   file: "invitations-handler.ts",
-                  line: 208,
+                  line: 201,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
@@ -1200,36 +1418,63 @@ var InvitationsHandler = class {
                   state: import_services2.Invitation.State.TIMEOUT
                 });
               } else {
-                import_log4.log.error("failed", err, {
+                import_log5.log.error("failed", err, {
                   file: "invitations-handler.ts",
-                  line: 211,
+                  line: 204,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 stream.error(err);
               }
-              import_log4.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols3.trace.error({
+              import_log5.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.error({
                 id: traceId,
                 error: err
               }), {
                 file: "invitations-handler.ts",
-                line: 214,
+                line: 207,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
             } finally {
               if (type !== import_services2.Invitation.Type.MULTIUSE) {
-                await (0, import_async6.sleep)(import_client.ON_CLOSE_DELAY);
+                await (0, import_async7.sleep)(import_client.ON_CLOSE_DELAY);
                 await ctx.dispose();
               }
             }
           });
+        },
+        onError: (err) => {
+          if (err instanceof import_errors2.InvalidInvitationExtensionRoleError) {
+            return;
+          }
+          if (err instanceof import_async7.TimeoutError) {
+            (0, import_log5.log)("timeout", {
+              ...protocol.toJSON()
+            }, {
+              file: "invitations-handler.ts",
+              line: 221,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            stream.next({
+              ...invitation,
+              state: import_services2.Invitation.State.TIMEOUT
+            });
+          } else {
+            import_log5.log.error("failed", err, {
+              file: "invitations-handler.ts",
+              line: 224,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            stream.error(err);
+          }
         }
       });
       extension._traceParent = this._traceParent;
       return extension;
     };
-    (0, import_async6.scheduleTask)(ctx, async () => {
+    (0, import_async7.scheduleTask)(ctx, async () => {
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1260,28 +1505,36 @@ var InvitationsHandler = class {
   }
   acceptInvitation(protocol, invitation) {
     const { timeout = import_client.INVITATION_TIMEOUT } = invitation;
-    (0, import_node_assert5.default)(protocol);
-    const authenticated = new import_async6.Trigger();
-    const stream = new import_async6.PushStream();
-    const ctx = new import_context3.Context({
+    (0, import_node_assert6.default)(protocol);
+    const authenticated = new import_async7.Trigger();
+    let currentState;
+    const stream = new import_async7.PushStream();
+    const setState = (newData) => {
+      (0, import_node_assert6.default)(newData.state !== void 0);
+      currentState = newData.state;
+      stream.next({
+        ...invitation,
+        ...newData
+      });
+    };
+    const ctx = new import_context4.Context({
       onError: (err) => {
-        if (err instanceof import_async6.TimeoutError) {
-          (0, import_log4.log)("timeout", {
+        if (err instanceof import_async7.TimeoutError) {
+          (0, import_log5.log)("timeout", {
             ...protocol.toJSON()
           }, {
             file: "invitations-handler.ts",
-            line: 267,
+            line: 279,
             scope: this,
             callSite: (f, a) => f(...a)
           });
-          stream.next({
-            ...invitation,
+          setState({
             state: import_services2.Invitation.State.TIMEOUT
           });
         } else {
-          import_log4.log.warn("auth failed", err, {
+          import_log5.log.warn("auth failed", err, {
             file: "invitations-handler.ts",
-            line: 270,
+            line: 282,
             scope: this,
             callSite: (f, a) => f(...a)
           });
@@ -1291,11 +1544,11 @@ var InvitationsHandler = class {
       }
     });
     ctx.onDispose(() => {
-      (0, import_log4.log)("complete", {
+      (0, import_log5.log)("complete", {
         ...protocol.toJSON()
       }, {
         file: "invitations-handler.ts",
-        line: 278,
+        line: 290,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1304,50 +1557,62 @@ var InvitationsHandler = class {
     const createExtension = () => {
       let connectionCount = 0;
       const extension = new InvitationGuestExtension({
-        onOpen: () => {
-          (0, import_async6.scheduleTask)(ctx, async () => {
-            const traceId = import_keys5.PublicKey.random().toHex();
+        onOpen: (extensionCtx) => {
+          extensionCtx.onDispose(async () => {
+            (0, import_log5.log)("extension disposed", {
+              currentState
+            }, {
+              file: "invitations-handler.ts",
+              line: 300,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            if (currentState !== import_services2.Invitation.State.SUCCESS) {
+              stream.error(new Error("Remote peer disconnected."));
+            }
+          });
+          (0, import_async7.scheduleTask)(ctx, async () => {
+            const traceId = import_keys6.PublicKey.random().toHex();
             try {
-              import_log4.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols3.trace.begin({
+              import_log5.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.begin({
                 id: traceId,
                 parentId: this._traceParent
               }), {
                 file: "invitations-handler.ts",
-                line: 290,
+                line: 309,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
               }
-              (0, import_async6.scheduleTask)(ctx, () => ctx.raise(new import_async6.TimeoutError(timeout)), timeout);
-              (0, import_log4.log)("connected", {
+              (0, import_async7.scheduleTask)(ctx, () => ctx.raise(new import_async7.TimeoutError(timeout)), timeout);
+              (0, import_log5.log)("connected", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 301,
+                line: 320,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              stream.next({
-                ...invitation,
+              setState({
                 state: import_services2.Invitation.State.CONNECTED
               });
-              (0, import_log4.log)("introduce", {
+              (0, import_log5.log)("introduce", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 305,
+                line: 324,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               const introductionResponse = await extension.rpc.InvitationHostService.introduce(protocol.createIntroduction());
-              (0, import_log4.log)("introduce response", {
+              (0, import_log5.log)("introduce response", {
                 ...protocol.toJSON(),
                 response: introductionResponse
               }, {
                 file: "invitations-handler.ts",
-                line: 309,
+                line: 328,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1357,44 +1622,42 @@ var InvitationsHandler = class {
               }
               if (isAuthenticationRequired(invitation)) {
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  (0, import_log4.log)("guest waiting for authentication code...", {}, {
+                  (0, import_log5.log)("guest waiting for authentication code...", {}, {
                     file: "invitations-handler.ts",
-                    line: 318,
+                    line: 337,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
-                  stream.next({
-                    ...invitation,
+                  setState({
                     state: import_services2.Invitation.State.READY_FOR_AUTHENTICATION
                   });
                   const authCode = await authenticated.wait({
                     timeout
                   });
-                  (0, import_log4.log)("sending authentication request", {}, {
+                  (0, import_log5.log)("sending authentication request", {}, {
                     file: "invitations-handler.ts",
-                    line: 322,
+                    line: 341,
                     scope: this,
                     callSite: (f, a) => f(...a)
                   });
-                  stream.next({
-                    ...invitation,
+                  setState({
                     state: import_services2.Invitation.State.AUTHENTICATING
                   });
                   const response = await extension.rpc.InvitationHostService.authenticate({
                     authCode
                   });
-                  if (response.status === void 0 || response.status === import_invitations.AuthenticationResponse.Status.OK) {
+                  if (response.status === void 0 || response.status === import_invitations2.AuthenticationResponse.Status.OK) {
                     break;
                   }
-                  if (response.status === import_invitations.AuthenticationResponse.Status.INVALID_OTP) {
+                  if (response.status === import_invitations2.AuthenticationResponse.Status.INVALID_OTP) {
                     if (attempt === MAX_OTP_ATTEMPTS) {
                       throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
                     } else {
-                      (0, import_log4.log)("retrying invalid code", {
+                      (0, import_log5.log)("retrying invalid code", {
                         attempt
                       }, {
                         file: "invitations-handler.ts",
-                        line: 333,
+                        line: 352,
                         scope: this,
                         callSite: (f, a) => f(...a)
                       });
@@ -1403,72 +1666,69 @@ var InvitationsHandler = class {
                   }
                 }
               } else {
-                stream.next({
-                  ...invitation,
+                setState({
                   state: import_services2.Invitation.State.READY_FOR_AUTHENTICATION
                 });
               }
-              (0, import_log4.log)("request admission", {
+              (0, import_log5.log)("request admission", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 344,
+                line: 363,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
               const admissionRequest = await protocol.createAdmissionRequest();
               const admissionResponse = await extension.rpc.InvitationHostService.admit(admissionRequest);
               const result = await protocol.accept(admissionResponse, admissionRequest);
-              (0, import_log4.log)("admitted by host", {
+              (0, import_log5.log)("admitted by host", {
                 ...protocol.toJSON()
               }, {
                 file: "invitations-handler.ts",
-                line: 352,
+                line: 371,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
-              stream.next({
-                ...invitation,
+              setState({
                 ...result,
                 state: import_services2.Invitation.State.SUCCESS
               });
-              import_log4.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols3.trace.end({
+              import_log5.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
                 file: "invitations-handler.ts",
-                line: 354,
+                line: 373,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
             } catch (err) {
-              if (err instanceof import_async6.TimeoutError) {
-                (0, import_log4.log)("timeout", {
+              if (err instanceof import_async7.TimeoutError) {
+                (0, import_log5.log)("timeout", {
                   ...protocol.toJSON()
                 }, {
                   file: "invitations-handler.ts",
-                  line: 357,
+                  line: 376,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
-                stream.next({
-                  ...invitation,
+                setState({
                   state: import_services2.Invitation.State.TIMEOUT
                 });
               } else {
-                (0, import_log4.log)("auth failed", err, {
+                (0, import_log5.log)("auth failed", err, {
                   file: "invitations-handler.ts",
-                  line: 360,
+                  line: 379,
                   scope: this,
                   callSite: (f, a) => f(...a)
                 });
                 stream.error(err);
               }
-              import_log4.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols3.trace.error({
+              import_log5.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.error({
                 id: traceId,
                 error: err
               }), {
                 file: "invitations-handler.ts",
-                line: 363,
+                line: 382,
                 scope: this,
                 callSite: (f, a) => f(...a)
               });
@@ -1476,24 +1736,49 @@ var InvitationsHandler = class {
               await ctx.dispose();
             }
           });
+        },
+        onError: (err) => {
+          if (err instanceof import_errors2.InvalidInvitationExtensionRoleError) {
+            return;
+          }
+          if (err instanceof import_async7.TimeoutError) {
+            (0, import_log5.log)("timeout", {
+              ...protocol.toJSON()
+            }, {
+              file: "invitations-handler.ts",
+              line: 393,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            setState({
+              state: import_services2.Invitation.State.TIMEOUT
+            });
+          } else {
+            (0, import_log5.log)("auth failed", err, {
+              file: "invitations-handler.ts",
+              line: 396,
+              scope: this,
+              callSite: (f, a) => f(...a)
+            });
+            stream.error(err);
+          }
         }
       });
       return extension;
     };
-    (0, import_async6.scheduleTask)(ctx, async () => {
-      (0, import_node_assert5.default)(invitation.swarmKey);
+    (0, import_async7.scheduleTask)(ctx, async () => {
+      (0, import_node_assert6.default)(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
-        peerId: import_keys5.PublicKey.random(),
+        peerId: import_keys6.PublicKey.random(),
         protocolProvider: (0, import_network_manager.createTeleportProtocolFactory)(async (teleport) => {
           teleport.addExtension("dxos.halo.invitations", createExtension());
         }),
         topology: new import_network_manager.StarTopology(topic)
       });
       ctx.onDispose(() => swarmConnection.close());
-      stream.next({
-        ...invitation,
+      setState({
         state: import_services2.Invitation.State.CONNECTING
       });
     });
@@ -1501,8 +1786,7 @@ var InvitationsHandler = class {
       initialInvitation: invitation,
       subscriber: stream.observable,
       onCancel: async () => {
-        stream.next({
-          ...invitation,
+        setState({
           state: import_services2.Invitation.State.CANCELLED
         });
         await ctx.dispose();
@@ -1515,119 +1799,12 @@ var InvitationsHandler = class {
   }
 };
 var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_services2.Invitation.AuthMethod.NONE;
-var InvitationHostExtension = class extends import_teleport.RpcExtension {
-  constructor(_callbacks) {
-    super({
-      exposed: {
-        InvitationHostService: import_protocols3.schema.getService("dxos.halo.invitations.InvitationHostService")
-      }
-    });
-    this._callbacks = _callbacks;
-  }
-  async getHandlers() {
-    return {
-      // TODO(dmaretskyi): For now this is just forwarding the data to callbacks since we don't have session-specific logic.
-      // Perhaps in the future we will have more complex logic here.
-      InvitationHostService: {
-        introduce: async (request) => {
-          const traceId = import_keys5.PublicKey.random().toHex();
-          import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.begin({
-            id: traceId,
-            parentId: this._traceParent
-          }), {
-            file: "invitations-handler.ts",
-            line: 442,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          const response = await this._callbacks.introduce(request);
-          import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.end({
-            id: traceId
-          }), {
-            file: "invitations-handler.ts",
-            line: 447,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          return response;
-        },
-        authenticate: async (request) => {
-          const traceId = import_keys5.PublicKey.random().toHex();
-          import_log4.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols3.trace.begin({
-            id: traceId,
-            parentId: this._traceParent
-          }), {
-            file: "invitations-handler.ts",
-            line: 453,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          const response = await this._callbacks.authenticate(request);
-          import_log4.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols3.trace.end({
-            id: traceId,
-            data: {
-              ...response
-            }
-          }), {
-            file: "invitations-handler.ts",
-            line: 458,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          return response;
-        },
-        admit: async (request) => {
-          const traceId = import_keys5.PublicKey.random().toHex();
-          import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.begin({
-            id: traceId,
-            parentId: this._traceParent
-          }), {
-            file: "invitations-handler.ts",
-            line: 464,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          const response = await this._callbacks.admit(request);
-          import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.end({
-            id: traceId
-          }), {
-            file: "invitations-handler.ts",
-            line: 469,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          return response;
-        }
-      }
-    };
-  }
-  async onOpen(context) {
-    await super.onOpen(context);
-    this._callbacks.onOpen();
-  }
-};
-var InvitationGuestExtension = class extends import_teleport.RpcExtension {
-  constructor(_callbacks) {
-    super({
-      requested: {
-        InvitationHostService: import_protocols3.schema.getService("dxos.halo.invitations.InvitationHostService")
-      }
-    });
-    this._callbacks = _callbacks;
-  }
-  async getHandlers() {
-    return {};
-  }
-  async onOpen(context) {
-    await super.onOpen(context);
-    this._callbacks.onOpen();
-  }
-};
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
-var import_node_assert6 = __toESM(require("node:assert"));
+var import_node_assert7 = __toESM(require("node:assert"));
+var import_async8 = require("@dxos/async");
 var import_codec_protobuf7 = require("@dxos/codec-protobuf");
-var import_log5 = require("@dxos/log");
+var import_log6 = require("@dxos/log");
 var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var InvitationsServiceImpl = class {
   constructor(_invitationsHandler, _getHandler) {
@@ -1635,203 +1812,74 @@ var InvitationsServiceImpl = class {
     this._getHandler = _getHandler;
     this._createInvitations = /* @__PURE__ */ new Map();
     this._acceptInvitations = /* @__PURE__ */ new Map();
+    this._invitationCreated = new import_async8.Event();
+    this._invitationAccepted = new import_async8.Event();
+    this._removedCreated = new import_async8.Event();
+    this._removedAccepted = new import_async8.Event();
   }
   // TODO(burdon): Guest/host label.
   getLoggingContext() {
     return {};
   }
-  createInvitation(invitation) {
+  createInvitation(options) {
+    let invitation;
+    const existingInvitation = this._createInvitations.get(options.invitationId);
+    if (existingInvitation) {
+      invitation = existingInvitation;
+    } else {
+      const handler = this._getHandler(options);
+      invitation = this._invitationsHandler.createInvitation(handler, options);
+      this._createInvitations.set(invitation.get().invitationId, invitation);
+      this._invitationCreated.emit(invitation.get());
+    }
     return new import_codec_protobuf7.Stream(({ next, close }) => {
-      const handler = this._getHandler(invitation);
-      (0, import_log5.log)("stream opened", this.getLoggingContext(), {
-        file: "invitations-service.ts",
-        line: 37,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      let invitationId;
-      const observable = this._invitationsHandler.createInvitation(handler, invitation);
-      observable.subscribe((invitation2) => {
-        switch (invitation2.state) {
-          case import_services3.Invitation.State.CONNECTING: {
-            (0, import_node_assert6.default)(invitation2.invitationId);
-            invitationId = invitation2.invitationId;
-            this._createInvitations.set(invitation2.invitationId, observable);
-            invitation2.state = import_services3.Invitation.State.CONNECTING;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.CONNECTED: {
-            (0, import_node_assert6.default)(invitation2.invitationId);
-            invitation2.state = import_services3.Invitation.State.CONNECTED;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.READY_FOR_AUTHENTICATION: {
-            (0, import_node_assert6.default)(invitation2.invitationId);
-            invitation2.state = import_services3.Invitation.State.READY_FOR_AUTHENTICATION;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.AUTHENTICATING: {
-            (0, import_node_assert6.default)(invitation2.invitationId);
-            invitation2.state = import_services3.Invitation.State.AUTHENTICATING;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.SUCCESS: {
-            (0, import_node_assert6.default)(invitation2.invitationId);
-            invitation2.state = import_services3.Invitation.State.SUCCESS;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.CANCELLED: {
-            (0, import_node_assert6.default)(invitationId);
-            invitation2.invitationId = invitationId;
-            invitation2.state = import_services3.Invitation.State.CANCELLED;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.TIMEOUT: {
-            (0, import_node_assert6.default)(invitationId);
-            invitation2.invitationId = invitationId;
-            invitation2.state = import_services3.Invitation.State.TIMEOUT;
-            next(invitation2);
-            break;
-          }
-        }
+      invitation.subscribe((invitation2) => {
+        next(invitation2);
       }, (err) => {
         close(err);
       }, () => {
         close();
+        this._createInvitations.delete(invitation.get().invitationId);
       });
-      return (err) => {
-        const context = this.getLoggingContext();
-        if (err) {
-          import_log5.log.warn("stream closed", {
-            ...context,
-            err
-          }, {
-            file: "invitations-service.ts",
-            line: 103,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        } else {
-          (0, import_log5.log)("stream closed", context, {
-            file: "invitations-service.ts",
-            line: 105,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        }
-        this._createInvitations.delete(invitation.invitationId);
-      };
     });
   }
-  acceptInvitation(invitation) {
+  acceptInvitation(options) {
+    let invitation;
+    const existingInvitation = this._acceptInvitations.get(options.invitationId);
+    if (existingInvitation) {
+      invitation = existingInvitation;
+    } else {
+      const handler = this._getHandler(options);
+      invitation = this._invitationsHandler.acceptInvitation(handler, options);
+      this._acceptInvitations.set(invitation.get().invitationId, invitation);
+      this._invitationAccepted.emit(invitation.get());
+    }
     return new import_codec_protobuf7.Stream(({ next, close }) => {
-      (0, import_log5.log)("stream opened", this.getLoggingContext(), {
-        file: "invitations-service.ts",
-        line: 115,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      const handler = this._getHandler(invitation);
-      let invitationId;
-      const observable = this._invitationsHandler.acceptInvitation(handler, invitation);
-      observable.subscribe((invitation2) => {
-        switch (invitation2.state) {
-          case import_services3.Invitation.State.CONNECTING: {
-            (0, import_node_assert6.default)(invitation2.invitationId);
-            invitationId = invitation2.invitationId;
-            this._acceptInvitations.set(invitation2.invitationId, observable);
-            invitation2.state = import_services3.Invitation.State.CONNECTING;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.CONNECTED: {
-            (0, import_node_assert6.default)(invitation2.invitationId);
-            invitation2.state = import_services3.Invitation.State.CONNECTED;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.READY_FOR_AUTHENTICATION: {
-            (0, import_node_assert6.default)(invitation2.invitationId);
-            invitation2.state = import_services3.Invitation.State.READY_FOR_AUTHENTICATION;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.AUTHENTICATING: {
-            (0, import_node_assert6.default)(invitation2.invitationId);
-            invitation2.state = import_services3.Invitation.State.AUTHENTICATING;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.SUCCESS: {
-            invitation2.state = import_services3.Invitation.State.SUCCESS;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.CANCELLED: {
-            (0, import_node_assert6.default)(invitationId);
-            invitation2.invitationId = invitationId;
-            invitation2.state = import_services3.Invitation.State.CANCELLED;
-            next(invitation2);
-            break;
-          }
-          case import_services3.Invitation.State.TIMEOUT: {
-            (0, import_node_assert6.default)(invitationId);
-            invitation2.invitationId = invitationId;
-            invitation2.state = import_services3.Invitation.State.TIMEOUT;
-            next(invitation2);
-            break;
-          }
-        }
+      invitation.subscribe((invitation2) => {
+        next(invitation2);
       }, (err) => {
         close(err);
       }, () => {
         close();
+        this._acceptInvitations.delete(invitation.get().invitationId);
       });
-      return (err) => {
-        const context = this.getLoggingContext();
-        if (err) {
-          import_log5.log.warn("stream closed", {
-            ...context,
-            err
-          }, {
-            file: "invitations-service.ts",
-            line: 181,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        } else {
-          (0, import_log5.log)("stream closed", context, {
-            file: "invitations-service.ts",
-            line: 183,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-        }
-        this._acceptInvitations.delete(invitation.invitationId);
-      };
     });
   }
   async authenticate({ invitationId, authCode }) {
-    (0, import_log5.log)("authenticating...", {}, {
+    (0, import_log6.log)("authenticating...", {}, {
       file: "invitations-service.ts",
-      line: 192,
+      line: 103,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert6.default)(invitationId);
+    (0, import_node_assert7.default)(invitationId);
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
-      import_log5.log.warn("invalid invitation", {
+      import_log6.log.warn("invalid invitation", {
         invitationId
       }, {
         file: "invitations-service.ts",
-        line: 196,
+        line: 107,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -1840,35 +1888,91 @@ var InvitationsServiceImpl = class {
     }
   }
   async cancelInvitation({ invitationId }) {
-    var _a;
-    (0, import_log5.log)("cancelling...", {}, {
+    (0, import_log6.log)("deleting...", {}, {
       file: "invitations-service.ts",
-      line: 203,
+      line: 114,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert6.default)(invitationId);
-    const observable = (_a = this._createInvitations.get(invitationId)) != null ? _a : this._acceptInvitations.get(invitationId);
-    if (!observable) {
-      import_log5.log.warn("invalid invitation", {
+    (0, import_node_assert7.default)(invitationId);
+    const created = this._createInvitations.get(invitationId);
+    const accepted = this._acceptInvitations.get(invitationId);
+    if (created) {
+      await created.cancel();
+      this._createInvitations.delete(invitationId);
+      this._removedCreated.emit(created.get());
+    } else if (accepted) {
+      await accepted.cancel();
+      this._acceptInvitations.delete(invitationId);
+      this._removedAccepted.emit(accepted.get());
+    } else {
+      import_log6.log.warn("invalid invitation", {
         invitationId
       }, {
         file: "invitations-service.ts",
-        line: 207,
+        line: 127,
         scope: this,
         callSite: (f, a) => f(...a)
       });
-    } else {
-      await (observable == null ? void 0 : observable.cancel());
     }
   }
+  queryInvitations() {
+    return new import_codec_protobuf7.Stream(({ next, ctx }) => {
+      this._invitationCreated.on(ctx, (invitation) => {
+        next({
+          action: import_services3.QueryInvitationsResponse.Action.ADDED,
+          type: import_services3.QueryInvitationsResponse.Type.CREATED,
+          invitations: [
+            invitation
+          ]
+        });
+      });
+      this._invitationAccepted.on(ctx, (invitation) => {
+        next({
+          action: import_services3.QueryInvitationsResponse.Action.ADDED,
+          type: import_services3.QueryInvitationsResponse.Type.ACCEPTED,
+          invitations: [
+            invitation
+          ]
+        });
+      });
+      this._removedCreated.on(ctx, (invitation) => {
+        next({
+          action: import_services3.QueryInvitationsResponse.Action.REMOVED,
+          type: import_services3.QueryInvitationsResponse.Type.CREATED,
+          invitations: [
+            invitation
+          ]
+        });
+      });
+      this._removedAccepted.on(ctx, (invitation) => {
+        next({
+          action: import_services3.QueryInvitationsResponse.Action.REMOVED,
+          type: import_services3.QueryInvitationsResponse.Type.ACCEPTED,
+          invitations: [
+            invitation
+          ]
+        });
+      });
+      next({
+        action: import_services3.QueryInvitationsResponse.Action.ADDED,
+        type: import_services3.QueryInvitationsResponse.Type.CREATED,
+        invitations: Array.from(this._createInvitations.values()).map((invitation) => invitation.get())
+      });
+      next({
+        action: import_services3.QueryInvitationsResponse.Action.ADDED,
+        type: import_services3.QueryInvitationsResponse.Type.ACCEPTED,
+        invitations: Array.from(this._acceptInvitations.values()).map((invitation) => invitation.get())
+      });
+    });
+  }
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts
-var import_node_assert7 = __toESM(require("node:assert"));
+var import_node_assert8 = __toESM(require("node:assert"));
 var import_credentials8 = require("@dxos/credentials");
 var import_feed_store3 = require("@dxos/feed-store");
-var import_log6 = require("@dxos/log");
+var import_log7 = require("@dxos/log");
 var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
@@ -1891,12 +1995,12 @@ var SpaceInvitationProtocol = class {
   }
   async admit(request, guestProfile) {
     var _a;
-    (0, import_node_assert7.default)(this._spaceKey);
+    (0, import_node_assert8.default)(this._spaceKey);
     const space = await this._spaceManager.spaces.get(this._spaceKey);
-    (0, import_node_assert7.default)(space);
-    (0, import_node_assert7.default)(request.space);
+    (0, import_node_assert8.default)(space);
+    (0, import_node_assert8.default)(request.space);
     const { identityKey, deviceKey } = request.space;
-    (0, import_log6.log)("writing guest credentials", {
+    (0, import_log7.log)("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
@@ -1906,9 +2010,9 @@ var SpaceInvitationProtocol = class {
       callSite: (f, a) => f(...a)
     });
     const credentials = await (0, import_credentials8.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
-    (0, import_node_assert7.default)(credentials[0].credential);
+    (0, import_node_assert8.default)(credentials[0].credential);
     const spaceMemberCredential = credentials[0].credential.credential;
-    (0, import_node_assert7.default)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    (0, import_node_assert8.default)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
     await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, credentials);
     return {
       space: {
@@ -1936,11 +2040,11 @@ var SpaceInvitationProtocol = class {
     };
   }
   async accept(response) {
-    (0, import_node_assert7.default)(response.space);
+    (0, import_node_assert8.default)(response.space);
     const { credential, controlTimeframe, dataTimeframe } = response.space;
     const assertion = (0, import_credentials8.getCredentialAssertion)(credential);
-    (0, import_node_assert7.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
-    (0, import_node_assert7.default)(credential.subject.id.equals(this._signingContext.identityKey));
+    (0, import_node_assert8.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
+    (0, import_node_assert8.default)(credential.subject.id.equals(this._signingContext.identityKey));
     await this._spaceManager.acceptSpace({
       spaceKey: assertion.spaceKey,
       genesisFeedKey: assertion.genesisFeedKey,
@@ -1955,12 +2059,12 @@ var SpaceInvitationProtocol = class {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-var import_node_assert13 = __toESM(require("node:assert"));
-var import_async18 = require("@dxos/async");
+var import_node_assert14 = __toESM(require("node:assert"));
+var import_async20 = require("@dxos/async");
 var import_client8 = require("@dxos/client");
 var import_echo_pipeline5 = require("@dxos/echo-pipeline");
-var import_log16 = require("@dxos/log");
-var import_protocols7 = require("@dxos/protocols");
+var import_log18 = require("@dxos/log");
+var import_protocols8 = require("@dxos/protocols");
 var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 
 // packages/sdk/client-services/src/packlets/deprecated/tracing.ts
@@ -1977,7 +2081,7 @@ var TracingServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
-var import_async7 = require("@dxos/async");
+var import_async9 = require("@dxos/async");
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
 var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
 var DevicesServiceImpl = class {
@@ -2008,7 +2112,7 @@ var DevicesServiceImpl = class {
           });
         }
       };
-      const subscriptions = new import_async7.EventSubscriptions();
+      const subscriptions = new import_async9.EventSubscriptions();
       subscriptions.add(this._identityManager.stateUpdate.on(() => {
         update();
         if (this._identityManager.identity) {
@@ -2046,37 +2150,37 @@ var NetworkServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
-var import_node_assert9 = __toESM(require("node:assert"));
-var import_async10 = require("@dxos/async");
+var import_node_assert10 = __toESM(require("node:assert"));
+var import_async12 = require("@dxos/async");
 var import_client3 = require("@dxos/client");
-var import_context6 = require("@dxos/context");
+var import_context7 = require("@dxos/context");
 var import_credentials10 = require("@dxos/credentials");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
-var import_keys8 = require("@dxos/keys");
-var import_log9 = require("@dxos/log");
-var import_protocols5 = require("@dxos/protocols");
+var import_keys9 = require("@dxos/keys");
+var import_log10 = require("@dxos/log");
+var import_protocols6 = require("@dxos/protocols");
 var import_teleport_extension_gossip = require("@dxos/teleport-extension-gossip");
 var import_util5 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-var import_async9 = require("@dxos/async");
+var import_async11 = require("@dxos/async");
 var import_client2 = require("@dxos/client");
-var import_context5 = require("@dxos/context");
+var import_context6 = require("@dxos/context");
 var import_debug3 = require("@dxos/debug");
 var import_echo_pipeline = require("@dxos/echo-pipeline");
-var import_errors = require("@dxos/errors");
-var import_keys7 = require("@dxos/keys");
-var import_log8 = require("@dxos/log");
+var import_errors3 = require("@dxos/errors");
+var import_keys8 = require("@dxos/keys");
+var import_log9 = require("@dxos/log");
 var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util4 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
-var import_node_assert8 = __toESM(require("node:assert"));
-var import_async8 = require("@dxos/async");
-var import_context4 = require("@dxos/context");
-var import_keys6 = require("@dxos/keys");
-var import_log7 = require("@dxos/log");
-var import_protocols4 = require("@dxos/protocols");
+var import_node_assert9 = __toESM(require("node:assert"));
+var import_async10 = require("@dxos/async");
+var import_context5 = require("@dxos/context");
+var import_keys7 = require("@dxos/keys");
+var import_log8 = require("@dxos/log");
+var import_protocols5 = require("@dxos/protocols");
 var import_teleport2 = require("@dxos/teleport");
 var import_util3 = require("@dxos/util");
 var DEFAULT_RETRY_TIMEOUT = 1e3;
@@ -2084,11 +2188,11 @@ var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
 var NotarizationPlugin = class {
   constructor() {
-    this._ctx = new import_context4.Context();
-    this._extensionOpened = new import_async8.Event();
+    this._ctx = new import_context5.Context();
+    this._extensionOpened = new import_async10.Event();
     this._extensions = /* @__PURE__ */ new Set();
-    this._processedCredentials = new import_util3.ComplexSet(import_keys6.PublicKey.hash);
-    this._processCredentialsTriggers = new import_util3.ComplexMap(import_keys6.PublicKey.hash);
+    this._processedCredentials = new import_util3.ComplexSet(import_keys7.PublicKey.hash);
+    this._processCredentialsTriggers = new import_util3.ComplexMap(import_keys7.PublicKey.hash);
   }
   async open() {
   }
@@ -2099,7 +2203,7 @@ var NotarizationPlugin = class {
   * Request credentials to be notarized.
   */
   async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
-    (0, import_log7.log)("notarize", {
+    (0, import_log8.log)("notarize", {
       credentials
     }, {
       file: "notarization-plugin.ts",
@@ -2107,11 +2211,11 @@ var NotarizationPlugin = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert8.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
-    const errors = new import_async8.Trigger();
+    (0, import_node_assert9.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
+    const errors = new import_async10.Trigger();
     const ctx = this._ctx.derive({
       onError: (err) => {
-        import_log7.log.warn("Notarization error", {
+        import_log8.log.warn("Notarization error", {
           err
         }, {
           file: "notarization-plugin.ts",
@@ -2125,8 +2229,8 @@ var NotarizationPlugin = class {
     });
     opCtx == null ? void 0 : opCtx.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
-      (0, import_async8.scheduleTask)(ctx, () => {
-        import_log7.log.warn("Notarization timeout", {
+      (0, import_async10.scheduleTask)(ctx, () => {
+        import_log8.log.warn("Notarization timeout", {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
         }, {
@@ -2136,12 +2240,12 @@ var NotarizationPlugin = class {
           callSite: (f, a) => f(...a)
         });
         void ctx.dispose();
-        errors.throw(new import_async8.TimeoutError(timeout, "Notarization timed out"));
+        errors.throw(new import_async10.TimeoutError(timeout, "Notarization timed out"));
       }, timeout);
     }
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
     const peersTried = /* @__PURE__ */ new Set();
-    const notarizeTask = new import_async8.DeferredTask(ctx, async () => {
+    const notarizeTask = new import_async10.DeferredTask(ctx, async () => {
       try {
         if (this._extensions.size === 0) {
           return;
@@ -2150,7 +2254,7 @@ var NotarizationPlugin = class {
           ...this._extensions
         ].find((peer2) => !peersTried.has(peer2));
         if (!peer) {
-          import_log7.log.warn("Exhausted all peers to notarize with", {
+          import_log8.log.warn("Exhausted all peers to notarize with", {
             retryIn: retryTimeout
           }, {
             file: "notarization-plugin.ts",
@@ -2159,11 +2263,11 @@ var NotarizationPlugin = class {
             callSite: (f, a) => f(...a)
           });
           peersTried.clear();
-          (0, import_async8.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
+          (0, import_async10.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
           return;
         }
         peersTried.add(peer);
-        (0, import_log7.log)("try notarizing", {
+        (0, import_log8.log)("try notarizing", {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
@@ -2175,15 +2279,15 @@ var NotarizationPlugin = class {
         await peer.rpc.NotarizationService.notarize({
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
-        (0, import_log7.log)("success", {}, {
+        (0, import_log8.log)("success", {}, {
           file: "notarization-plugin.ts",
           line: 142,
           scope: this,
           callSite: (f, a) => f(...a)
         });
-        await (0, import_async8.sleep)(successDelay);
+        await (0, import_async10.sleep)(successDelay);
       } catch (err) {
-        import_log7.log.warn("error notarizing (recoverable)", err, {
+        import_log8.log.warn("error notarizing (recoverable)", err, {
           file: "notarization-plugin.ts",
           line: 145,
           scope: this,
@@ -2196,11 +2300,11 @@ var NotarizationPlugin = class {
     this._extensionOpened.on(ctx, () => notarizeTask.schedule());
     try {
       await Promise.race([
-        (0, import_context4.rejectOnDispose)(ctx),
+        (0, import_context5.rejectOnDispose)(ctx),
         allNotarized,
         errors.wait()
       ]);
-      (0, import_log7.log)("done", {}, {
+      (0, import_log8.log)("done", {}, {
         file: "notarization-plugin.ts",
         line: 155,
         scope: this,
@@ -2223,14 +2327,14 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    (0, import_node_assert8.default)(!this._writer, "Writer already set.");
+    (0, import_node_assert9.default)(!this._writer, "Writer already set.");
     this._writer = writer;
   }
   async _waitUntilProcessed(id) {
     if (this._processedCredentials.has(id)) {
       return;
     }
-    await (0, import_util3.entry)(this._processCredentialsTriggers, id).orInsert(new import_async8.Trigger()).value.wait();
+    await (0, import_util3.entry)(this._processCredentialsTriggers, id).orInsert(new import_async10.Trigger()).value.wait();
   }
   /**
   * Requests from other peers to notarize credentials.
@@ -2241,7 +2345,7 @@ var NotarizationPlugin = class {
       throw new Error("Writer not set");
     }
     for (const credential of (_a = request.credentials) != null ? _a : []) {
-      (0, import_node_assert8.default)(credential.id, "Credential must have an id");
+      (0, import_node_assert9.default)(credential.id, "Credential must have an id");
       if (this._processedCredentials.has(credential.id)) {
         continue;
       }
@@ -2251,7 +2355,7 @@ var NotarizationPlugin = class {
   createExtension() {
     const extension = new NotarizationTeleportExtension({
       onOpen: async () => {
-        (0, import_log7.log)("extension opened", {
+        (0, import_log8.log)("extension opened", {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
@@ -2263,7 +2367,7 @@ var NotarizationPlugin = class {
         this._extensionOpened.emit();
       },
       onClose: async () => {
-        (0, import_log7.log)("extension closed", {
+        (0, import_log8.log)("extension closed", {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
@@ -2282,10 +2386,10 @@ var NotarizationTeleportExtension = class extends import_teleport2.RpcExtension
   constructor(_params) {
     super({
       requested: {
-        NotarizationService: import_protocols4.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: import_protocols5.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
       },
       exposed: {
-        NotarizationService: import_protocols4.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: import_protocols5.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
       }
     });
     this._params = _params;
@@ -2323,9 +2427,9 @@ var __decorate = function(decorators, target, key, desc) {
 var AUTH_TIMEOUT2 = 3e4;
 var DataSpace = class DataSpace2 {
   constructor(params) {
-    this._ctx = new import_context5.Context();
+    this._ctx = new import_context6.Context();
     this._state = import_client2.SpaceState.CLOSED;
-    this.stateUpdate = new import_async9.Event();
+    this.stateUpdate = new import_async11.Event();
     var _a;
     this._inner = params.inner;
     this._inner.stateUpdate.on(this._ctx, () => this.stateUpdate.emit());
@@ -2346,7 +2450,7 @@ var DataSpace = class DataSpace2 {
       snapshotId: params.snapshotId
     });
     this.authVerifier = new TrustedKeySetAuthVerifier({
-      trustedKeysProvider: () => new import_util4.ComplexSet(import_keys7.PublicKey.hash, Array.from(this._inner.spaceState.members.keys())),
+      trustedKeysProvider: () => new import_util4.ComplexSet(import_keys8.PublicKey.hash, Array.from(this._inner.spaceState.members.keys())),
       update: this._inner.stateUpdate,
       authTimeout: AUTH_TIMEOUT2
     });
@@ -2400,12 +2504,12 @@ var DataSpace = class DataSpace2 {
   * Initialize the data pipeline in a separate task.
   */
   initializeDataPipelineAsync() {
-    (0, import_async9.scheduleTask)(this._ctx, async () => {
+    (0, import_async11.scheduleTask)(this._ctx, async () => {
       try {
         await this.initializeDataPipeline();
       } catch (err) {
-        if (err instanceof import_errors.CancelledError) {
-          (0, import_log8.log)("Data pipeline initialization cancelled", err, {
+        if (err instanceof import_errors3.CancelledError) {
+          (0, import_log9.log)("Data pipeline initialization cancelled", err, {
             file: "data-space.ts",
             line: 178,
             scope: this,
@@ -2413,7 +2517,7 @@ var DataSpace = class DataSpace2 {
           });
           return;
         }
-        import_log8.log.error("Error initializing data pipeline", err, {
+        import_log9.log.error("Error initializing data pipeline", err, {
           file: "data-space.ts",
           line: 182,
           scope: this,
@@ -2425,7 +2529,7 @@ var DataSpace = class DataSpace2 {
   async initializeDataPipeline() {
     var _a, _b, _c, _d;
     if (this._state !== import_client2.SpaceState.INACTIVE) {
-      throw new import_errors.SystemError("Invalid operation");
+      throw new import_errors3.SystemError("Invalid operation");
     }
     this._state = import_client2.SpaceState.INITIALIZING;
     await this._inner.controlPipeline.state.waitUntilReachedTargetTimeframe({
@@ -2433,7 +2537,7 @@ var DataSpace = class DataSpace2 {
       breakOnStall: false
     });
     await this._createWritableFeeds();
-    (0, import_log8.log)("Writable feeds created", {}, {
+    (0, import_log9.log)("Writable feeds created", {}, {
       file: "data-space.ts",
       line: 200,
       scope: this,
@@ -2454,7 +2558,7 @@ var DataSpace = class DataSpace2 {
         return pipeline;
       }
     });
-    (0, import_log8.log)("waiting for data pipeline to reach target timeframe", {}, {
+    (0, import_log9.log)("waiting for data pipeline to reach target timeframe", {}, {
       file: "data-space.ts",
       line: 220,
       scope: this,
@@ -2464,7 +2568,7 @@ var DataSpace = class DataSpace2 {
       ctx: this._ctx,
       breakOnStall: false
     });
-    (0, import_log8.log)("data pipeline ready", {}, {
+    (0, import_log9.log)("data pipeline ready", {}, {
       file: "data-space.ts",
       line: 227,
       scope: this,
@@ -2523,7 +2627,7 @@ __decorate([
   (0, import_debug3.timed)(1e4)
 ], DataSpace.prototype, "_createWritableFeeds", null);
 DataSpace = __decorate([
-  (0, import_async9.trackLeaks)("open", "close")
+  (0, import_async11.trackLeaks)("open", "close")
 ], DataSpace);
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
@@ -2547,24 +2651,24 @@ var DataSpaceManager = class DataSpaceManager2 {
     this._modelFactory = _modelFactory;
     this._feedStore = _feedStore;
     this._snapshotStore = _snapshotStore;
-    this._ctx = new import_context6.Context();
-    this.updated = new import_async10.Event();
-    this._spaces = new import_util5.ComplexMap(import_keys8.PublicKey.hash);
+    this._ctx = new import_context7.Context();
+    this.updated = new import_async12.Event();
+    this._spaces = new import_util5.ComplexMap(import_keys9.PublicKey.hash);
     this._isOpen = false;
-    this._instanceId = import_keys8.PublicKey.random().toHex();
+    this._instanceId = import_keys9.PublicKey.random().toHex();
   }
   // TODO(burdon): Remove.
   get spaces() {
     return this._spaces;
   }
   async open() {
-    (0, import_log9.log)("open", {}, {
+    (0, import_log10.log)("open", {}, {
       file: "data-space-manager.ts",
       line: 83,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    import_log9.log.trace("dxos.echo.data-space-manager", import_protocols5.trace.begin({
+    import_log10.log.trace("dxos.echo.data-space-manager", import_protocols6.trace.begin({
       id: this._instanceId,
       parentId: this._traceParent
     }), {
@@ -2574,7 +2678,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       callSite: (f, a) => f(...a)
     });
     await this._metadataStore.load();
-    (0, import_log9.log)("metadata loaded", {
+    (0, import_log10.log)("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
       file: "data-space-manager.ts",
@@ -2583,7 +2687,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       callSite: (f, a) => f(...a)
     });
     for (const spaceMetadata of this._metadataStore.spaces) {
-      (0, import_log9.log)("load space", {
+      (0, import_log10.log)("load space", {
         spaceMetadata
       }, {
         file: "data-space-manager.ts",
@@ -2598,7 +2702,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     this.updated.emit();
   }
   async close() {
-    (0, import_log9.log)("close", {}, {
+    (0, import_log10.log)("close", {}, {
       file: "data-space-manager.ts",
       line: 100,
       scope: this,
@@ -2609,7 +2713,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     for (const space of this._spaces.values()) {
       await space.close();
     }
-    import_log9.log.trace("dxos.echo.data-space-manager", import_protocols5.trace.end({
+    import_log10.log.trace("dxos.echo.data-space-manager", import_protocols6.trace.end({
       id: this._instanceId
     }), {
       file: "data-space-manager.ts",
@@ -2622,7 +2726,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   * Creates a new space writing the genesis credentials to the control feed.
   */
   async createSpace() {
-    (0, import_node_assert9.default)(this._isOpen, "Not open.");
+    (0, import_node_assert10.default)(this._isOpen, "Not open.");
     const spaceKey = await this._keyring.createKey();
     const controlFeedKey = await this._keyring.createKey();
     const dataFeedKey = await this._keyring.createKey();
@@ -2632,7 +2736,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       controlFeedKey,
       dataFeedKey
     };
-    (0, import_log9.log)("creating space...", {
+    (0, import_log10.log)("creating space...", {
       spaceKey
     }, {
       file: "data-space-manager.ts",
@@ -2644,7 +2748,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     const credentials = await (0, import_echo_pipeline2.spaceGenesis)(this._keyring, this._signingContext, space.inner);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    (0, import_node_assert9.default)((0, import_credentials10.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    (0, import_node_assert10.default)((0, import_credentials10.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
     await this._signingContext.recordCredential(memberCredential);
     await space.initializeDataPipeline();
     this.updated.emit();
@@ -2652,7 +2756,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
-    (0, import_log9.log)("accept space", {
+    (0, import_log10.log)("accept space", {
       opts
     }, {
       file: "data-space-manager.ts",
@@ -2660,8 +2764,8 @@ var DataSpaceManager = class DataSpaceManager2 {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert9.default)(this._isOpen, "Not open.");
-    (0, import_node_assert9.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
+    (0, import_node_assert10.default)(this._isOpen, "Not open.");
+    (0, import_node_assert10.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
     const metadata = {
       key: opts.spaceKey,
       genesisFeedKey: opts.genesisFeedKey,
@@ -2680,13 +2784,13 @@ var DataSpaceManager = class DataSpaceManager2 {
   * TODO(dmaretskyi): Consider removing.
   */
   async waitUntilSpaceReady(spaceKey) {
-    await (0, import_context6.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
+    await (0, import_context7.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
       return !!space && space.state === import_client3.SpaceState.READY;
     }));
   }
   async _constructSpace(metadata) {
-    (0, import_log9.log)("construct space", {
+    (0, import_log10.log)("construct space", {
       metadata
     }, {
       file: "data-space-manager.ts",
@@ -2741,7 +2845,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       snapshotId: metadata.snapshot,
       callbacks: {
         beforeReady: async () => {
-          (0, import_log9.log)("before space ready", {
+          (0, import_log10.log)("before space ready", {
             space: space.key
           }, {
             file: "data-space-manager.ts",
@@ -2752,7 +2856,7 @@ var DataSpaceManager = class DataSpaceManager2 {
           this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.dataPipeline.databaseBackend.createDataServiceHost());
         },
         afterReady: async () => {
-          (0, import_log9.log)("after space ready", {
+          (0, import_log10.log)("after space ready", {
             space: space.key,
             open: this._isOpen
           }, {
@@ -2779,27 +2883,27 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
 };
 __decorate2([
-  import_async10.synchronized
+  import_async12.synchronized
 ], DataSpaceManager.prototype, "open", null);
 __decorate2([
-  import_async10.synchronized
+  import_async12.synchronized
 ], DataSpaceManager.prototype, "close", null);
 __decorate2([
-  import_async10.synchronized
+  import_async12.synchronized
 ], DataSpaceManager.prototype, "createSpace", null);
 __decorate2([
-  import_async10.synchronized
+  import_async12.synchronized
 ], DataSpaceManager.prototype, "acceptSpace", null);
 DataSpaceManager = __decorate2([
-  (0, import_async10.trackLeaks)("open", "close")
+  (0, import_async12.trackLeaks)("open", "close")
 ], DataSpaceManager);
 
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
-var import_async11 = require("@dxos/async");
+var import_async13 = require("@dxos/async");
 var import_codec_protobuf10 = require("@dxos/codec-protobuf");
 var import_debug4 = require("@dxos/debug");
 var import_echo_pipeline3 = require("@dxos/echo-pipeline");
-var import_log10 = require("@dxos/log");
+var import_log11 = require("@dxos/log");
 var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util6 = require("@dxos/util");
 var TIMEFRAME_UPDATE_DEBOUNCE_TIME = 500;
@@ -2826,7 +2930,7 @@ var SpacesServiceImpl = class {
       const onUpdate = async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._transformSpace(space));
-        (0, import_log10.log)("update", {
+        (0, import_log11.log)("update", {
           spaces
         }, {
           file: "spaces-service.ts",
@@ -2838,9 +2942,9 @@ var SpacesServiceImpl = class {
           spaces
         });
       };
-      (0, import_async11.scheduleTask)(ctx, async () => {
+      (0, import_async13.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const subscriptions = new import_async11.EventSubscriptions();
+        const subscriptions = new import_async13.EventSubscriptions();
         ctx.onDispose(() => subscriptions.clear());
         const subscribeSpaces = () => {
           subscriptions.clear();
@@ -2875,7 +2979,7 @@ var SpacesServiceImpl = class {
   }
   subscribeMessages({ spaceKey, channel }) {
     return new import_codec_protobuf10.Stream(({ ctx, next }) => {
-      (0, import_async11.scheduleTask)(ctx, async () => {
+      (0, import_async13.scheduleTask)(ctx, async () => {
         var _a;
         const dataSpaceManager = await this._getDataSpaceManager();
         const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug4.raise)(new import_echo_pipeline3.SpaceNotFoundError(spaceKey));
@@ -2896,7 +3000,7 @@ var SpacesServiceImpl = class {
         }
       });
       ctx.onDispose(() => processor.close());
-      (0, import_async11.scheduleTask)(ctx, () => processor.open());
+      (0, import_async13.scheduleTask)(ctx, () => processor.open());
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
@@ -2943,23 +3047,23 @@ var SpacesServiceImpl = class {
 var getChannelId = (channel) => `user-channel/${channel}`;
 
 // packages/sdk/client-services/src/packlets/storage/storage.ts
-var import_errors2 = require("@dxos/errors");
+var import_errors4 = require("@dxos/errors");
 var import_config = require("@dxos/protocols/proto/dxos/config");
 var import_random_access_storage = require("@dxos/random-access-storage");
 var StorageDriver = import_config.Runtime.Client.Storage.StorageDriver;
 var createStorageObjects = (config) => {
   const { path = "dxos/storage", storageType, keyStorage, persistent = false } = config != null ? config : {};
   if (persistent && storageType === StorageDriver.RAM) {
-    throw new import_errors2.InvalidConfigError("RAM storage cannot be used in persistent mode.");
+    throw new import_errors4.InvalidConfigError("RAM storage cannot be used in persistent mode.");
   }
   if (!persistent && storageType !== void 0 && storageType !== StorageDriver.RAM) {
-    throw new import_errors2.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+    throw new import_errors4.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
   }
   if (persistent && keyStorage === StorageDriver.RAM) {
-    throw new import_errors2.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+    throw new import_errors4.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
   }
   if (!persistent && keyStorage !== StorageDriver.RAM && keyStorage !== void 0) {
-    throw new import_errors2.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+    throw new import_errors4.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
   }
   return {
     storage: (0, import_random_access_storage.createStorage)({
@@ -3028,8 +3132,8 @@ var SystemServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
-var import_async13 = require("@dxos/async");
-var import_log11 = require("@dxos/log");
+var import_async15 = require("@dxos/async");
+var import_log12 = require("@dxos/log");
 var import_messaging = require("@dxos/messaging");
 var import_network_manager2 = require("@dxos/network-manager");
 var import_util7 = require("@dxos/util");
@@ -3088,15 +3192,15 @@ var ClientRpcServer = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
-var import_node_assert10 = __toESM(require("node:assert"));
-var import_async12 = require("@dxos/async");
+var import_node_assert11 = __toESM(require("node:assert"));
+var import_async14 = require("@dxos/async");
 var import_client4 = require("@dxos/client");
 var import_iframe = require("@dxos/protocols/proto/dxos/iframe");
 var import_rpc2 = require("@dxos/rpc");
 var ShellRuntimeImpl = class {
   constructor(_port) {
     this._port = _port;
-    this.layoutUpdate = new import_async12.Event();
+    this.layoutUpdate = new import_async14.Event();
     this._layout = import_iframe.ShellLayout.DEFAULT;
   }
   get layout() {
@@ -3118,7 +3222,7 @@ var ShellRuntimeImpl = class {
     });
   }
   async setAppContext(context) {
-    (0, import_node_assert10.default)(this._appRpc, "runtime not open");
+    (0, import_node_assert11.default)(this._appRpc, "runtime not open");
     await this._appRpc.rpc.AppService.setContext(context);
   }
   async open() {
@@ -3147,8 +3251,8 @@ var ShellRuntimeImpl = class {
 };
 var MemoryShellRuntime = class {
   constructor({ layout, invitationCode, spaceKey } = {}) {
-    this.layoutUpdate = new import_async12.Event();
-    this.contextUpdate = new import_async12.Event();
+    this.layoutUpdate = new import_async14.Event();
+    this.contextUpdate = new import_async14.Event();
     this._layout = layout != null ? layout : import_iframe.ShellLayout.DEFAULT;
     this._invitationCode = invitationCode;
     this._spaceKey = spaceKey;
@@ -3190,8 +3294,31 @@ var __decorate3 = function(decorators, target, key, desc) {
 var LOCK_KEY = "DXOS_RESOURCE_LOCK";
 var IFrameHostRuntime = class {
   constructor({ configProvider, appPort, shellPort }) {
-    this._transportFactory = (0, import_network_manager2.createWebRTCTransportFactory)();
-    this._ready = new import_async13.Trigger();
+    this._transportFactory = (0, import_network_manager2.createWebRTCTransportFactory)({
+      iceServers: [
+        {
+          urls: "stun:dev.kube.dxos.org:3478",
+          username: "dxos",
+          credential: "dxos"
+        },
+        {
+          urls: "turn:dev.kube.dxos.org:3478",
+          username: "dxos",
+          credential: "dxos"
+        },
+        {
+          urls: "stun:kube.dxos.org:3478",
+          username: "dxos",
+          credential: "dxos"
+        },
+        {
+          urls: "turn:kube.dxos.org:3478",
+          username: "dxos",
+          credential: "dxos"
+        }
+      ]
+    });
+    this._ready = new import_async15.Trigger();
     this._configProvider = configProvider;
     this._appPort = appPort;
     this._shellPort = shellPort;
@@ -3207,23 +3334,21 @@ var IFrameHostRuntime = class {
   }
   async start() {
     var _a;
-    (0, import_log11.log)("starting...", {}, {
+    (0, import_log12.log)("starting...", {}, {
       file: "iframe-host-runtime.ts",
-      line: 67,
+      line: 75,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     try {
       this._config = await (0, import_util7.getAsyncValue)(this._configProvider);
-      const signalServer = this._config.get("runtime.services.signal.server");
+      const signals = this._config.get("runtime.services.signaling");
       this._clientServices = new LocalClientServices({
         lockKey: LOCK_KEY,
         config: this._config,
         networkManager: new import_network_manager2.NetworkManager({
           log: true,
-          signalManager: signalServer ? new import_messaging.WebsocketSignalManager([
-            signalServer
-          ]) : new import_messaging.MemorySignalManager(new import_messaging.MemorySignalManagerContext()),
+          signalManager: signals ? new import_messaging.WebsocketSignalManager(signals) : new import_messaging.MemorySignalManager(new import_messaging.MemorySignalManagerContext()),
           transportFactory: this._transportFactory
         })
       });
@@ -3258,17 +3383,17 @@ var IFrameHostRuntime = class {
         (_a = this._shellRuntime) == null ? void 0 : _a.open()
       ]);
       this._ready.wake(void 0);
-      (0, import_log11.log)("started", {}, {
+      (0, import_log12.log)("started", {}, {
         file: "iframe-host-runtime.ts",
-        line: 110,
+        line: 118,
         scope: this,
         callSite: (f, a) => f(...a)
       });
     } catch (err) {
       this._ready.wake(err);
-      import_log11.log.catch(err, {}, {
+      import_log12.log.catch(err, {}, {
         file: "iframe-host-runtime.ts",
-        line: 113,
+        line: 121,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -3276,34 +3401,59 @@ var IFrameHostRuntime = class {
   }
   async stop() {
     var _a;
-    (0, import_log11.log)("stopping...", {}, {
+    (0, import_log12.log)("stopping...", {}, {
       file: "iframe-host-runtime.ts",
-      line: 118,
+      line: 126,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     await this._clientRpc.close();
     await this._clientServices.close();
     await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
-    (0, import_log11.log)("stopped", {}, {
+    (0, import_log12.log)("stopped", {}, {
       file: "iframe-host-runtime.ts",
-      line: 122,
+      line: 130,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
 };
 __decorate3([
-  import_log11.logInfo
+  import_log12.logInfo
 ], IFrameHostRuntime.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
 var import_client5 = require("@dxos/client");
+var import_errors5 = require("@dxos/errors");
+var import_log13 = require("@dxos/log");
 var import_network_manager3 = require("@dxos/network-manager");
 var import_rpc3 = require("@dxos/rpc");
 var IFrameProxyRuntime = class {
   constructor({ systemPort, workerAppPort, windowAppPort, shellPort }) {
-    this._transportService = new import_network_manager3.WebRTCTransportService();
+    this._transportService = new import_network_manager3.WebRTCTransportService({
+      iceServers: [
+        {
+          urls: "stun:dev.kube.dxos.org:3478",
+          username: "dxos",
+          credential: "dxos"
+        },
+        {
+          urls: "turn:dev.kube.dxos.org:3478",
+          username: "dxos",
+          credential: "dxos"
+        },
+        {
+          urls: "stun:kube.dxos.org:3478",
+          username: "dxos",
+          credential: "dxos"
+        },
+        {
+          urls: "turn:kube.dxos.org:3478",
+          username: "dxos",
+          credential: "dxos"
+        }
+      ]
+    });
     this._systemPort = systemPort;
     this._windowAppPort = windowAppPort;
     this._workerAppPort = workerAppPort;
@@ -3319,7 +3469,7 @@ var IFrameProxyRuntime = class {
         }
       },
       port: this._systemPort,
-      timeout: 200
+      timeout: 1e3
     });
     this._workerAppPort.subscribe((msg) => this._windowAppPort.send(msg));
     this._windowAppPort.subscribe((msg) => this._workerAppPort.send(msg));
@@ -3332,10 +3482,20 @@ var IFrameProxyRuntime = class {
   }
   async open(origin) {
     var _a;
-    await this._systemRpc.open();
-    await this._systemRpc.rpc.WorkerService.start({
-      origin
-    });
+    try {
+      await this._systemRpc.open();
+      await this._systemRpc.rpc.WorkerService.start({
+        origin
+      });
+    } catch (err) {
+      import_log13.log.catch(err, {}, {
+        file: "iframe-proxy-runtime.ts",
+        line: 79,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      throw new import_errors5.RemoteServiceConnectionError("Failed to connect to worker");
+    }
     await ((_a = this._shellRuntime) == null ? void 0 : _a.open());
   }
   async close() {
@@ -3347,8 +3507,8 @@ var IFrameProxyRuntime = class {
 };
 
 // packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
-var import_async14 = require("@dxos/async");
-var import_log12 = require("@dxos/log");
+var import_async16 = require("@dxos/async");
+var import_log14 = require("@dxos/log");
 var __decorate4 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -3366,7 +3526,7 @@ var Message;
 var VaultResourceLock = class {
   constructor({ lockKey, onAcquire, onRelease }) {
     this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
-    this._releaseTrigger = new import_async14.Trigger();
+    this._releaseTrigger = new import_async16.Trigger();
     this._lockKey = lockKey;
     this._onAcquire = onAcquire;
     this._onRelease = onRelease;
@@ -3380,28 +3540,28 @@ var VaultResourceLock = class {
       message: Message.ACQUIRING
     });
     try {
-      (0, import_log12.log)("aquiring lock...", {}, {
+      (0, import_log14.log)("aquiring lock...", {}, {
         file: "vault-resource-lock.ts",
         line: 44,
         scope: this,
         callSite: (f, a) => f(...a)
       });
-      await (0, import_async14.asyncTimeout)(this._requestLock(), 3e3);
-      (0, import_log12.log)("acquired lock", {}, {
+      await (0, import_async16.asyncTimeout)(this._requestLock(), 3e3);
+      (0, import_log14.log)("acquired lock", {}, {
         file: "vault-resource-lock.ts",
         line: 46,
         scope: this,
         callSite: (f, a) => f(...a)
       });
     } catch (e) {
-      (0, import_log12.log)("stealing lock...", {}, {
+      (0, import_log14.log)("stealing lock...", {}, {
         file: "vault-resource-lock.ts",
         line: 48,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       await this._requestLock(true);
-      (0, import_log12.log)("stolen lock", {}, {
+      (0, import_log14.log)("stolen lock", {}, {
         file: "vault-resource-lock.ts",
         line: 50,
         scope: this,
@@ -3418,7 +3578,7 @@ var VaultResourceLock = class {
     }
   }
   async _requestLock(steal = false) {
-    (0, import_log12.log)("requesting lock...", {
+    (0, import_log14.log)("requesting lock...", {
       steal
     }, {
       file: "vault-resource-lock.ts",
@@ -3426,23 +3586,23 @@ var VaultResourceLock = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const acquired = new import_async14.Trigger();
+    const acquired = new import_async16.Trigger();
     void navigator.locks.request(this._lockKey, {
       steal
     }, async () => {
       var _a, _b;
       await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
       acquired.wake();
-      this._releaseTrigger = new import_async14.Trigger();
+      this._releaseTrigger = new import_async16.Trigger();
       await this._releaseTrigger.wait();
-      (0, import_log12.log)("releasing lock...", {}, {
+      (0, import_log14.log)("releasing lock...", {}, {
         file: "vault-resource-lock.ts",
         line: 74,
         scope: this,
         callSite: (f, a) => f(...a)
       });
       await ((_b = this._onRelease) == null ? void 0 : _b.call(this));
-      (0, import_log12.log)("released lock", {}, {
+      (0, import_log14.log)("released lock", {}, {
         file: "vault-resource-lock.ts",
         line: 76,
         scope: this,
@@ -3453,7 +3613,7 @@ var VaultResourceLock = class {
       await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
     });
     await acquired.wait();
-    (0, import_log12.log)("recieved lock", {
+    (0, import_log14.log)("recieved lock", {
       steal
     }, {
       file: "vault-resource-lock.ts",
@@ -3464,20 +3624,20 @@ var VaultResourceLock = class {
   }
 };
 __decorate4([
-  import_log12.logInfo
+  import_log14.logInfo
 ], VaultResourceLock.prototype, "lockKey", null);
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
-var import_async16 = require("@dxos/async");
-var import_log14 = require("@dxos/log");
+var import_async18 = require("@dxos/async");
+var import_log16 = require("@dxos/log");
 var import_messaging2 = require("@dxos/messaging");
 var import_network_manager4 = require("@dxos/network-manager");
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
-var import_node_assert11 = __toESM(require("node:assert"));
-var import_async15 = require("@dxos/async");
+var import_node_assert12 = __toESM(require("node:assert"));
+var import_async17 = require("@dxos/async");
 var import_client6 = require("@dxos/client");
-var import_log13 = require("@dxos/log");
+var import_log15 = require("@dxos/log");
 var import_rpc4 = require("@dxos/rpc");
 var import_util8 = require("@dxos/util");
 var __decorate5 = function(decorators, target, key, desc) {
@@ -3494,10 +3654,10 @@ var WorkerSession = class {
   constructor({ serviceHost, systemPort, appPort, shellPort, readySignal, options = {
     heartbeatInterval: 1e3
   } }) {
-    this._startTrigger = new import_async15.Trigger();
+    this._startTrigger = new import_async17.Trigger();
     this.onClose = new import_util8.Callback();
-    (0, import_node_assert11.default)(options);
-    (0, import_node_assert11.default)(serviceHost);
+    (0, import_node_assert12.default)(options);
+    (0, import_node_assert12.default)(serviceHost);
     this._options = options;
     this._serviceHost = serviceHost;
     const middleware = {
@@ -3544,7 +3704,7 @@ var WorkerSession = class {
               try {
                 await this.close();
               } catch (err) {
-                import_log13.log.catch(err, {}, {
+                import_log15.log.catch(err, {}, {
                   file: "worker-session.ts",
                   line: 107,
                   scope: this,
@@ -3562,7 +3722,7 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    import_log13.log.info("opening..", {}, {
+    import_log15.log.info("opening..", {}, {
       file: "worker-session.ts",
       line: 121,
       scope: this,
@@ -3580,7 +3740,7 @@ var WorkerSession = class {
       try {
         await this._iframeRpc.rpc.IframeService.heartbeat();
       } catch (err1) {
-        import_log13.log.warn("Heartbeat failed", {
+        import_log15.log.warn("Heartbeat failed", {
           err: err1
         }, {
           file: "worker-session.ts",
@@ -3591,7 +3751,7 @@ var WorkerSession = class {
         try {
           await this.close();
         } catch (err) {
-          import_log13.log.catch(err, {}, {
+          import_log15.log.catch(err, {}, {
             file: "worker-session.ts",
             line: 137,
             scope: this,
@@ -3602,7 +3762,7 @@ var WorkerSession = class {
     }, this._options.heartbeatInterval);
   }
   async close() {
-    import_log13.log.info("closing..", {}, {
+    import_log15.log.info("closing..", {}, {
       file: "worker-session.ts",
       line: 144,
       scope: this,
@@ -3611,7 +3771,7 @@ var WorkerSession = class {
     try {
       await this.onClose.callIfSet();
     } catch (err) {
-      import_log13.log.catch(err, {}, {
+      import_log15.log.catch(err, {}, {
         file: "worker-session.ts",
         line: 148,
         scope: this,
@@ -3628,9 +3788,9 @@ var WorkerSession = class {
   }
   async _maybeOpenShell() {
     try {
-      await (0, import_async15.asyncTimeout)(this._shellClientRpc.open(), 1e3);
+      await (0, import_async17.asyncTimeout)(this._shellClientRpc.open(), 1e3);
     } catch (e) {
-      import_log13.log.info("No shell connected.", {}, {
+      import_log15.log.info("No shell connected.", {}, {
         file: "worker-session.ts",
         line: 162,
         scope: this,
@@ -3640,7 +3800,7 @@ var WorkerSession = class {
   }
 };
 __decorate5([
-  import_log13.logInfo
+  import_log15.logInfo
 ], WorkerSession.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
@@ -3649,7 +3809,7 @@ var WorkerRuntime = class {
   constructor(_configProvider) {
     this._configProvider = _configProvider;
     this._transportFactory = new import_network_manager4.WebRTCTransportProxyFactory();
-    this._ready = new import_async16.Trigger();
+    this._ready = new import_async18.Trigger();
     this.sessions = /* @__PURE__ */ new Set();
     this._clientServices = new ClientServicesHost();
   }
@@ -3657,7 +3817,7 @@ var WorkerRuntime = class {
     return this._clientServices;
   }
   async start() {
-    (0, import_log14.log)("starting...", {}, {
+    (0, import_log16.log)("starting...", {}, {
       file: "worker-runtime.ts",
       line: 48,
       scope: this,
@@ -3665,20 +3825,18 @@ var WorkerRuntime = class {
     });
     try {
       this._config = await this._configProvider();
-      const signalServer = this._config.get("runtime.services.signal.server");
+      const signals = this._config.get("runtime.services.signaling");
       this._clientServices.initialize({
         config: this._config,
         networkManager: new import_network_manager4.NetworkManager({
           log: true,
-          signalManager: signalServer ? new import_messaging2.WebsocketSignalManager([
-            signalServer
-          ]) : new import_messaging2.MemorySignalManager(new import_messaging2.MemorySignalManagerContext()),
+          signalManager: signals ? new import_messaging2.WebsocketSignalManager(signals) : new import_messaging2.MemorySignalManager(new import_messaging2.MemorySignalManagerContext()),
           transportFactory: this._transportFactory
         })
       });
       await this._clientServices.open();
       this._ready.wake(void 0);
-      (0, import_log14.log)("started", {}, {
+      (0, import_log16.log)("started", {}, {
         file: "worker-runtime.ts",
         line: 65,
         scope: this,
@@ -3686,7 +3844,7 @@ var WorkerRuntime = class {
       });
     } catch (err) {
       this._ready.wake(err);
-      import_log14.log.catch(err, {}, {
+      import_log16.log.catch(err, {}, {
         file: "worker-runtime.ts",
         line: 68,
         scope: this,
@@ -3738,27 +3896,27 @@ var WorkerRuntime = class {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-var import_node_assert12 = __toESM(require("node:assert"));
-var import_async17 = require("@dxos/async");
+var import_node_assert13 = __toESM(require("node:assert"));
+var import_async19 = require("@dxos/async");
 var import_client7 = require("@dxos/client");
 var import_credentials11 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
 var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_keyring = require("@dxos/keyring");
-var import_keys9 = require("@dxos/keys");
-var import_log15 = require("@dxos/log");
-var import_protocols6 = require("@dxos/protocols");
+var import_keys10 = require("@dxos/keys");
+var import_log17 = require("@dxos/log");
+var import_protocols7 = require("@dxos/protocols");
 var ServiceContext = class {
   // prettier-ignore
   constructor(storage, networkManager, modelFactory) {
     this.storage = storage;
     this.networkManager = networkManager;
     this.modelFactory = modelFactory;
-    this.initialized = new import_async17.Trigger();
+    this.initialized = new import_async19.Trigger();
     this.dataServiceSubscriptions = new import_echo_pipeline4.DataServiceSubscriptions();
     this._handlerFactories = /* @__PURE__ */ new Map();
-    this._instanceId = import_keys9.PublicKey.random().toHex();
+    this._instanceId = import_keys10.PublicKey.random().toHex();
     networkManager._traceParent = this._instanceId;
     this.metadataStore = new import_echo_pipeline4.MetadataStore(storage.createDirectory("metadata"));
     this.snapshotStore = new import_echo_pipeline4.SnapshotStore(storage.createDirectory("snapshots"));
@@ -3787,7 +3945,7 @@ var ServiceContext = class {
     }, this._acceptIdentity.bind(this)));
   }
   async open() {
-    import_log15.log.trace("dxos.sdk.service-context", import_protocols6.trace.begin({
+    import_log17.log.trace("dxos.sdk.service-context", import_protocols7.trace.begin({
       id: this._instanceId
     }), {
       file: "service-context.ts",
@@ -3795,7 +3953,7 @@ var ServiceContext = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_log15.log)("opening...", {}, {
+    (0, import_log17.log)("opening...", {}, {
       file: "service-context.ts",
       line: 117,
       scope: this,
@@ -3807,7 +3965,7 @@ var ServiceContext = class {
     if (this.identityManager.identity) {
       await this._initialize();
     }
-    (0, import_log15.log)("opened", {}, {
+    (0, import_log17.log)("opened", {}, {
       file: "service-context.ts",
       line: 124,
       scope: this,
@@ -3816,7 +3974,7 @@ var ServiceContext = class {
   }
   async close() {
     var _a, _b;
-    (0, import_log15.log)("closing...", {}, {
+    (0, import_log17.log)("closing...", {}, {
       file: "service-context.ts",
       line: 128,
       scope: this,
@@ -3829,13 +3987,13 @@ var ServiceContext = class {
     await this.feedStore.close();
     await this.networkManager.close();
     this.dataServiceSubscriptions.clear();
-    (0, import_log15.log)("closed", {}, {
+    (0, import_log17.log)("closed", {}, {
       file: "service-context.ts",
       line: 136,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    import_log15.log.trace("dxos.sdk.service-context", import_protocols6.trace.end({
+    import_log17.log.trace("dxos.sdk.service-context", import_protocols7.trace.end({
       id: this._instanceId
     }), {
       file: "service-context.ts",
@@ -3851,7 +4009,7 @@ var ServiceContext = class {
   }
   getInvitationHandler(invitation) {
     const factory = this._handlerFactories.get(invitation.kind);
-    (0, import_node_assert12.default)(factory, `Unknown invitation kind: ${invitation.kind}`);
+    (0, import_node_assert13.default)(factory, `Unknown invitation kind: ${invitation.kind}`);
     return factory(invitation);
   }
   async _acceptIdentity(params) {
@@ -3862,7 +4020,7 @@ var ServiceContext = class {
   // Called when identity is created.
   async _initialize() {
     var _a;
-    (0, import_log15.log)("initializing spaces...", {}, {
+    (0, import_log17.log)("initializing spaces...", {}, {
       file: "service-context.ts",
       line: 163,
       scope: this,
@@ -3886,7 +4044,7 @@ var ServiceContext = class {
     this.dataSpaceManager._traceParent = this._instanceId;
     await this.dataSpaceManager.open();
     this._handlerFactories.set(import_client7.Invitation.Kind.SPACE, (invitation) => {
-      (0, import_node_assert12.default)(this.dataSpaceManager, "dataSpaceManager not initialized yet");
+      (0, import_node_assert13.default)(this.dataSpaceManager, "dataSpaceManager not initialized yet");
       return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
     });
     this.initialized.wake();
@@ -3900,7 +4058,7 @@ var ServiceContext = class {
           return;
         }
         if (!this.dataSpaceManager) {
-          (0, import_log15.log)("dataSpaceManager not initialized yet, ignoring space admission", {
+          (0, import_log17.log)("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
             file: "service-context.ts",
@@ -3911,7 +4069,7 @@ var ServiceContext = class {
           return;
         }
         if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
-          (0, import_log15.log)("space already exists, ignoring space admission", {
+          (0, import_log17.log)("space already exists, ignoring space admission", {
             details: assertion
           }, {
             file: "service-context.ts",
@@ -3922,7 +4080,7 @@ var ServiceContext = class {
           return;
         }
         try {
-          (0, import_log15.log)("accepting space recorded in halo", {
+          (0, import_log17.log)("accepting space recorded in halo", {
             details: assertion
           }, {
             file: "service-context.ts",
@@ -3935,7 +4093,7 @@ var ServiceContext = class {
             genesisFeedKey: assertion.genesisFeedKey
           });
         } catch (err) {
-          import_log15.log.catch(err, {}, {
+          import_log17.log.catch(err, {}, {
             file: "service-context.ts",
             line: 220,
             scope: this,
@@ -3983,7 +4141,7 @@ var ClientServicesHost = class {
     // TODO(wittjosiah): Turn this on by default.
     lockKey
   } = {}) {
-    this._statusUpdate = new import_async18.Event();
+    this._statusUpdate = new import_async20.Event();
     this._opening = false;
     this._open = false;
     this._instanceId = import_client8.PublicKey.random().toHex();
@@ -4040,16 +4198,16 @@ var ClientServicesHost = class {
   * Can only be called once.
   */
   initialize({ config, networkManager }) {
-    (0, import_node_assert13.default)(!this._open, "service host is open");
+    (0, import_node_assert14.default)(!this._open, "service host is open");
     if (config) {
-      (0, import_node_assert13.default)(!this._config, "config already set");
+      (0, import_node_assert14.default)(!this._config, "config already set");
       this._config = config;
       if (!this._storage) {
         this._storage = createStorageObjects(config.get("runtime.client.storage", {})).storage;
       }
     }
     if (networkManager) {
-      (0, import_node_assert13.default)(!this._networkManager, "network manager already set");
+      (0, import_node_assert14.default)(!this._networkManager, "network manager already set");
       this._networkManager = networkManager;
     }
   }
@@ -4058,7 +4216,7 @@ var ClientServicesHost = class {
     if (this._open) {
       return;
     }
-    import_log16.log.trace("dxos.sdk.client-services-host", import_protocols7.trace.begin({
+    import_log18.log.trace("dxos.sdk.client-services-host", import_protocols8.trace.begin({
       id: this._instanceId
     }), {
       file: "service-host.ts",
@@ -4066,11 +4224,11 @@ var ClientServicesHost = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    (0, import_node_assert13.default)(this._config, "config not set");
-    (0, import_node_assert13.default)(this._storage, "storage not set");
-    (0, import_node_assert13.default)(this._networkManager, "network manager not set");
+    (0, import_node_assert14.default)(this._config, "config not set");
+    (0, import_node_assert14.default)(this._storage, "storage not set");
+    (0, import_node_assert14.default)(this._networkManager, "network manager not set");
     this._opening = true;
-    (0, import_log16.log)("opening...", {
+    (0, import_log18.log)("opening...", {
       lockKey: (_a = this._resourceLock) == null ? void 0 : _a.lockKey
     }, {
       file: "service-host.ts",
@@ -4104,7 +4262,7 @@ var ClientServicesHost = class {
     this._open = true;
     this._statusUpdate.emit();
     const deviceKey = (_c = this._serviceContext.identityManager.identity) == null ? void 0 : _c.deviceKey;
-    (0, import_log16.log)("opened", {
+    (0, import_log18.log)("opened", {
       deviceKey
     }, {
       file: "service-host.ts",
@@ -4119,7 +4277,7 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    (0, import_log16.log)("closing...", {
+    (0, import_log18.log)("closing...", {
       deviceKey
     }, {
       file: "service-host.ts",
@@ -4133,7 +4291,7 @@ var ClientServicesHost = class {
     await this._serviceContext.close();
     this._open = false;
     this._statusUpdate.emit();
-    (0, import_log16.log)("closed", {
+    (0, import_log18.log)("closed", {
       deviceKey
     }, {
       file: "service-host.ts",
@@ -4141,7 +4299,7 @@ var ClientServicesHost = class {
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    import_log16.log.trace("dxos.sdk.client-services-host", import_protocols7.trace.end({
+    import_log18.log.trace("dxos.sdk.client-services-host", import_protocols8.trace.end({
       id: this._instanceId
     }), {
       file: "service-host.ts",
@@ -4152,7 +4310,7 @@ var ClientServicesHost = class {
   }
   async reset() {
     var _a;
-    (0, import_log16.log)("resetting...", {}, {
+    (0, import_log18.log)("resetting...", {}, {
       file: "service-host.ts",
       line: 240,
       scope: this,
@@ -4160,7 +4318,7 @@ var ClientServicesHost = class {
     });
     await ((_a = this._serviceContext) == null ? void 0 : _a.close());
     await this._storage.reset();
-    (0, import_log16.log)("reset", {}, {
+    (0, import_log18.log)("reset", {}, {
       file: "service-host.ts",
       line: 243,
       scope: this,
@@ -4193,7 +4351,7 @@ var LocalClientServices = class {
 
 // packages/sdk/client-services/src/packlets/services/utils.ts
 var import_config2 = require("@dxos/config");
-var import_log17 = require("@dxos/log");
+var import_log19 = require("@dxos/log");
 var import_messaging3 = require("@dxos/messaging");
 var import_network_manager5 = require("@dxos/network-manager");
 var fromHost = (config = new import_config2.Config()) => {
@@ -4203,11 +4361,9 @@ var fromHost = (config = new import_config2.Config()) => {
   });
 };
 var createNetworkManager = (config, options = {}) => {
-  const signalServer = config.get("runtime.services.signal.server");
-  if (signalServer) {
-    const { log: log1 = true, signalManager = new import_messaging3.WebsocketSignalManager([
-      signalServer
-    ]), transportFactory = (0, import_network_manager5.createWebRTCTransportFactory)({
+  const signals = config.get("runtime.services.signaling");
+  if (signals) {
+    const { log: log1 = true, signalManager = new import_messaging3.WebsocketSignalManager(signals), transportFactory = (0, import_network_manager5.createWebRTCTransportFactory)({
       iceServers: config.get("runtime.services.ice")
     }) } = options;
     return new import_network_manager5.NetworkManager({
@@ -4216,7 +4372,7 @@ var createNetworkManager = (config, options = {}) => {
       transportFactory
     });
   }
-  import_log17.log.warn("P2P network is not configured.", {}, {
+  import_log19.log.warn("P2P network is not configured.", {}, {
     file: "utils.ts",
     line: 48,
     scope: void 0,