@dxos/client-services 0.1.49-next.fdd6c88 → 0.1.50-next.1bfebf8

package/dist/lib/node/index.cjs

@@ -44,6 +44,7 @@ __export(src_exports, {
   InvitationsHandler: () => InvitationsHandler,
   InvitationsServiceImpl: () => InvitationsServiceImpl,
   LocalClientServices: () => LocalClientServices,
+  Lock: () => Lock,
   MemoryShellRuntime: () => MemoryShellRuntime,
   ServiceContext: () => ServiceContext,
   ServiceRegistry: () => ServiceRegistry,
@@ -51,12 +52,12 @@ __export(src_exports, {
   SpaceInvitationProtocol: () => SpaceInvitationProtocol,
   SpacesServiceImpl: () => SpacesServiceImpl,
   TrustedKeySetAuthVerifier: () => TrustedKeySetAuthVerifier,
-  VaultResourceLock: () => VaultResourceLock,
   WorkerRuntime: () => WorkerRuntime,
   WorkerSession: () => WorkerSession,
   createAuthProvider: () => createAuthProvider,
   createStorageObjects: () => createStorageObjects,
   getNetworkPeers: () => getNetworkPeers,
+  isLocked: () => isLocked,
   subscribeToFeedBlocks: () => subscribeToFeedBlocks,
   subscribeToFeeds: () => subscribeToFeeds,
   subscribeToNetworkStatus: () => subscribeToNetworkStatus,
@@ -69,7 +70,7 @@ module.exports = __toCommonJS(src_exports);
 
 // packages/sdk/client-services/src/packlets/devtools/devtools.ts
 var import_async3 = require("@dxos/async");
-var import_codec_protobuf5 = require("@dxos/codec-protobuf");
+var import_codec_protobuf6 = require("@dxos/codec-protobuf");
 
 // packages/sdk/client-services/src/packlets/devtools/feeds.ts
 var import_async = require("@dxos/async");
@@ -157,11 +158,22 @@ var subscribeToKeyringKeys = ({ keyring }) => new import_codec_protobuf2.Stream(
   (0, import_async2.scheduleTask)(ctx, update);
 });
 
-// packages/sdk/client-services/src/packlets/devtools/network.ts
+// packages/sdk/client-services/src/packlets/devtools/metadata.ts
 var import_codec_protobuf3 = require("@dxos/codec-protobuf");
+var subscribeToMetadata = ({ context }) => new import_codec_protobuf3.Stream(({ next, ctx }) => {
+  context.metadataStore.update.on(ctx, (data) => next({
+    metadata: data
+  }));
+  next({
+    metadata: context.metadataStore.metadata
+  });
+});
+
+// packages/sdk/client-services/src/packlets/devtools/network.ts
+var import_codec_protobuf4 = require("@dxos/codec-protobuf");
 var import_context = require("@dxos/context");
 var import_keys2 = require("@dxos/keys");
-var subscribeToNetworkStatus = ({ signalManager }) => new import_codec_protobuf3.Stream(({ next, close }) => {
+var subscribeToNetworkStatus = ({ signalManager }) => new import_codec_protobuf4.Stream(({ next, close }) => {
   const update = () => {
     try {
       const status = signalManager.getStatus();
@@ -175,7 +187,7 @@ var subscribeToNetworkStatus = ({ signalManager }) => new import_codec_protobuf3
   signalManager.statusChanged.on(() => update());
   update();
 });
-var subscribeToSignal = ({ signalManager }) => new import_codec_protobuf3.Stream(({ next }) => {
+var subscribeToSignal = ({ signalManager }) => new import_codec_protobuf4.Stream(({ next }) => {
   const ctx = new import_context.Context();
   signalManager.onMessage.on(ctx, (message) => {
     next({
@@ -197,7 +209,7 @@ var subscribeToSignal = ({ signalManager }) => new import_codec_protobuf3.Stream
     return ctx.dispose();
   };
 });
-var subscribeToNetworkTopics = ({ networkManager }) => new import_codec_protobuf3.Stream(({ next, close }) => {
+var subscribeToNetworkTopics = ({ networkManager }) => new import_codec_protobuf4.Stream(({ next, close }) => {
   const update = () => {
     try {
       const topics = networkManager.topics;
@@ -218,7 +230,7 @@ var subscribeToNetworkTopics = ({ networkManager }) => new import_codec_protobuf
   networkManager.topicsUpdated.on(update);
   update();
 });
-var subscribeToSwarmInfo = ({ networkManager }) => new import_codec_protobuf3.Stream(({ next }) => {
+var subscribeToSwarmInfo = ({ networkManager }) => new import_codec_protobuf4.Stream(({ next }) => {
   var _a;
   const update = () => {
     var _a2;
@@ -246,9 +258,9 @@ var getNetworkPeers = ({ networkManager }, request) => {
 };
 
 // packages/sdk/client-services/src/packlets/devtools/spaces.ts
-var import_codec_protobuf4 = require("@dxos/codec-protobuf");
+var import_codec_protobuf5 = require("@dxos/codec-protobuf");
 var subscribeToSpaces = (context, { spaceKeys = [] }) => {
-  return new import_codec_protobuf4.Stream(({ next }) => {
+  return new import_codec_protobuf5.Stream(({ next }) => {
     let unsubscribe;
     const update = async () => {
       const spaces = [
@@ -292,7 +304,7 @@ var DevtoolsServiceImpl = class {
     this.params = params;
   }
   events(request) {
-    return new import_codec_protobuf5.Stream(({ next }) => {
+    return new import_codec_protobuf6.Stream(({ next }) => {
       this.params.events.ready.on(() => {
         next({
           ready: {}
@@ -384,6 +396,11 @@ var DevtoolsServiceImpl = class {
       networkManager: this.params.context.networkManager
     });
   }
+  subscribeToMetadata() {
+    return subscribeToMetadata({
+      context: this.params.context
+    });
+  }
 };
 
 // packages/sdk/client-services/src/packlets/identity/authenticator.ts
@@ -907,7 +924,7 @@ var IdentityManager = class {
 
 // packages/sdk/client-services/src/packlets/identity/identity-service.ts
 var import_node_assert3 = __toESM(require("node:assert"));
-var import_codec_protobuf6 = require("@dxos/codec-protobuf");
+var import_codec_protobuf7 = require("@dxos/codec-protobuf");
 var import_credentials6 = require("@dxos/credentials");
 var import_debug2 = require("@dxos/debug");
 var IdentityServiceImpl = class {
@@ -923,7 +940,7 @@ var IdentityServiceImpl = class {
     return (0, import_debug2.todo)();
   }
   queryIdentity() {
-    return new import_codec_protobuf6.Stream(({ next }) => {
+    return new import_codec_protobuf7.Stream(({ next }) => {
       const emitNext = () => next({
         identity: this._getIdentity()
       });
@@ -1855,7 +1872,7 @@ var InvitationsHandler = class {
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
 var import_node_assert7 = __toESM(require("node:assert"));
 var import_async9 = require("@dxos/async");
-var import_codec_protobuf7 = require("@dxos/codec-protobuf");
+var import_codec_protobuf8 = require("@dxos/codec-protobuf");
 var import_log6 = require("@dxos/log");
 var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
 var InvitationsServiceImpl = class {
@@ -1884,7 +1901,7 @@ var InvitationsServiceImpl = class {
       this._createInvitations.set(invitation.get().invitationId, invitation);
       this._invitationCreated.emit(invitation.get());
     }
-    return new import_codec_protobuf7.Stream(({ next, close }) => {
+    return new import_codec_protobuf8.Stream(({ next, close }) => {
       invitation.subscribe((invitation2) => {
         next(invitation2);
       }, (err) => {
@@ -1906,7 +1923,7 @@ var InvitationsServiceImpl = class {
       this._acceptInvitations.set(invitation.get().invitationId, invitation);
       this._invitationAccepted.emit(invitation.get());
     }
-    return new import_codec_protobuf7.Stream(({ next, close }) => {
+    return new import_codec_protobuf8.Stream(({ next, close }) => {
       invitation.subscribe((invitation2) => {
         next(invitation2);
       }, (err) => {
@@ -1969,7 +1986,7 @@ var InvitationsServiceImpl = class {
     }
   }
   queryInvitations() {
-    return new import_codec_protobuf7.Stream(({ next, ctx }) => {
+    return new import_codec_protobuf8.Stream(({ next, ctx }) => {
       this._invitationCreated.on(ctx, (invitation) => {
         next({
           action: import_services4.QueryInvitationsResponse.Action.ADDED,
@@ -2111,20 +2128,20 @@ var SpaceInvitationProtocol = class {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-var import_node_assert14 = __toESM(require("node:assert"));
-var import_async23 = require("@dxos/async");
-var import_client_protocol9 = require("@dxos/client-protocol");
+var import_node_assert12 = __toESM(require("node:assert"));
+var import_async18 = require("@dxos/async");
+var import_client_protocol4 = require("@dxos/client-protocol");
 var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_keys11 = require("@dxos/keys");
-var import_log19 = require("@dxos/log");
-var import_messaging3 = require("@dxos/messaging");
-var import_network_manager5 = require("@dxos/network-manager");
+var import_log15 = require("@dxos/log");
+var import_messaging = require("@dxos/messaging");
+var import_network_manager2 = require("@dxos/network-manager");
 var import_protocols9 = require("@dxos/protocols");
-var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
 
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
 var import_async10 = require("@dxos/async");
-var import_codec_protobuf8 = require("@dxos/codec-protobuf");
+var import_codec_protobuf9 = require("@dxos/codec-protobuf");
 var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
@@ -2134,7 +2151,7 @@ var DevicesServiceImpl = class {
     throw new Error("Method not implemented.");
   }
   queryDevices() {
-    return new import_codec_protobuf8.Stream(({ next }) => {
+    return new import_codec_protobuf9.Stream(({ next }) => {
       const update = () => {
         var _a;
         const deviceKeys = (_a = this._identityManager.identity) == null ? void 0 : _a.authorizedDeviceKeys;
@@ -2169,38 +2186,96 @@ var DevicesServiceImpl = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/logging/logging-service.ts
+// packages/sdk/client-services/src/packlets/locks/node.ts
+var import_lockfile = __toESM(require("lockfile"));
 var import_async11 = require("@dxos/async");
-var import_codec_protobuf9 = require("@dxos/codec-protobuf");
 var import_log8 = require("@dxos/log");
+var __decorate = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var Lock = class {
+  constructor({ lockKey: lockPath, onAcquire, onRelease }) {
+    this._releaseTrigger = new import_async11.Trigger();
+    this._lockPath = lockPath;
+    this._onAcquire = onAcquire;
+    this._onRelease = onRelease;
+  }
+  get lockKey() {
+    return this._lockPath;
+  }
+  async acquire() {
+    var _a;
+    (0, import_log8.log)("acquiring lock...", {}, {
+      file: "node.ts",
+      line: 31,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    if (import_lockfile.default.checkSync(this.lockKey)) {
+      throw new Error(`Lock already acquired: ${this._lockPath}`);
+    }
+    import_lockfile.default.lockSync(this._lockPath);
+    await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
+    (0, import_log8.log)("acquired lock", {}, {
+      file: "node.ts",
+      line: 39,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+  }
+  async release() {
+    var _a;
+    if (!import_lockfile.default.checkSync(this._lockPath)) {
+      throw new Error(`Lock already acquired: ${this._lockPath}`);
+    }
+    await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
+    import_lockfile.default.unlockSync(this._lockPath);
+  }
+};
+__decorate([
+  import_log8.logInfo
+], Lock.prototype, "lockKey", null);
+var isLocked = (lockPath) => import_lockfile.default.checkSync(lockPath);
+
+// packages/sdk/client-services/src/packlets/logging/logging-service.ts
+var import_async12 = require("@dxos/async");
+var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_log9 = require("@dxos/log");
 var import_util3 = require("@dxos/util");
 var LoggingServiceImpl = class {
   constructor() {
-    this._logs = new import_async11.Event();
+    this._logs = new import_async12.Event();
     this._logProcessor = (_config, entry2) => {
       this._logs.emit(entry2);
     };
   }
   async open() {
-    import_log8.log.runtimeConfig.processors.push(this._logProcessor);
+    import_log9.log.runtimeConfig.processors.push(this._logProcessor);
   }
   async close() {
-    const index = import_log8.log.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
-    import_log8.log.runtimeConfig.processors.splice(index, 1);
+    const index = import_log9.log.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
+    import_log9.log.runtimeConfig.processors.splice(index, 1);
   }
   queryLogs(request) {
     var _a;
     const filters = ((_a = request.filters) == null ? void 0 : _a.length) ? request.filters : void 0;
-    return new import_codec_protobuf9.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf10.Stream(({ ctx, next }) => {
       const handler = (entry2) => {
         var _a2, _b, _c;
         if (((_a2 = entry2.meta) == null ? void 0 : _a2.file.includes("logging-service")) || entry2.context && Object.values(entry2.context).some((value) => typeof value === "string" && value.includes("LoggingService"))) {
           return;
         }
-        if ((0, import_log8.shouldLog)(entry2, filters)) {
+        if ((0, import_log9.shouldLog)(entry2, filters)) {
           const record = {
             ...entry2,
-            context: (0, import_util3.jsonify)((0, import_log8.getContextFromEntry)(entry2))
+            context: (0, import_util3.jsonify)((0, import_log9.getContextFromEntry)(entry2))
           };
           (_b = record.meta) == null ? true : delete _b.bugcheck;
           (_c = record.meta) == null ? true : delete _c.scope;
@@ -2216,14 +2291,14 @@ var LoggingServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/network/network-service.ts
-var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_codec_protobuf11 = require("@dxos/codec-protobuf");
 var NetworkServiceImpl = class {
   constructor(networkManager, signalManager) {
     this.networkManager = networkManager;
     this.signalManager = signalManager;
   }
   queryStatus() {
-    return new import_codec_protobuf10.Stream(({ next }) => {
+    return new import_codec_protobuf11.Stream(({ next }) => {
       const update = () => {
         next({
           swarm: this.networkManager.connectionState,
@@ -2249,45 +2324,46 @@ var NetworkServiceImpl = class {
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
 var import_node_assert10 = __toESM(require("node:assert"));
-var import_async14 = require("@dxos/async");
+var import_async15 = require("@dxos/async");
 var import_context7 = require("@dxos/context");
 var import_credentials12 = require("@dxos/credentials");
 var import_keys9 = require("@dxos/keys");
-var import_log11 = require("@dxos/log");
+var import_log12 = require("@dxos/log");
 var import_protocols6 = require("@dxos/protocols");
 var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_gossip = require("@dxos/teleport-extension-gossip");
 var import_util6 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-var import_async13 = require("@dxos/async");
+var import_async14 = require("@dxos/async");
 var import_client_protocol3 = require("@dxos/client-protocol");
 var import_context6 = require("@dxos/context");
 var import_debug3 = require("@dxos/debug");
 var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_errors3 = require("@dxos/errors");
 var import_keys8 = require("@dxos/keys");
-var import_log10 = require("@dxos/log");
+var import_log11 = require("@dxos/log");
 var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
 var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util5 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
 var import_node_assert9 = __toESM(require("node:assert"));
-var import_async12 = require("@dxos/async");
+var import_async13 = require("@dxos/async");
 var import_context5 = require("@dxos/context");
 var import_keys7 = require("@dxos/keys");
-var import_log9 = require("@dxos/log");
+var import_log10 = require("@dxos/log");
 var import_protocols5 = require("@dxos/protocols");
 var import_teleport2 = require("@dxos/teleport");
 var import_util4 = require("@dxos/util");
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
+var WRITER_NOT_SET_ERROR_CODE = "WRITER_NOT_SET";
 var NotarizationPlugin = class {
   constructor() {
     this._ctx = new import_context5.Context();
-    this._extensionOpened = new import_async12.Event();
+    this._extensionOpened = new import_async13.Event();
     this._extensions = /* @__PURE__ */ new Set();
     this._processedCredentials = new import_util4.ComplexSet(import_keys7.PublicKey.hash);
     this._processCredentialsTriggers = new import_util4.ComplexMap(import_keys7.PublicKey.hash);
@@ -2301,23 +2377,23 @@ var NotarizationPlugin = class {
   * Request credentials to be notarized.
   */
   async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
-    (0, import_log9.log)("notarize", {
+    (0, import_log10.log)("notarize", {
       credentials
     }, {
       file: "notarization-plugin.ts",
-      line: 85,
+      line: 87,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     (0, import_node_assert9.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
-    const errors = new import_async12.Trigger();
+    const errors = new import_async13.Trigger();
     const ctx = this._ctx.derive({
       onError: (err) => {
-        import_log9.log.warn("Notarization error", {
+        import_log10.log.warn("Notarization error", {
           err
         }, {
           file: "notarization-plugin.ts",
-          line: 94,
+          line: 96,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2327,23 +2403,23 @@ var NotarizationPlugin = class {
     });
     opCtx == null ? void 0 : opCtx.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
-      (0, import_async12.scheduleTask)(ctx, () => {
-        import_log9.log.warn("Notarization timeout", {
+      (0, import_async13.scheduleTask)(ctx, () => {
+        import_log10.log.warn("Notarization timeout", {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
         }, {
           file: "notarization-plugin.ts",
-          line: 106,
+          line: 108,
           scope: this,
           callSite: (f, a) => f(...a)
         });
         void ctx.dispose();
-        errors.throw(new import_async12.TimeoutError(timeout, "Notarization timed out"));
+        errors.throw(new import_async13.TimeoutError(timeout, "Notarization timed out"));
       }, timeout);
     }
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
     const peersTried = /* @__PURE__ */ new Set();
-    const notarizeTask = new import_async12.DeferredTask(ctx, async () => {
+    const notarizeTask = new import_async13.DeferredTask(ctx, async () => {
       try {
         if (this._extensions.size === 0) {
           return;
@@ -2352,45 +2428,47 @@ var NotarizationPlugin = class {
           ...this._extensions
         ].find((peer2) => !peersTried.has(peer2));
         if (!peer) {
-          import_log9.log.warn("Exhausted all peers to notarize with", {
+          import_log10.log.warn("Exhausted all peers to notarize with", {
             retryIn: retryTimeout
           }, {
             file: "notarization-plugin.ts",
-            line: 131,
+            line: 133,
             scope: this,
             callSite: (f, a) => f(...a)
           });
           peersTried.clear();
-          (0, import_async12.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
+          (0, import_async13.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
           return;
         }
         peersTried.add(peer);
-        (0, import_log9.log)("try notarizing", {
+        (0, import_log10.log)("try notarizing", {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
           file: "notarization-plugin.ts",
-          line: 138,
+          line: 140,
           scope: this,
           callSite: (f, a) => f(...a)
         });
         await peer.rpc.NotarizationService.notarize({
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
-        (0, import_log9.log)("success", {}, {
+        (0, import_log10.log)("success", {}, {
           file: "notarization-plugin.ts",
-          line: 142,
+          line: 144,
           scope: this,
           callSite: (f, a) => f(...a)
         });
-        await (0, import_async12.sleep)(successDelay);
+        await (0, import_async13.sleep)(successDelay);
       } catch (err) {
-        import_log9.log.warn("error notarizing (recoverable)", err, {
-          file: "notarization-plugin.ts",
-          line: 145,
-          scope: this,
-          callSite: (f, a) => f(...a)
-        });
+        if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
+          import_log10.log.warn("error notarizing (recoverable)", err, {
+            file: "notarization-plugin.ts",
+            line: 148,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
         notarizeTask.schedule();
       }
     });
@@ -2402,9 +2480,9 @@ var NotarizationPlugin = class {
         allNotarized,
         errors.wait()
       ]);
-      (0, import_log9.log)("done", {}, {
+      (0, import_log10.log)("done", {}, {
         file: "notarization-plugin.ts",
-        line: 155,
+        line: 159,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -2432,7 +2510,7 @@ var NotarizationPlugin = class {
     if (this._processedCredentials.has(id)) {
       return;
     }
-    await (0, import_util4.entry)(this._processCredentialsTriggers, id).orInsert(new import_async12.Trigger()).value.wait();
+    await (0, import_util4.entry)(this._processCredentialsTriggers, id).orInsert(new import_async13.Trigger()).value.wait();
   }
   /**
   * Requests from other peers to notarize credentials.
@@ -2440,7 +2518,7 @@ var NotarizationPlugin = class {
   async _onNotarize(request) {
     var _a;
     if (!this._writer) {
-      throw new Error("Writer not set");
+      throw new Error(WRITER_NOT_SET_ERROR_CODE);
     }
     for (const credential of (_a = request.credentials) != null ? _a : []) {
       (0, import_node_assert9.default)(credential.id, "Credential must have an id");
@@ -2453,11 +2531,11 @@ var NotarizationPlugin = class {
   createExtension() {
     const extension = new NotarizationTeleportExtension({
       onOpen: async () => {
-        (0, import_log9.log)("extension opened", {
+        (0, import_log10.log)("extension opened", {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
-          line: 204,
+          line: 208,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2465,11 +2543,11 @@ var NotarizationPlugin = class {
         this._extensionOpened.emit();
       },
       onClose: async () => {
-        (0, import_log9.log)("extension closed", {
+        (0, import_log10.log)("extension closed", {
           peer: extension.localPeerId
         }, {
           file: "notarization-plugin.ts",
-          line: 209,
+          line: 213,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2512,7 +2590,7 @@ var NotarizationTeleportExtension = class extends import_teleport2.RpcExtension
 };
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-var __decorate = function(decorators, target, key, desc) {
+var __decorate2 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2530,7 +2608,7 @@ var DataSpace = class DataSpace2 {
     * Error for _state === SpaceState.ERROR.
     */
     this.error = void 0;
-    this.stateUpdate = new import_async13.Event();
+    this.stateUpdate = new import_async14.Event();
     this.metrics = {};
     var _a;
     this._inner = params.inner;
@@ -2601,13 +2679,13 @@ var DataSpace = class DataSpace2 {
   * Initialize the data pipeline in a separate task.
   */
   initializeDataPipelineAsync() {
-    (0, import_async13.scheduleTask)(this._ctx, async () => {
+    (0, import_async14.scheduleTask)(this._ctx, async () => {
       try {
         this.metrics.pipelineInitBegin = new Date();
         await this.initializeDataPipeline();
       } catch (err) {
         if (err instanceof import_errors3.CancelledError) {
-          (0, import_log10.log)("Data pipeline initialization cancelled", err, {
+          (0, import_log11.log)("Data pipeline initialization cancelled", err, {
             file: "data-space.ts",
             line: 172,
             scope: this,
@@ -2615,7 +2693,7 @@ var DataSpace = class DataSpace2 {
           });
           return;
         }
-        import_log10.log.error("Error initializing data pipeline", err, {
+        import_log11.log.error("Error initializing data pipeline", err, {
           file: "data-space.ts",
           line: 176,
           scope: this,
@@ -2641,7 +2719,7 @@ var DataSpace = class DataSpace2 {
     });
     this.metrics.controlPipelineReady = new Date();
     await this._createWritableFeeds();
-    (0, import_log10.log)("Writable feeds created", {}, {
+    (0, import_log11.log)("Writable feeds created", {}, {
       file: "data-space.ts",
       line: 201,
       scope: this,
@@ -2656,7 +2734,7 @@ var DataSpace = class DataSpace2 {
     await this._inner.initializeDataPipeline();
     this.metrics.dataPipelineOpen = new Date();
     await (0, import_context6.cancelWithContext)(this._ctx, this._inner.dataPipeline.ensureEpochInitialized());
-    (0, import_log10.log)("waiting for data pipeline to reach target timeframe", {}, {
+    (0, import_log11.log)("waiting for data pipeline to reach target timeframe", {}, {
       file: "data-space.ts",
       line: 220,
       scope: this,
@@ -2667,7 +2745,7 @@ var DataSpace = class DataSpace2 {
       breakOnStall: false
     });
     this.metrics.dataPipelineReady = new Date();
-    (0, import_log10.log)("data pipeline ready", {}, {
+    (0, import_log11.log)("data pipeline ready", {}, {
       file: "data-space.ts",
       line: 229,
       scope: this,
@@ -2743,11 +2821,11 @@ var DataSpace = class DataSpace2 {
     }
   }
 };
-__decorate([
+__decorate2([
   (0, import_debug3.timed)(1e4)
 ], DataSpace.prototype, "_createWritableFeeds", null);
-DataSpace = __decorate([
-  (0, import_async13.trackLeaks)("open", "close")
+DataSpace = __decorate2([
+  (0, import_async14.trackLeaks)("open", "close")
 ], DataSpace);
 
 // packages/sdk/client-services/src/packlets/spaces/genesis.ts
@@ -2821,7 +2899,7 @@ var spaceGenesis = async (keyring, signingContext, space) => {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
-var __decorate2 = function(decorators, target, key, desc) {
+var __decorate3 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2840,7 +2918,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     this._signingContext = _signingContext;
     this._feedStore = _feedStore;
     this._ctx = new import_context7.Context();
-    this.updated = new import_async14.Event();
+    this.updated = new import_async15.Event();
     this._spaces = new import_util6.ComplexMap(import_keys9.PublicKey.hash);
     this._isOpen = false;
     this._instanceId = import_keys9.PublicKey.random().toHex();
@@ -2850,13 +2928,13 @@ var DataSpaceManager = class DataSpaceManager2 {
     return this._spaces;
   }
   async open() {
-    (0, import_log11.log)("open", {}, {
+    (0, import_log12.log)("open", {}, {
       file: "data-space-manager.ts",
       line: 80,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    import_log11.log.trace("dxos.echo.data-space-manager.open", import_protocols6.trace.begin({
+    import_log12.log.trace("dxos.echo.data-space-manager.open", import_protocols6.trace.begin({
       id: this._instanceId
     }), {
       file: "data-space-manager.ts",
@@ -2865,7 +2943,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       callSite: (f, a) => f(...a)
     });
     await this._metadataStore.load();
-    (0, import_log11.log)("metadata loaded", {
+    (0, import_log12.log)("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
       file: "data-space-manager.ts",
@@ -2875,7 +2953,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     });
     for (const spaceMetadata of this._metadataStore.spaces) {
       try {
-        (0, import_log11.log)("load space", {
+        (0, import_log12.log)("load space", {
           spaceMetadata
         }, {
           file: "data-space-manager.ts",
@@ -2886,7 +2964,7 @@ var DataSpaceManager = class DataSpaceManager2 {
         const space = await this._constructSpace(spaceMetadata);
         space.initializeDataPipelineAsync();
       } catch (err) {
-        import_log11.log.error("Error loading space", {
+        import_log12.log.error("Error loading space", {
           spaceMetadata,
           err
         }, {
@@ -2899,7 +2977,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     }
     this._isOpen = true;
     this.updated.emit();
-    import_log11.log.trace("dxos.echo.data-space-manager.open", import_protocols6.trace.end({
+    import_log12.log.trace("dxos.echo.data-space-manager.open", import_protocols6.trace.end({
       id: this._instanceId
     }), {
       file: "data-space-manager.ts",
@@ -2909,7 +2987,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     });
   }
   async close() {
-    (0, import_log11.log)("close", {}, {
+    (0, import_log12.log)("close", {}, {
       file: "data-space-manager.ts",
       line: 102,
       scope: this,
@@ -2935,7 +3013,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       controlFeedKey,
       dataFeedKey
     };
-    (0, import_log11.log)("creating space...", {
+    (0, import_log12.log)("creating space...", {
       spaceKey
     }, {
       file: "data-space-manager.ts",
@@ -2955,7 +3033,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
-    (0, import_log11.log)("accept space", {
+    (0, import_log12.log)("accept space", {
       opts
     }, {
       file: "data-space-manager.ts",
@@ -2989,7 +3067,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     }));
   }
   async _constructSpace(metadata) {
-    (0, import_log11.log)("construct space", {
+    (0, import_log12.log)("construct space", {
       metadata
     }, {
       file: "data-space-manager.ts",
@@ -3027,7 +3105,7 @@ var DataSpaceManager = class DataSpaceManager2 {
         session.addExtension("dxos.mesh.teleport.notarization", dataSpace.notarizationPlugin.createExtension());
       },
       onAuthFailure: () => {
-        import_log11.log.warn("auth failure", {}, {
+        import_log12.log.warn("auth failure", {}, {
           file: "data-space-manager.ts",
           line: 212,
           scope: this,
@@ -3048,7 +3126,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       signingContext: this._signingContext,
       callbacks: {
         beforeReady: async () => {
-          (0, import_log11.log)("before space ready", {
+          (0, import_log12.log)("before space ready", {
             space: space.key
           }, {
             file: "data-space-manager.ts",
@@ -3059,7 +3137,7 @@ var DataSpaceManager = class DataSpaceManager2 {
           this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.dataPipeline.databaseHost.createDataServiceHost());
         },
         afterReady: async () => {
-          (0, import_log11.log)("after space ready", {
+          (0, import_log12.log)("after space ready", {
             space: space.key,
             open: this._isOpen
           }, {
@@ -3086,28 +3164,28 @@ var DataSpaceManager = class DataSpaceManager2 {
     return dataSpace;
   }
 };
-__decorate2([
-  import_async14.synchronized
+__decorate3([
+  import_async15.synchronized
 ], DataSpaceManager.prototype, "open", null);
-__decorate2([
-  import_async14.synchronized
+__decorate3([
+  import_async15.synchronized
 ], DataSpaceManager.prototype, "close", null);
-__decorate2([
-  import_async14.synchronized
+__decorate3([
+  import_async15.synchronized
 ], DataSpaceManager.prototype, "createSpace", null);
-__decorate2([
-  import_async14.synchronized
+__decorate3([
+  import_async15.synchronized
 ], DataSpaceManager.prototype, "acceptSpace", null);
-DataSpaceManager = __decorate2([
-  (0, import_async14.trackLeaks)("open", "close")
+DataSpaceManager = __decorate3([
+  (0, import_async15.trackLeaks)("open", "close")
 ], DataSpaceManager);
 
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
-var import_async15 = require("@dxos/async");
-var import_codec_protobuf11 = require("@dxos/codec-protobuf");
+var import_async16 = require("@dxos/async");
+var import_codec_protobuf12 = require("@dxos/codec-protobuf");
 var import_debug5 = require("@dxos/debug");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
-var import_log12 = require("@dxos/log");
+var import_log13 = require("@dxos/log");
 var import_protocols7 = require("@dxos/protocols");
 var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util7 = require("@dxos/util");
@@ -3131,15 +3209,15 @@ var SpacesServiceImpl = class {
     (0, import_debug5.todo)();
   }
   querySpaces() {
-    return new import_codec_protobuf11.Stream(({ next, ctx }) => {
+    return new import_codec_protobuf12.Stream(({ next, ctx }) => {
       const onUpdate = async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._transformSpace(space));
-        (0, import_log12.log)("update", {
+        (0, import_log13.log)("update", {
           spaces
         }, {
           file: "spaces-service.ts",
-          line: 62,
+          line: 59,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -3147,9 +3225,9 @@ var SpacesServiceImpl = class {
           spaces
         });
       };
-      (0, import_async15.scheduleTask)(ctx, async () => {
+      (0, import_async16.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const subscriptions = new import_async15.EventSubscriptions();
+        const subscriptions = new import_async16.EventSubscriptions();
         ctx.onDispose(() => subscriptions.clear());
         const subscribeSpaces = () => {
           subscriptions.clear();
@@ -3183,8 +3261,8 @@ var SpacesServiceImpl = class {
     await space.postMessage(getChannelId(channel), message);
   }
   subscribeMessages({ spaceKey, channel }) {
-    return new import_codec_protobuf11.Stream(({ ctx, next }) => {
-      (0, import_async15.scheduleTask)(ctx, async () => {
+    return new import_codec_protobuf12.Stream(({ ctx, next }) => {
+      (0, import_async16.scheduleTask)(ctx, async () => {
         var _a;
         const dataSpaceManager = await this._getDataSpaceManager();
         const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
@@ -3196,7 +3274,7 @@ var SpacesServiceImpl = class {
     });
   }
   queryCredentials({ spaceKey }) {
-    return new import_codec_protobuf11.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf12.Stream(({ ctx, next }) => {
       var _a;
       const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
       const processor = space.spaceState.registerProcessor({
@@ -3205,7 +3283,7 @@ var SpacesServiceImpl = class {
         }
       });
       ctx.onDispose(() => processor.close());
-      (0, import_async15.scheduleTask)(ctx, () => processor.open());
+      (0, import_async16.scheduleTask)(ctx, () => processor.open());
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
@@ -3308,7 +3386,7 @@ var toStorageType = (type) => {
 };
 
 // packages/sdk/client-services/src/packlets/system/system-service.ts
-var import_codec_protobuf12 = require("@dxos/codec-protobuf");
+var import_codec_protobuf13 = require("@dxos/codec-protobuf");
 var SystemServiceImpl = class {
   constructor({ config, statusUpdate, onUpdateStatus, getCurrentStatus, onReset }) {
     this._config = config;
@@ -3325,7 +3403,7 @@ var SystemServiceImpl = class {
     await this._onUpdateStatus(status);
   }
   queryStatus() {
-    return new import_codec_protobuf12.Stream(({ next }) => {
+    return new import_codec_protobuf13.Stream(({ next }) => {
       const update = () => {
         next({
           status: this._getCurrentStatus()
@@ -3345,1225 +3423,1096 @@ var SystemServiceImpl = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
+// packages/sdk/client-services/src/packlets/services/service-context.ts
+var import_node_assert11 = __toESM(require("node:assert"));
 var import_async17 = require("@dxos/async");
-var import_client_protocol5 = require("@dxos/client-protocol");
-var import_log13 = require("@dxos/log");
-var import_messaging = require("@dxos/messaging");
-var import_network_manager2 = require("@dxos/network-manager");
-var import_util8 = require("@dxos/util");
-
-// packages/sdk/client-services/src/packlets/services/client-rpc-server.ts
-var import_codec_protobuf13 = require("@dxos/codec-protobuf");
+var import_credentials13 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
-var import_rpc = require("@dxos/rpc");
-var ClientRpcServer = class {
-  constructor(params) {
-    this._handlerCache = /* @__PURE__ */ new Map();
-    const { serviceRegistry, handleCall, handleStream, ...rpcOptions } = params;
-    this._handleCall = handleCall;
-    this._handleStream = handleStream;
-    this._serviceRegistry = serviceRegistry;
-    this._rpcPeer = new import_rpc.RpcPeer({
-      ...rpcOptions,
-      callHandler: (method, params2) => {
-        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
-        const handler = (method2, params3) => this._getServiceHandler(serviceName).call(method2, params3);
-        if (this._handleCall) {
-          return this._handleCall(methodName, params2, handler);
-        } else {
-          return handler(methodName, params2);
-        }
-      },
-      streamHandler: (method, params2) => {
-        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
-        const handler = (method2, params3) => this._getServiceHandler(serviceName).callStream(method2, params3);
-        if (this._handleStream) {
-          return import_codec_protobuf13.Stream.unwrapPromise(this._handleStream(methodName, params2, handler));
-        } else {
-          return handler(methodName, params2);
+var import_echo_pipeline3 = require("@dxos/echo-pipeline");
+var import_feed_store4 = require("@dxos/feed-store");
+var import_keyring = require("@dxos/keyring");
+var import_keys10 = require("@dxos/keys");
+var import_log14 = require("@dxos/log");
+var import_protocols8 = require("@dxos/protocols");
+var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
+var ServiceContext = class {
+  // prettier-ignore
+  constructor(storage, networkManager, signalManager, modelFactory) {
+    this.storage = storage;
+    this.networkManager = networkManager;
+    this.signalManager = signalManager;
+    this.modelFactory = modelFactory;
+    this.initialized = new import_async17.Trigger();
+    this.dataServiceSubscriptions = new import_echo_pipeline3.DataServiceSubscriptions();
+    this._handlerFactories = /* @__PURE__ */ new Map();
+    this._instanceId = import_keys10.PublicKey.random().toHex();
+    this.metadataStore = new import_echo_pipeline3.MetadataStore(storage.createDirectory("metadata"));
+    this.snapshotStore = new import_echo_pipeline3.SnapshotStore(storage.createDirectory("snapshots"));
+    this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
+    this.feedStore = new import_feed_store4.FeedStore({
+      factory: new import_feed_store4.FeedFactory({
+        root: storage.createDirectory("feeds"),
+        signer: this.keyring,
+        hypercore: {
+          valueEncoding: import_echo_pipeline3.valueEncoding
         }
-      }
+      })
+    });
+    this.spaceManager = new import_echo_pipeline3.SpaceManager({
+      feedStore: this.feedStore,
+      networkManager: this.networkManager,
+      metadataStore: this.metadataStore,
+      modelFactory: this.modelFactory,
+      snapshotStore: this.snapshotStore
     });
+    this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
+    this.invitations = new InvitationsHandler(this.networkManager);
+    this._handlerFactories.set(import_services10.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
+      var _a;
+      return (_a = this.identityManager.identity) != null ? _a : (0, import_debug6.failUndefined)();
+    }, this._acceptIdentity.bind(this)));
   }
   async open() {
-    await this._rpcPeer.open();
+    import_log14.log.trace("dxos.sdk.service-context.open", import_protocols8.trace.begin({
+      id: this._instanceId
+    }), {
+      file: "service-context.ts",
+      line: 119,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this._checkStorageVersion();
+    (0, import_log14.log)("opening...", {}, {
+      file: "service-context.ts",
+      line: 123,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this.signalManager.open();
+    await this.networkManager.open();
+    await this.spaceManager.open();
+    await this.identityManager.open();
+    if (this.identityManager.identity) {
+      await this._initialize();
+    }
+    (0, import_log14.log)("opened", {}, {
+      file: "service-context.ts",
+      line: 131,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    import_log14.log.trace("dxos.sdk.service-context.open", import_protocols8.trace.end({
+      id: this._instanceId
+    }), {
+      file: "service-context.ts",
+      line: 132,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
   }
   async close() {
-    await this._rpcPeer.close();
-  }
-  _getServiceHandler(serviceName) {
-    var _a;
-    if (!this._handlerCache.has(serviceName)) {
-      const [key, descriptor] = (_a = Object.entries(this._serviceRegistry.descriptors).find(([key2, descriptor2]) => descriptor2.name === serviceName)) != null ? _a : (0, import_debug6.raise)(new Error(`Service not available: ${serviceName}`));
-      const service = this._serviceRegistry.services[key];
-      if (!service) {
-        throw new Error(`Service not available: ${serviceName}`);
-      }
-      this._handlerCache.set(serviceName, descriptor.createServer(service));
-    }
-    return this._handlerCache.get(serviceName);
+    var _a, _b;
+    (0, import_log14.log)("closing...", {}, {
+      file: "service-context.ts",
+      line: 136,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await ((_a = this._deviceSpaceSync) == null ? void 0 : _a.close());
+    await ((_b = this.dataSpaceManager) == null ? void 0 : _b.close());
+    await this.identityManager.close();
+    await this.spaceManager.close();
+    await this.feedStore.close();
+    await this.networkManager.close();
+    await this.signalManager.close();
+    this.dataServiceSubscriptions.clear();
+    (0, import_log14.log)("closed", {}, {
+      file: "service-context.ts",
+      line: 145,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
   }
-};
-
-// packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
-var import_node_assert11 = __toESM(require("node:assert"));
-var import_async16 = require("@dxos/async");
-var import_client_protocol4 = require("@dxos/client-protocol");
-var import_iframe = require("@dxos/protocols/proto/dxos/iframe");
-var import_rpc2 = require("@dxos/rpc");
-var ShellRuntimeImpl = class {
-  constructor(_port) {
-    this._port = _port;
-    this.layoutUpdate = new import_async16.Event();
-    this._layout = import_iframe.ShellLayout.DEFAULT;
+  async createIdentity(params = {}) {
+    const identity = await this.identityManager.createIdentity(params);
+    await this._initialize();
+    return identity;
   }
-  get layout() {
-    return this._layout;
+  getInvitationHandler(invitation) {
+    const factory = this._handlerFactories.get(invitation.kind);
+    (0, import_node_assert11.default)(factory, `Unknown invitation kind: ${invitation.kind}`);
+    return factory(invitation);
   }
-  get invitationCode() {
-    return this._invitationCode;
+  async _acceptIdentity(params) {
+    const identity = await this.identityManager.acceptIdentity(params);
+    await this._initialize();
+    return identity;
   }
-  get spaceKey() {
-    return this._spaceKey;
+  async _checkStorageVersion() {
+    await this.metadataStore.load();
+    if (this.metadataStore.version !== import_protocols8.STORAGE_VERSION) {
+      throw new Error(`Invalid storage version: current=${this.metadataStore.version}, expected=${import_protocols8.STORAGE_VERSION}`);
+    }
   }
-  setLayout(layout, options = {}) {
-    this._layout = layout;
-    this._invitationCode = options.invitationCode;
-    this._spaceKey = options.spaceKey;
-    this.layoutUpdate.emit({
-      layout,
-      ...options
+  // Called when identity is created.
+  async _initialize() {
+    var _a;
+    (0, import_log14.log)("initializing spaces...", {}, {
+      file: "service-context.ts",
+      line: 178,
+      scope: this,
+      callSite: (f, a) => f(...a)
     });
-  }
-  async setAppContext(context) {
-    (0, import_node_assert11.default)(this._appRpc, "runtime not open");
-    await this._appRpc.rpc.AppService.setContext(context);
-  }
-  async open() {
-    this._appRpc = (0, import_rpc2.createProtoRpcPeer)({
-      requested: import_client_protocol4.appServiceBundle,
-      exposed: import_client_protocol4.shellServiceBundle,
-      handlers: {
-        ShellService: {
-          setLayout: async (request) => {
-            this._layout = request.layout;
-            this._invitationCode = request.invitationCode;
-            this._spaceKey = request.spaceKey;
-            this.layoutUpdate.emit(request);
+    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug6.failUndefined)();
+    const signingContext = {
+      credentialSigner: identity.getIdentityCredentialSigner(),
+      identityKey: identity.identityKey,
+      deviceKey: identity.deviceKey,
+      profile: identity.profileDocument,
+      recordCredential: async (credential) => {
+        await identity.controlPipeline.writer.write({
+          credential: {
+            credential
           }
+        });
+      }
+    };
+    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.feedStore);
+    await this.dataSpaceManager.open();
+    this._handlerFactories.set(import_services10.Invitation.Kind.SPACE, (invitation) => {
+      (0, import_node_assert11.default)(this.dataSpaceManager, "dataSpaceManager not initialized yet");
+      return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
+    });
+    this.initialized.wake();
+    this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
+      process: async (credential) => {
+        const assertion = (0, import_credentials13.getCredentialAssertion)(credential);
+        if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
+          return;
         }
-      },
-      port: this._port
+        if (assertion.spaceKey.equals(identity.space.key)) {
+          return;
+        }
+        if (!this.dataSpaceManager) {
+          (0, import_log14.log)("dataSpaceManager not initialized yet, ignoring space admission", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 217,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
+          (0, import_log14.log)("space already exists, ignoring space admission", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 221,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          return;
+        }
+        try {
+          (0, import_log14.log)("accepting space recorded in halo", {
+            details: assertion
+          }, {
+            file: "service-context.ts",
+            line: 226,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+          await this.dataSpaceManager.acceptSpace({
+            spaceKey: assertion.spaceKey,
+            genesisFeedKey: assertion.genesisFeedKey
+          });
+        } catch (err) {
+          import_log14.log.catch(err, {}, {
+            file: "service-context.ts",
+            line: 232,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
+        }
+      }
     });
-    await this._appRpc.open();
-  }
-  async close() {
-    var _a;
-    await ((_a = this._appRpc) == null ? void 0 : _a.close());
-    this._appRpc = void 0;
+    await this._deviceSpaceSync.open();
   }
 };
-var MemoryShellRuntime = class {
-  constructor({ layout, invitationCode, spaceKey } = {}) {
-    this.layoutUpdate = new import_async16.Event();
-    this.contextUpdate = new import_async16.Event();
-    this._layout = layout != null ? layout : import_iframe.ShellLayout.DEFAULT;
-    this._invitationCode = invitationCode;
-    this._spaceKey = spaceKey;
+
+// packages/sdk/client-services/src/packlets/services/service-registry.ts
+var ServiceRegistry = class {
+  // prettier-ignore
+  constructor(_serviceBundle, _handlers = {}) {
+    this._serviceBundle = _serviceBundle;
+    this._handlers = _handlers;
   }
-  get layout() {
-    return this._layout;
+  get descriptors() {
+    return this._serviceBundle;
   }
-  get invitationCode() {
-    return this._invitationCode;
+  get services() {
+    return this._handlers;
   }
-  get spaceKey() {
-    return this._spaceKey;
+  setServices(services) {
+    this._handlers = services;
   }
-  setLayout(layout, options = {}) {
-    this._layout = layout;
-    this._invitationCode = options.invitationCode;
-    this._spaceKey = options.spaceKey;
-    this.layoutUpdate.emit({
-      layout,
-      ...options
-    });
+  addService(name, service) {
+    this._handlers[name] = service;
   }
-  async setAppContext(context) {
-    this.contextUpdate.emit(context);
+  removeService(name) {
+    delete this._handlers[name];
   }
 };
 
-// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
-var __decorate3 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
-    r = Reflect.decorate(decorators, target, key, desc);
-  else
-    for (var i = decorators.length - 1; i >= 0; i--)
-      if (d = decorators[i])
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var LOCK_KEY = "DXOS_RESOURCE_LOCK";
-var IFrameHostRuntime = class {
-  constructor({ config, origin, appPort, shellPort }) {
-    this._ready = new import_async17.Trigger();
-    this._configProvider = config;
-    this.origin = origin;
-    this._appPort = appPort;
-    this._shellPort = shellPort;
-    if (this._shellPort) {
-      this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
-    }
-  }
-  get services() {
-    return this._clientServices;
-  }
-  get shell() {
-    return this._shellRuntime;
-  }
-  async start() {
-    var _a;
-    (0, import_log13.log)("starting...", {}, {
-      file: "iframe-host-runtime.ts",
-      line: 70,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    try {
-      this._config = await (0, import_util8.getAsyncValue)(this._configProvider);
-      this._transportFactory = (0, import_network_manager2.createWebRTCTransportFactory)({
-        iceServers: this._config.get("runtime.services.ice")
-      });
-      const signals = this._config.get("runtime.services.signaling");
-      this._clientServices = new LocalClientServices({
-        lockKey: LOCK_KEY,
-        config: this._config,
-        signalManager: signals ? new import_messaging.WebsocketSignalManager(signals) : new import_messaging.MemorySignalManager(new import_messaging.MemorySignalManagerContext()),
-        transportFactory: this._transportFactory
+// packages/sdk/client-services/src/packlets/services/service-host.ts
+var ClientServicesHost = class {
+  constructor({
+    config,
+    modelFactory = (0, import_client_protocol4.createDefaultModelFactory)(),
+    // TODO(burdon): Create ApolloLink abstraction (see Client).
+    transportFactory,
+    signalManager,
+    connectionLog,
+    storage,
+    // TODO(wittjosiah): Turn this on by default.
+    lockKey
+  } = {}) {
+    this._statusUpdate = new import_async18.Event();
+    this._opening = false;
+    this._open = false;
+    this._storage = storage;
+    this._modelFactory = modelFactory;
+    if (config) {
+      this.initialize({
+        config,
+        transportFactory,
+        signalManager
       });
-      const middleware = {
-        handleCall: async (method, params, handler) => {
-          const error = await this._ready.wait({
-            timeout: import_client_protocol5.PROXY_CONNECTION_TIMEOUT
-          });
-          if (error) {
-            throw error;
+    }
+    if (lockKey) {
+      this._resourceLock = new Lock({
+        lockKey,
+        onAcquire: () => {
+          if (!this._opening) {
+            void this.open();
           }
-          return handler(method, params);
         },
-        handleStream: async (method, params, handler) => {
-          const error = await this._ready.wait({
-            timeout: import_client_protocol5.PROXY_CONNECTION_TIMEOUT
-          });
-          if (error) {
-            throw error;
-          }
-          return handler(method, params);
-        }
-      };
-      this._clientRpc = new ClientRpcServer({
-        serviceRegistry: this._clientServices.host.serviceRegistry,
-        port: this._appPort,
-        ...middleware
+        onRelease: () => this.close()
       });
-      await Promise.all([
-        this._clientServices.open(),
-        this._clientRpc.open(),
-        (_a = this._shellRuntime) == null ? void 0 : _a.open()
-      ]);
-      this._ready.wake(void 0);
-      (0, import_log13.log)("started", {}, {
-        file: "iframe-host-runtime.ts",
-        line: 113,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    } catch (err) {
-      this._ready.wake(err);
-      import_log13.log.catch(err, {}, {
-        file: "iframe-host-runtime.ts",
-        line: 116,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    }
-  }
-  async stop() {
-    var _a;
-    (0, import_log13.log)("stopping...", {}, {
-      file: "iframe-host-runtime.ts",
-      line: 121,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await this._clientRpc.close();
-    await this._clientServices.close();
-    await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
-    (0, import_log13.log)("stopped", {}, {
-      file: "iframe-host-runtime.ts",
-      line: 125,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-  }
-};
-__decorate3([
-  import_log13.logInfo
-], IFrameHostRuntime.prototype, "origin", void 0);
-
-// packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
-var import_async18 = require("@dxos/async");
-var import_client_protocol6 = require("@dxos/client-protocol");
-var import_errors5 = require("@dxos/errors");
-var import_log14 = require("@dxos/log");
-var import_network_manager3 = require("@dxos/network-manager");
-var import_rpc3 = require("@dxos/rpc");
-var import_util9 = require("@dxos/util");
-var IFrameProxyRuntime = class {
-  constructor({ config, systemPort, shellPort }) {
-    this._id = String(Math.floor(Math.random() * 1e6));
-    this._release = new import_async18.Trigger();
-    this._configProvider = config;
-    this._systemPort = systemPort;
-    this._shellPort = shellPort;
-    if (this._shellPort) {
-      this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
     }
-  }
-  get shell() {
-    return this._shellRuntime;
-  }
-  async open(origin) {
-    var _a;
-    this._config = await (0, import_util9.getAsyncValue)(this._configProvider);
-    this._transportService = new import_network_manager3.WebRTCTransportService({
-      iceServers: this._config.get("runtime.services.ice")
-    });
-    this._systemRpc = (0, import_rpc3.createProtoRpcPeer)({
-      requested: import_client_protocol6.workerServiceBundle,
-      exposed: import_client_protocol6.iframeServiceBundle,
-      handlers: {
-        BridgeService: this._transportService
+    this._systemService = new SystemServiceImpl({
+      config: this._config,
+      statusUpdate: this._statusUpdate,
+      getCurrentStatus: () => this.isOpen ? import_services11.SystemStatus.ACTIVE : import_services11.SystemStatus.INACTIVE,
+      onUpdateStatus: async (status) => {
+        var _a, _b;
+        if (!this.isOpen && status === import_services11.SystemStatus.ACTIVE) {
+          await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
+        } else if (this.isOpen && status === import_services11.SystemStatus.INACTIVE) {
+          await ((_b = this._resourceLock) == null ? void 0 : _b.release());
+        }
       },
-      port: this._systemPort,
-      timeout: 200
+      onReset: async () => {
+        await this.reset();
+      }
+    });
+    this._loggingService = new LoggingServiceImpl();
+    this._serviceRegistry = new ServiceRegistry(import_client_protocol4.clientServiceBundle, {
+      SystemService: this._systemService
     });
-    let lockKey;
-    if (typeof navigator !== "undefined") {
-      lockKey = this._lockKey(origin);
-      this._release = new import_async18.Trigger();
-      const ready = new import_async18.Trigger();
-      void navigator.locks.request(lockKey, async () => {
-        ready.wake();
-        await this._release.wait();
-      });
-      await ready.wait();
-    }
-    try {
-      await this._systemRpc.open();
-      await this._systemRpc.rpc.WorkerService.start({
-        origin,
-        lockKey
-      });
-    } catch (err) {
-      import_log14.log.catch(err, {}, {
-        file: "iframe-proxy-runtime.ts",
-        line: 85,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      throw new import_errors5.RemoteServiceConnectionError("Failed to connect to worker");
-    }
-    await ((_a = this._shellRuntime) == null ? void 0 : _a.open());
   }
-  async close() {
-    var _a;
-    this._release.wake();
-    await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
-    await this._systemRpc.rpc.WorkerService.stop();
-    await this._systemRpc.close();
+  get isOpen() {
+    return this._open;
   }
-  _lockKey(origin) {
-    return `${origin}-${this._id}`;
+  get serviceRegistry() {
+    return this._serviceRegistry;
   }
-};
-
-// packages/sdk/client-services/src/packlets/vault/vault-resource-lock.ts
-var import_async19 = require("@dxos/async");
-var import_client_protocol7 = require("@dxos/client-protocol");
-var import_log15 = require("@dxos/log");
-var __decorate4 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
-    r = Reflect.decorate(decorators, target, key, desc);
-  else
-    for (var i = decorators.length - 1; i >= 0; i--)
-      if (d = decorators[i])
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var Message;
-(function(Message2) {
-  Message2["ACQUIRING"] = "acquiring";
-})(Message || (Message = {}));
-var VaultResourceLock = class {
-  constructor({ lockKey, onAcquire, onRelease }) {
-    this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
-    this._releaseTrigger = new import_async19.Trigger();
-    this._lockKey = lockKey;
-    this._onAcquire = onAcquire;
-    this._onRelease = onRelease;
-    this._broadcastChannel.onmessage = this._onMessage.bind(this);
+  get descriptors() {
+    return this._serviceRegistry.descriptors;
   }
-  get lockKey() {
-    return this._lockKey;
+  get services() {
+    return this._serviceRegistry.services;
   }
-  async acquire() {
-    this._broadcastChannel.postMessage({
-      message: Message.ACQUIRING
-    });
-    try {
-      (0, import_log15.log)("aquiring lock...", {}, {
-        file: "vault-resource-lock.ts",
-        line: 45,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      await (0, import_async19.asyncTimeout)(this._requestLock(), import_client_protocol7.RESOURCE_LOCK_TIMEOUT);
-      (0, import_log15.log)("acquired lock", {}, {
-        file: "vault-resource-lock.ts",
-        line: 47,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    } catch (e) {
-      (0, import_log15.log)("stealing lock...", {}, {
-        file: "vault-resource-lock.ts",
-        line: 49,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      await this._requestLock(true);
-      (0, import_log15.log)("stolen lock", {}, {
-        file: "vault-resource-lock.ts",
-        line: 51,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
+  /**
+  * Initialize the service host with the config.
+  * Config can also be provided in the constructor.
+  * Can only be called once.
+  */
+  initialize({ config, ...options }) {
+    var _a, _b, _c;
+    (0, import_node_assert12.default)(!this._open, "service host is open");
+    if (config) {
+      (0, import_node_assert12.default)(!this._config, "config already set");
+      this._config = config;
+      if (!this._storage) {
+        this._storage = createStorageObjects(config.get("runtime.client.storage", {})).storage;
+      }
     }
+    const { connectionLog = true, transportFactory = (0, import_network_manager2.createWebRTCTransportFactory)({
+      iceServers: (_a = this._config) == null ? void 0 : _a.get("runtime.services.ice")
+    }), signalManager = new import_messaging.WebsocketSignalManager((_c = (_b = this._config) == null ? void 0 : _b.get("runtime.services.signaling")) != null ? _c : []) } = options;
+    this._signalManager = signalManager;
+    (0, import_node_assert12.default)(!this._networkManager, "network manager already set");
+    this._networkManager = new import_network_manager2.NetworkManager({
+      log: connectionLog,
+      transportFactory,
+      signalManager
+    });
   }
-  async release() {
-    this._releaseTrigger.wake();
-  }
-  _onMessage(event) {
-    if (event.data.message === Message.ACQUIRING) {
-      this._releaseTrigger.wake();
+  async open() {
+    var _a, _b, _c;
+    if (this._open) {
+      return;
     }
-  }
-  async _requestLock(steal = false) {
-    (0, import_log15.log)("requesting lock...", {
-      steal
+    const traceId = import_keys11.PublicKey.random().toHex();
+    import_log15.log.trace("dxos.sdk.client-services-host.open", import_protocols9.trace.begin({
+      id: traceId
+    }), {
+      file: "service-host.ts",
+      line: 187,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    (0, import_node_assert12.default)(this._config, "config not set");
+    (0, import_node_assert12.default)(this._storage, "storage not set");
+    (0, import_node_assert12.default)(this._signalManager, "signal manager not set");
+    (0, import_node_assert12.default)(this._networkManager, "network manager not set");
+    this._opening = true;
+    (0, import_log15.log)("opening...", {
+      lockKey: (_a = this._resourceLock) == null ? void 0 : _a.lockKey
     }, {
-      file: "vault-resource-lock.ts",
-      line: 66,
+      file: "service-host.ts",
+      line: 195,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const acquired = new import_async19.Trigger();
-    void navigator.locks.request(this._lockKey, {
-      steal
-    }, async () => {
-      var _a, _b;
-      await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
-      acquired.wake();
-      this._releaseTrigger = new import_async19.Trigger();
-      await this._releaseTrigger.wait();
-      (0, import_log15.log)("releasing lock...", {}, {
-        file: "vault-resource-lock.ts",
-        line: 75,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      await ((_b = this._onRelease) == null ? void 0 : _b.call(this));
-      (0, import_log15.log)("released lock", {}, {
-        file: "vault-resource-lock.ts",
-        line: 77,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    }).catch(async () => {
-      var _a;
-      await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
+    await ((_b = this._resourceLock) == null ? void 0 : _b.acquire());
+    await this._loggingService.open();
+    this._serviceContext = new ServiceContext(this._storage, this._networkManager, this._signalManager, this._modelFactory);
+    this._serviceRegistry.setServices({
+      SystemService: this._systemService,
+      IdentityService: new IdentityServiceImpl(this._serviceContext),
+      InvitationsService: new InvitationsServiceImpl(this._serviceContext.invitations, (invitation) => this._serviceContext.getInvitationHandler(invitation)),
+      DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
+      SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, this._serviceContext.dataServiceSubscriptions, async () => {
+        await this._serviceContext.initialized.wait();
+        return this._serviceContext.dataSpaceManager;
+      }),
+      DataService: new import_echo_pipeline4.DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
+      NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager, this._serviceContext.signalManager),
+      LoggingService: this._loggingService,
+      // TODO(burdon): Move to new protobuf definitions.
+      DevtoolsHost: new DevtoolsServiceImpl({
+        events: new DevtoolsHostEvents(),
+        config: this._config,
+        context: this._serviceContext
+      })
     });
-    await acquired.wait();
-    (0, import_log15.log)("recieved lock", {
-      steal
+    await this._serviceContext.open();
+    this._opening = false;
+    this._open = true;
+    this._statusUpdate.emit();
+    const deviceKey = (_c = this._serviceContext.identityManager.identity) == null ? void 0 : _c.deviceKey;
+    (0, import_log15.log)("opened", {
+      deviceKey
     }, {
-      file: "vault-resource-lock.ts",
-      line: 84,
+      file: "service-host.ts",
+      line: 250,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    import_log15.log.trace("dxos.sdk.client-services-host.open", import_protocols9.trace.end({
+      id: traceId
+    }), {
+      file: "service-host.ts",
+      line: 251,
       scope: this,
       callSite: (f, a) => f(...a)
     });
   }
-};
-__decorate4([
-  import_log15.logInfo
-], VaultResourceLock.prototype, "lockKey", null);
-
-// packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
-var import_async21 = require("@dxos/async");
-var import_log17 = require("@dxos/log");
-var import_messaging2 = require("@dxos/messaging");
-var import_network_manager4 = require("@dxos/network-manager");
-
-// packages/sdk/client-services/src/packlets/vault/worker-session.ts
-var import_node_assert12 = __toESM(require("node:assert"));
-var import_async20 = require("@dxos/async");
-var import_client_protocol8 = require("@dxos/client-protocol");
-var import_log16 = require("@dxos/log");
-var import_rpc4 = require("@dxos/rpc");
-var import_util10 = require("@dxos/util");
-var __decorate5 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
-    r = Reflect.decorate(decorators, target, key, desc);
-  else
-    for (var i = decorators.length - 1; i >= 0; i--)
-      if (d = decorators[i])
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var WorkerSession = class {
-  constructor({ serviceHost, systemPort, appPort, shellPort, readySignal }) {
-    this._startTrigger = new import_async20.Trigger();
-    this.onClose = new import_util10.Callback();
-    (0, import_node_assert12.default)(serviceHost);
-    this._serviceHost = serviceHost;
-    const middleware = {
-      handleCall: async (method, params, handler) => {
-        const error = await readySignal.wait({
-          timeout: import_client_protocol8.PROXY_CONNECTION_TIMEOUT
-        });
-        if (error) {
-          throw error;
-        }
-        return handler(method, params);
-      },
-      handleStream: async (method, params, handler) => {
-        const error = await readySignal.wait({
-          timeout: import_client_protocol8.PROXY_CONNECTION_TIMEOUT
-        });
-        if (error) {
-          throw error;
-        }
-        return handler(method, params);
-      }
-    };
-    this._clientRpc = new ClientRpcServer({
-      serviceRegistry: this._serviceHost.serviceRegistry,
-      port: appPort,
-      ...middleware
-    });
-    this._shellClientRpc = new ClientRpcServer({
-      serviceRegistry: this._serviceHost.serviceRegistry,
-      port: shellPort,
-      ...middleware
-    });
-    this._iframeRpc = (0, import_rpc4.createProtoRpcPeer)({
-      requested: import_client_protocol8.iframeServiceBundle,
-      exposed: import_client_protocol8.workerServiceBundle,
-      handlers: {
-        WorkerService: {
-          start: async (request) => {
-            this.origin = request.origin;
-            this.lockKey = request.lockKey;
-            this._startTrigger.wake();
-          },
-          stop: async () => {
-            setTimeout(async () => {
-              try {
-                await this.close();
-              } catch (err) {
-                import_log16.log.catch(err, {}, {
-                  file: "worker-session.ts",
-                  line: 100,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
-                });
-              }
-            });
-          }
-        }
-      },
-      port: systemPort,
-      timeout: 1e3
-    });
-    this.bridgeService = this._iframeRpc.rpc.BridgeService;
-  }
-  async open() {
-    import_log16.log.info("opening..", {}, {
-      file: "worker-session.ts",
-      line: 114,
+  async close() {
+    var _a;
+    if (!this._open) {
+      return;
+    }
+    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
+    (0, import_log15.log)("closing...", {
+      deviceKey
+    }, {
+      file: "service-host.ts",
+      line: 260,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    await Promise.all([
-      this._clientRpc.open(),
-      this._iframeRpc.open(),
-      this._maybeOpenShell()
-    ]);
-    await this._startTrigger.wait({
-      timeout: import_client_protocol8.PROXY_CONNECTION_TIMEOUT
+    this._serviceRegistry.setServices({
+      SystemService: this._systemService
     });
-    if (this.lockKey) {
-      void this._afterLockReleases(this.lockKey, () => this.close());
-    }
-  }
-  async close() {
-    import_log16.log.info("closing..", {}, {
-      file: "worker-session.ts",
-      line: 124,
+    await this._loggingService.close();
+    await this._serviceContext.close();
+    this._open = false;
+    this._statusUpdate.emit();
+    (0, import_log15.log)("closed", {
+      deviceKey
+    }, {
+      file: "service-host.ts",
+      line: 266,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    try {
-      await this.onClose.callIfSet();
-    } catch (err) {
-      import_log16.log.catch(err, {}, {
-        file: "worker-session.ts",
-        line: 128,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    }
-    await Promise.all([
-      this._clientRpc.close(),
-      this._iframeRpc.close()
-    ]);
-  }
-  async _maybeOpenShell() {
-    try {
-      await (0, import_async20.asyncTimeout)(this._shellClientRpc.open(), 1e3);
-    } catch (e) {
-      import_log16.log.info("No shell connected.", {}, {
-        file: "worker-session.ts",
-        line: 138,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    }
-  }
-  _afterLockReleases(lockKey, callback) {
-    return navigator.locks.request(lockKey, () => {
-    }).then(callback);
-  }
-};
-__decorate5([
-  import_log16.logInfo
-], WorkerSession.prototype, "origin", void 0);
-__decorate5([
-  import_log16.logInfo
-], WorkerSession.prototype, "lockKey", void 0);
-
-// packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
-var WorkerRuntime = class {
-  // prettier-ignore
-  constructor(_configProvider) {
-    this._configProvider = _configProvider;
-    this._transportFactory = new import_network_manager4.WebRTCTransportProxyFactory();
-    this._ready = new import_async21.Trigger();
-    this.sessions = /* @__PURE__ */ new Set();
-    this._clientServices = new ClientServicesHost();
-  }
-  get host() {
-    return this._clientServices;
   }
-  async start() {
-    (0, import_log17.log)("starting...", {}, {
-      file: "worker-runtime.ts",
-      line: 48,
+  async reset() {
+    var _a;
+    const traceId = import_keys11.PublicKey.random().toHex();
+    import_log15.log.trace("dxos.sdk.client-services-host.reset", import_protocols9.trace.begin({
+      id: traceId
+    }), {
+      file: "service-host.ts",
+      line: 271,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    try {
-      this._config = await this._configProvider();
-      const signals = this._config.get("runtime.services.signaling");
-      this._clientServices.initialize({
-        config: this._config,
-        signalManager: signals ? new import_messaging2.WebsocketSignalManager(signals) : new import_messaging2.MemorySignalManager(new import_messaging2.MemorySignalManagerContext()),
-        transportFactory: this._transportFactory
-      });
-      await this._clientServices.open();
-      this._ready.wake(void 0);
-      (0, import_log17.log)("started", {}, {
-        file: "worker-runtime.ts",
-        line: 62,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    } catch (err) {
-      this._ready.wake(err);
-      import_log17.log.catch(err, {}, {
-        file: "worker-runtime.ts",
-        line: 65,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-    }
-  }
-  async stop() {
-    await this._clientServices.close();
-  }
-  /**
-  * Create a new session.
-  */
-  async createSession({ appPort, systemPort, shellPort }) {
-    const session = new WorkerSession({
-      serviceHost: this._clientServices,
-      appPort,
-      systemPort,
-      shellPort,
-      readySignal: this._ready
+    (0, import_log15.log)("resetting...", {}, {
+      file: "service-host.ts",
+      line: 273,
+      scope: this,
+      callSite: (f, a) => f(...a)
     });
-    session.onClose.set(async () => {
-      this.sessions.delete(session);
-      this._reconnectWebrtc();
+    await ((_a = this._serviceContext) == null ? void 0 : _a.close());
+    await this._storage.reset();
+    (0, import_log15.log)("reset", {}, {
+      file: "service-host.ts",
+      line: 276,
+      scope: this,
+      callSite: (f, a) => f(...a)
     });
-    await session.open();
-    this.sessions.add(session);
-    this._reconnectWebrtc();
-  }
-  /**
-  * Selects one of the existing session fro WebRTC networking.
-  */
-  _reconnectWebrtc() {
-    (0, import_log17.log)("reconnecting webrtc...", {}, {
-      file: "worker-runtime.ts",
-      line: 102,
+    import_log15.log.trace("dxos.sdk.client-services-host.reset", import_protocols9.trace.end({
+      id: traceId
+    }), {
+      file: "service-host.ts",
+      line: 277,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    if (this._sessionForNetworking) {
-      if (!this.sessions.has(this._sessionForNetworking)) {
-        this._sessionForNetworking = void 0;
-      }
-    }
-    if (!this._sessionForNetworking) {
-      const selected = Array.from(this.sessions).find((session) => session.bridgeService);
-      if (selected) {
-        this._sessionForNetworking = selected;
-        this._transportFactory.setBridgeService(selected.bridgeService);
-      } else {
-        this._transportFactory.setBridgeService(void 0);
-      }
-    }
   }
 };
 
-// packages/sdk/client-services/src/packlets/services/service-context.ts
-var import_node_assert13 = __toESM(require("node:assert"));
-var import_async22 = require("@dxos/async");
-var import_credentials13 = require("@dxos/credentials");
-var import_debug7 = require("@dxos/debug");
-var import_echo_pipeline3 = require("@dxos/echo-pipeline");
-var import_feed_store4 = require("@dxos/feed-store");
-var import_keyring = require("@dxos/keyring");
-var import_keys10 = require("@dxos/keys");
-var import_log18 = require("@dxos/log");
-var import_protocols8 = require("@dxos/protocols");
-var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
-var ServiceContext = class {
-  // prettier-ignore
-  constructor(storage, networkManager, signalManager, modelFactory) {
-    this.storage = storage;
-    this.networkManager = networkManager;
-    this.signalManager = signalManager;
-    this.modelFactory = modelFactory;
-    this.initialized = new import_async22.Trigger();
-    this.dataServiceSubscriptions = new import_echo_pipeline3.DataServiceSubscriptions();
-    this._handlerFactories = /* @__PURE__ */ new Map();
-    this._instanceId = import_keys10.PublicKey.random().toHex();
-    this.metadataStore = new import_echo_pipeline3.MetadataStore(storage.createDirectory("metadata"));
-    this.snapshotStore = new import_echo_pipeline3.SnapshotStore(storage.createDirectory("snapshots"));
-    this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
-    this.feedStore = new import_feed_store4.FeedStore({
-      factory: new import_feed_store4.FeedFactory({
-        root: storage.createDirectory("feeds"),
-        signer: this.keyring,
-        hypercore: {
-          valueEncoding: import_echo_pipeline3.valueEncoding
+// packages/sdk/client-services/src/packlets/services/local-client-services.ts
+var LocalClientServices = class {
+  constructor(params) {
+    this._host = new ClientServicesHost(params);
+  }
+  get descriptors() {
+    return this._host.descriptors;
+  }
+  get services() {
+    return this._host.services;
+  }
+  get host() {
+    return this._host;
+  }
+  async open() {
+    await this._host.open();
+  }
+  async close() {
+    await this._host.close();
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
+var import_async20 = require("@dxos/async");
+var import_client_protocol6 = require("@dxos/client-protocol");
+var import_log16 = require("@dxos/log");
+var import_messaging2 = require("@dxos/messaging");
+var import_network_manager3 = require("@dxos/network-manager");
+var import_util8 = require("@dxos/util");
+
+// packages/sdk/client-services/src/packlets/services/client-rpc-server.ts
+var import_codec_protobuf14 = require("@dxos/codec-protobuf");
+var import_debug7 = require("@dxos/debug");
+var import_rpc = require("@dxos/rpc");
+var ClientRpcServer = class {
+  constructor(params) {
+    this._handlerCache = /* @__PURE__ */ new Map();
+    const { serviceRegistry, handleCall, handleStream, ...rpcOptions } = params;
+    this._handleCall = handleCall;
+    this._handleStream = handleStream;
+    this._serviceRegistry = serviceRegistry;
+    this._rpcPeer = new import_rpc.RpcPeer({
+      ...rpcOptions,
+      callHandler: (method, params2) => {
+        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
+        const handler = (method2, params3) => this._getServiceHandler(serviceName).call(method2, params3);
+        if (this._handleCall) {
+          return this._handleCall(methodName, params2, handler);
+        } else {
+          return handler(methodName, params2);
         }
-      })
-    });
-    this.spaceManager = new import_echo_pipeline3.SpaceManager({
-      feedStore: this.feedStore,
-      networkManager: this.networkManager,
-      metadataStore: this.metadataStore,
-      modelFactory: this.modelFactory,
-      snapshotStore: this.snapshotStore
+      },
+      streamHandler: (method, params2) => {
+        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
+        const handler = (method2, params3) => this._getServiceHandler(serviceName).callStream(method2, params3);
+        if (this._handleStream) {
+          return import_codec_protobuf14.Stream.unwrapPromise(this._handleStream(methodName, params2, handler));
+        } else {
+          return handler(methodName, params2);
+        }
+      }
     });
-    this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager);
-    this.invitations = new InvitationsHandler(this.networkManager);
-    this._handlerFactories.set(import_services12.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
-      var _a;
-      return (_a = this.identityManager.identity) != null ? _a : (0, import_debug7.failUndefined)();
-    }, this._acceptIdentity.bind(this)));
   }
   async open() {
-    import_log18.log.trace("dxos.sdk.service-context.open", import_protocols8.trace.begin({
-      id: this._instanceId
-    }), {
-      file: "service-context.ts",
-      line: 119,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await this._checkStorageVersion();
-    (0, import_log18.log)("opening...", {}, {
-      file: "service-context.ts",
-      line: 123,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await this.signalManager.open();
-    await this.networkManager.open();
-    await this.spaceManager.open();
-    await this.identityManager.open();
-    if (this.identityManager.identity) {
-      await this._initialize();
+    await this._rpcPeer.open();
+  }
+  async close() {
+    await this._rpcPeer.close();
+  }
+  _getServiceHandler(serviceName) {
+    var _a;
+    if (!this._handlerCache.has(serviceName)) {
+      const [key, descriptor] = (_a = Object.entries(this._serviceRegistry.descriptors).find(([key2, descriptor2]) => descriptor2.name === serviceName)) != null ? _a : (0, import_debug7.raise)(new Error(`Service not available: ${serviceName}`));
+      const service = this._serviceRegistry.services[key];
+      if (!service) {
+        throw new Error(`Service not available: ${serviceName}`);
+      }
+      this._handlerCache.set(serviceName, descriptor.createServer(service));
     }
-    (0, import_log18.log)("opened", {}, {
-      file: "service-context.ts",
-      line: 131,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    return this._handlerCache.get(serviceName);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
+var import_node_assert13 = __toESM(require("node:assert"));
+var import_async19 = require("@dxos/async");
+var import_client_protocol5 = require("@dxos/client-protocol");
+var import_iframe = require("@dxos/protocols/proto/dxos/iframe");
+var import_rpc2 = require("@dxos/rpc");
+var ShellRuntimeImpl = class {
+  constructor(_port) {
+    this._port = _port;
+    this.layoutUpdate = new import_async19.Event();
+    this._layout = import_iframe.ShellLayout.DEFAULT;
+  }
+  get layout() {
+    return this._layout;
+  }
+  get invitationCode() {
+    return this._invitationCode;
+  }
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setLayout(layout, options = {}) {
+    this._layout = layout;
+    this._invitationCode = options.invitationCode;
+    this._spaceKey = options.spaceKey;
+    this.layoutUpdate.emit({
+      layout,
+      ...options
     });
-    import_log18.log.trace("dxos.sdk.service-context.open", import_protocols8.trace.end({
-      id: this._instanceId
-    }), {
-      file: "service-context.ts",
-      line: 132,
-      scope: this,
-      callSite: (f, a) => f(...a)
+  }
+  async setAppContext(context) {
+    (0, import_node_assert13.default)(this._appRpc, "runtime not open");
+    await this._appRpc.rpc.AppService.setContext(context);
+  }
+  async open() {
+    this._appRpc = (0, import_rpc2.createProtoRpcPeer)({
+      requested: import_client_protocol5.appServiceBundle,
+      exposed: import_client_protocol5.shellServiceBundle,
+      handlers: {
+        ShellService: {
+          setLayout: async (request) => {
+            this._layout = request.layout;
+            this._invitationCode = request.invitationCode;
+            this._spaceKey = request.spaceKey;
+            this.layoutUpdate.emit(request);
+          }
+        }
+      },
+      port: this._port
     });
+    await this._appRpc.open();
   }
   async close() {
-    var _a, _b;
-    (0, import_log18.log)("closing...", {}, {
-      file: "service-context.ts",
-      line: 136,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await ((_a = this._deviceSpaceSync) == null ? void 0 : _a.close());
-    await ((_b = this.dataSpaceManager) == null ? void 0 : _b.close());
-    await this.identityManager.close();
-    await this.spaceManager.close();
-    await this.feedStore.close();
-    await this.networkManager.close();
-    await this.signalManager.close();
-    this.dataServiceSubscriptions.clear();
-    (0, import_log18.log)("closed", {}, {
-      file: "service-context.ts",
-      line: 145,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
+    var _a;
+    await ((_a = this._appRpc) == null ? void 0 : _a.close());
+    this._appRpc = void 0;
   }
-  async createIdentity(params = {}) {
-    const identity = await this.identityManager.createIdentity(params);
-    await this._initialize();
-    return identity;
+};
+var MemoryShellRuntime = class {
+  constructor({ layout, invitationCode, spaceKey } = {}) {
+    this.layoutUpdate = new import_async19.Event();
+    this.contextUpdate = new import_async19.Event();
+    this._layout = layout != null ? layout : import_iframe.ShellLayout.DEFAULT;
+    this._invitationCode = invitationCode;
+    this._spaceKey = spaceKey;
   }
-  getInvitationHandler(invitation) {
-    const factory = this._handlerFactories.get(invitation.kind);
-    (0, import_node_assert13.default)(factory, `Unknown invitation kind: ${invitation.kind}`);
-    return factory(invitation);
+  get layout() {
+    return this._layout;
   }
-  async _acceptIdentity(params) {
-    const identity = await this.identityManager.acceptIdentity(params);
-    await this._initialize();
-    return identity;
+  get invitationCode() {
+    return this._invitationCode;
   }
-  async _checkStorageVersion() {
-    await this.metadataStore.load();
-    if (this.metadataStore.version !== import_protocols8.STORAGE_VERSION) {
-      import_log18.log.error("Invalid storage version", {
-        current: this.metadataStore.version,
-        expected: import_protocols8.STORAGE_VERSION
-      }, {
-        file: "service-context.ts",
-        line: 171,
-        scope: this,
-        callSite: (f, a) => f(...a)
-      });
-      await this.metadataStore.clear();
+  get spaceKey() {
+    return this._spaceKey;
+  }
+  setLayout(layout, options = {}) {
+    this._layout = layout;
+    this._invitationCode = options.invitationCode;
+    this._spaceKey = options.spaceKey;
+    this.layoutUpdate.emit({
+      layout,
+      ...options
+    });
+  }
+  async setAppContext(context) {
+    this.contextUpdate.emit(context);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
+var __decorate4 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var LOCK_KEY = "DXOS_RESOURCE_LOCK";
+var IFrameHostRuntime = class {
+  constructor({ config, origin, appPort, shellPort }) {
+    this._ready = new import_async20.Trigger();
+    this._configProvider = config;
+    this.origin = origin;
+    this._appPort = appPort;
+    this._shellPort = shellPort;
+    if (this._shellPort) {
+      this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
     }
   }
-  // Called when identity is created.
-  async _initialize() {
+  get services() {
+    return this._clientServices;
+  }
+  get shell() {
+    return this._shellRuntime;
+  }
+  async start() {
     var _a;
-    (0, import_log18.log)("initializing spaces...", {}, {
-      file: "service-context.ts",
-      line: 179,
+    (0, import_log16.log)("starting...", {}, {
+      file: "iframe-host-runtime.ts",
+      line: 70,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug7.failUndefined)();
-    const signingContext = {
-      credentialSigner: identity.getIdentityCredentialSigner(),
-      identityKey: identity.identityKey,
-      deviceKey: identity.deviceKey,
-      profile: identity.profileDocument,
-      recordCredential: async (credential) => {
-        await identity.controlPipeline.writer.write({
-          credential: {
-            credential
-          }
-        });
-      }
-    };
-    this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.feedStore);
-    await this.dataSpaceManager.open();
-    this._handlerFactories.set(import_services12.Invitation.Kind.SPACE, (invitation) => {
-      (0, import_node_assert13.default)(this.dataSpaceManager, "dataSpaceManager not initialized yet");
-      return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
-    });
-    this.initialized.wake();
-    this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
-      process: async (credential) => {
-        const assertion = (0, import_credentials13.getCredentialAssertion)(credential);
-        if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
-          return;
-        }
-        if (assertion.spaceKey.equals(identity.space.key)) {
-          return;
-        }
-        if (!this.dataSpaceManager) {
-          (0, import_log18.log)("dataSpaceManager not initialized yet, ignoring space admission", {
-            details: assertion
-          }, {
-            file: "service-context.ts",
-            line: 218,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          return;
-        }
-        if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
-          (0, import_log18.log)("space already exists, ignoring space admission", {
-            details: assertion
-          }, {
-            file: "service-context.ts",
-            line: 222,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          return;
-        }
-        try {
-          (0, import_log18.log)("accepting space recorded in halo", {
-            details: assertion
-          }, {
-            file: "service-context.ts",
-            line: 227,
-            scope: this,
-            callSite: (f, a) => f(...a)
-          });
-          await this.dataSpaceManager.acceptSpace({
-            spaceKey: assertion.spaceKey,
-            genesisFeedKey: assertion.genesisFeedKey
+    try {
+      this._config = await (0, import_util8.getAsyncValue)(this._configProvider);
+      this._transportFactory = (0, import_network_manager3.createWebRTCTransportFactory)({
+        iceServers: this._config.get("runtime.services.ice")
+      });
+      const signals = this._config.get("runtime.services.signaling");
+      this._clientServices = new LocalClientServices({
+        lockKey: LOCK_KEY,
+        config: this._config,
+        signalManager: signals ? new import_messaging2.WebsocketSignalManager(signals) : new import_messaging2.MemorySignalManager(new import_messaging2.MemorySignalManagerContext()),
+        transportFactory: this._transportFactory
+      });
+      const middleware = {
+        handleCall: async (method, params, handler) => {
+          const error = await this._ready.wait({
+            timeout: import_client_protocol6.PROXY_CONNECTION_TIMEOUT
           });
-        } catch (err) {
-          import_log18.log.catch(err, {}, {
-            file: "service-context.ts",
-            line: 233,
-            scope: this,
-            callSite: (f, a) => f(...a)
+          if (error) {
+            throw error;
+          }
+          return handler(method, params);
+        },
+        handleStream: async (method, params, handler) => {
+          const error = await this._ready.wait({
+            timeout: import_client_protocol6.PROXY_CONNECTION_TIMEOUT
           });
+          if (error) {
+            throw error;
+          }
+          return handler(method, params);
         }
-      }
+      };
+      this._clientRpc = new ClientRpcServer({
+        serviceRegistry: this._clientServices.host.serviceRegistry,
+        port: this._appPort,
+        ...middleware
+      });
+      await Promise.all([
+        this._clientServices.open(),
+        this._clientRpc.open(),
+        (_a = this._shellRuntime) == null ? void 0 : _a.open()
+      ]);
+      this._ready.wake(void 0);
+      (0, import_log16.log)("started", {}, {
+        file: "iframe-host-runtime.ts",
+        line: 113,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } catch (err) {
+      this._ready.wake(err);
+      import_log16.log.catch(err, {}, {
+        file: "iframe-host-runtime.ts",
+        line: 116,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
+  }
+  async stop() {
+    var _a;
+    (0, import_log16.log)("stopping...", {}, {
+      file: "iframe-host-runtime.ts",
+      line: 121,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    await this._clientRpc.close();
+    await this._clientServices.close();
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
+    (0, import_log16.log)("stopped", {}, {
+      file: "iframe-host-runtime.ts",
+      line: 125,
+      scope: this,
+      callSite: (f, a) => f(...a)
     });
-    await this._deviceSpaceSync.open();
   }
 };
+__decorate4([
+  import_log16.logInfo
+], IFrameHostRuntime.prototype, "origin", void 0);
 
-// packages/sdk/client-services/src/packlets/services/service-registry.ts
-var ServiceRegistry = class {
-  // prettier-ignore
-  constructor(_serviceBundle, _handlers = {}) {
-    this._serviceBundle = _serviceBundle;
-    this._handlers = _handlers;
-  }
-  get descriptors() {
-    return this._serviceBundle;
+// packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
+var import_async21 = require("@dxos/async");
+var import_client_protocol7 = require("@dxos/client-protocol");
+var import_errors5 = require("@dxos/errors");
+var import_log17 = require("@dxos/log");
+var import_network_manager4 = require("@dxos/network-manager");
+var import_rpc3 = require("@dxos/rpc");
+var import_util9 = require("@dxos/util");
+var IFrameProxyRuntime = class {
+  constructor({ config, systemPort, shellPort }) {
+    this._id = String(Math.floor(Math.random() * 1e6));
+    this._release = new import_async21.Trigger();
+    this._configProvider = config;
+    this._systemPort = systemPort;
+    this._shellPort = shellPort;
+    if (this._shellPort) {
+      this._shellRuntime = new ShellRuntimeImpl(this._shellPort);
+    }
   }
-  get services() {
-    return this._handlers;
+  get shell() {
+    return this._shellRuntime;
   }
-  setServices(services) {
-    this._handlers = services;
+  async open(origin) {
+    var _a;
+    this._config = await (0, import_util9.getAsyncValue)(this._configProvider);
+    this._transportService = new import_network_manager4.WebRTCTransportService({
+      iceServers: this._config.get("runtime.services.ice")
+    });
+    this._systemRpc = (0, import_rpc3.createProtoRpcPeer)({
+      requested: import_client_protocol7.workerServiceBundle,
+      exposed: import_client_protocol7.iframeServiceBundle,
+      handlers: {
+        BridgeService: this._transportService
+      },
+      port: this._systemPort,
+      timeout: 200
+    });
+    let lockKey;
+    if (typeof navigator !== "undefined") {
+      lockKey = this._lockKey(origin);
+      this._release = new import_async21.Trigger();
+      const ready = new import_async21.Trigger();
+      void navigator.locks.request(lockKey, async () => {
+        ready.wake();
+        await this._release.wait();
+      });
+      await ready.wait();
+    }
+    try {
+      await this._systemRpc.open();
+      await this._systemRpc.rpc.WorkerService.start({
+        origin,
+        lockKey
+      });
+    } catch (err) {
+      import_log17.log.catch(err, {}, {
+        file: "iframe-proxy-runtime.ts",
+        line: 85,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+      throw new import_errors5.RemoteServiceConnectionError("Failed to connect to worker");
+    }
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.open());
   }
-  addService(name, service) {
-    this._handlers[name] = service;
+  async close() {
+    var _a;
+    this._release.wake();
+    await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
+    await this._systemRpc.rpc.WorkerService.stop();
+    await this._systemRpc.close();
   }
-  removeService(name) {
-    delete this._handlers[name];
+  _lockKey(origin) {
+    return `${origin}-${this._id}`;
   }
 };
 
-// packages/sdk/client-services/src/packlets/services/service-host.ts
-var ClientServicesHost = class {
-  constructor({
-    config,
-    modelFactory = (0, import_client_protocol9.createDefaultModelFactory)(),
-    // TODO(burdon): Create ApolloLink abstraction (see Client).
-    transportFactory,
-    signalManager,
-    connectionLog,
-    storage,
-    // TODO(wittjosiah): Turn this on by default.
-    lockKey
-  } = {}) {
-    this._statusUpdate = new import_async23.Event();
-    this._opening = false;
-    this._open = false;
-    this._storage = storage;
-    this._modelFactory = modelFactory;
-    if (config) {
-      this.initialize({
-        config,
-        transportFactory,
-        signalManager
-      });
-    }
-    this._resourceLock = lockKey ? new VaultResourceLock({
-      lockKey,
-      onAcquire: () => {
-        if (!this._opening) {
-          void this.open();
+// packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
+var import_async23 = require("@dxos/async");
+var import_log19 = require("@dxos/log");
+var import_messaging3 = require("@dxos/messaging");
+var import_network_manager5 = require("@dxos/network-manager");
+
+// packages/sdk/client-services/src/packlets/vault/worker-session.ts
+var import_node_assert14 = __toESM(require("node:assert"));
+var import_async22 = require("@dxos/async");
+var import_client_protocol8 = require("@dxos/client-protocol");
+var import_log18 = require("@dxos/log");
+var import_rpc4 = require("@dxos/rpc");
+var import_util10 = require("@dxos/util");
+var __decorate5 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var WorkerSession = class {
+  constructor({ serviceHost, systemPort, appPort, shellPort, readySignal }) {
+    this._startTrigger = new import_async22.Trigger();
+    this.onClose = new import_util10.Callback();
+    (0, import_node_assert14.default)(serviceHost);
+    this._serviceHost = serviceHost;
+    const middleware = {
+      handleCall: async (method, params, handler) => {
+        const error = await readySignal.wait({
+          timeout: import_client_protocol8.PROXY_CONNECTION_TIMEOUT
+        });
+        if (error) {
+          throw error;
         }
+        return handler(method, params);
       },
-      onRelease: () => this.close()
-    }) : void 0;
-    this._systemService = new SystemServiceImpl({
-      config: this._config,
-      statusUpdate: this._statusUpdate,
-      getCurrentStatus: () => this.isOpen ? import_services13.SystemStatus.ACTIVE : import_services13.SystemStatus.INACTIVE,
-      onUpdateStatus: async (status) => {
-        var _a, _b;
-        if (!this.isOpen && status === import_services13.SystemStatus.ACTIVE) {
-          await ((_a = this._resourceLock) == null ? void 0 : _a.acquire());
-        } else if (this.isOpen && status === import_services13.SystemStatus.INACTIVE) {
-          await ((_b = this._resourceLock) == null ? void 0 : _b.release());
+      handleStream: async (method, params, handler) => {
+        const error = await readySignal.wait({
+          timeout: import_client_protocol8.PROXY_CONNECTION_TIMEOUT
+        });
+        if (error) {
+          throw error;
         }
-      },
-      onReset: async () => {
-        await this.reset();
+        return handler(method, params);
       }
+    };
+    this._clientRpc = new ClientRpcServer({
+      serviceRegistry: this._serviceHost.serviceRegistry,
+      port: appPort,
+      ...middleware
     });
-    this._loggingService = new LoggingServiceImpl();
-    this._serviceRegistry = new ServiceRegistry(import_client_protocol9.clientServiceBundle, {
-      SystemService: this._systemService
+    this._shellClientRpc = new ClientRpcServer({
+      serviceRegistry: this._serviceHost.serviceRegistry,
+      port: shellPort,
+      ...middleware
     });
-  }
-  get isOpen() {
-    return this._open;
-  }
-  get serviceRegistry() {
-    return this._serviceRegistry;
-  }
-  get descriptors() {
-    return this._serviceRegistry.descriptors;
-  }
-  get services() {
-    return this._serviceRegistry.services;
-  }
-  /**
-  * Initialize the service host with the config.
-  * Config can also be provided in the constructor.
-  * Can only be called once.
-  */
-  initialize({ config, ...options }) {
-    var _a, _b, _c;
-    (0, import_node_assert14.default)(!this._open, "service host is open");
-    if (config) {
-      (0, import_node_assert14.default)(!this._config, "config already set");
-      this._config = config;
-      if (!this._storage) {
-        this._storage = createStorageObjects(config.get("runtime.client.storage", {})).storage;
-      }
-    }
-    const { connectionLog = true, transportFactory = (0, import_network_manager5.createWebRTCTransportFactory)({
-      iceServers: (_a = this._config) == null ? void 0 : _a.get("runtime.services.ice")
-    }), signalManager = new import_messaging3.WebsocketSignalManager((_c = (_b = this._config) == null ? void 0 : _b.get("runtime.services.signaling")) != null ? _c : []) } = options;
-    this._signalManager = signalManager;
-    (0, import_node_assert14.default)(!this._networkManager, "network manager already set");
-    this._networkManager = new import_network_manager5.NetworkManager({
-      log: connectionLog,
-      transportFactory,
-      signalManager
+    this._iframeRpc = (0, import_rpc4.createProtoRpcPeer)({
+      requested: import_client_protocol8.iframeServiceBundle,
+      exposed: import_client_protocol8.workerServiceBundle,
+      handlers: {
+        WorkerService: {
+          start: async (request) => {
+            this.origin = request.origin;
+            this.lockKey = request.lockKey;
+            this._startTrigger.wake();
+          },
+          stop: async () => {
+            setTimeout(async () => {
+              try {
+                await this.close();
+              } catch (err) {
+                import_log18.log.catch(err, {}, {
+                  file: "worker-session.ts",
+                  line: 100,
+                  scope: this,
+                  callSite: (f, a) => f(...a)
+                });
+              }
+            });
+          }
+        }
+      },
+      port: systemPort,
+      timeout: 1e3
     });
+    this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    var _a, _b, _c;
-    if (this._open) {
-      return;
-    }
-    const traceId = import_keys11.PublicKey.random().toHex();
-    import_log19.log.trace("dxos.sdk.client-services-host.open", import_protocols9.trace.begin({
-      id: traceId
-    }), {
-      file: "service-host.ts",
-      line: 187,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    (0, import_node_assert14.default)(this._config, "config not set");
-    (0, import_node_assert14.default)(this._storage, "storage not set");
-    (0, import_node_assert14.default)(this._signalManager, "signal manager not set");
-    (0, import_node_assert14.default)(this._networkManager, "network manager not set");
-    this._opening = true;
-    (0, import_log19.log)("opening...", {
-      lockKey: (_a = this._resourceLock) == null ? void 0 : _a.lockKey
-    }, {
-      file: "service-host.ts",
-      line: 195,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await ((_b = this._resourceLock) == null ? void 0 : _b.acquire());
-    await this._loggingService.open();
-    this._serviceContext = new ServiceContext(this._storage, this._networkManager, this._signalManager, this._modelFactory);
-    this._serviceRegistry.setServices({
-      SystemService: this._systemService,
-      IdentityService: new IdentityServiceImpl(this._serviceContext),
-      InvitationsService: new InvitationsServiceImpl(this._serviceContext.invitations, (invitation) => this._serviceContext.getInvitationHandler(invitation)),
-      DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
-      SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, this._serviceContext.dataServiceSubscriptions, async () => {
-        await this._serviceContext.initialized.wait();
-        return this._serviceContext.dataSpaceManager;
-      }),
-      DataService: new import_echo_pipeline4.DataServiceImpl(this._serviceContext.dataServiceSubscriptions),
-      NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager, this._serviceContext.signalManager),
-      LoggingService: this._loggingService,
-      // TODO(burdon): Move to new protobuf definitions.
-      DevtoolsHost: new DevtoolsServiceImpl({
-        events: new DevtoolsHostEvents(),
-        config: this._config,
-        context: this._serviceContext
-      })
-    });
-    await this._serviceContext.open();
-    this._opening = false;
-    this._open = true;
-    this._statusUpdate.emit();
-    const deviceKey = (_c = this._serviceContext.identityManager.identity) == null ? void 0 : _c.deviceKey;
-    (0, import_log19.log)("opened", {
-      deviceKey
-    }, {
-      file: "service-host.ts",
-      line: 250,
+    import_log18.log.info("opening..", {}, {
+      file: "worker-session.ts",
+      line: 114,
       scope: this,
       callSite: (f, a) => f(...a)
     });
-    import_log19.log.trace("dxos.sdk.client-services-host.open", import_protocols9.trace.end({
-      id: traceId
-    }), {
-      file: "service-host.ts",
-      line: 251,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    await Promise.all([
+      this._clientRpc.open(),
+      this._iframeRpc.open(),
+      this._maybeOpenShell()
+    ]);
+    await this._startTrigger.wait({
+      timeout: import_client_protocol8.PROXY_CONNECTION_TIMEOUT
     });
+    if (this.lockKey) {
+      void this._afterLockReleases(this.lockKey, () => this.close());
+    }
   }
   async close() {
-    var _a;
-    if (!this._open) {
-      return;
-    }
-    const deviceKey = (_a = this._serviceContext.identityManager.identity) == null ? void 0 : _a.deviceKey;
-    (0, import_log19.log)("closing...", {
-      deviceKey
-    }, {
-      file: "service-host.ts",
-      line: 260,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    this._serviceRegistry.setServices({
-      SystemService: this._systemService
-    });
-    await this._loggingService.close();
-    await this._serviceContext.close();
-    this._open = false;
-    this._statusUpdate.emit();
-    (0, import_log19.log)("closed", {
-      deviceKey
-    }, {
-      file: "service-host.ts",
-      line: 266,
+    import_log18.log.info("closing..", {}, {
+      file: "worker-session.ts",
+      line: 124,
       scope: this,
       callSite: (f, a) => f(...a)
     });
+    try {
+      await this.onClose.callIfSet();
+    } catch (err) {
+      import_log18.log.catch(err, {}, {
+        file: "worker-session.ts",
+        line: 128,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
+    await Promise.all([
+      this._clientRpc.close(),
+      this._iframeRpc.close()
+    ]);
   }
-  async reset() {
-    var _a;
-    const traceId = import_keys11.PublicKey.random().toHex();
-    import_log19.log.trace("dxos.sdk.client-services-host.reset", import_protocols9.trace.begin({
-      id: traceId
-    }), {
-      file: "service-host.ts",
-      line: 271,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    (0, import_log19.log)("resetting...", {}, {
-      file: "service-host.ts",
-      line: 273,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await ((_a = this._serviceContext) == null ? void 0 : _a.close());
-    await this._storage.reset();
-    (0, import_log19.log)("reset", {}, {
-      file: "service-host.ts",
-      line: 276,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    import_log19.log.trace("dxos.sdk.client-services-host.reset", import_protocols9.trace.end({
-      id: traceId
-    }), {
-      file: "service-host.ts",
-      line: 277,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
+  async _maybeOpenShell() {
+    try {
+      await (0, import_async22.asyncTimeout)(this._shellClientRpc.open(), 1e3);
+    } catch (e) {
+      import_log18.log.info("No shell connected.", {}, {
+        file: "worker-session.ts",
+        line: 138,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
+  }
+  _afterLockReleases(lockKey, callback) {
+    return navigator.locks.request(lockKey, () => {
+    }).then(callback);
   }
 };
+__decorate5([
+  import_log18.logInfo
+], WorkerSession.prototype, "origin", void 0);
+__decorate5([
+  import_log18.logInfo
+], WorkerSession.prototype, "lockKey", void 0);
 
-// packages/sdk/client-services/src/packlets/services/local-client-services.ts
-var LocalClientServices = class {
-  constructor(params) {
-    this._host = new ClientServicesHost(params);
+// packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
+var WorkerRuntime = class {
+  // prettier-ignore
+  constructor(_configProvider) {
+    this._configProvider = _configProvider;
+    this._transportFactory = new import_network_manager5.WebRTCTransportProxyFactory();
+    this._ready = new import_async23.Trigger();
+    this.sessions = /* @__PURE__ */ new Set();
+    this._clientServices = new ClientServicesHost();
   }
-  get descriptors() {
-    return this._host.descriptors;
+  get host() {
+    return this._clientServices;
   }
-  get services() {
-    return this._host.services;
+  async start() {
+    (0, import_log19.log)("starting...", {}, {
+      file: "worker-runtime.ts",
+      line: 48,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    try {
+      this._config = await this._configProvider();
+      const signals = this._config.get("runtime.services.signaling");
+      this._clientServices.initialize({
+        config: this._config,
+        signalManager: signals ? new import_messaging3.WebsocketSignalManager(signals) : new import_messaging3.MemorySignalManager(new import_messaging3.MemorySignalManagerContext()),
+        transportFactory: this._transportFactory
+      });
+      await this._clientServices.open();
+      this._ready.wake(void 0);
+      (0, import_log19.log)("started", {}, {
+        file: "worker-runtime.ts",
+        line: 62,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    } catch (err) {
+      this._ready.wake(err);
+      import_log19.log.catch(err, {}, {
+        file: "worker-runtime.ts",
+        line: 65,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
+    }
   }
-  get host() {
-    return this._host;
+  async stop() {
+    await this._clientServices.close();
   }
-  async open() {
-    await this._host.open();
+  /**
+  * Create a new session.
+  */
+  async createSession({ appPort, systemPort, shellPort }) {
+    const session = new WorkerSession({
+      serviceHost: this._clientServices,
+      appPort,
+      systemPort,
+      shellPort,
+      readySignal: this._ready
+    });
+    session.onClose.set(async () => {
+      this.sessions.delete(session);
+      this._reconnectWebrtc();
+    });
+    await session.open();
+    this.sessions.add(session);
+    this._reconnectWebrtc();
   }
-  async close() {
-    await this._host.close();
+  /**
+  * Selects one of the existing session fro WebRTC networking.
+  */
+  _reconnectWebrtc() {
+    (0, import_log19.log)("reconnecting webrtc...", {}, {
+      file: "worker-runtime.ts",
+      line: 102,
+      scope: this,
+      callSite: (f, a) => f(...a)
+    });
+    if (this._sessionForNetworking) {
+      if (!this.sessions.has(this._sessionForNetworking)) {
+        this._sessionForNetworking = void 0;
+      }
+    }
+    if (!this._sessionForNetworking) {
+      const selected = Array.from(this.sessions).find((session) => session.bridgeService);
+      if (selected) {
+        this._sessionForNetworking = selected;
+        this._transportFactory.setBridgeService(selected.bridgeService);
+      } else {
+        this._transportFactory.setBridgeService(void 0);
+      }
+    }
   }
 };
 // Annotate the CommonJS export names for ESM import in node:
@@ -4582,6 +4531,7 @@ var LocalClientServices = class {
   InvitationsHandler,
   InvitationsServiceImpl,
   LocalClientServices,
+  Lock,
   MemoryShellRuntime,
   ServiceContext,
   ServiceRegistry,
@@ -4589,12 +4539,12 @@ var LocalClientServices = class {
   SpaceInvitationProtocol,
   SpacesServiceImpl,
   TrustedKeySetAuthVerifier,
-  VaultResourceLock,
   WorkerRuntime,
   WorkerSession,
   createAuthProvider,
   createStorageObjects,
   getNetworkPeers,
+  isLocked,
   subscribeToFeedBlocks,
   subscribeToFeeds,
   subscribeToNetworkStatus,