@dxos/client-services 0.1.53-main.b6f5d87 → 0.1.53-main.bb44a18

package/dist/lib/node/index.cjs

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // packages/sdk/client-services/src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   DataSpace: () => DataSpace,
   DataSpaceManager: () => DataSpaceManager,
@@ -44,7 +45,6 @@ __export(src_exports, {
   InvitationsHandler: () => InvitationsHandler,
   InvitationsServiceImpl: () => InvitationsServiceImpl,
   Lock: () => Lock,
-  MemoryShellRuntime: () => MemoryShellRuntime,
   ServiceContext: () => ServiceContext,
   ServiceRegistry: () => ServiceRegistry,
   ShellRuntimeImpl: () => ShellRuntimeImpl,
@@ -54,6 +54,7 @@ __export(src_exports, {
   WorkerRuntime: () => WorkerRuntime,
   WorkerSession: () => WorkerSession,
   createAuthProvider: () => createAuthProvider,
+  createDefaultModelFactory: () => createDefaultModelFactory,
   createStorageObjects: () => createStorageObjects,
   getNetworkPeers: () => getNetworkPeers,
   isLocked: () => isLocked,
@@ -419,6 +420,8 @@ var import_context2 = require("@dxos/context");
 var import_credentials = require("@dxos/credentials");
 var import_log = require("@dxos/log");
 var import_protocols = require("@dxos/protocols");
+var __dxlog_file = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts";
+var Credential = import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential");
 var createAuthProvider = (signer) => async (nonce) => {
   const credential = await signer.createCredential({
     assertion: {
@@ -427,7 +430,7 @@ var createAuthProvider = (signer) => async (nonce) => {
     subject: signer.getIssuer(),
     nonce
   });
-  return import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").encode(credential);
+  return Credential.encode(credential);
 };
 var TrustedKeySetAuthVerifier = class {
   // prettier-ignore
@@ -440,24 +443,24 @@ var TrustedKeySetAuthVerifier = class {
   }
   get verifier() {
     return async (nonce, auth) => {
-      const credential = import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
+      const credential = Credential.decode(auth);
       (0, import_log.log)("authenticating...", {
         credential
       }, {
-        file: "authenticator.ts",
-        line: 57,
-        scope: this,
-        callSite: (f, a) => f(...a)
+        F: __dxlog_file,
+        L: 59,
+        S: this,
+        C: (f, a) => f(...a)
       });
       const result = await (0, import_credentials.verifyCredential)(credential);
       if (result.kind === "fail") {
         (0, import_log.log)("Invalid credential", {
           result
         }, {
-          file: "authenticator.ts",
-          line: 61,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file,
+          L: 63,
+          S: this,
+          C: (f, a) => f(...a)
         });
         return false;
       }
@@ -466,10 +469,10 @@ var TrustedKeySetAuthVerifier = class {
           nonce,
           credential
         }, {
-          file: "authenticator.ts",
-          line: 66,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file,
+          L: 68,
+          S: this,
+          C: (f, a) => f(...a)
         });
         return false;
       }
@@ -477,10 +480,10 @@ var TrustedKeySetAuthVerifier = class {
         (0, import_log.log)("key is not currently in trusted set, waiting...", {
           key: credential.issuer
         }, {
-          file: "authenticator.ts",
-          line: 71,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file,
+          L: 73,
+          S: this,
+          C: (f, a) => f(...a)
         });
         return true;
       }
@@ -493,20 +496,20 @@ var TrustedKeySetAuthVerifier = class {
           (0, import_log.log)("auth success", {
             key: credential.issuer
           }, {
-            file: "authenticator.ts",
-            line: 82,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file,
+            L: 84,
+            S: this,
+            C: (f, a) => f(...a)
           });
           trigger.wake(true);
         } else {
           (0, import_log.log)("key is not currently in trusted set, waiting...", {
             key: credential.issuer
           }, {
-            file: "authenticator.ts",
-            line: 85,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file,
+            L: 87,
+            S: this,
+            C: (f, a) => f(...a)
           });
         }
       });
@@ -528,7 +531,7 @@ var TrustedKeySetAuthVerifier = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity.ts
-var import_node_assert = __toESM(require("node:assert"));
+var import_tiny_invariant = __toESM(require("tiny-invariant"));
 var import_async5 = require("@dxos/async");
 var import_client_protocol = require("@dxos/client-protocol");
 var import_credentials2 = require("@dxos/credentials");
@@ -536,6 +539,7 @@ var import_debug = require("@dxos/debug");
 var import_feed_store2 = require("@dxos/feed-store");
 var import_log2 = require("@dxos/log");
 var import_credentials3 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var __dxlog_file2 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity.ts";
 var Identity = class {
   constructor({ space, signer, identityKey, deviceKey }) {
     this.stateUpdate = new import_async5.Event();
@@ -543,15 +547,15 @@ var Identity = class {
     this._signer = signer;
     this.identityKey = identityKey;
     this.deviceKey = deviceKey;
-    this._deviceStateMachine = this.space.spaceState.registerProcessor(new import_credentials2.DeviceStateMachine({
+    this._deviceStateMachine = new import_credentials2.DeviceStateMachine({
       identityKey: this.identityKey,
       deviceKey: this.deviceKey,
       onUpdate: () => this.stateUpdate.emit()
-    }));
-    this._profileStateMachine = this.space.spaceState.registerProcessor(new import_credentials2.ProfileStateMachine({
+    });
+    this._profileStateMachine = new import_credentials2.ProfileStateMachine({
       identityKey: this.identityKey,
       onUpdate: () => this.stateUpdate.emit()
-    }));
+    });
     this.authVerifier = new TrustedKeySetAuthVerifier({
       trustedKeysProvider: () => this.authorizedDeviceKeys,
       update: this.stateUpdate,
@@ -560,27 +564,27 @@ var Identity = class {
   }
   // TODO(burdon): Expose state object?
   get authorizedDeviceKeys() {
-    return this._deviceStateMachine.processor.authorizedDeviceKeys;
+    return this._deviceStateMachine.authorizedDeviceKeys;
   }
   async open() {
-    await this._deviceStateMachine.open();
-    await this._profileStateMachine.open();
+    await this.space.spaceState.addCredentialProcessor(this._deviceStateMachine);
+    await this.space.spaceState.addCredentialProcessor(this._profileStateMachine);
     await this.space.open();
   }
   async close() {
     await this.authVerifier.close();
-    await this._deviceStateMachine.close();
-    await this._profileStateMachine.close();
+    await this.space.spaceState.removeCredentialProcessor(this._profileStateMachine);
+    await this.space.spaceState.removeCredentialProcessor(this._deviceStateMachine);
     await this.space.close();
   }
   async ready() {
-    await this._deviceStateMachine.processor.deviceChainReady.wait();
+    await this._deviceStateMachine.deviceChainReady.wait();
     await this.controlPipeline.state.waitUntilReachedTargetTimeframe({
       timeout: import_client_protocol.LOAD_CONTROL_FEEDS_TIMEOUT
     });
   }
   get profileDocument() {
-    return this._profileStateMachine.processor.profile;
+    return this._profileStateMachine.profile;
   }
   /**
   * @test-only
@@ -595,7 +599,7 @@ var Identity = class {
     return this.space.genesisFeedKey;
   }
   get deviceCredentialChain() {
-    return this._deviceStateMachine.processor.deviceCredentialChain;
+    return this._deviceStateMachine.deviceCredentialChain;
   }
   getAdmissionCredentials() {
     var _a, _b;
@@ -610,8 +614,8 @@ var Identity = class {
   * Requires identity to be ready.
   */
   getIdentityCredentialSigner() {
-    (0, import_node_assert.default)(this._deviceStateMachine.processor.deviceCredentialChain, "Device credential chain is not ready.");
-    return (0, import_credentials2.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.processor.deviceCredentialChain, this.deviceKey);
+    (0, import_tiny_invariant.default)(this._deviceStateMachine.deviceCredentialChain, "Device credential chain is not ready.");
+    return (0, import_credentials2.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.deviceCredentialChain, this.deviceKey);
   }
   /**
   * Issues credentials as device.
@@ -627,10 +631,10 @@ var Identity = class {
       controlFeedKey,
       dataFeedKey
     }, {
-      file: "identity.ts",
-      line: 156,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file2,
+      L: 151,
+      S: this,
+      C: (f, a) => f(...a)
     });
     const signer = this.getIdentityCredentialSigner();
     await (0, import_feed_store2.writeMessages)(this.controlPipeline.writer, [
@@ -671,7 +675,7 @@ var Identity = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity-manager.ts
-var import_node_assert2 = __toESM(require("node:assert"));
+var import_tiny_invariant2 = __toESM(require("tiny-invariant"));
 var import_async6 = require("@dxos/async");
 var import_credentials4 = require("@dxos/credentials");
 var import_keys4 = require("@dxos/keys");
@@ -679,6 +683,7 @@ var import_log3 = require("@dxos/log");
 var import_protocols2 = require("@dxos/protocols");
 var import_credentials5 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util2 = require("@dxos/util");
+var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts";
 var IdentityManager = class {
   // TODO(burdon): IdentityManagerParams.
   // TODO(dmaretskyi): Perhaps this should take/generate the peerKey outside of an initialized identity.
@@ -698,20 +703,20 @@ var IdentityManager = class {
     import_log3.log.trace("dxos.halo.identity-manager.open", import_protocols2.trace.begin({
       id: traceId
     }), {
-      file: "identity-manager.ts",
-      line: 70,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 70,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await this._metadataStore.load();
     const identityRecord = this._metadataStore.getIdentityRecord();
     (0, import_log3.log)("identity record", {
       identityRecord
     }, {
-      file: "identity-manager.ts",
-      line: 74,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 74,
+      S: this,
+      C: (f, a) => f(...a)
     });
     if (identityRecord) {
       this._identity = await this._constructIdentity(identityRecord);
@@ -721,20 +726,20 @@ var IdentityManager = class {
         identityKey: identityRecord.identityKey,
         displayName: (_a = this._identity.profileDocument) == null ? void 0 : _a.displayName
       }, {
-        file: "identity-manager.ts",
-        line: 79,
-        scope: this,
-        callSite: (f, a) => f(...a)
+        F: __dxlog_file3,
+        L: 79,
+        S: this,
+        C: (f, a) => f(...a)
       });
       this.stateUpdate.emit();
     }
     import_log3.log.trace("dxos.halo.identity-manager.open", import_protocols2.trace.end({
       id: traceId
     }), {
-      file: "identity-manager.ts",
-      line: 85,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 85,
+      S: this,
+      C: (f, a) => f(...a)
     });
   }
   async close() {
@@ -743,12 +748,12 @@ var IdentityManager = class {
   }
   async createIdentity({ displayName } = {}) {
     var _a;
-    (0, import_node_assert2.default)(!this._identity, "Identity already exists.");
-    (0, import_log3.log)("creating identity...", {}, {
-      file: "identity-manager.ts",
-      line: 94,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_tiny_invariant2.default)(!this._identity, "Identity already exists.");
+    (0, import_log3.log)("creating identity...", void 0, {
+      F: __dxlog_file3,
+      L: 94,
+      S: this,
+      C: (f, a) => f(...a)
     });
     const controlFeedKey = await this._keyring.createKey();
     const identityRecord = {
@@ -765,8 +770,8 @@ var IdentityManager = class {
     await identity.open();
     {
       const generator = new import_credentials4.CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
-      (0, import_node_assert2.default)(identityRecord.haloSpace.genesisFeedKey, "Genesis feed key is required.");
-      (0, import_node_assert2.default)(identityRecord.haloSpace.dataFeedKey, "Data feed key is required.");
+      (0, import_tiny_invariant2.default)(identityRecord.haloSpace.genesisFeedKey, "Genesis feed key is required.");
+      (0, import_tiny_invariant2.default)(identityRecord.haloSpace.dataFeedKey, "Data feed key is required.");
       const credentials = [
         // Space genesis.
         ...await generator.createSpaceGenesis(identityRecord.haloSpace.key, identityRecord.haloSpace.genesisFeedKey),
@@ -794,20 +799,20 @@ var IdentityManager = class {
       identityKey: identityRecord.identityKey,
       displayName: (_a = this._identity.profileDocument) == null ? void 0 : _a.displayName
     }, {
-      file: "identity-manager.ts",
-      line: 149,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 149,
+      S: this,
+      C: (f, a) => f(...a)
     });
     this.stateUpdate.emit();
     (0, import_log3.log)("created identity", {
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey
     }, {
-      file: "identity-manager.ts",
-      line: 155,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 155,
+      S: this,
+      C: (f, a) => f(...a)
     });
     return identity;
   }
@@ -819,12 +824,12 @@ var IdentityManager = class {
     (0, import_log3.log)("accepting identity", {
       params
     }, {
-      file: "identity-manager.ts",
-      line: 163,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 163,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    (0, import_node_assert2.default)(!this._identity, "Identity already exists.");
+    (0, import_tiny_invariant2.default)(!this._identity, "Identity already exists.");
     const identityRecord = {
       identityKey: params.identityKey,
       deviceKey: params.deviceKey,
@@ -845,38 +850,38 @@ var IdentityManager = class {
       identityKey: identityRecord.identityKey,
       displayName: (_a = this._identity.profileDocument) == null ? void 0 : _a.displayName
     }, {
-      file: "identity-manager.ts",
-      line: 183,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 183,
+      S: this,
+      C: (f, a) => f(...a)
     });
     this.stateUpdate.emit();
     (0, import_log3.log)("accepted identity", {
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey
     }, {
-      file: "identity-manager.ts",
-      line: 189,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 189,
+      S: this,
+      C: (f, a) => f(...a)
     });
     return identity;
   }
   async _constructIdentity(identityRecord) {
-    (0, import_node_assert2.default)(!this._identity);
+    (0, import_tiny_invariant2.default)(!this._identity);
     (0, import_log3.log)("constructing identity", {
       identityRecord
     }, {
-      file: "identity-manager.ts",
-      line: 195,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 195,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    (0, import_node_assert2.default)(identityRecord.haloSpace.controlFeedKey);
+    (0, import_tiny_invariant2.default)(identityRecord.haloSpace.controlFeedKey);
     const controlFeed = await this._feedStore.openFeed(identityRecord.haloSpace.controlFeedKey, {
       writable: true
     });
-    (0, import_node_assert2.default)(identityRecord.haloSpace.dataFeedKey);
+    (0, import_tiny_invariant2.default)(identityRecord.haloSpace.dataFeedKey);
     const dataFeed = await this._feedStore.openFeed(identityRecord.haloSpace.dataFeedKey, {
       writable: true,
       sparse: true
@@ -901,10 +906,10 @@ var IdentityManager = class {
     (0, import_log3.log)("done", {
       identityKey: identityRecord.identityKey
     }, {
-      file: "identity-manager.ts",
-      line: 226,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file3,
+      L: 226,
+      S: this,
+      C: (f, a) => f(...a)
     });
     if (identityRecord.haloSpace.controlTimeframe) {
       identity.controlPipeline.state.setTargetTimeframe(identityRecord.haloSpace.controlTimeframe);
@@ -921,11 +926,11 @@ var IdentityManager = class {
       onNetworkConnection: () => {
       },
       onAuthFailure: () => {
-        import_log3.log.warn("auth failure", {}, {
-          file: "identity-manager.ts",
-          line: 245,
-          scope: this,
-          callSite: (f, a) => f(...a)
+        import_log3.log.warn("auth failure", void 0, {
+          F: __dxlog_file3,
+          L: 245,
+          S: this,
+          C: (f, a) => f(...a)
         });
       },
       memberKey: identityKey
@@ -934,7 +939,7 @@ var IdentityManager = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/identity-service.ts
-var import_node_assert3 = __toESM(require("node:assert"));
+var import_tiny_invariant3 = __toESM(require("tiny-invariant"));
 var import_codec_protobuf7 = require("@dxos/codec-protobuf");
 var import_credentials6 = require("@dxos/credentials");
 var import_debug2 = require("@dxos/debug");
@@ -970,7 +975,7 @@ var IdentityServiceImpl = class {
     };
   }
   async signPresentation({ presentation, nonce }) {
-    (0, import_node_assert3.default)(this._serviceContext.identityManager.identity, "Identity not initialized.");
+    (0, import_tiny_invariant3.default)(this._serviceContext.identityManager.identity, "Identity not initialized.");
     return await (0, import_credentials6.signPresentation)({
       presentation,
       signer: this._serviceContext.keyring,
@@ -982,7 +987,7 @@ var IdentityServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/device-invitation-protocol.ts
-var import_node_assert4 = __toESM(require("node:assert"));
+var import_tiny_invariant4 = __toESM(require("tiny-invariant"));
 var import_services = require("@dxos/protocols/proto/dxos/client/services");
 var DeviceInvitationProtocol = class {
   constructor(_keyring, _getIdentity, _acceptIdentity) {
@@ -999,7 +1004,7 @@ var DeviceInvitationProtocol = class {
     };
   }
   async admit(request) {
-    (0, import_node_assert4.default)(request.device);
+    (0, import_tiny_invariant4.default)(request.device);
     const identity = this._getIdentity();
     await identity.admitDevice(request.device);
     return {
@@ -1027,9 +1032,9 @@ var DeviceInvitationProtocol = class {
     };
   }
   async accept(response, request) {
-    (0, import_node_assert4.default)(response.device);
+    (0, import_tiny_invariant4.default)(response.device);
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
-    (0, import_node_assert4.default)(request.device);
+    (0, import_tiny_invariant4.default)(request.device);
     const { deviceKey, controlFeedKey, dataFeedKey } = request.device;
     await this._acceptIdentity({
       identityKey,
@@ -1047,7 +1052,7 @@ var DeviceInvitationProtocol = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-var import_node_assert6 = __toESM(require("node:assert"));
+var import_tiny_invariant6 = __toESM(require("tiny-invariant"));
 var import_async8 = require("@dxos/async");
 var import_client_protocol2 = require("@dxos/client-protocol");
 var import_context4 = require("@dxos/context");
@@ -1061,7 +1066,7 @@ var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations");
 
 // packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts
-var import_node_assert5 = __toESM(require("node:assert"));
+var import_tiny_invariant5 = __toESM(require("tiny-invariant"));
 var import_async7 = require("@dxos/async");
 var import_context3 = require("@dxos/context");
 var import_errors = require("@dxos/errors");
@@ -1071,6 +1076,7 @@ var import_protocols3 = require("@dxos/protocols");
 var import_services2 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport = require("@dxos/teleport");
+var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts";
 var OPTIONS_TIMEOUT = 1e4;
 var MAX_OTP_ATTEMPTS = 3;
 var InvitationHostExtension = class extends import_teleport.RpcExtension {
@@ -1098,7 +1104,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
       // Perhaps in the future we will have more complex logic here.
       InvitationHostService: {
         options: async (options) => {
-          (0, import_node_assert5.default)(!this._remoteOptions, "Remote options already set.");
+          (0, import_tiny_invariant5.default)(!this._remoteOptions, "Remote options already set.");
           this._remoteOptions = options;
           this._remoteOptionsTrigger.wake();
         },
@@ -1108,20 +1114,20 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
           import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.begin({
             id: traceId
           }), {
-            file: "invitation-extension.ts",
-            line: 98,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file4,
+            L: 98,
+            S: this,
+            C: (f, a) => f(...a)
           });
           const invitation = await this._callbacks.resolveInvitation(request);
           if (!invitation) {
             import_log4.log.warn("invitation not found", {
               invitationId
             }, {
-              file: "invitation-extension.ts",
-              line: 102,
-              scope: this,
-              callSite: (f, a) => f(...a)
+              F: __dxlog_file4,
+              L: 102,
+              S: this,
+              C: (f, a) => f(...a)
             });
             this._callbacks.onError(new Error("Invitation not found."));
             return {
@@ -1132,10 +1138,10 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
           (0, import_log4.log)("guest introduced itself", {
             guestProfile: profile
           }, {
-            file: "invitation-extension.ts",
-            line: 111,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file4,
+            L: 111,
+            S: this,
+            C: (f, a) => f(...a)
           });
           this.guestProfile = profile;
           this._callbacks.onStateUpdate({
@@ -1145,10 +1151,10 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
           import_log4.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols3.trace.end({
             id: traceId
           }), {
-            file: "invitation-extension.ts",
-            line: 118,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file4,
+            L: 118,
+            S: this,
+            C: (f, a) => f(...a)
           });
           return {
             spaceKey: this.invitation.authMethod === import_services2.Invitation.AuthMethod.NONE ? this.invitation.spaceKey : void 0,
@@ -1160,28 +1166,28 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
           import_log4.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols3.trace.begin({
             id: traceId
           }), {
-            file: "invitation-extension.ts",
-            line: 127,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file4,
+            L: 127,
+            S: this,
+            C: (f, a) => f(...a)
           });
           (0, import_log4.log)("received authentication request", {
             authCode: code
           }, {
-            file: "invitation-extension.ts",
-            line: 128,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file4,
+            L: 128,
+            S: this,
+            C: (f, a) => f(...a)
           });
           let status = import_invitations.AuthenticationResponse.Status.OK;
-          (0, import_node_assert5.default)(this.invitation, "Invitation is not set.");
+          (0, import_tiny_invariant5.default)(this.invitation, "Invitation is not set.");
           switch (this.invitation.authMethod) {
             case import_services2.Invitation.AuthMethod.NONE: {
-              (0, import_log4.log)("authentication not required", {}, {
-                file: "invitation-extension.ts",
-                line: 134,
-                scope: this,
-                callSite: (f, a) => f(...a)
+              (0, import_log4.log)("authentication not required", void 0, {
+                F: __dxlog_file4,
+                L: 134,
+                S: this,
+                C: (f, a) => f(...a)
               });
               return {
                 status: import_invitations.AuthenticationResponse.Status.OK
@@ -1203,10 +1209,10 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               import_log4.log.error("invalid authentication method", {
                 authMethod: this.invitation.authMethod
               }, {
-                file: "invitation-extension.ts",
-                line: 152,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file4,
+                L: 152,
+                S: this,
+                C: (f, a) => f(...a)
               });
               status = import_invitations.AuthenticationResponse.Status.INTERNAL_ERROR;
               break;
@@ -1218,10 +1224,10 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               status
             }
           }), {
-            file: "invitation-extension.ts",
-            line: 158,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file4,
+            L: 158,
+            S: this,
+            C: (f, a) => f(...a)
           });
           return {
             status
@@ -1232,13 +1238,13 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
           import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.begin({
             id: traceId
           }), {
-            file: "invitation-extension.ts",
-            line: 164,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file4,
+            L: 164,
+            S: this,
+            C: (f, a) => f(...a)
           });
           try {
-            (0, import_node_assert5.default)(this.invitation, "Invitation is not set.");
+            (0, import_tiny_invariant5.default)(this.invitation, "Invitation is not set.");
             if (isAuthenticationRequired(this.invitation) && !this.authenticationPassed) {
               throw new Error("Not authenticated");
             }
@@ -1246,10 +1252,10 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             import_log4.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols3.trace.end({
               id: traceId
             }), {
-              file: "invitation-extension.ts",
-              line: 175,
-              scope: this,
-              callSite: (f, a) => f(...a)
+              F: __dxlog_file4,
+              L: 175,
+              S: this,
+              C: (f, a) => f(...a)
             });
             return response;
           } catch (err) {
@@ -1303,7 +1309,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     return {
       InvitationHostService: {
         options: async (options) => {
-          (0, import_node_assert5.default)(!this._remoteOptions, "Remote options already set.");
+          (0, import_tiny_invariant5.default)(!this._remoteOptions, "Remote options already set.");
           this._remoteOptions = options;
           this._remoteOptionsTrigger.wake();
         },
@@ -1323,11 +1329,11 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     var _a;
     await super.onOpen(context);
     try {
-      (0, import_log4.log)("begin options", {}, {
-        file: "invitation-extension.ts",
-        line: 263,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      (0, import_log4.log)("begin options", void 0, {
+        F: __dxlog_file4,
+        L: 263,
+        S: this,
+        C: (f, a) => f(...a)
       });
       await (0, import_context3.cancelWithContext)(this._ctx, this.rpc.InvitationHostService.options({
         role: import_invitations.Options.Role.GUEST
@@ -1335,11 +1341,11 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
       await (0, import_context3.cancelWithContext)(this._ctx, this._remoteOptionsTrigger.wait({
         timeout: OPTIONS_TIMEOUT
       }));
-      (0, import_log4.log)("end options", {}, {
-        file: "invitation-extension.ts",
-        line: 266,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      (0, import_log4.log)("end options", void 0, {
+        F: __dxlog_file4,
+        L: 266,
+        S: this,
+        C: (f, a) => f(...a)
       });
       if (((_a = this._remoteOptions) == null ? void 0 : _a.role) !== import_invitations.Options.Role.HOST) {
         throw new import_errors.InvalidInvitationExtensionRoleError(void 0, {
@@ -1350,20 +1356,20 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
       this._callbacks.onOpen(this._ctx);
     } catch (err) {
       (0, import_log4.log)("openError", err, {
-        file: "invitation-extension.ts",
-        line: 276,
-        scope: this,
-        callSite: (f, a) => f(...a)
+        F: __dxlog_file4,
+        L: 276,
+        S: this,
+        C: (f, a) => f(...a)
       });
       this._callbacks.onError(err);
     }
   }
   async onClose() {
-    (0, import_log4.log)("onClose", {}, {
-      file: "invitation-extension.ts",
-      line: 282,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log4.log)("onClose", void 0, {
+      F: __dxlog_file4,
+      L: 282,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await this._ctx.dispose();
   }
@@ -1371,6 +1377,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
 var isAuthenticationRequired = (invitation) => invitation.authMethod !== import_services2.Invitation.AuthMethod.NONE;
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
+var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts";
 var InvitationsHandler = class {
   /**
   * @internal
@@ -1382,7 +1389,7 @@ var InvitationsHandler = class {
     var _a;
     const { invitationId = import_keys6.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys6.PublicKey.random() } = options != null ? options : {};
     const authCode = (_a = options == null ? void 0 : options.authCode) != null ? _a : authMethod === import_services3.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials7.generatePasscode)(import_client_protocol2.AUTHENTICATION_CODE_LENGTH) : void 0;
-    (0, import_node_assert6.default)(protocol);
+    (0, import_tiny_invariant6.default)(protocol);
     const invitation = {
       invitationId,
       type,
@@ -1404,10 +1411,10 @@ var InvitationsHandler = class {
       (0, import_log5.log)("complete", {
         ...protocol.toJSON()
       }, {
-        file: "invitations-handler.ts",
-        line: 99,
-        scope: this,
-        callSite: (f, a) => f(...a)
+        F: __dxlog_file5,
+        L: 99,
+        S: this,
+        C: (f, a) => f(...a)
       });
       stream.complete();
     });
@@ -1429,7 +1436,7 @@ var InvitationsHandler = class {
           var _a2, _b, _c;
           try {
             const deviceKey = (_c = (_a2 = admissionRequest.device) == null ? void 0 : _a2.deviceKey) != null ? _c : (_b = admissionRequest.space) == null ? void 0 : _b.deviceKey;
-            (0, import_node_assert6.default)(deviceKey);
+            (0, import_tiny_invariant6.default)(deviceKey);
             const admissionResponse = await protocol.admit(admissionRequest, extension.guestProfile);
             extension.completedTrigger.wake(deviceKey);
             return admissionResponse;
@@ -1445,18 +1452,18 @@ var InvitationsHandler = class {
               import_log5.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.begin({
                 id: traceId
               }), {
-                file: "invitations-handler.ts",
-                line: 138,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 138,
+                S: this,
+                C: (f, a) => f(...a)
               });
               (0, import_log5.log)("connected", {
                 ...protocol.toJSON()
               }, {
-                file: "invitations-handler.ts",
-                line: 139,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 139,
+                S: this,
+                C: (f, a) => f(...a)
               });
               stream.next({
                 ...invitation,
@@ -1469,10 +1476,10 @@ var InvitationsHandler = class {
                 guest: deviceKey,
                 ...protocol.toJSON()
               }, {
-                file: "invitations-handler.ts",
-                line: 142,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 142,
+                S: this,
+                C: (f, a) => f(...a)
               });
               stream.next({
                 ...invitation,
@@ -1481,20 +1488,20 @@ var InvitationsHandler = class {
               import_log5.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
-                file: "invitations-handler.ts",
-                line: 144,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 144,
+                S: this,
+                C: (f, a) => f(...a)
               });
             } catch (err) {
               if (err instanceof import_async8.TimeoutError) {
                 (0, import_log5.log)("timeout", {
                   ...protocol.toJSON()
                 }, {
-                  file: "invitations-handler.ts",
-                  line: 147,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
+                  F: __dxlog_file5,
+                  L: 147,
+                  S: this,
+                  C: (f, a) => f(...a)
                 });
                 stream.next({
                   ...invitation,
@@ -1502,10 +1509,10 @@ var InvitationsHandler = class {
                 });
               } else {
                 import_log5.log.error("failed", err, {
-                  file: "invitations-handler.ts",
-                  line: 150,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
+                  F: __dxlog_file5,
+                  L: 150,
+                  S: this,
+                  C: (f, a) => f(...a)
                 });
                 stream.error(err);
               }
@@ -1513,10 +1520,10 @@ var InvitationsHandler = class {
                 id: traceId,
                 error: err
               }), {
-                file: "invitations-handler.ts",
-                line: 153,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 153,
+                S: this,
+                C: (f, a) => f(...a)
               });
             } finally {
               if (type !== import_services3.Invitation.Type.MULTIUSE) {
@@ -1534,10 +1541,10 @@ var InvitationsHandler = class {
             (0, import_log5.log)("timeout", {
               ...protocol.toJSON()
             }, {
-              file: "invitations-handler.ts",
-              line: 168,
-              scope: this,
-              callSite: (f, a) => f(...a)
+              F: __dxlog_file5,
+              L: 168,
+              S: this,
+              C: (f, a) => f(...a)
             });
             stream.next({
               ...invitation,
@@ -1545,10 +1552,10 @@ var InvitationsHandler = class {
             });
           } else {
             import_log5.log.error("failed", err, {
-              file: "invitations-handler.ts",
-              line: 171,
-              scope: this,
-              callSite: (f, a) => f(...a)
+              F: __dxlog_file5,
+              L: 171,
+              S: this,
+              C: (f, a) => f(...a)
             });
             stream.error(err);
           }
@@ -1588,13 +1595,13 @@ var InvitationsHandler = class {
   }
   acceptInvitation(protocol, invitation) {
     const { timeout = import_client_protocol2.INVITATION_TIMEOUT } = invitation;
-    (0, import_node_assert6.default)(protocol);
+    (0, import_tiny_invariant6.default)(protocol);
     const authenticated = new import_async8.Trigger();
     let admitted = false;
     let currentState;
     const stream = new import_async8.PushStream();
     const setState = (newData) => {
-      (0, import_node_assert6.default)(newData.state !== void 0);
+      (0, import_tiny_invariant6.default)(newData.state !== void 0);
       currentState = newData.state;
       stream.next({
         ...invitation,
@@ -1607,20 +1614,20 @@ var InvitationsHandler = class {
           (0, import_log5.log)("timeout", {
             ...protocol.toJSON()
           }, {
-            file: "invitations-handler.ts",
-            line: 230,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file5,
+            L: 230,
+            S: this,
+            C: (f, a) => f(...a)
           });
           setState({
             state: import_services3.Invitation.State.TIMEOUT
           });
         } else {
           import_log5.log.warn("auth failed", err, {
-            file: "invitations-handler.ts",
-            line: 233,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file5,
+            L: 233,
+            S: this,
+            C: (f, a) => f(...a)
           });
           stream.error(err);
         }
@@ -1631,10 +1638,10 @@ var InvitationsHandler = class {
       (0, import_log5.log)("complete", {
         ...protocol.toJSON()
       }, {
-        file: "invitations-handler.ts",
-        line: 241,
-        scope: this,
-        callSite: (f, a) => f(...a)
+        F: __dxlog_file5,
+        L: 241,
+        S: this,
+        C: (f, a) => f(...a)
       });
       stream.complete();
     });
@@ -1646,10 +1653,10 @@ var InvitationsHandler = class {
             (0, import_log5.log)("extension disposed", {
               currentState
             }, {
-              file: "invitations-handler.ts",
-              line: 251,
-              scope: this,
-              callSite: (f, a) => f(...a)
+              F: __dxlog_file5,
+              L: 251,
+              S: this,
+              C: (f, a) => f(...a)
             });
             if (!admitted) {
               stream.error(new Error("Remote peer disconnected."));
@@ -1661,10 +1668,10 @@ var InvitationsHandler = class {
               import_log5.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.begin({
                 id: traceId
               }), {
-                file: "invitations-handler.ts",
-                line: 260,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 260,
+                S: this,
+                C: (f, a) => f(...a)
               });
               if (++connectionCount > 1) {
                 throw new Error(`multiple connections detected: ${connectionCount}`);
@@ -1673,10 +1680,10 @@ var InvitationsHandler = class {
               (0, import_log5.log)("connected", {
                 ...protocol.toJSON()
               }, {
-                file: "invitations-handler.ts",
-                line: 268,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 268,
+                S: this,
+                C: (f, a) => f(...a)
               });
               setState({
                 state: import_services3.Invitation.State.CONNECTED
@@ -1684,20 +1691,20 @@ var InvitationsHandler = class {
               (0, import_log5.log)("introduce", {
                 ...protocol.toJSON()
               }, {
-                file: "invitations-handler.ts",
-                line: 272,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 272,
+                S: this,
+                C: (f, a) => f(...a)
               });
               const introductionResponse = await extension.rpc.InvitationHostService.introduce(protocol.createIntroduction());
               (0, import_log5.log)("introduce response", {
                 ...protocol.toJSON(),
                 response: introductionResponse
               }, {
-                file: "invitations-handler.ts",
-                line: 276,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 276,
+                S: this,
+                C: (f, a) => f(...a)
               });
               invitation.authMethod = introductionResponse.authMethod;
               if (introductionResponse.spaceKey) {
@@ -1705,11 +1712,11 @@ var InvitationsHandler = class {
               }
               if (isAuthenticationRequired(invitation)) {
                 for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  (0, import_log5.log)("guest waiting for authentication code...", {}, {
-                    file: "invitations-handler.ts",
-                    line: 285,
-                    scope: this,
-                    callSite: (f, a) => f(...a)
+                  (0, import_log5.log)("guest waiting for authentication code...", void 0, {
+                    F: __dxlog_file5,
+                    L: 285,
+                    S: this,
+                    C: (f, a) => f(...a)
                   });
                   setState({
                     state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
@@ -1717,11 +1724,11 @@ var InvitationsHandler = class {
                   const authCode = await authenticated.wait({
                     timeout
                   });
-                  (0, import_log5.log)("sending authentication request", {}, {
-                    file: "invitations-handler.ts",
-                    line: 289,
-                    scope: this,
-                    callSite: (f, a) => f(...a)
+                  (0, import_log5.log)("sending authentication request", void 0, {
+                    F: __dxlog_file5,
+                    L: 289,
+                    S: this,
+                    C: (f, a) => f(...a)
                   });
                   setState({
                     state: import_services3.Invitation.State.AUTHENTICATING
@@ -1739,10 +1746,10 @@ var InvitationsHandler = class {
                       (0, import_log5.log)("retrying invalid code", {
                         attempt
                       }, {
-                        file: "invitations-handler.ts",
-                        line: 300,
-                        scope: this,
-                        callSite: (f, a) => f(...a)
+                        F: __dxlog_file5,
+                        L: 300,
+                        S: this,
+                        C: (f, a) => f(...a)
                       });
                       authenticated.reset();
                     }
@@ -1756,10 +1763,10 @@ var InvitationsHandler = class {
               (0, import_log5.log)("request admission", {
                 ...protocol.toJSON()
               }, {
-                file: "invitations-handler.ts",
-                line: 311,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 311,
+                S: this,
+                C: (f, a) => f(...a)
               });
               const admissionRequest = await protocol.createAdmissionRequest();
               const admissionResponse = await extension.rpc.InvitationHostService.admit(admissionRequest);
@@ -1768,10 +1775,10 @@ var InvitationsHandler = class {
               (0, import_log5.log)("admitted by host", {
                 ...protocol.toJSON()
               }, {
-                file: "invitations-handler.ts",
-                line: 322,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 322,
+                S: this,
+                C: (f, a) => f(...a)
               });
               setState({
                 ...result,
@@ -1780,30 +1787,30 @@ var InvitationsHandler = class {
               import_log5.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols4.trace.end({
                 id: traceId
               }), {
-                file: "invitations-handler.ts",
-                line: 324,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 324,
+                S: this,
+                C: (f, a) => f(...a)
               });
             } catch (err) {
               if (err instanceof import_async8.TimeoutError) {
                 (0, import_log5.log)("timeout", {
                   ...protocol.toJSON()
                 }, {
-                  file: "invitations-handler.ts",
-                  line: 327,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
+                  F: __dxlog_file5,
+                  L: 327,
+                  S: this,
+                  C: (f, a) => f(...a)
                 });
                 setState({
                   state: import_services3.Invitation.State.TIMEOUT
                 });
               } else {
                 (0, import_log5.log)("auth failed", err, {
-                  file: "invitations-handler.ts",
-                  line: 330,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
+                  F: __dxlog_file5,
+                  L: 330,
+                  S: this,
+                  C: (f, a) => f(...a)
                 });
                 stream.error(err);
               }
@@ -1811,10 +1818,10 @@ var InvitationsHandler = class {
                 id: traceId,
                 error: err
               }), {
-                file: "invitations-handler.ts",
-                line: 333,
-                scope: this,
-                callSite: (f, a) => f(...a)
+                F: __dxlog_file5,
+                L: 333,
+                S: this,
+                C: (f, a) => f(...a)
               });
             } finally {
               await ctx.dispose();
@@ -1829,20 +1836,20 @@ var InvitationsHandler = class {
             (0, import_log5.log)("timeout", {
               ...protocol.toJSON()
             }, {
-              file: "invitations-handler.ts",
-              line: 344,
-              scope: this,
-              callSite: (f, a) => f(...a)
+              F: __dxlog_file5,
+              L: 344,
+              S: this,
+              C: (f, a) => f(...a)
             });
             setState({
               state: import_services3.Invitation.State.TIMEOUT
             });
           } else {
             (0, import_log5.log)("auth failed", err, {
-              file: "invitations-handler.ts",
-              line: 347,
-              scope: this,
-              callSite: (f, a) => f(...a)
+              F: __dxlog_file5,
+              L: 347,
+              S: this,
+              C: (f, a) => f(...a)
             });
             stream.error(err);
           }
@@ -1851,7 +1858,7 @@ var InvitationsHandler = class {
       return extension;
     };
     (0, import_async8.scheduleTask)(ctx, async () => {
-      (0, import_node_assert6.default)(invitation.swarmKey);
+      (0, import_tiny_invariant6.default)(invitation.swarmKey);
       const topic = invitation.swarmKey;
       const swarmConnection = await this._networkManager.joinSwarm({
         topic,
@@ -1884,11 +1891,12 @@ var InvitationsHandler = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
-var import_node_assert7 = __toESM(require("node:assert"));
+var import_tiny_invariant7 = __toESM(require("tiny-invariant"));
 var import_async9 = require("@dxos/async");
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
 var import_log6 = require("@dxos/log");
 var import_services4 = require("@dxos/protocols/proto/dxos/client/services");
+var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts";
 var InvitationsServiceImpl = class {
   constructor(_invitationsHandler, _getHandler) {
     this._invitationsHandler = _invitationsHandler;
@@ -1949,35 +1957,35 @@ var InvitationsServiceImpl = class {
     });
   }
   async authenticate({ invitationId, authCode }) {
-    (0, import_log6.log)("authenticating...", {}, {
-      file: "invitations-service.ts",
-      line: 103,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log6.log)("authenticating...", void 0, {
+      F: __dxlog_file6,
+      L: 103,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    (0, import_node_assert7.default)(invitationId);
+    (0, import_tiny_invariant7.default)(invitationId);
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
       import_log6.log.warn("invalid invitation", {
         invitationId
       }, {
-        file: "invitations-service.ts",
-        line: 107,
-        scope: this,
-        callSite: (f, a) => f(...a)
+        F: __dxlog_file6,
+        L: 107,
+        S: this,
+        C: (f, a) => f(...a)
       });
     } else {
       await observable.authenticate(authCode);
     }
   }
   async cancelInvitation({ invitationId }) {
-    (0, import_log6.log)("deleting...", {}, {
-      file: "invitations-service.ts",
-      line: 114,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log6.log)("deleting...", void 0, {
+      F: __dxlog_file6,
+      L: 114,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    (0, import_node_assert7.default)(invitationId);
+    (0, import_tiny_invariant7.default)(invitationId);
     const created = this._createInvitations.get(invitationId);
     const accepted = this._acceptInvitations.get(invitationId);
     if (created) {
@@ -1992,10 +2000,10 @@ var InvitationsServiceImpl = class {
       import_log6.log.warn("invalid invitation", {
         invitationId
       }, {
-        file: "invitations-service.ts",
-        line: 127,
-        scope: this,
-        callSite: (f, a) => f(...a)
+        F: __dxlog_file6,
+        L: 127,
+        S: this,
+        C: (f, a) => f(...a)
       });
     }
   }
@@ -2052,11 +2060,12 @@ var InvitationsServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts
-var import_node_assert8 = __toESM(require("node:assert"));
+var import_tiny_invariant8 = __toESM(require("tiny-invariant"));
 var import_credentials8 = require("@dxos/credentials");
 var import_feed_store3 = require("@dxos/feed-store");
 var import_log7 = require("@dxos/log");
 var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
+var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -2078,24 +2087,24 @@ var SpaceInvitationProtocol = class {
   }
   async admit(request, guestProfile) {
     var _a;
-    (0, import_node_assert8.default)(this._spaceKey);
+    (0, import_tiny_invariant8.default)(this._spaceKey);
     const space = await this._spaceManager.spaces.get(this._spaceKey);
-    (0, import_node_assert8.default)(space);
-    (0, import_node_assert8.default)(request.space);
+    (0, import_tiny_invariant8.default)(space);
+    (0, import_tiny_invariant8.default)(request.space);
     const { identityKey, deviceKey } = request.space;
     (0, import_log7.log)("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: deviceKey
     }, {
-      file: "space-invitation-protocol.ts",
-      line: 50,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file7,
+      L: 50,
+      S: this,
+      C: (f, a) => f(...a)
     });
     const credentials = await (0, import_credentials8.createAdmissionCredentials)(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, guestProfile);
-    (0, import_node_assert8.default)(credentials[0].credential);
+    (0, import_tiny_invariant8.default)(credentials[0].credential);
     const spaceMemberCredential = credentials[0].credential.credential;
-    (0, import_node_assert8.default)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    (0, import_tiny_invariant8.default)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
     await (0, import_feed_store3.writeMessages)(space.inner.controlPipeline.writer, credentials);
     return {
       space: {
@@ -2123,11 +2132,11 @@ var SpaceInvitationProtocol = class {
     };
   }
   async accept(response) {
-    (0, import_node_assert8.default)(response.space);
+    (0, import_tiny_invariant8.default)(response.space);
     const { credential, controlTimeframe, dataTimeframe } = response.space;
     const assertion = (0, import_credentials8.getCredentialAssertion)(credential);
-    (0, import_node_assert8.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
-    (0, import_node_assert8.default)(credential.subject.id.equals(this._signingContext.identityKey));
+    (0, import_tiny_invariant8.default)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential");
+    (0, import_tiny_invariant8.default)(credential.subject.id.equals(this._signingContext.identityKey));
     await this._spaceManager.acceptSpace({
       spaceKey: assertion.spaceKey,
       genesisFeedKey: assertion.genesisFeedKey,
@@ -2141,11 +2150,64 @@ var SpaceInvitationProtocol = class {
   }
 };
 
+// packages/sdk/client-services/src/packlets/services/client-rpc-server.ts
+var import_codec_protobuf9 = require("@dxos/codec-protobuf");
+var import_debug3 = require("@dxos/debug");
+var import_rpc = require("@dxos/rpc");
+var ClientRpcServer = class {
+  constructor(params) {
+    this._handlerCache = /* @__PURE__ */ new Map();
+    const { serviceRegistry, handleCall, handleStream, ...rpcOptions } = params;
+    this._handleCall = handleCall;
+    this._handleStream = handleStream;
+    this._serviceRegistry = serviceRegistry;
+    this._rpcPeer = new import_rpc.RpcPeer({
+      ...rpcOptions,
+      callHandler: (method, params2) => {
+        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
+        const handler = (method2, params3) => this._getServiceHandler(serviceName).call(method2, params3);
+        if (this._handleCall) {
+          return this._handleCall(methodName, params2, handler);
+        } else {
+          return handler(methodName, params2);
+        }
+      },
+      streamHandler: (method, params2) => {
+        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
+        const handler = (method2, params3) => this._getServiceHandler(serviceName).callStream(method2, params3);
+        if (this._handleStream) {
+          return import_codec_protobuf9.Stream.unwrapPromise(this._handleStream(methodName, params2, handler));
+        } else {
+          return handler(methodName, params2);
+        }
+      }
+    });
+  }
+  async open() {
+    await this._rpcPeer.open();
+  }
+  async close() {
+    await this._rpcPeer.close();
+  }
+  _getServiceHandler(serviceName) {
+    var _a;
+    if (!this._handlerCache.has(serviceName)) {
+      const [key, descriptor] = (_a = Object.entries(this._serviceRegistry.descriptors).find(([key2, descriptor2]) => descriptor2.name === serviceName)) != null ? _a : (0, import_debug3.raise)(new Error(`Service not available: ${serviceName}`));
+      const service = this._serviceRegistry.services[key];
+      if (!service) {
+        throw new Error(`Service not available: ${serviceName}`);
+      }
+      this._handlerCache.set(serviceName, descriptor.createServer(service));
+    }
+    return this._handlerCache.get(serviceName);
+  }
+};
+
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-var import_node_assert11 = __toESM(require("node:assert"));
+var import_tiny_invariant11 = __toESM(require("tiny-invariant"));
 var import_async14 = require("@dxos/async");
 var import_credentials13 = require("@dxos/credentials");
-var import_debug6 = require("@dxos/debug");
+var import_debug7 = require("@dxos/debug");
 var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_keyring = require("@dxos/keyring");
@@ -2156,7 +2218,7 @@ var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_object_sync = require("@dxos/teleport-extension-object-sync");
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
-var import_node_assert10 = __toESM(require("node:assert"));
+var import_tiny_invariant10 = __toESM(require("tiny-invariant"));
 var import_async12 = require("@dxos/async");
 var import_context7 = require("@dxos/context");
 var import_credentials12 = require("@dxos/credentials");
@@ -2171,7 +2233,7 @@ var import_util5 = require("@dxos/util");
 var import_async11 = require("@dxos/async");
 var import_client_protocol3 = require("@dxos/client-protocol");
 var import_context6 = require("@dxos/context");
-var import_debug3 = require("@dxos/debug");
+var import_debug4 = require("@dxos/debug");
 var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_errors3 = require("@dxos/errors");
 var import_keys8 = require("@dxos/keys");
@@ -2182,7 +2244,7 @@ var import_timeframe = require("@dxos/timeframe");
 var import_util4 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
-var import_node_assert9 = __toESM(require("node:assert"));
+var import_tiny_invariant9 = __toESM(require("tiny-invariant"));
 var import_async10 = require("@dxos/async");
 var import_context5 = require("@dxos/context");
 var import_keys7 = require("@dxos/keys");
@@ -2190,6 +2252,7 @@ var import_log8 = require("@dxos/log");
 var import_protocols5 = require("@dxos/protocols");
 var import_teleport2 = require("@dxos/teleport");
 var import_util3 = require("@dxos/util");
+var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
@@ -2202,6 +2265,9 @@ var NotarizationPlugin = class {
     this._processedCredentials = new import_util3.ComplexSet(import_keys7.PublicKey.hash);
     this._processCredentialsTriggers = new import_util3.ComplexMap(import_keys7.PublicKey.hash);
   }
+  get hasWriter() {
+    return !!this._writer;
+  }
   async open() {
   }
   async close() {
@@ -2214,22 +2280,22 @@ var NotarizationPlugin = class {
     (0, import_log8.log)("notarize", {
       credentials
     }, {
-      file: "notarization-plugin.ts",
-      line: 87,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file8,
+      L: 91,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    (0, import_node_assert9.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
+    (0, import_tiny_invariant9.default)(credentials.every((credential) => credential.id), "Credentials must have an id");
     const errors = new import_async10.Trigger();
     const ctx = this._ctx.derive({
       onError: (err) => {
         import_log8.log.warn("Notarization error", {
           err
         }, {
-          file: "notarization-plugin.ts",
-          line: 96,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file8,
+          L: 100,
+          S: this,
+          C: (f, a) => f(...a)
         });
         void ctx.dispose();
         errors.throw(err);
@@ -2242,10 +2308,10 @@ var NotarizationPlugin = class {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
         }, {
-          file: "notarization-plugin.ts",
-          line: 108,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file8,
+          L: 112,
+          S: this,
+          C: (f, a) => f(...a)
         });
         void ctx.dispose();
         errors.throw(new import_async10.TimeoutError(timeout, "Notarization timed out"));
@@ -2265,10 +2331,10 @@ var NotarizationPlugin = class {
           import_log8.log.warn("Exhausted all peers to notarize with", {
             retryIn: retryTimeout
           }, {
-            file: "notarization-plugin.ts",
-            line: 133,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file8,
+            L: 137,
+            S: this,
+            C: (f, a) => f(...a)
           });
           peersTried.clear();
           (0, import_async10.scheduleTask)(ctx, () => notarizeTask.schedule(), retryTimeout);
@@ -2279,28 +2345,28 @@ var NotarizationPlugin = class {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
-          file: "notarization-plugin.ts",
-          line: 140,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file8,
+          L: 144,
+          S: this,
+          C: (f, a) => f(...a)
         });
         await peer.rpc.NotarizationService.notarize({
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
-        (0, import_log8.log)("success", {}, {
-          file: "notarization-plugin.ts",
-          line: 144,
-          scope: this,
-          callSite: (f, a) => f(...a)
+        (0, import_log8.log)("success", void 0, {
+          F: __dxlog_file8,
+          L: 148,
+          S: this,
+          C: (f, a) => f(...a)
         });
         await (0, import_async10.sleep)(successDelay);
       } catch (err) {
         if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
           import_log8.log.warn("error notarizing (recoverable)", err, {
-            file: "notarization-plugin.ts",
-            line: 148,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file8,
+            L: 152,
+            S: this,
+            C: (f, a) => f(...a)
           });
         }
         notarizeTask.schedule();
@@ -2314,11 +2380,11 @@ var NotarizationPlugin = class {
         allNotarized,
         errors.wait()
       ]);
-      (0, import_log8.log)("done", {}, {
-        file: "notarization-plugin.ts",
-        line: 159,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      (0, import_log8.log)("done", void 0, {
+        F: __dxlog_file8,
+        L: 163,
+        S: this,
+        C: (f, a) => f(...a)
       });
     } finally {
       await ctx.dispose();
@@ -2327,7 +2393,7 @@ var NotarizationPlugin = class {
   /**
   * Called with credentials arriving from the control pipeline.
   */
-  async process(credential) {
+  async processCredential(credential) {
     var _a;
     if (!credential.id) {
       return;
@@ -2337,7 +2403,7 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    (0, import_node_assert9.default)(!this._writer, "Writer already set.");
+    (0, import_tiny_invariant9.default)(!this._writer, "Writer already set.");
     this._writer = writer;
   }
   async _waitUntilProcessed(id) {
@@ -2355,7 +2421,7 @@ var NotarizationPlugin = class {
       throw new Error(WRITER_NOT_SET_ERROR_CODE);
     }
     for (const credential of (_a = request.credentials) != null ? _a : []) {
-      (0, import_node_assert9.default)(credential.id, "Credential must have an id");
+      (0, import_tiny_invariant9.default)(credential.id, "Credential must have an id");
       if (this._processedCredentials.has(credential.id)) {
         continue;
       }
@@ -2368,10 +2434,10 @@ var NotarizationPlugin = class {
         (0, import_log8.log)("extension opened", {
           peer: extension.localPeerId
         }, {
-          file: "notarization-plugin.ts",
-          line: 208,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file8,
+          L: 212,
+          S: this,
+          C: (f, a) => f(...a)
         });
         this._extensions.add(extension);
         this._extensionOpened.emit();
@@ -2380,10 +2446,10 @@ var NotarizationPlugin = class {
         (0, import_log8.log)("extension closed", {
           peer: extension.localPeerId
         }, {
-          file: "notarization-plugin.ts",
-          line: 213,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file8,
+          L: 217,
+          S: this,
+          C: (f, a) => f(...a)
         });
         this._extensions.delete(extension);
       },
@@ -2424,7 +2490,7 @@ var NotarizationTeleportExtension = class extends import_teleport2.RpcExtension
 };
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-var __decorate = function(decorators, target, key, desc) {
+function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2433,10 +2499,12 @@ var __decorate = function(decorators, target, key, desc) {
       if (d = decorators[i])
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
+}
+var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
 var DataSpace = class DataSpace2 {
   constructor(params) {
     this._ctx = new import_context6.Context();
+    this._notarizationPlugin = new NotarizationPlugin();
     this._state = import_services6.SpaceState.CLOSED;
     /**
     * Error for _state === SpaceState.ERROR.
@@ -2459,8 +2527,8 @@ var DataSpace = class DataSpace2 {
       update: this._inner.stateUpdate,
       authTimeout: import_client_protocol3.AUTH_TIMEOUT
     });
-    this._notarizationPluginConsumer = this._inner.spaceState.registerProcessor(new NotarizationPlugin());
     this._cache = params.cache;
+    this._state = params.initialState;
   }
   get key() {
     return this._inner.key;
@@ -2482,25 +2550,36 @@ var DataSpace = class DataSpace2 {
     return this._presence;
   }
   get notarizationPlugin() {
-    return this._notarizationPluginConsumer.processor;
+    return this._notarizationPlugin;
   }
   get cache() {
     return this._cache;
   }
   async open() {
-    await this.notarizationPlugin.open();
-    await this._notarizationPluginConsumer.open();
+    await this._open();
+  }
+  async _open() {
+    await this._notarizationPlugin.open();
+    await this._inner.spaceState.addCredentialProcessor(this._notarizationPlugin);
     await this._inner.open();
-    this._state = import_services6.SpaceState.INACTIVE;
+    this._state = import_services6.SpaceState.CONTROL_ONLY;
+    this.stateUpdate.emit();
+    this.metrics = {};
     this.metrics.open = new Date();
   }
   async close() {
+    await this._close();
+  }
+  async _close() {
+    var _a, _b;
+    await ((_b = (_a = this._callbacks).beforeClose) == null ? void 0 : _b.call(_a));
     this._state = import_services6.SpaceState.CLOSED;
     await this._ctx.dispose();
+    this._ctx = new import_context6.Context();
     await this.authVerifier.close();
     await this._inner.close();
-    await this._notarizationPluginConsumer.close();
-    await this.notarizationPlugin.close();
+    await this._inner.spaceState.removeCredentialProcessor(this._notarizationPlugin);
+    await this._notarizationPlugin.close();
     await this._presence.destroy();
   }
   async postMessage(channel, message) {
@@ -2520,18 +2599,18 @@ var DataSpace = class DataSpace2 {
       } catch (err) {
         if (err instanceof import_errors3.CancelledError) {
           (0, import_log9.log)("Data pipeline initialization cancelled", err, {
-            file: "data-space.ts",
-            line: 173,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file9,
+            L: 193,
+            S: this,
+            C: (f, a) => f(...a)
           });
           return;
         }
         import_log9.log.error("Error initializing data pipeline", err, {
-          file: "data-space.ts",
-          line: 177,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file9,
+          L: 197,
+          S: this,
+          C: (f, a) => f(...a)
         });
         this._state = import_services6.SpaceState.ERROR;
         this.error = err;
@@ -2543,7 +2622,7 @@ var DataSpace = class DataSpace2 {
   }
   async initializeDataPipeline() {
     var _a, _b, _c, _d;
-    if (this._state !== import_services6.SpaceState.INACTIVE) {
+    if (this._state !== import_services6.SpaceState.CONTROL_ONLY) {
       throw new import_errors3.SystemError("Invalid operation");
     }
     this._state = import_services6.SpaceState.INITIALIZING;
@@ -2553,37 +2632,39 @@ var DataSpace = class DataSpace2 {
     });
     this.metrics.controlPipelineReady = new Date();
     await this._createWritableFeeds();
-    (0, import_log9.log)("Writable feeds created", {}, {
-      file: "data-space.ts",
-      line: 201,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log9.log)("Writable feeds created", void 0, {
+      F: __dxlog_file9,
+      L: 221,
+      S: this,
+      C: (f, a) => f(...a)
     });
     this.stateUpdate.emit();
-    this.notarizationPlugin.setWriter((0, import_echo_pipeline.createMappedFeedWriter)((credential) => ({
-      credential: {
-        credential
-      }
-    }), this._inner.controlPipeline.writer));
+    if (!this.notarizationPlugin.hasWriter) {
+      this.notarizationPlugin.setWriter((0, import_echo_pipeline.createMappedFeedWriter)((credential) => ({
+        credential: {
+          credential
+        }
+      }), this._inner.controlPipeline.writer));
+    }
     await this._inner.initializeDataPipeline();
     this.metrics.dataPipelineOpen = new Date();
     await (0, import_context6.cancelWithContext)(this._ctx, this._inner.dataPipeline.ensureEpochInitialized());
-    (0, import_log9.log)("waiting for data pipeline to reach target timeframe", {}, {
-      file: "data-space.ts",
-      line: 220,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log9.log)("waiting for data pipeline to reach target timeframe", void 0, {
+      F: __dxlog_file9,
+      L: 242,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await this._inner.dataPipeline.pipelineState.waitUntilReachedTargetTimeframe({
       ctx: this._ctx,
       breakOnStall: false
     });
     this.metrics.dataPipelineReady = new Date();
-    (0, import_log9.log)("data pipeline ready", {}, {
-      file: "data-space.ts",
-      line: 229,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log9.log)("data pipeline ready", void 0, {
+      F: __dxlog_file9,
+      L: 251,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await ((_b = (_a = this._callbacks).beforeReady) == null ? void 0 : _b.call(_a));
     this._state = import_services6.SpaceState.READY;
@@ -2661,17 +2742,46 @@ var DataSpace = class DataSpace2 {
       }
     }
   }
+  async activate() {
+    if (this._state !== import_services6.SpaceState.INACTIVE) {
+      throw new import_errors3.SystemError("Invalid operation");
+    }
+    await this._metadataStore.setSpaceState(this.key, import_services6.SpaceState.ACTIVE);
+    await this._open();
+    this.initializeDataPipelineAsync();
+  }
+  async deactivate() {
+    if (this._state === import_services6.SpaceState.INACTIVE) {
+      throw new import_errors3.SystemError("Invalid operation");
+    }
+    await this._metadataStore.setSpaceState(this.key, import_services6.SpaceState.INACTIVE);
+    await this._close();
+    this._state = import_services6.SpaceState.INACTIVE;
+    this.stateUpdate.emit();
+  }
 };
-__decorate([
-  (0, import_debug3.timed)(1e4)
+_ts_decorate([
+  import_async11.synchronized
+], DataSpace.prototype, "open", null);
+_ts_decorate([
+  import_async11.synchronized
+], DataSpace.prototype, "close", null);
+_ts_decorate([
+  (0, import_debug4.timed)(1e4)
 ], DataSpace.prototype, "_createWritableFeeds", null);
-DataSpace = __decorate([
+_ts_decorate([
+  import_async11.synchronized
+], DataSpace.prototype, "activate", null);
+_ts_decorate([
+  import_async11.synchronized
+], DataSpace.prototype, "deactivate", null);
+DataSpace = _ts_decorate([
   (0, import_async11.trackLeaks)("open", "close")
 ], DataSpace);
 
 // packages/sdk/client-services/src/packlets/spaces/genesis.ts
 var import_credentials10 = require("@dxos/credentials");
-var import_debug4 = require("@dxos/debug");
+var import_debug5 = require("@dxos/debug");
 var import_credentials11 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe2 = require("@dxos/timeframe");
 var spaceGenesis = async (keyring, signingContext, space) => {
@@ -2695,11 +2805,11 @@ var spaceGenesis = async (keyring, signingContext, space) => {
         spaceKey: space.key,
         role: import_credentials11.SpaceMember.Role.ADMIN,
         profile: signingContext.profile,
-        genesisFeedKey: (_a = space.controlFeedKey) != null ? _a : (0, import_debug4.failUndefined)()
+        genesisFeedKey: (_a = space.controlFeedKey) != null ? _a : (0, import_debug5.failUndefined)()
       }
     }),
     await signingContext.credentialSigner.createCredential({
-      subject: (_b = space.controlFeedKey) != null ? _b : (0, import_debug4.failUndefined)(),
+      subject: (_b = space.controlFeedKey) != null ? _b : (0, import_debug5.failUndefined)(),
       assertion: {
         "@type": "dxos.halo.credentials.AdmittedFeed",
         spaceKey: space.key,
@@ -2709,7 +2819,7 @@ var spaceGenesis = async (keyring, signingContext, space) => {
       }
     }),
     await signingContext.credentialSigner.createCredential({
-      subject: (_c = space.dataFeedKey) != null ? _c : (0, import_debug4.failUndefined)(),
+      subject: (_c = space.dataFeedKey) != null ? _c : (0, import_debug5.failUndefined)(),
       assertion: {
         "@type": "dxos.halo.credentials.AdmittedFeed",
         spaceKey: space.key,
@@ -2719,7 +2829,7 @@ var spaceGenesis = async (keyring, signingContext, space) => {
       }
     }),
     await signingContext.credentialSigner.createCredential({
-      subject: (_d = space.key) != null ? _d : (0, import_debug4.failUndefined)(),
+      subject: (_d = space.key) != null ? _d : (0, import_debug5.failUndefined)(),
       assertion: {
         "@type": "dxos.halo.credentials.Epoch",
         number: 0,
@@ -2740,7 +2850,7 @@ var spaceGenesis = async (keyring, signingContext, space) => {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
-var __decorate2 = function(decorators, target, key, desc) {
+function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2749,7 +2859,8 @@ var __decorate2 = function(decorators, target, key, desc) {
       if (d = decorators[i])
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
+}
+var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
 var DataSpaceManager = class DataSpaceManager2 {
   constructor(_spaceManager, _metadataStore, _dataServiceSubscriptions, _keyring, _signingContext, _feedStore) {
     this._spaceManager = _spaceManager;
@@ -2769,50 +2880,52 @@ var DataSpaceManager = class DataSpaceManager2 {
     return this._spaces;
   }
   async open() {
-    (0, import_log10.log)("open", {}, {
-      file: "data-space-manager.ts",
-      line: 80,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log10.log)("open", void 0, {
+      F: __dxlog_file10,
+      L: 80,
+      S: this,
+      C: (f, a) => f(...a)
     });
     import_log10.log.trace("dxos.echo.data-space-manager.open", import_protocols6.trace.begin({
       id: this._instanceId
     }), {
-      file: "data-space-manager.ts",
-      line: 81,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file10,
+      L: 81,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await this._metadataStore.load();
     (0, import_log10.log)("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
-      file: "data-space-manager.ts",
-      line: 83,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file10,
+      L: 83,
+      S: this,
+      C: (f, a) => f(...a)
     });
     for (const spaceMetadata of this._metadataStore.spaces) {
       try {
         (0, import_log10.log)("load space", {
           spaceMetadata
         }, {
-          file: "data-space-manager.ts",
-          line: 87,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file10,
+          L: 87,
+          S: this,
+          C: (f, a) => f(...a)
         });
         const space = await this._constructSpace(spaceMetadata);
-        space.initializeDataPipelineAsync();
+        if (spaceMetadata.state !== import_services7.SpaceState.INACTIVE) {
+          space.initializeDataPipelineAsync();
+        }
       } catch (err) {
         import_log10.log.error("Error loading space", {
           spaceMetadata,
           err
         }, {
-          file: "data-space-manager.ts",
-          line: 91,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file10,
+          L: 93,
+          S: this,
+          C: (f, a) => f(...a)
         });
       }
     }
@@ -2821,18 +2934,18 @@ var DataSpaceManager = class DataSpaceManager2 {
     import_log10.log.trace("dxos.echo.data-space-manager.open", import_protocols6.trace.end({
       id: this._instanceId
     }), {
-      file: "data-space-manager.ts",
-      line: 97,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file10,
+      L: 99,
+      S: this,
+      C: (f, a) => f(...a)
     });
   }
   async close() {
-    (0, import_log10.log)("close", {}, {
-      file: "data-space-manager.ts",
-      line: 102,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log10.log)("close", void 0, {
+      F: __dxlog_file10,
+      L: 104,
+      S: this,
+      C: (f, a) => f(...a)
     });
     this._isOpen = false;
     await this._ctx.dispose();
@@ -2844,7 +2957,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   * Creates a new space writing the genesis credentials to the control feed.
   */
   async createSpace() {
-    (0, import_node_assert10.default)(this._isOpen, "Not open.");
+    (0, import_tiny_invariant10.default)(this._isOpen, "Not open.");
     const spaceKey = await this._keyring.createKey();
     const controlFeedKey = await this._keyring.createKey();
     const dataFeedKey = await this._keyring.createKey();
@@ -2852,21 +2965,22 @@ var DataSpaceManager = class DataSpaceManager2 {
       key: spaceKey,
       genesisFeedKey: controlFeedKey,
       controlFeedKey,
-      dataFeedKey
+      dataFeedKey,
+      state: import_services7.SpaceState.ACTIVE
     };
     (0, import_log10.log)("creating space...", {
       spaceKey
     }, {
-      file: "data-space-manager.ts",
-      line: 126,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file10,
+      L: 129,
+      S: this,
+      C: (f, a) => f(...a)
     });
     const space = await this._constructSpace(metadata);
     const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    (0, import_node_assert10.default)((0, import_credentials12.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
+    (0, import_tiny_invariant10.default)((0, import_credentials12.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember");
     await this._signingContext.recordCredential(memberCredential);
     await space.initializeDataPipeline();
     this.updated.emit();
@@ -2877,13 +2991,13 @@ var DataSpaceManager = class DataSpaceManager2 {
     (0, import_log10.log)("accept space", {
       opts
     }, {
-      file: "data-space-manager.ts",
-      line: 145,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file10,
+      L: 148,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    (0, import_node_assert10.default)(this._isOpen, "Not open.");
-    (0, import_node_assert10.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
+    (0, import_tiny_invariant10.default)(this._isOpen, "Not open.");
+    (0, import_tiny_invariant10.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
     const metadata = {
       key: opts.spaceKey,
       genesisFeedKey: opts.genesisFeedKey,
@@ -2911,10 +3025,10 @@ var DataSpaceManager = class DataSpaceManager2 {
     (0, import_log10.log)("construct space", {
       metadata
     }, {
-      file: "data-space-manager.ts",
-      line: 181,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file10,
+      L: 183,
+      S: this,
+      C: (f, a) => f(...a)
     });
     const gossip = new import_teleport_extension_gossip.Gossip({
       localPeerId: this._signingContext.deviceKey
@@ -2946,11 +3060,11 @@ var DataSpaceManager = class DataSpaceManager2 {
         session.addExtension("dxos.mesh.teleport.notarization", dataSpace.notarizationPlugin.createExtension());
       },
       onAuthFailure: () => {
-        import_log10.log.warn("auth failure", {}, {
-          file: "data-space-manager.ts",
-          line: 212,
-          scope: this,
-          callSite: (f, a) => f(...a)
+        import_log10.log.warn("auth failure", void 0, {
+          F: __dxlog_file10,
+          L: 214,
+          S: this,
+          C: (f, a) => f(...a)
         });
       },
       memberKey: this._signingContext.identityKey
@@ -2959,6 +3073,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     dataFeed && space.setDataFeed(dataFeed);
     const dataSpace = new DataSpace({
       inner: space,
+      initialState: metadata.state === import_services7.SpaceState.INACTIVE ? import_services7.SpaceState.INACTIVE : import_services7.SpaceState.CLOSED,
       metadataStore: this._metadataStore,
       gossip,
       presence,
@@ -2970,31 +3085,44 @@ var DataSpaceManager = class DataSpaceManager2 {
           (0, import_log10.log)("before space ready", {
             space: space.key
           }, {
-            file: "data-space-manager.ts",
-            line: 229,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file10,
+            L: 232,
+            S: this,
+            C: (f, a) => f(...a)
           });
-          this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.dataPipeline.databaseHost.createDataServiceHost());
+          await this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.dataPipeline.databaseHost.createDataServiceHost());
         },
         afterReady: async () => {
           (0, import_log10.log)("after space ready", {
             space: space.key,
             open: this._isOpen
           }, {
-            file: "data-space-manager.ts",
-            line: 236,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file10,
+            L: 239,
+            S: this,
+            C: (f, a) => f(...a)
           });
           if (this._isOpen) {
             this.updated.emit();
           }
+        },
+        beforeClose: async () => {
+          (0, import_log10.log)("before space close", {
+            space: space.key
+          }, {
+            F: __dxlog_file10,
+            L: 245,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          await this._dataServiceSubscriptions.unregisterSpace(space.key);
         }
       },
       cache: metadata.cache
     });
-    await dataSpace.open();
+    if (metadata.state !== import_services7.SpaceState.INACTIVE) {
+      await dataSpace.open();
+    }
     if (metadata.controlTimeframe) {
       dataSpace.inner.controlPipeline.state.setTargetTimeframe(metadata.controlTimeframe);
     }
@@ -3005,32 +3133,33 @@ var DataSpaceManager = class DataSpaceManager2 {
     return dataSpace;
   }
 };
-__decorate2([
+_ts_decorate2([
   import_async12.synchronized
 ], DataSpaceManager.prototype, "open", null);
-__decorate2([
+_ts_decorate2([
   import_async12.synchronized
 ], DataSpaceManager.prototype, "close", null);
-__decorate2([
+_ts_decorate2([
   import_async12.synchronized
 ], DataSpaceManager.prototype, "createSpace", null);
-__decorate2([
+_ts_decorate2([
   import_async12.synchronized
 ], DataSpaceManager.prototype, "acceptSpace", null);
-DataSpaceManager = __decorate2([
+DataSpaceManager = _ts_decorate2([
   (0, import_async12.trackLeaks)("open", "close")
 ], DataSpaceManager);
 
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
 var import_async13 = require("@dxos/async");
-var import_codec_protobuf9 = require("@dxos/codec-protobuf");
-var import_debug5 = require("@dxos/debug");
+var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_debug6 = require("@dxos/debug");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
+var import_errors4 = require("@dxos/errors");
 var import_log11 = require("@dxos/log");
 var import_protocols7 = require("@dxos/protocols");
 var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util6 = require("@dxos/util");
-var TIMEFRAME_UPDATE_DEBOUNCE_TIME = 500;
+var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _dataServiceSubscriptions, _getDataSpaceManager) {
     this._identityManager = _identityManager;
@@ -3044,28 +3173,44 @@ var SpacesServiceImpl = class {
     }
     const dataSpaceManager = await this._getDataSpaceManager();
     const space = await dataSpaceManager.createSpace();
-    return this._transformSpace(space);
+    return this._serializeSpace(space);
   }
-  async updateSpace(request) {
-    (0, import_debug5.todo)();
+  async updateSpace({ spaceKey, state }) {
+    var _a;
+    const dataSpaceManager = await this._getDataSpaceManager();
+    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+    if (state) {
+      switch (state) {
+        case import_services8.SpaceState.ACTIVE:
+          await space.activate();
+          break;
+        case import_services8.SpaceState.INACTIVE:
+          await space.deactivate();
+          break;
+        default:
+          throw new import_errors4.ApiError("Invalid space state");
+      }
+    }
   }
   querySpaces() {
-    return new import_codec_protobuf9.Stream(({ next, ctx }) => {
-      const onUpdate = async () => {
+    return new import_codec_protobuf10.Stream(({ next, ctx }) => {
+      const scheduler = new import_async13.UpdateScheduler(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._transformSpace(space));
+        const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space));
         (0, import_log11.log)("update", {
           spaces
         }, {
-          file: "spaces-service.ts",
-          line: 60,
-          scope: this,
-          callSite: (f, a) => f(...a)
+          F: __dxlog_file11,
+          L: 78,
+          S: this,
+          C: (f, a) => f(...a)
         });
         next({
           spaces
         });
-      };
+      }, {
+        maxFrequency: 2
+      });
       (0, import_async13.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const subscriptions = new import_async13.EventSubscriptions();
@@ -3073,21 +3218,21 @@ var SpacesServiceImpl = class {
         const subscribeSpaces = () => {
           subscriptions.clear();
           for (const space of dataSpaceManager.spaces.values()) {
-            subscriptions.add(space.stateUpdate.on(ctx, onUpdate));
-            subscriptions.add(space.presence.updated.on(ctx, onUpdate));
-            subscriptions.add(space.dataPipeline.onNewEpoch.on(ctx, onUpdate));
-            space.inner.controlPipeline.state.timeframeUpdate.debounce(TIMEFRAME_UPDATE_DEBOUNCE_TIME).on(ctx, onUpdate);
+            subscriptions.add(space.stateUpdate.on(ctx, () => scheduler.trigger()));
+            subscriptions.add(space.presence.updated.on(ctx, () => scheduler.trigger()));
+            subscriptions.add(space.dataPipeline.onNewEpoch.on(ctx, () => scheduler.trigger()));
+            space.inner.controlPipeline.state.timeframeUpdate.on(ctx, () => scheduler.trigger());
             if (space.dataPipeline.pipelineState) {
-              subscriptions.add(space.dataPipeline.pipelineState.timeframeUpdate.debounce(TIMEFRAME_UPDATE_DEBOUNCE_TIME).on(ctx, onUpdate));
+              subscriptions.add(space.dataPipeline.pipelineState.timeframeUpdate.on(ctx, () => scheduler.trigger()));
             }
           }
         };
         dataSpaceManager.updated.on(ctx, () => {
           subscribeSpaces();
-          void onUpdate();
+          scheduler.trigger();
         });
         subscribeSpaces();
-        void onUpdate();
+        scheduler.trigger();
       });
       if (!this._identityManager.identity) {
         next({
@@ -3099,15 +3244,15 @@ var SpacesServiceImpl = class {
   async postMessage({ spaceKey, channel, message }) {
     var _a;
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
     await space.postMessage(getChannelId(channel), message);
   }
   subscribeMessages({ spaceKey, channel }) {
-    return new import_codec_protobuf9.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf10.Stream(({ ctx, next }) => {
       (0, import_async13.scheduleTask)(ctx, async () => {
         var _a;
         const dataSpaceManager = await this._getDataSpaceManager();
-        const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+        const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
         const handle = space.listen(getChannelId(channel), (message) => {
           next(message);
         });
@@ -3116,21 +3261,21 @@ var SpacesServiceImpl = class {
     });
   }
   queryCredentials({ spaceKey }) {
-    return new import_codec_protobuf9.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf10.Stream(({ ctx, next }) => {
       var _a;
-      const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
-      const processor = space.spaceState.registerProcessor({
-        process: async (credential) => {
+      const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+      const processor = {
+        processCredential: async (credential) => {
           next(credential);
         }
-      });
-      ctx.onDispose(() => processor.close());
-      (0, import_async13.scheduleTask)(ctx, () => processor.open());
+      };
+      ctx.onDispose(() => space.spaceState.removeCredentialProcessor(processor));
+      (0, import_async13.scheduleTask)(ctx, () => space.spaceState.addCredentialProcessor(processor));
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
     var _a;
-    const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+    const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
     for (const credential of credentials != null ? credentials : []) {
       await space.controlPipeline.writer.write({
         credential: {
@@ -3142,10 +3287,10 @@ var SpacesServiceImpl = class {
   async createEpoch({ spaceKey }) {
     var _a;
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
     await space.createEpoch();
   }
-  _transformSpace(space) {
+  _serializeSpace(space) {
     var _a, _b, _c, _d, _e, _f, _g;
     return {
       spaceKey: space.key,
@@ -3185,6 +3330,7 @@ var SpacesServiceImpl = class {
 var getChannelId = (channel) => `user-channel/${channel}`;
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
+var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
 var ServiceContext = class {
   // prettier-ignore
   constructor(storage, networkManager, signalManager, modelFactory) {
@@ -3221,24 +3367,24 @@ var ServiceContext = class {
     this.invitations = new InvitationsHandler(this.networkManager);
     this._handlerFactories.set(import_services9.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
       var _a;
-      return (_a = this.identityManager.identity) != null ? _a : (0, import_debug6.failUndefined)();
+      return (_a = this.identityManager.identity) != null ? _a : (0, import_debug7.failUndefined)();
     }, this._acceptIdentity.bind(this)));
   }
   async open() {
     import_log12.log.trace("dxos.sdk.service-context.open", import_protocols8.trace.begin({
       id: this._instanceId
     }), {
-      file: "service-context.ts",
-      line: 126,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file12,
+      L: 126,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await this._checkStorageVersion();
-    (0, import_log12.log)("opening...", {}, {
-      file: "service-context.ts",
-      line: 130,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log12.log)("opening...", void 0, {
+      F: __dxlog_file12,
+      L: 130,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await this.signalManager.open();
     await this.networkManager.open();
@@ -3247,42 +3393,44 @@ var ServiceContext = class {
     if (this.identityManager.identity) {
       await this._initialize();
     }
-    (0, import_log12.log)("opened", {}, {
-      file: "service-context.ts",
-      line: 138,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log12.log)("opened", void 0, {
+      F: __dxlog_file12,
+      L: 138,
+      S: this,
+      C: (f, a) => f(...a)
     });
     import_log12.log.trace("dxos.sdk.service-context.open", import_protocols8.trace.end({
       id: this._instanceId
     }), {
-      file: "service-context.ts",
-      line: 139,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file12,
+      L: 139,
+      S: this,
+      C: (f, a) => f(...a)
     });
   }
   async close() {
-    var _a, _b;
-    (0, import_log12.log)("closing...", {}, {
-      file: "service-context.ts",
-      line: 143,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    await ((_a = this._deviceSpaceSync) == null ? void 0 : _a.close());
-    await ((_b = this.dataSpaceManager) == null ? void 0 : _b.close());
+    var _a;
+    (0, import_log12.log)("closing...", void 0, {
+      F: __dxlog_file12,
+      L: 143,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    if (this._deviceSpaceSync && this.identityManager.identity) {
+      await this.identityManager.identity.space.spaceState.removeCredentialProcessor(this._deviceSpaceSync);
+    }
+    await ((_a = this.dataSpaceManager) == null ? void 0 : _a.close());
     await this.identityManager.close();
     await this.spaceManager.close();
     await this.feedStore.close();
     await this.networkManager.close();
     await this.signalManager.close();
     this.dataServiceSubscriptions.clear();
-    (0, import_log12.log)("closed", {}, {
-      file: "service-context.ts",
-      line: 152,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log12.log)("closed", void 0, {
+      F: __dxlog_file12,
+      L: 154,
+      S: this,
+      C: (f, a) => f(...a)
     });
   }
   async createIdentity(params = {}) {
@@ -3292,7 +3440,7 @@ var ServiceContext = class {
   }
   getInvitationHandler(invitation) {
     const factory = this._handlerFactories.get(invitation.kind);
-    (0, import_node_assert11.default)(factory, `Unknown invitation kind: ${invitation.kind}`);
+    (0, import_tiny_invariant11.default)(factory, `Unknown invitation kind: ${invitation.kind}`);
     return factory(invitation);
   }
   async _acceptIdentity(params) {
@@ -3309,13 +3457,13 @@ var ServiceContext = class {
   // Called when identity is created.
   async _initialize() {
     var _a;
-    (0, import_log12.log)("initializing spaces...", {}, {
-      file: "service-context.ts",
-      line: 185,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log12.log)("initializing spaces...", void 0, {
+      F: __dxlog_file12,
+      L: 187,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug6.failUndefined)();
+    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug7.failUndefined)();
     const signingContext = {
       credentialSigner: identity.getIdentityCredentialSigner(),
       identityKey: identity.identityKey,
@@ -3332,12 +3480,12 @@ var ServiceContext = class {
     this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.dataServiceSubscriptions, this.keyring, signingContext, this.feedStore);
     await this.dataSpaceManager.open();
     this._handlerFactories.set(import_services9.Invitation.Kind.SPACE, (invitation) => {
-      (0, import_node_assert11.default)(this.dataSpaceManager, "dataSpaceManager not initialized yet");
+      (0, import_tiny_invariant11.default)(this.dataSpaceManager, "dataSpaceManager not initialized yet");
       return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
     });
     this.initialized.wake();
-    this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
-      process: async (credential) => {
+    this._deviceSpaceSync = {
+      processCredential: async (credential) => {
         const assertion = (0, import_credentials13.getCredentialAssertion)(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
@@ -3349,10 +3497,10 @@ var ServiceContext = class {
           (0, import_log12.log)("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
-            file: "service-context.ts",
-            line: 224,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file12,
+            L: 226,
+            S: this,
+            C: (f, a) => f(...a)
           });
           return;
         }
@@ -3360,10 +3508,10 @@ var ServiceContext = class {
           (0, import_log12.log)("space already exists, ignoring space admission", {
             details: assertion
           }, {
-            file: "service-context.ts",
-            line: 228,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file12,
+            L: 230,
+            S: this,
+            C: (f, a) => f(...a)
           });
           return;
         }
@@ -3371,44 +3519,47 @@ var ServiceContext = class {
           (0, import_log12.log)("accepting space recorded in halo", {
             details: assertion
           }, {
-            file: "service-context.ts",
-            line: 233,
-            scope: this,
-            callSite: (f, a) => f(...a)
+            F: __dxlog_file12,
+            L: 235,
+            S: this,
+            C: (f, a) => f(...a)
           });
           await this.dataSpaceManager.acceptSpace({
             spaceKey: assertion.spaceKey,
             genesisFeedKey: assertion.genesisFeedKey
           });
         } catch (err) {
-          import_log12.log.catch(err, {}, {
-            file: "service-context.ts",
-            line: 239,
-            scope: this,
-            callSite: (f, a) => f(...a)
+          import_log12.log.catch(err, void 0, {
+            F: __dxlog_file12,
+            L: 241,
+            S: this,
+            C: (f, a) => f(...a)
           });
         }
       }
-    });
-    await this._deviceSpaceSync.open();
+    };
+    await identity.space.spaceState.addCredentialProcessor(this._deviceSpaceSync);
   }
 };
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-var import_node_assert13 = __toESM(require("node:assert"));
+var import_tiny_invariant13 = __toESM(require("tiny-invariant"));
 var import_async17 = require("@dxos/async");
 var import_client_protocol5 = require("@dxos/client-protocol");
+var import_document_model = require("@dxos/document-model");
 var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_keys11 = require("@dxos/keys");
 var import_log15 = require("@dxos/log");
 var import_messaging = require("@dxos/messaging");
+var import_model_factory = require("@dxos/model-factory");
 var import_network_manager2 = require("@dxos/network-manager");
 var import_protocols9 = require("@dxos/protocols");
 var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
+var import_text_model = require("@dxos/text-model");
 
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
 var import_async15 = require("@dxos/async");
-var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_codec_protobuf11 = require("@dxos/codec-protobuf");
 var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
@@ -3418,7 +3569,7 @@ var DevicesServiceImpl = class {
     throw new Error("Method not implemented.");
   }
   queryDevices() {
-    return new import_codec_protobuf10.Stream(({ next }) => {
+    return new import_codec_protobuf11.Stream(({ next }) => {
       const update = () => {
         var _a;
         const deviceKeys = (_a = this._identityManager.identity) == null ? void 0 : _a.authorizedDeviceKeys;
@@ -3454,10 +3605,10 @@ var DevicesServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/locks/node.ts
-var import_node_assert12 = __toESM(require("node:assert"));
+var import_tiny_invariant12 = __toESM(require("tiny-invariant"));
 var import_lock_file = require("@dxos/lock-file");
 var import_log13 = require("@dxos/log");
-var __decorate3 = function(decorators, target, key, desc) {
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -3466,7 +3617,8 @@ var __decorate3 = function(decorators, target, key, desc) {
       if (d = decorators[i])
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
+}
+var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/node.ts";
 var Lock = class {
   constructor({ lockKey: lockPath, onAcquire, onRelease }) {
     this._lockPath = lockPath;
@@ -3478,36 +3630,36 @@ var Lock = class {
   }
   async acquire() {
     var _a;
-    (0, import_log13.log)("acquiring lock...", {}, {
-      file: "node.ts",
-      line: 32,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log13.log)("acquiring lock...", void 0, {
+      F: __dxlog_file13,
+      L: 32,
+      S: this,
+      C: (f, a) => f(...a)
     });
     this._fileHandle = await import_lock_file.LockFile.acquire(this._lockPath);
     await ((_a = this._onAcquire) == null ? void 0 : _a.call(this));
-    (0, import_log13.log)("acquired lock", {}, {
-      file: "node.ts",
-      line: 37,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log13.log)("acquired lock", void 0, {
+      F: __dxlog_file13,
+      L: 37,
+      S: this,
+      C: (f, a) => f(...a)
     });
   }
   async release() {
     var _a;
     await ((_a = this._onRelease) == null ? void 0 : _a.call(this));
-    (0, import_node_assert12.default)(this._fileHandle, "Lock is not acquired");
+    (0, import_tiny_invariant12.default)(this._fileHandle, "Lock is not acquired");
     await import_lock_file.LockFile.release(this._fileHandle);
   }
 };
-__decorate3([
+_ts_decorate3([
   import_log13.logInfo
 ], Lock.prototype, "lockKey", null);
 var isLocked = (lockPath) => import_lock_file.LockFile.isLocked(lockPath);
 
 // packages/sdk/client-services/src/packlets/logging/logging-service.ts
 var import_async16 = require("@dxos/async");
-var import_codec_protobuf11 = require("@dxos/codec-protobuf");
+var import_codec_protobuf12 = require("@dxos/codec-protobuf");
 var import_log14 = require("@dxos/log");
 var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util7 = require("@dxos/util");
@@ -3526,13 +3678,13 @@ var LoggingServiceImpl = class {
     import_log14.log.runtimeConfig.processors.splice(index, 1);
   }
   queryLogs(request) {
-    return new import_codec_protobuf11.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf12.Stream(({ ctx, next }) => {
       const handler = (entry2) => {
         var _a, _b, _c, _d, _e;
         if (LOG_PROCESSING > 0) {
           return;
         }
-        if (((_a = entry2.meta) == null ? void 0 : _a.file.includes("logging-service")) || entry2.context && Object.values(entry2.context).some((value) => typeof value === "string" && value.includes("LoggingService"))) {
+        if (((_a = entry2.meta) == null ? void 0 : _a.F.includes("logging-service")) || entry2.context && Object.values(entry2.context).some((value) => typeof value === "string" && value.includes("LoggingService"))) {
           return;
         }
         if (!shouldLog(entry2, request)) {
@@ -3544,8 +3696,8 @@ var LoggingServiceImpl = class {
           timestamp: new Date(),
           meta: {
             // TODO(dmaretskyi): Fix proto.
-            file: (_c = (_b = entry2.meta) == null ? void 0 : _b.file) != null ? _c : "",
-            line: (_e = (_d = entry2.meta) == null ? void 0 : _d.line) != null ? _e : 0
+            file: (_c = (_b = entry2.meta) == null ? void 0 : _b.F) != null ? _c : "",
+            line: (_e = (_d = entry2.meta) == null ? void 0 : _d.L) != null ? _e : 0
           }
         };
         try {
@@ -3575,21 +3727,21 @@ var shouldLog = (entry2, request) => {
   } else {
     return request.filters.some((filter) => {
       var _a2, _b;
-      return matchFilter(filter, entry2.level, (_b = (_a2 = entry2.meta) == null ? void 0 : _a2.file) != null ? _b : "", options);
+      return matchFilter(filter, entry2.level, (_b = (_a2 = entry2.meta) == null ? void 0 : _a2.F) != null ? _b : "", options);
     });
   }
 };
 var LOG_PROCESSING = 0;
 
 // packages/sdk/client-services/src/packlets/network/network-service.ts
-var import_codec_protobuf12 = require("@dxos/codec-protobuf");
+var import_codec_protobuf13 = require("@dxos/codec-protobuf");
 var NetworkServiceImpl = class {
   constructor(networkManager, signalManager) {
     this.networkManager = networkManager;
     this.signalManager = signalManager;
   }
   queryStatus() {
-    return new import_codec_protobuf12.Stream(({ next }) => {
+    return new import_codec_protobuf13.Stream(({ next }) => {
       const update = () => {
         next({
           swarm: this.networkManager.connectionState,
@@ -3615,7 +3767,7 @@ var NetworkServiceImpl = class {
 
 // packages/sdk/client-services/src/packlets/storage/storage.ts
 var import_client_protocol4 = require("@dxos/client-protocol");
-var import_errors4 = require("@dxos/errors");
+var import_errors5 = require("@dxos/errors");
 var import_config = require("@dxos/protocols/proto/dxos/config");
 var import_random_access_storage = require("@dxos/random-access-storage");
 var import_util8 = require("@dxos/util");
@@ -3623,16 +3775,16 @@ var StorageDriver = import_config.Runtime.Client.Storage.StorageDriver;
 var createStorageObjects = (config) => {
   const { path = (0, import_util8.isNode)() ? import_client_protocol4.DX_DATA : "dxos/storage", storageType, keyStorage, persistent = false } = config != null ? config : {};
   if (persistent && storageType === StorageDriver.RAM) {
-    throw new import_errors4.InvalidConfigError("RAM storage cannot be used in persistent mode.");
+    throw new import_errors5.InvalidConfigError("RAM storage cannot be used in persistent mode.");
   }
   if (!persistent && storageType !== void 0 && storageType !== StorageDriver.RAM) {
-    throw new import_errors4.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+    throw new import_errors5.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
   }
   if (persistent && keyStorage === StorageDriver.RAM) {
-    throw new import_errors4.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+    throw new import_errors5.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
   }
   if (!persistent && keyStorage !== StorageDriver.RAM && keyStorage !== void 0) {
-    throw new import_errors4.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+    throw new import_errors5.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
   }
   return {
     storage: (0, import_random_access_storage.createStorage)({
@@ -3663,7 +3815,7 @@ var toStorageType = (type) => {
 };
 
 // packages/sdk/client-services/src/packlets/system/system-service.ts
-var import_codec_protobuf13 = require("@dxos/codec-protobuf");
+var import_codec_protobuf14 = require("@dxos/codec-protobuf");
 var SystemServiceImpl = class {
   constructor({ config, statusUpdate, onUpdateStatus, getCurrentStatus, onReset }) {
     this._config = config;
@@ -3680,7 +3832,7 @@ var SystemServiceImpl = class {
     await this._onUpdateStatus(status);
   }
   queryStatus() {
-    return new import_codec_protobuf13.Stream(({ next }) => {
+    return new import_codec_protobuf14.Stream(({ next }) => {
       const update = () => {
         next({
           status: this._getCurrentStatus()
@@ -3725,7 +3877,7 @@ var ServiceRegistry = class {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-var __decorate4 = function(decorators, target, key, desc) {
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -3734,24 +3886,30 @@ var __decorate4 = function(decorators, target, key, desc) {
       if (d = decorators[i])
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
+var createDefaultModelFactory = () => {
+  return new import_model_factory.ModelFactory().registerModel(import_document_model.DocumentModel).registerModel(import_text_model.TextModel);
 };
 var ClientServicesHost = class {
   constructor({
     config,
-    modelFactory = (0, import_client_protocol5.createDefaultModelFactory)(),
+    modelFactory = createDefaultModelFactory(),
     // TODO(burdon): Create ApolloLink abstraction (see Client).
     transportFactory,
     signalManager,
     connectionLog,
     storage,
     // TODO(wittjosiah): Turn this on by default.
-    lockKey
+    lockKey,
+    callbacks
   } = {}) {
     this._statusUpdate = new import_async17.Event();
     this._opening = false;
     this._open = false;
     this._storage = storage;
     this._modelFactory = modelFactory;
+    this._callbacks = callbacks;
     if (config) {
       this.initialize({
         config,
@@ -3810,9 +3968,9 @@ var ClientServicesHost = class {
   */
   initialize({ config, ...options }) {
     var _a, _b, _c;
-    (0, import_node_assert13.default)(!this._open, "service host is open");
+    (0, import_tiny_invariant13.default)(!this._open, "service host is open");
     if (config) {
-      (0, import_node_assert13.default)(!this._config, "config already set");
+      (0, import_tiny_invariant13.default)(!this._config, "config already set");
       this._config = config;
       if (!this._storage) {
         this._storage = createStorageObjects(config.get("runtime.client.storage", {})).storage;
@@ -3822,7 +3980,7 @@ var ClientServicesHost = class {
       iceServers: (_a = this._config) == null ? void 0 : _a.get("runtime.services.ice")
     }), signalManager = new import_messaging.WebsocketSignalManager((_c = (_b = this._config) == null ? void 0 : _b.get("runtime.services.signaling")) != null ? _c : []) } = options;
     this._signalManager = signalManager;
-    (0, import_node_assert13.default)(!this._networkManager, "network manager already set");
+    (0, import_tiny_invariant13.default)(!this._networkManager, "network manager already set");
     this._networkManager = new import_network_manager2.NetworkManager({
       log: connectionLog,
       transportFactory,
@@ -3838,23 +3996,23 @@ var ClientServicesHost = class {
     import_log15.log.trace("dxos.sdk.client-services-host.open", import_protocols9.trace.begin({
       id: traceId
     }), {
-      file: "service-host.ts",
-      line: 188,
-      scope: this,
-      callSite: (f, a) => f(...a)
-    });
-    (0, import_node_assert13.default)(this._config, "config not set");
-    (0, import_node_assert13.default)(this._storage, "storage not set");
-    (0, import_node_assert13.default)(this._signalManager, "signal manager not set");
-    (0, import_node_assert13.default)(this._networkManager, "network manager not set");
+      F: __dxlog_file14,
+      L: 203,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    (0, import_tiny_invariant13.default)(this._config, "config not set");
+    (0, import_tiny_invariant13.default)(this._storage, "storage not set");
+    (0, import_tiny_invariant13.default)(this._signalManager, "signal manager not set");
+    (0, import_tiny_invariant13.default)(this._networkManager, "network manager not set");
     this._opening = true;
     (0, import_log15.log)("opening...", {
       lockKey: (_a = this._resourceLock) == null ? void 0 : _a.lockKey
     }, {
-      file: "service-host.ts",
-      line: 196,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file14,
+      L: 211,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await ((_b = this._resourceLock) == null ? void 0 : _b.acquire());
     await this._loggingService.open();
@@ -3886,18 +4044,18 @@ var ClientServicesHost = class {
     (0, import_log15.log)("opened", {
       deviceKey
     }, {
-      file: "service-host.ts",
-      line: 251,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file14,
+      L: 266,
+      S: this,
+      C: (f, a) => f(...a)
     });
     import_log15.log.trace("dxos.sdk.client-services-host.open", import_protocols9.trace.end({
       id: traceId
     }), {
-      file: "service-host.ts",
-      line: 252,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file14,
+      L: 267,
+      S: this,
+      C: (f, a) => f(...a)
     });
   }
   async close() {
@@ -3909,10 +4067,10 @@ var ClientServicesHost = class {
     (0, import_log15.log)("closing...", {
       deviceKey
     }, {
-      file: "service-host.ts",
-      line: 262,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file14,
+      L: 277,
+      S: this,
+      C: (f, a) => f(...a)
     });
     this._serviceRegistry.setServices({
       SystemService: this._systemService
@@ -3924,51 +4082,52 @@ var ClientServicesHost = class {
     (0, import_log15.log)("closed", {
       deviceKey
     }, {
-      file: "service-host.ts",
-      line: 268,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file14,
+      L: 283,
+      S: this,
+      C: (f, a) => f(...a)
     });
   }
   async reset() {
-    var _a;
+    var _a, _b, _c;
     const traceId = import_keys11.PublicKey.random().toHex();
     import_log15.log.trace("dxos.sdk.client-services-host.reset", import_protocols9.trace.begin({
       id: traceId
     }), {
-      file: "service-host.ts",
-      line: 273,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file14,
+      L: 288,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    (0, import_log15.log)("resetting...", {}, {
-      file: "service-host.ts",
-      line: 275,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log15.log)("resetting...", void 0, {
+      F: __dxlog_file14,
+      L: 290,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await ((_a = this._serviceContext) == null ? void 0 : _a.close());
     await this._storage.reset();
-    (0, import_log15.log)("reset", {}, {
-      file: "service-host.ts",
-      line: 278,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log15.log)("reset", void 0, {
+      F: __dxlog_file14,
+      L: 293,
+      S: this,
+      C: (f, a) => f(...a)
     });
     import_log15.log.trace("dxos.sdk.client-services-host.reset", import_protocols9.trace.end({
       id: traceId
     }), {
-      file: "service-host.ts",
-      line: 279,
-      scope: this,
-      callSite: (f, a) => f(...a)
+      F: __dxlog_file14,
+      L: 294,
+      S: this,
+      C: (f, a) => f(...a)
     });
+    await ((_c = (_b = this._callbacks) == null ? void 0 : _b.onReset) == null ? void 0 : _c.call(_b));
   }
 };
-__decorate4([
+_ts_decorate4([
   import_async17.synchronized
 ], ClientServicesHost.prototype, "open", null);
-__decorate4([
+_ts_decorate4([
   import_async17.synchronized
 ], ClientServicesHost.prototype, "close", null);
 
@@ -3980,61 +4139,8 @@ var import_messaging2 = require("@dxos/messaging");
 var import_network_manager3 = require("@dxos/network-manager");
 var import_util9 = require("@dxos/util");
 
-// packages/sdk/client-services/src/packlets/services/client-rpc-server.ts
-var import_codec_protobuf14 = require("@dxos/codec-protobuf");
-var import_debug7 = require("@dxos/debug");
-var import_rpc = require("@dxos/rpc");
-var ClientRpcServer = class {
-  constructor(params) {
-    this._handlerCache = /* @__PURE__ */ new Map();
-    const { serviceRegistry, handleCall, handleStream, ...rpcOptions } = params;
-    this._handleCall = handleCall;
-    this._handleStream = handleStream;
-    this._serviceRegistry = serviceRegistry;
-    this._rpcPeer = new import_rpc.RpcPeer({
-      ...rpcOptions,
-      callHandler: (method, params2) => {
-        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
-        const handler = (method2, params3) => this._getServiceHandler(serviceName).call(method2, params3);
-        if (this._handleCall) {
-          return this._handleCall(methodName, params2, handler);
-        } else {
-          return handler(methodName, params2);
-        }
-      },
-      streamHandler: (method, params2) => {
-        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
-        const handler = (method2, params3) => this._getServiceHandler(serviceName).callStream(method2, params3);
-        if (this._handleStream) {
-          return import_codec_protobuf14.Stream.unwrapPromise(this._handleStream(methodName, params2, handler));
-        } else {
-          return handler(methodName, params2);
-        }
-      }
-    });
-  }
-  async open() {
-    await this._rpcPeer.open();
-  }
-  async close() {
-    await this._rpcPeer.close();
-  }
-  _getServiceHandler(serviceName) {
-    var _a;
-    if (!this._handlerCache.has(serviceName)) {
-      const [key, descriptor] = (_a = Object.entries(this._serviceRegistry.descriptors).find(([key2, descriptor2]) => descriptor2.name === serviceName)) != null ? _a : (0, import_debug7.raise)(new Error(`Service not available: ${serviceName}`));
-      const service = this._serviceRegistry.services[key];
-      if (!service) {
-        throw new Error(`Service not available: ${serviceName}`);
-      }
-      this._handlerCache.set(serviceName, descriptor.createServer(service));
-    }
-    return this._handlerCache.get(serviceName);
-  }
-};
-
 // packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
-var import_node_assert14 = __toESM(require("node:assert"));
+var import_tiny_invariant14 = __toESM(require("tiny-invariant"));
 var import_async18 = require("@dxos/async");
 var import_client_protocol6 = require("@dxos/client-protocol");
 var import_iframe = require("@dxos/protocols/proto/dxos/iframe");
@@ -4064,7 +4170,7 @@ var ShellRuntimeImpl = class {
     });
   }
   async setAppContext(context) {
-    (0, import_node_assert14.default)(this._appRpc, "runtime not open");
+    (0, import_tiny_invariant14.default)(this._appRpc, "runtime not open");
     await this._appRpc.rpc.AppService.setContext(context);
   }
   async open() {
@@ -4091,39 +4197,9 @@ var ShellRuntimeImpl = class {
     this._appRpc = void 0;
   }
 };
-var MemoryShellRuntime = class {
-  constructor({ layout, invitationCode, spaceKey } = {}) {
-    this.layoutUpdate = new import_async18.Event();
-    this.contextUpdate = new import_async18.Event();
-    this._layout = layout != null ? layout : import_iframe.ShellLayout.DEFAULT;
-    this._invitationCode = invitationCode;
-    this._spaceKey = spaceKey;
-  }
-  get layout() {
-    return this._layout;
-  }
-  get invitationCode() {
-    return this._invitationCode;
-  }
-  get spaceKey() {
-    return this._spaceKey;
-  }
-  setLayout(layout, options = {}) {
-    this._layout = layout;
-    this._invitationCode = options.invitationCode;
-    this._spaceKey = options.spaceKey;
-    this.layoutUpdate.emit({
-      layout,
-      ...options
-    });
-  }
-  async setAppContext(context) {
-    this.contextUpdate.emit(context);
-  }
-};
 
 // packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts
-var __decorate5 = function(decorators, target, key, desc) {
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -4132,7 +4208,8 @@ var __decorate5 = function(decorators, target, key, desc) {
       if (d = decorators[i])
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
+}
+var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/iframe-host-runtime.ts";
 var LOCK_KEY = "DXOS_RESOURCE_LOCK";
 var IFrameHostRuntime = class {
   constructor({ config, origin, appPort, shellPort }) {
@@ -4153,11 +4230,11 @@ var IFrameHostRuntime = class {
   }
   async start() {
     var _a;
-    (0, import_log16.log)("starting...", {}, {
-      file: "iframe-host-runtime.ts",
-      line: 70,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log16.log)("starting...", void 0, {
+      F: __dxlog_file15,
+      L: 70,
+      S: this,
+      C: (f, a) => f(...a)
     });
     try {
       this._config = await (0, import_util9.getAsyncValue)(this._configProvider);
@@ -4202,53 +4279,54 @@ var IFrameHostRuntime = class {
         (_a = this._shellRuntime) == null ? void 0 : _a.open()
       ]);
       this._ready.wake(void 0);
-      (0, import_log16.log)("started", {}, {
-        file: "iframe-host-runtime.ts",
-        line: 113,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      (0, import_log16.log)("started", void 0, {
+        F: __dxlog_file15,
+        L: 113,
+        S: this,
+        C: (f, a) => f(...a)
       });
     } catch (err) {
       this._ready.wake(err);
-      import_log16.log.catch(err, {}, {
-        file: "iframe-host-runtime.ts",
-        line: 116,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      import_log16.log.catch(err, void 0, {
+        F: __dxlog_file15,
+        L: 116,
+        S: this,
+        C: (f, a) => f(...a)
       });
     }
   }
   async stop() {
     var _a;
-    (0, import_log16.log)("stopping...", {}, {
-      file: "iframe-host-runtime.ts",
-      line: 121,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log16.log)("stopping...", void 0, {
+      F: __dxlog_file15,
+      L: 121,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await this._clientRpc.close();
     await this._clientServices.close();
     await ((_a = this._shellRuntime) == null ? void 0 : _a.close());
-    (0, import_log16.log)("stopped", {}, {
-      file: "iframe-host-runtime.ts",
-      line: 125,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log16.log)("stopped", void 0, {
+      F: __dxlog_file15,
+      L: 125,
+      S: this,
+      C: (f, a) => f(...a)
     });
   }
 };
-__decorate5([
+_ts_decorate5([
   import_log16.logInfo
 ], IFrameHostRuntime.prototype, "origin", void 0);
 
 // packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
 var import_async20 = require("@dxos/async");
 var import_client_protocol8 = require("@dxos/client-protocol");
-var import_errors5 = require("@dxos/errors");
+var import_errors6 = require("@dxos/errors");
 var import_log17 = require("@dxos/log");
 var import_network_manager4 = require("@dxos/network-manager");
 var import_rpc3 = require("@dxos/rpc");
 var import_util10 = require("@dxos/util");
+var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts";
 var IFrameProxyRuntime = class {
   constructor({ config, systemPort, shellPort }) {
     this._id = String(Math.floor(Math.random() * 1e6));
@@ -4296,13 +4374,13 @@ var IFrameProxyRuntime = class {
         lockKey
       });
     } catch (err) {
-      import_log17.log.catch(err, {}, {
-        file: "iframe-proxy-runtime.ts",
-        line: 85,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      import_log17.log.catch(err, void 0, {
+        F: __dxlog_file16,
+        L: 85,
+        S: this,
+        C: (f, a) => f(...a)
       });
-      throw new import_errors5.RemoteServiceConnectionError("Failed to connect to worker");
+      throw new import_errors6.RemoteServiceConnectionError("Failed to connect to worker");
     }
     await ((_a = this._shellRuntime) == null ? void 0 : _a.open());
   }
@@ -4325,13 +4403,13 @@ var import_messaging3 = require("@dxos/messaging");
 var import_network_manager5 = require("@dxos/network-manager");
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
-var import_node_assert15 = __toESM(require("node:assert"));
+var import_tiny_invariant15 = __toESM(require("tiny-invariant"));
 var import_async21 = require("@dxos/async");
 var import_client_protocol9 = require("@dxos/client-protocol");
 var import_log18 = require("@dxos/log");
 var import_rpc4 = require("@dxos/rpc");
 var import_util11 = require("@dxos/util");
-var __decorate6 = function(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
     r = Reflect.decorate(decorators, target, key, desc);
@@ -4340,12 +4418,13 @@ var __decorate6 = function(decorators, target, key, desc) {
       if (d = decorators[i])
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
+}
+var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-session.ts";
 var WorkerSession = class {
   constructor({ serviceHost, systemPort, appPort, shellPort, readySignal }) {
     this._startTrigger = new import_async21.Trigger();
     this.onClose = new import_util11.Callback();
-    (0, import_node_assert15.default)(serviceHost);
+    (0, import_tiny_invariant15.default)(serviceHost);
     this._serviceHost = serviceHost;
     const middleware = {
       handleCall: async (method, params, handler) => {
@@ -4392,11 +4471,11 @@ var WorkerSession = class {
               try {
                 await this.close();
               } catch (err) {
-                import_log18.log.catch(err, {}, {
-                  file: "worker-session.ts",
-                  line: 100,
-                  scope: this,
-                  callSite: (f, a) => f(...a)
+                import_log18.log.catch(err, void 0, {
+                  F: __dxlog_file17,
+                  L: 99,
+                  S: this,
+                  C: (f, a) => f(...a)
                 });
               }
             });
@@ -4409,11 +4488,11 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    import_log18.log.info("opening..", {}, {
-      file: "worker-session.ts",
-      line: 114,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    import_log18.log.info("opening...", void 0, {
+      F: __dxlog_file17,
+      L: 113,
+      S: this,
+      C: (f, a) => f(...a)
     });
     await Promise.all([
       this._clientRpc.open(),
@@ -4426,38 +4505,50 @@ var WorkerSession = class {
     if (this.lockKey) {
       void this._afterLockReleases(this.lockKey, () => this.close());
     }
+    import_log18.log.info("opened", void 0, {
+      F: __dxlog_file17,
+      L: 120,
+      S: this,
+      C: (f, a) => f(...a)
+    });
   }
   async close() {
-    import_log18.log.info("closing..", {}, {
-      file: "worker-session.ts",
-      line: 124,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    import_log18.log.info("closing...", void 0, {
+      F: __dxlog_file17,
+      L: 124,
+      S: this,
+      C: (f, a) => f(...a)
     });
     try {
       await this.onClose.callIfSet();
     } catch (err) {
-      import_log18.log.catch(err, {}, {
-        file: "worker-session.ts",
-        line: 128,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      import_log18.log.catch(err, void 0, {
+        F: __dxlog_file17,
+        L: 128,
+        S: this,
+        C: (f, a) => f(...a)
       });
     }
     await Promise.all([
       this._clientRpc.close(),
       this._iframeRpc.close()
     ]);
+    import_log18.log.info("closed", void 0, {
+      F: __dxlog_file17,
+      L: 132,
+      S: this,
+      C: (f, a) => f(...a)
+    });
   }
   async _maybeOpenShell() {
     try {
       await (0, import_async21.asyncTimeout)(this._shellClientRpc.open(), 1e3);
     } catch (e) {
-      import_log18.log.info("No shell connected.", {}, {
-        file: "worker-session.ts",
-        line: 138,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      import_log18.log.info("No shell connected.", void 0, {
+        F: __dxlog_file17,
+        L: 139,
+        S: this,
+        C: (f, a) => f(...a)
       });
     }
   }
@@ -4466,14 +4557,15 @@ var WorkerSession = class {
     }).then(callback);
   }
 };
-__decorate6([
+_ts_decorate6([
   import_log18.logInfo
 ], WorkerSession.prototype, "origin", void 0);
-__decorate6([
+_ts_decorate6([
   import_log18.logInfo
 ], WorkerSession.prototype, "lockKey", void 0);
 
 // packages/sdk/client-services/src/packlets/vault/worker-runtime.ts
+var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/vault/worker-runtime.ts";
 var WorkerRuntime = class {
   // prettier-ignore
   constructor(_configProvider) {
@@ -4481,17 +4573,23 @@ var WorkerRuntime = class {
     this._transportFactory = new import_network_manager5.WebRTCTransportProxyFactory();
     this._ready = new import_async22.Trigger();
     this.sessions = /* @__PURE__ */ new Set();
-    this._clientServices = new ClientServicesHost();
+    this._clientServices = new ClientServicesHost({
+      callbacks: {
+        onReset: async () => {
+          self.close();
+        }
+      }
+    });
   }
   get host() {
     return this._clientServices;
   }
   async start() {
-    (0, import_log19.log)("starting...", {}, {
-      file: "worker-runtime.ts",
-      line: 48,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log19.log)("starting...", void 0, {
+      F: __dxlog_file18,
+      L: 48,
+      S: this,
+      C: (f, a) => f(...a)
     });
     try {
       this._config = await this._configProvider();
@@ -4503,19 +4601,19 @@ var WorkerRuntime = class {
       });
       await this._clientServices.open();
       this._ready.wake(void 0);
-      (0, import_log19.log)("started", {}, {
-        file: "worker-runtime.ts",
-        line: 62,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      (0, import_log19.log)("started", void 0, {
+        F: __dxlog_file18,
+        L: 62,
+        S: this,
+        C: (f, a) => f(...a)
       });
     } catch (err) {
       this._ready.wake(err);
-      import_log19.log.catch(err, {}, {
-        file: "worker-runtime.ts",
-        line: 65,
-        scope: this,
-        callSite: (f, a) => f(...a)
+      import_log19.log.catch(err, void 0, {
+        F: __dxlog_file18,
+        L: 65,
+        S: this,
+        C: (f, a) => f(...a)
       });
     }
   }
@@ -4545,11 +4643,11 @@ var WorkerRuntime = class {
   * Selects one of the existing session fro WebRTC networking.
   */
   _reconnectWebrtc() {
-    (0, import_log19.log)("reconnecting webrtc...", {}, {
-      file: "worker-runtime.ts",
-      line: 102,
-      scope: this,
-      callSite: (f, a) => f(...a)
+    (0, import_log19.log)("reconnecting webrtc...", void 0, {
+      F: __dxlog_file18,
+      L: 102,
+      S: this,
+      C: (f, a) => f(...a)
     });
     if (this._sessionForNetworking) {
       if (!this.sessions.has(this._sessionForNetworking)) {
@@ -4569,6 +4667,7 @@ var WorkerRuntime = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ClientRpcServer,
   ClientServicesHost,
   DataSpace,
   DataSpaceManager,
@@ -4583,7 +4682,6 @@ var WorkerRuntime = class {
   InvitationsHandler,
   InvitationsServiceImpl,
   Lock,
-  MemoryShellRuntime,
   ServiceContext,
   ServiceRegistry,
   ShellRuntimeImpl,
@@ -4593,6 +4691,7 @@ var WorkerRuntime = class {
   WorkerRuntime,
   WorkerSession,
   createAuthProvider,
+  createDefaultModelFactory,
   createStorageObjects,
   getNetworkPeers,
   isLocked,