@dxos/client-services 0.1.53-main.f5aedb7 → 0.1.53-next.3ab34c0

package/dist/lib/node/index.cjs

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // packages/sdk/client-services/src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   DataSpace: () => DataSpace,
   DataSpaceManager: () => DataSpaceManager,
@@ -420,6 +421,7 @@ var import_credentials = require("@dxos/credentials");
 var import_log = require("@dxos/log");
 var import_protocols = require("@dxos/protocols");
 var __dxlog_file = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts";
+var Credential = import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential");
 var createAuthProvider = (signer) => async (nonce) => {
   const credential = await signer.createCredential({
     assertion: {
@@ -428,7 +430,7 @@ var createAuthProvider = (signer) => async (nonce) => {
     subject: signer.getIssuer(),
     nonce
   });
-  return import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").encode(credential);
+  return Credential.encode(credential);
 };
 var TrustedKeySetAuthVerifier = class {
   // prettier-ignore
@@ -441,12 +443,12 @@ var TrustedKeySetAuthVerifier = class {
   }
   get verifier() {
     return async (nonce, auth) => {
-      const credential = import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
+      const credential = Credential.decode(auth);
       (0, import_log.log)("authenticating...", {
         credential
       }, {
         F: __dxlog_file,
-        L: 57,
+        L: 59,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -456,7 +458,7 @@ var TrustedKeySetAuthVerifier = class {
           result
         }, {
           F: __dxlog_file,
-          L: 61,
+          L: 63,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -468,7 +470,7 @@ var TrustedKeySetAuthVerifier = class {
           credential
         }, {
           F: __dxlog_file,
-          L: 66,
+          L: 68,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -479,7 +481,7 @@ var TrustedKeySetAuthVerifier = class {
           key: credential.issuer
         }, {
           F: __dxlog_file,
-          L: 71,
+          L: 73,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -495,7 +497,7 @@ var TrustedKeySetAuthVerifier = class {
             key: credential.issuer
           }, {
             F: __dxlog_file,
-            L: 82,
+            L: 84,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -505,7 +507,7 @@ var TrustedKeySetAuthVerifier = class {
             key: credential.issuer
           }, {
             F: __dxlog_file,
-            L: 85,
+            L: 87,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -545,15 +547,15 @@ var Identity = class {
     this._signer = signer;
     this.identityKey = identityKey;
     this.deviceKey = deviceKey;
-    this._deviceStateMachine = this.space.spaceState.registerProcessor(new import_credentials2.DeviceStateMachine({
+    this._deviceStateMachine = new import_credentials2.DeviceStateMachine({
       identityKey: this.identityKey,
       deviceKey: this.deviceKey,
       onUpdate: () => this.stateUpdate.emit()
-    }));
-    this._profileStateMachine = this.space.spaceState.registerProcessor(new import_credentials2.ProfileStateMachine({
+    });
+    this._profileStateMachine = new import_credentials2.ProfileStateMachine({
       identityKey: this.identityKey,
       onUpdate: () => this.stateUpdate.emit()
-    }));
+    });
     this.authVerifier = new TrustedKeySetAuthVerifier({
       trustedKeysProvider: () => this.authorizedDeviceKeys,
       update: this.stateUpdate,
@@ -562,27 +564,27 @@ var Identity = class {
   }
   // TODO(burdon): Expose state object?
   get authorizedDeviceKeys() {
-    return this._deviceStateMachine.processor.authorizedDeviceKeys;
+    return this._deviceStateMachine.authorizedDeviceKeys;
   }
   async open() {
-    await this._deviceStateMachine.open();
-    await this._profileStateMachine.open();
+    await this.space.spaceState.addCredentialProcessor(this._deviceStateMachine);
+    await this.space.spaceState.addCredentialProcessor(this._profileStateMachine);
     await this.space.open();
   }
   async close() {
     await this.authVerifier.close();
-    await this._deviceStateMachine.close();
-    await this._profileStateMachine.close();
+    await this.space.spaceState.removeCredentialProcessor(this._profileStateMachine);
+    await this.space.spaceState.removeCredentialProcessor(this._deviceStateMachine);
     await this.space.close();
   }
   async ready() {
-    await this._deviceStateMachine.processor.deviceChainReady.wait();
+    await this._deviceStateMachine.deviceChainReady.wait();
     await this.controlPipeline.state.waitUntilReachedTargetTimeframe({
       timeout: import_client_protocol.LOAD_CONTROL_FEEDS_TIMEOUT
     });
   }
   get profileDocument() {
-    return this._profileStateMachine.processor.profile;
+    return this._profileStateMachine.profile;
   }
   /**
   * @test-only
@@ -597,7 +599,7 @@ var Identity = class {
     return this.space.genesisFeedKey;
   }
   get deviceCredentialChain() {
-    return this._deviceStateMachine.processor.deviceCredentialChain;
+    return this._deviceStateMachine.deviceCredentialChain;
   }
   getAdmissionCredentials() {
     var _a, _b;
@@ -612,8 +614,8 @@ var Identity = class {
   * Requires identity to be ready.
   */
   getIdentityCredentialSigner() {
-    (0, import_tiny_invariant.default)(this._deviceStateMachine.processor.deviceCredentialChain, "Device credential chain is not ready.");
-    return (0, import_credentials2.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.processor.deviceCredentialChain, this.deviceKey);
+    (0, import_tiny_invariant.default)(this._deviceStateMachine.deviceCredentialChain, "Device credential chain is not ready.");
+    return (0, import_credentials2.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.deviceCredentialChain, this.deviceKey);
   }
   /**
   * Issues credentials as device.
@@ -630,7 +632,7 @@ var Identity = class {
       dataFeedKey
     }, {
       F: __dxlog_file2,
-      L: 156,
+      L: 151,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2148,11 +2150,64 @@ var SpaceInvitationProtocol = class {
   }
 };
 
+// packages/sdk/client-services/src/packlets/services/client-rpc-server.ts
+var import_codec_protobuf9 = require("@dxos/codec-protobuf");
+var import_debug3 = require("@dxos/debug");
+var import_rpc = require("@dxos/rpc");
+var ClientRpcServer = class {
+  constructor(params) {
+    this._handlerCache = /* @__PURE__ */ new Map();
+    const { serviceRegistry, handleCall, handleStream, ...rpcOptions } = params;
+    this._handleCall = handleCall;
+    this._handleStream = handleStream;
+    this._serviceRegistry = serviceRegistry;
+    this._rpcPeer = new import_rpc.RpcPeer({
+      ...rpcOptions,
+      callHandler: (method, params2) => {
+        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
+        const handler = (method2, params3) => this._getServiceHandler(serviceName).call(method2, params3);
+        if (this._handleCall) {
+          return this._handleCall(methodName, params2, handler);
+        } else {
+          return handler(methodName, params2);
+        }
+      },
+      streamHandler: (method, params2) => {
+        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
+        const handler = (method2, params3) => this._getServiceHandler(serviceName).callStream(method2, params3);
+        if (this._handleStream) {
+          return import_codec_protobuf9.Stream.unwrapPromise(this._handleStream(methodName, params2, handler));
+        } else {
+          return handler(methodName, params2);
+        }
+      }
+    });
+  }
+  async open() {
+    await this._rpcPeer.open();
+  }
+  async close() {
+    await this._rpcPeer.close();
+  }
+  _getServiceHandler(serviceName) {
+    var _a;
+    if (!this._handlerCache.has(serviceName)) {
+      const [key, descriptor] = (_a = Object.entries(this._serviceRegistry.descriptors).find(([key2, descriptor2]) => descriptor2.name === serviceName)) != null ? _a : (0, import_debug3.raise)(new Error(`Service not available: ${serviceName}`));
+      const service = this._serviceRegistry.services[key];
+      if (!service) {
+        throw new Error(`Service not available: ${serviceName}`);
+      }
+      this._handlerCache.set(serviceName, descriptor.createServer(service));
+    }
+    return this._handlerCache.get(serviceName);
+  }
+};
+
 // packages/sdk/client-services/src/packlets/services/service-context.ts
 var import_tiny_invariant11 = __toESM(require("tiny-invariant"));
 var import_async14 = require("@dxos/async");
 var import_credentials13 = require("@dxos/credentials");
-var import_debug6 = require("@dxos/debug");
+var import_debug7 = require("@dxos/debug");
 var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_keyring = require("@dxos/keyring");
@@ -2178,7 +2233,7 @@ var import_util5 = require("@dxos/util");
 var import_async11 = require("@dxos/async");
 var import_client_protocol3 = require("@dxos/client-protocol");
 var import_context6 = require("@dxos/context");
-var import_debug3 = require("@dxos/debug");
+var import_debug4 = require("@dxos/debug");
 var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_errors3 = require("@dxos/errors");
 var import_keys8 = require("@dxos/keys");
@@ -2210,6 +2265,9 @@ var NotarizationPlugin = class {
     this._processedCredentials = new import_util3.ComplexSet(import_keys7.PublicKey.hash);
     this._processCredentialsTriggers = new import_util3.ComplexMap(import_keys7.PublicKey.hash);
   }
+  get hasWriter() {
+    return !!this._writer;
+  }
   async open() {
   }
   async close() {
@@ -2223,7 +2281,7 @@ var NotarizationPlugin = class {
       credentials
     }, {
       F: __dxlog_file8,
-      L: 87,
+      L: 91,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2235,7 +2293,7 @@ var NotarizationPlugin = class {
           err
         }, {
           F: __dxlog_file8,
-          L: 96,
+          L: 100,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2251,7 +2309,7 @@ var NotarizationPlugin = class {
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
         }, {
           F: __dxlog_file8,
-          L: 108,
+          L: 112,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2274,7 +2332,7 @@ var NotarizationPlugin = class {
             retryIn: retryTimeout
           }, {
             F: __dxlog_file8,
-            L: 133,
+            L: 137,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2288,7 +2346,7 @@ var NotarizationPlugin = class {
           credentialId: credentials.map((credential) => credential.id)
         }, {
           F: __dxlog_file8,
-          L: 140,
+          L: 144,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2297,7 +2355,7 @@ var NotarizationPlugin = class {
         });
         (0, import_log8.log)("success", void 0, {
           F: __dxlog_file8,
-          L: 144,
+          L: 148,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2306,7 +2364,7 @@ var NotarizationPlugin = class {
         if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
           import_log8.log.warn("error notarizing (recoverable)", err, {
             F: __dxlog_file8,
-            L: 148,
+            L: 152,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2324,7 +2382,7 @@ var NotarizationPlugin = class {
       ]);
       (0, import_log8.log)("done", void 0, {
         F: __dxlog_file8,
-        L: 159,
+        L: 163,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2335,7 +2393,7 @@ var NotarizationPlugin = class {
   /**
   * Called with credentials arriving from the control pipeline.
   */
-  async process(credential) {
+  async processCredential(credential) {
     var _a;
     if (!credential.id) {
       return;
@@ -2377,7 +2435,7 @@ var NotarizationPlugin = class {
           peer: extension.localPeerId
         }, {
           F: __dxlog_file8,
-          L: 208,
+          L: 212,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2389,7 +2447,7 @@ var NotarizationPlugin = class {
           peer: extension.localPeerId
         }, {
           F: __dxlog_file8,
-          L: 213,
+          L: 217,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2446,6 +2504,7 @@ var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/sr
 var DataSpace = class DataSpace2 {
   constructor(params) {
     this._ctx = new import_context6.Context();
+    this._notarizationPlugin = new NotarizationPlugin();
     this._state = import_services6.SpaceState.CLOSED;
     /**
     * Error for _state === SpaceState.ERROR.
@@ -2468,8 +2527,8 @@ var DataSpace = class DataSpace2 {
       update: this._inner.stateUpdate,
       authTimeout: import_client_protocol3.AUTH_TIMEOUT
     });
-    this._notarizationPluginConsumer = this._inner.spaceState.registerProcessor(new NotarizationPlugin());
     this._cache = params.cache;
+    this._state = params.initialState;
   }
   get key() {
     return this._inner.key;
@@ -2491,25 +2550,36 @@ var DataSpace = class DataSpace2 {
     return this._presence;
   }
   get notarizationPlugin() {
-    return this._notarizationPluginConsumer.processor;
+    return this._notarizationPlugin;
   }
   get cache() {
     return this._cache;
   }
   async open() {
-    await this.notarizationPlugin.open();
-    await this._notarizationPluginConsumer.open();
+    await this._open();
+  }
+  async _open() {
+    await this._notarizationPlugin.open();
+    await this._inner.spaceState.addCredentialProcessor(this._notarizationPlugin);
     await this._inner.open();
-    this._state = import_services6.SpaceState.INACTIVE;
+    this._state = import_services6.SpaceState.CONTROL_ONLY;
+    this.stateUpdate.emit();
+    this.metrics = {};
     this.metrics.open = new Date();
   }
   async close() {
+    await this._close();
+  }
+  async _close() {
+    var _a, _b;
+    await ((_b = (_a = this._callbacks).beforeClose) == null ? void 0 : _b.call(_a));
     this._state = import_services6.SpaceState.CLOSED;
     await this._ctx.dispose();
+    this._ctx = new import_context6.Context();
     await this.authVerifier.close();
     await this._inner.close();
-    await this._notarizationPluginConsumer.close();
-    await this.notarizationPlugin.close();
+    await this._inner.spaceState.removeCredentialProcessor(this._notarizationPlugin);
+    await this._notarizationPlugin.close();
     await this._presence.destroy();
   }
   async postMessage(channel, message) {
@@ -2530,7 +2600,7 @@ var DataSpace = class DataSpace2 {
         if (err instanceof import_errors3.CancelledError) {
           (0, import_log9.log)("Data pipeline initialization cancelled", err, {
             F: __dxlog_file9,
-            L: 173,
+            L: 193,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2538,7 +2608,7 @@ var DataSpace = class DataSpace2 {
         }
         import_log9.log.error("Error initializing data pipeline", err, {
           F: __dxlog_file9,
-          L: 177,
+          L: 197,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2552,7 +2622,7 @@ var DataSpace = class DataSpace2 {
   }
   async initializeDataPipeline() {
     var _a, _b, _c, _d;
-    if (this._state !== import_services6.SpaceState.INACTIVE) {
+    if (this._state !== import_services6.SpaceState.CONTROL_ONLY) {
       throw new import_errors3.SystemError("Invalid operation");
     }
     this._state = import_services6.SpaceState.INITIALIZING;
@@ -2564,22 +2634,24 @@ var DataSpace = class DataSpace2 {
     await this._createWritableFeeds();
     (0, import_log9.log)("Writable feeds created", void 0, {
       F: __dxlog_file9,
-      L: 201,
+      L: 221,
       S: this,
       C: (f, a) => f(...a)
     });
     this.stateUpdate.emit();
-    this.notarizationPlugin.setWriter((0, import_echo_pipeline.createMappedFeedWriter)((credential) => ({
-      credential: {
-        credential
-      }
-    }), this._inner.controlPipeline.writer));
+    if (!this.notarizationPlugin.hasWriter) {
+      this.notarizationPlugin.setWriter((0, import_echo_pipeline.createMappedFeedWriter)((credential) => ({
+        credential: {
+          credential
+        }
+      }), this._inner.controlPipeline.writer));
+    }
     await this._inner.initializeDataPipeline();
     this.metrics.dataPipelineOpen = new Date();
     await (0, import_context6.cancelWithContext)(this._ctx, this._inner.dataPipeline.ensureEpochInitialized());
     (0, import_log9.log)("waiting for data pipeline to reach target timeframe", void 0, {
       F: __dxlog_file9,
-      L: 220,
+      L: 242,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2590,7 +2662,7 @@ var DataSpace = class DataSpace2 {
     this.metrics.dataPipelineReady = new Date();
     (0, import_log9.log)("data pipeline ready", void 0, {
       F: __dxlog_file9,
-      L: 229,
+      L: 251,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2670,17 +2742,46 @@ var DataSpace = class DataSpace2 {
       }
     }
   }
+  async activate() {
+    if (this._state !== import_services6.SpaceState.INACTIVE) {
+      throw new import_errors3.SystemError("Invalid operation");
+    }
+    await this._metadataStore.setSpaceState(this.key, import_services6.SpaceState.ACTIVE);
+    await this._open();
+    this.initializeDataPipelineAsync();
+  }
+  async deactivate() {
+    if (this._state === import_services6.SpaceState.INACTIVE) {
+      throw new import_errors3.SystemError("Invalid operation");
+    }
+    await this._metadataStore.setSpaceState(this.key, import_services6.SpaceState.INACTIVE);
+    await this._close();
+    this._state = import_services6.SpaceState.INACTIVE;
+    this.stateUpdate.emit();
+  }
 };
 _ts_decorate([
-  (0, import_debug3.timed)(1e4)
+  import_async11.synchronized
+], DataSpace.prototype, "open", null);
+_ts_decorate([
+  import_async11.synchronized
+], DataSpace.prototype, "close", null);
+_ts_decorate([
+  (0, import_debug4.timed)(1e4)
 ], DataSpace.prototype, "_createWritableFeeds", null);
+_ts_decorate([
+  import_async11.synchronized
+], DataSpace.prototype, "activate", null);
+_ts_decorate([
+  import_async11.synchronized
+], DataSpace.prototype, "deactivate", null);
 DataSpace = _ts_decorate([
   (0, import_async11.trackLeaks)("open", "close")
 ], DataSpace);
 
 // packages/sdk/client-services/src/packlets/spaces/genesis.ts
 var import_credentials10 = require("@dxos/credentials");
-var import_debug4 = require("@dxos/debug");
+var import_debug5 = require("@dxos/debug");
 var import_credentials11 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe2 = require("@dxos/timeframe");
 var spaceGenesis = async (keyring, signingContext, space) => {
@@ -2704,11 +2805,11 @@ var spaceGenesis = async (keyring, signingContext, space) => {
         spaceKey: space.key,
         role: import_credentials11.SpaceMember.Role.ADMIN,
         profile: signingContext.profile,
-        genesisFeedKey: (_a = space.controlFeedKey) != null ? _a : (0, import_debug4.failUndefined)()
+        genesisFeedKey: (_a = space.controlFeedKey) != null ? _a : (0, import_debug5.failUndefined)()
       }
     }),
     await signingContext.credentialSigner.createCredential({
-      subject: (_b = space.controlFeedKey) != null ? _b : (0, import_debug4.failUndefined)(),
+      subject: (_b = space.controlFeedKey) != null ? _b : (0, import_debug5.failUndefined)(),
       assertion: {
         "@type": "dxos.halo.credentials.AdmittedFeed",
         spaceKey: space.key,
@@ -2718,7 +2819,7 @@ var spaceGenesis = async (keyring, signingContext, space) => {
       }
     }),
     await signingContext.credentialSigner.createCredential({
-      subject: (_c = space.dataFeedKey) != null ? _c : (0, import_debug4.failUndefined)(),
+      subject: (_c = space.dataFeedKey) != null ? _c : (0, import_debug5.failUndefined)(),
       assertion: {
         "@type": "dxos.halo.credentials.AdmittedFeed",
         spaceKey: space.key,
@@ -2728,7 +2829,7 @@ var spaceGenesis = async (keyring, signingContext, space) => {
       }
     }),
     await signingContext.credentialSigner.createCredential({
-      subject: (_d = space.key) != null ? _d : (0, import_debug4.failUndefined)(),
+      subject: (_d = space.key) != null ? _d : (0, import_debug5.failUndefined)(),
       assertion: {
         "@type": "dxos.halo.credentials.Epoch",
         number: 0,
@@ -2813,14 +2914,16 @@ var DataSpaceManager = class DataSpaceManager2 {
           C: (f, a) => f(...a)
         });
         const space = await this._constructSpace(spaceMetadata);
-        space.initializeDataPipelineAsync();
+        if (spaceMetadata.state !== import_services7.SpaceState.INACTIVE) {
+          space.initializeDataPipelineAsync();
+        }
       } catch (err) {
         import_log10.log.error("Error loading space", {
           spaceMetadata,
           err
         }, {
           F: __dxlog_file10,
-          L: 91,
+          L: 93,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2832,7 +2935,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       id: this._instanceId
     }), {
       F: __dxlog_file10,
-      L: 97,
+      L: 99,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2840,7 +2943,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   async close() {
     (0, import_log10.log)("close", void 0, {
       F: __dxlog_file10,
-      L: 102,
+      L: 104,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2862,13 +2965,14 @@ var DataSpaceManager = class DataSpaceManager2 {
       key: spaceKey,
       genesisFeedKey: controlFeedKey,
       controlFeedKey,
-      dataFeedKey
+      dataFeedKey,
+      state: import_services7.SpaceState.ACTIVE
     };
     (0, import_log10.log)("creating space...", {
       spaceKey
     }, {
       F: __dxlog_file10,
-      L: 126,
+      L: 129,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2888,7 +2992,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       opts
     }, {
       F: __dxlog_file10,
-      L: 145,
+      L: 148,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2922,7 +3026,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       metadata
     }, {
       F: __dxlog_file10,
-      L: 180,
+      L: 183,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2958,7 +3062,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       onAuthFailure: () => {
         import_log10.log.warn("auth failure", void 0, {
           F: __dxlog_file10,
-          L: 211,
+          L: 214,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2969,6 +3073,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     dataFeed && space.setDataFeed(dataFeed);
     const dataSpace = new DataSpace({
       inner: space,
+      initialState: metadata.state === import_services7.SpaceState.INACTIVE ? import_services7.SpaceState.INACTIVE : import_services7.SpaceState.CLOSED,
       metadataStore: this._metadataStore,
       gossip,
       presence,
@@ -2981,11 +3086,11 @@ var DataSpaceManager = class DataSpaceManager2 {
             space: space.key
           }, {
             F: __dxlog_file10,
-            L: 228,
+            L: 232,
             S: this,
             C: (f, a) => f(...a)
           });
-          this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.dataPipeline.databaseHost.createDataServiceHost());
+          await this._dataServiceSubscriptions.registerSpace(space.key, dataSpace.dataPipeline.databaseHost.createDataServiceHost());
         },
         afterReady: async () => {
           (0, import_log10.log)("after space ready", {
@@ -2993,18 +3098,31 @@ var DataSpaceManager = class DataSpaceManager2 {
             open: this._isOpen
           }, {
             F: __dxlog_file10,
-            L: 235,
+            L: 239,
             S: this,
             C: (f, a) => f(...a)
           });
           if (this._isOpen) {
             this.updated.emit();
           }
+        },
+        beforeClose: async () => {
+          (0, import_log10.log)("before space close", {
+            space: space.key
+          }, {
+            F: __dxlog_file10,
+            L: 245,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          await this._dataServiceSubscriptions.unregisterSpace(space.key);
         }
       },
       cache: metadata.cache
     });
-    await dataSpace.open();
+    if (metadata.state !== import_services7.SpaceState.INACTIVE) {
+      await dataSpace.open();
+    }
     if (metadata.controlTimeframe) {
       dataSpace.inner.controlPipeline.state.setTargetTimeframe(metadata.controlTimeframe);
     }
@@ -3033,9 +3151,10 @@ DataSpaceManager = _ts_decorate2([
 
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
 var import_async13 = require("@dxos/async");
-var import_codec_protobuf9 = require("@dxos/codec-protobuf");
-var import_debug5 = require("@dxos/debug");
+var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_debug6 = require("@dxos/debug");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
+var import_errors4 = require("@dxos/errors");
 var import_log11 = require("@dxos/log");
 var import_protocols7 = require("@dxos/protocols");
 var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
@@ -3056,11 +3175,25 @@ var SpacesServiceImpl = class {
     const space = await dataSpaceManager.createSpace();
     return this._serializeSpace(space);
   }
-  async updateSpace(request) {
-    (0, import_debug5.todo)();
+  async updateSpace({ spaceKey, state }) {
+    var _a;
+    const dataSpaceManager = await this._getDataSpaceManager();
+    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+    if (state) {
+      switch (state) {
+        case import_services8.SpaceState.ACTIVE:
+          await space.activate();
+          break;
+        case import_services8.SpaceState.INACTIVE:
+          await space.deactivate();
+          break;
+        default:
+          throw new import_errors4.ApiError("Invalid space state");
+      }
+    }
   }
   querySpaces() {
-    return new import_codec_protobuf9.Stream(({ next, ctx }) => {
+    return new import_codec_protobuf10.Stream(({ next, ctx }) => {
       const scheduler = new import_async13.UpdateScheduler(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space));
@@ -3068,7 +3201,7 @@ var SpacesServiceImpl = class {
           spaces
         }, {
           F: __dxlog_file11,
-          L: 60,
+          L: 78,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3111,15 +3244,15 @@ var SpacesServiceImpl = class {
   async postMessage({ spaceKey, channel, message }) {
     var _a;
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
     await space.postMessage(getChannelId(channel), message);
   }
   subscribeMessages({ spaceKey, channel }) {
-    return new import_codec_protobuf9.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf10.Stream(({ ctx, next }) => {
       (0, import_async13.scheduleTask)(ctx, async () => {
         var _a;
         const dataSpaceManager = await this._getDataSpaceManager();
-        const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+        const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
         const handle = space.listen(getChannelId(channel), (message) => {
           next(message);
         });
@@ -3128,21 +3261,21 @@ var SpacesServiceImpl = class {
     });
   }
   queryCredentials({ spaceKey }) {
-    return new import_codec_protobuf9.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf10.Stream(({ ctx, next }) => {
       var _a;
-      const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
-      const processor = space.spaceState.registerProcessor({
-        process: async (credential) => {
+      const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+      const processor = {
+        processCredential: async (credential) => {
           next(credential);
         }
-      });
-      ctx.onDispose(() => processor.close());
-      (0, import_async13.scheduleTask)(ctx, () => processor.open());
+      };
+      ctx.onDispose(() => space.spaceState.removeCredentialProcessor(processor));
+      (0, import_async13.scheduleTask)(ctx, () => space.spaceState.addCredentialProcessor(processor));
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
     var _a;
-    const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+    const space = (_a = this._spaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
     for (const credential of credentials != null ? credentials : []) {
       await space.controlPipeline.writer.write({
         credential: {
@@ -3154,7 +3287,7 @@ var SpacesServiceImpl = class {
   async createEpoch({ spaceKey }) {
     var _a;
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug5.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
+    const space = (_a = dataSpaceManager.spaces.get(spaceKey)) != null ? _a : (0, import_debug6.raise)(new import_echo_pipeline2.SpaceNotFoundError(spaceKey));
     await space.createEpoch();
   }
   _serializeSpace(space) {
@@ -3234,7 +3367,7 @@ var ServiceContext = class {
     this.invitations = new InvitationsHandler(this.networkManager);
     this._handlerFactories.set(import_services9.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => {
       var _a;
-      return (_a = this.identityManager.identity) != null ? _a : (0, import_debug6.failUndefined)();
+      return (_a = this.identityManager.identity) != null ? _a : (0, import_debug7.failUndefined)();
     }, this._acceptIdentity.bind(this)));
   }
   async open() {
@@ -3276,15 +3409,17 @@ var ServiceContext = class {
     });
   }
   async close() {
-    var _a, _b;
+    var _a;
     (0, import_log12.log)("closing...", void 0, {
       F: __dxlog_file12,
       L: 143,
       S: this,
       C: (f, a) => f(...a)
     });
-    await ((_a = this._deviceSpaceSync) == null ? void 0 : _a.close());
-    await ((_b = this.dataSpaceManager) == null ? void 0 : _b.close());
+    if (this._deviceSpaceSync && this.identityManager.identity) {
+      await this.identityManager.identity.space.spaceState.removeCredentialProcessor(this._deviceSpaceSync);
+    }
+    await ((_a = this.dataSpaceManager) == null ? void 0 : _a.close());
     await this.identityManager.close();
     await this.spaceManager.close();
     await this.feedStore.close();
@@ -3293,7 +3428,7 @@ var ServiceContext = class {
     this.dataServiceSubscriptions.clear();
     (0, import_log12.log)("closed", void 0, {
       F: __dxlog_file12,
-      L: 152,
+      L: 154,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3324,11 +3459,11 @@ var ServiceContext = class {
     var _a;
     (0, import_log12.log)("initializing spaces...", void 0, {
       F: __dxlog_file12,
-      L: 185,
+      L: 187,
       S: this,
       C: (f, a) => f(...a)
     });
-    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug6.failUndefined)();
+    const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug7.failUndefined)();
     const signingContext = {
       credentialSigner: identity.getIdentityCredentialSigner(),
       identityKey: identity.identityKey,
@@ -3349,8 +3484,8 @@ var ServiceContext = class {
       return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
     });
     this.initialized.wake();
-    this._deviceSpaceSync = identity.space.spaceState.registerProcessor({
-      process: async (credential) => {
+    this._deviceSpaceSync = {
+      processCredential: async (credential) => {
         const assertion = (0, import_credentials13.getCredentialAssertion)(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
@@ -3363,7 +3498,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             F: __dxlog_file12,
-            L: 224,
+            L: 226,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3374,7 +3509,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             F: __dxlog_file12,
-            L: 228,
+            L: 230,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3385,7 +3520,7 @@ var ServiceContext = class {
             details: assertion
           }, {
             F: __dxlog_file12,
-            L: 233,
+            L: 235,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3396,14 +3531,14 @@ var ServiceContext = class {
         } catch (err) {
           import_log12.log.catch(err, void 0, {
             F: __dxlog_file12,
-            L: 239,
+            L: 241,
             S: this,
             C: (f, a) => f(...a)
           });
         }
       }
-    });
-    await this._deviceSpaceSync.open();
+    };
+    await identity.space.spaceState.addCredentialProcessor(this._deviceSpaceSync);
   }
 };
 
@@ -3424,7 +3559,7 @@ var import_text_model = require("@dxos/text-model");
 
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
 var import_async15 = require("@dxos/async");
-var import_codec_protobuf10 = require("@dxos/codec-protobuf");
+var import_codec_protobuf11 = require("@dxos/codec-protobuf");
 var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
@@ -3434,7 +3569,7 @@ var DevicesServiceImpl = class {
     throw new Error("Method not implemented.");
   }
   queryDevices() {
-    return new import_codec_protobuf10.Stream(({ next }) => {
+    return new import_codec_protobuf11.Stream(({ next }) => {
       const update = () => {
         var _a;
         const deviceKeys = (_a = this._identityManager.identity) == null ? void 0 : _a.authorizedDeviceKeys;
@@ -3524,7 +3659,7 @@ var isLocked = (lockPath) => import_lock_file.LockFile.isLocked(lockPath);
 
 // packages/sdk/client-services/src/packlets/logging/logging-service.ts
 var import_async16 = require("@dxos/async");
-var import_codec_protobuf11 = require("@dxos/codec-protobuf");
+var import_codec_protobuf12 = require("@dxos/codec-protobuf");
 var import_log14 = require("@dxos/log");
 var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util7 = require("@dxos/util");
@@ -3543,7 +3678,7 @@ var LoggingServiceImpl = class {
     import_log14.log.runtimeConfig.processors.splice(index, 1);
   }
   queryLogs(request) {
-    return new import_codec_protobuf11.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf12.Stream(({ ctx, next }) => {
       const handler = (entry2) => {
         var _a, _b, _c, _d, _e;
         if (LOG_PROCESSING > 0) {
@@ -3599,14 +3734,14 @@ var shouldLog = (entry2, request) => {
 var LOG_PROCESSING = 0;
 
 // packages/sdk/client-services/src/packlets/network/network-service.ts
-var import_codec_protobuf12 = require("@dxos/codec-protobuf");
+var import_codec_protobuf13 = require("@dxos/codec-protobuf");
 var NetworkServiceImpl = class {
   constructor(networkManager, signalManager) {
     this.networkManager = networkManager;
     this.signalManager = signalManager;
   }
   queryStatus() {
-    return new import_codec_protobuf12.Stream(({ next }) => {
+    return new import_codec_protobuf13.Stream(({ next }) => {
       const update = () => {
         next({
           swarm: this.networkManager.connectionState,
@@ -3632,7 +3767,7 @@ var NetworkServiceImpl = class {
 
 // packages/sdk/client-services/src/packlets/storage/storage.ts
 var import_client_protocol4 = require("@dxos/client-protocol");
-var import_errors4 = require("@dxos/errors");
+var import_errors5 = require("@dxos/errors");
 var import_config = require("@dxos/protocols/proto/dxos/config");
 var import_random_access_storage = require("@dxos/random-access-storage");
 var import_util8 = require("@dxos/util");
@@ -3640,16 +3775,16 @@ var StorageDriver = import_config.Runtime.Client.Storage.StorageDriver;
 var createStorageObjects = (config) => {
   const { path = (0, import_util8.isNode)() ? import_client_protocol4.DX_DATA : "dxos/storage", storageType, keyStorage, persistent = false } = config != null ? config : {};
   if (persistent && storageType === StorageDriver.RAM) {
-    throw new import_errors4.InvalidConfigError("RAM storage cannot be used in persistent mode.");
+    throw new import_errors5.InvalidConfigError("RAM storage cannot be used in persistent mode.");
   }
   if (!persistent && storageType !== void 0 && storageType !== StorageDriver.RAM) {
-    throw new import_errors4.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+    throw new import_errors5.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
   }
   if (persistent && keyStorage === StorageDriver.RAM) {
-    throw new import_errors4.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+    throw new import_errors5.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
   }
   if (!persistent && keyStorage !== StorageDriver.RAM && keyStorage !== void 0) {
-    throw new import_errors4.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+    throw new import_errors5.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
   }
   return {
     storage: (0, import_random_access_storage.createStorage)({
@@ -3680,7 +3815,7 @@ var toStorageType = (type) => {
 };
 
 // packages/sdk/client-services/src/packlets/system/system-service.ts
-var import_codec_protobuf13 = require("@dxos/codec-protobuf");
+var import_codec_protobuf14 = require("@dxos/codec-protobuf");
 var SystemServiceImpl = class {
   constructor({ config, statusUpdate, onUpdateStatus, getCurrentStatus, onReset }) {
     this._config = config;
@@ -3697,7 +3832,7 @@ var SystemServiceImpl = class {
     await this._onUpdateStatus(status);
   }
   queryStatus() {
-    return new import_codec_protobuf13.Stream(({ next }) => {
+    return new import_codec_protobuf14.Stream(({ next }) => {
       const update = () => {
         next({
           status: this._getCurrentStatus()
@@ -4004,59 +4139,6 @@ var import_messaging2 = require("@dxos/messaging");
 var import_network_manager3 = require("@dxos/network-manager");
 var import_util9 = require("@dxos/util");
 
-// packages/sdk/client-services/src/packlets/services/client-rpc-server.ts
-var import_codec_protobuf14 = require("@dxos/codec-protobuf");
-var import_debug7 = require("@dxos/debug");
-var import_rpc = require("@dxos/rpc");
-var ClientRpcServer = class {
-  constructor(params) {
-    this._handlerCache = /* @__PURE__ */ new Map();
-    const { serviceRegistry, handleCall, handleStream, ...rpcOptions } = params;
-    this._handleCall = handleCall;
-    this._handleStream = handleStream;
-    this._serviceRegistry = serviceRegistry;
-    this._rpcPeer = new import_rpc.RpcPeer({
-      ...rpcOptions,
-      callHandler: (method, params2) => {
-        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
-        const handler = (method2, params3) => this._getServiceHandler(serviceName).call(method2, params3);
-        if (this._handleCall) {
-          return this._handleCall(methodName, params2, handler);
-        } else {
-          return handler(methodName, params2);
-        }
-      },
-      streamHandler: (method, params2) => {
-        const [serviceName, methodName] = (0, import_rpc.parseMethodName)(method);
-        const handler = (method2, params3) => this._getServiceHandler(serviceName).callStream(method2, params3);
-        if (this._handleStream) {
-          return import_codec_protobuf14.Stream.unwrapPromise(this._handleStream(methodName, params2, handler));
-        } else {
-          return handler(methodName, params2);
-        }
-      }
-    });
-  }
-  async open() {
-    await this._rpcPeer.open();
-  }
-  async close() {
-    await this._rpcPeer.close();
-  }
-  _getServiceHandler(serviceName) {
-    var _a;
-    if (!this._handlerCache.has(serviceName)) {
-      const [key, descriptor] = (_a = Object.entries(this._serviceRegistry.descriptors).find(([key2, descriptor2]) => descriptor2.name === serviceName)) != null ? _a : (0, import_debug7.raise)(new Error(`Service not available: ${serviceName}`));
-      const service = this._serviceRegistry.services[key];
-      if (!service) {
-        throw new Error(`Service not available: ${serviceName}`);
-      }
-      this._handlerCache.set(serviceName, descriptor.createServer(service));
-    }
-    return this._handlerCache.get(serviceName);
-  }
-};
-
 // packages/sdk/client-services/src/packlets/vault/shell-runtime.ts
 var import_tiny_invariant14 = __toESM(require("tiny-invariant"));
 var import_async18 = require("@dxos/async");
@@ -4239,7 +4321,7 @@ _ts_decorate5([
 // packages/sdk/client-services/src/packlets/vault/iframe-proxy-runtime.ts
 var import_async20 = require("@dxos/async");
 var import_client_protocol8 = require("@dxos/client-protocol");
-var import_errors5 = require("@dxos/errors");
+var import_errors6 = require("@dxos/errors");
 var import_log17 = require("@dxos/log");
 var import_network_manager4 = require("@dxos/network-manager");
 var import_rpc3 = require("@dxos/rpc");
@@ -4298,7 +4380,7 @@ var IFrameProxyRuntime = class {
         S: this,
         C: (f, a) => f(...a)
       });
-      throw new import_errors5.RemoteServiceConnectionError("Failed to connect to worker");
+      throw new import_errors6.RemoteServiceConnectionError("Failed to connect to worker");
     }
     await ((_a = this._shellRuntime) == null ? void 0 : _a.open());
   }
@@ -4391,7 +4473,7 @@ var WorkerSession = class {
               } catch (err) {
                 import_log18.log.catch(err, void 0, {
                   F: __dxlog_file17,
-                  L: 100,
+                  L: 99,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -4406,9 +4488,9 @@ var WorkerSession = class {
     this.bridgeService = this._iframeRpc.rpc.BridgeService;
   }
   async open() {
-    import_log18.log.info("opening..", void 0, {
+    import_log18.log.info("opening...", void 0, {
       F: __dxlog_file17,
-      L: 114,
+      L: 113,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4423,9 +4505,15 @@ var WorkerSession = class {
     if (this.lockKey) {
       void this._afterLockReleases(this.lockKey, () => this.close());
     }
+    import_log18.log.info("opened", void 0, {
+      F: __dxlog_file17,
+      L: 120,
+      S: this,
+      C: (f, a) => f(...a)
+    });
   }
   async close() {
-    import_log18.log.info("closing..", void 0, {
+    import_log18.log.info("closing...", void 0, {
       F: __dxlog_file17,
       L: 124,
       S: this,
@@ -4445,6 +4533,12 @@ var WorkerSession = class {
       this._clientRpc.close(),
       this._iframeRpc.close()
     ]);
+    import_log18.log.info("closed", void 0, {
+      F: __dxlog_file17,
+      L: 132,
+      S: this,
+      C: (f, a) => f(...a)
+    });
   }
   async _maybeOpenShell() {
     try {
@@ -4452,7 +4546,7 @@ var WorkerSession = class {
     } catch (e) {
       import_log18.log.info("No shell connected.", void 0, {
         F: __dxlog_file17,
-        L: 138,
+        L: 139,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -4573,6 +4667,7 @@ var WorkerRuntime = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ClientRpcServer,
   ClientServicesHost,
   DataSpace,
   DataSpaceManager,