@dxos/client-services 0.4.10-main.eedd150 → 0.4.10-main.f635fb0

package/dist/lib/node/{chunk-42TXJ32V.cjs → chunk-CLDZACGI.cjs}

@@ -26,15 +26,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var chunk_42TXJ32V_exports = {};
-__export(chunk_42TXJ32V_exports, {
+var chunk_CLDZACGI_exports = {};
+__export(chunk_CLDZACGI_exports, {
   ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
+  ClientServicesProviderResource: () => ClientServicesProviderResource,
   DataSpace: () => DataSpace,
   DataSpaceManager: () => DataSpaceManager,
   DeviceInvitationProtocol: () => DeviceInvitationProtocol,
   DevtoolsHostEvents: () => DevtoolsHostEvents,
   DevtoolsServiceImpl: () => DevtoolsServiceImpl,
+  DiagnosticsCollector: () => DiagnosticsCollector,
   Identity: () => Identity,
   IdentityManager: () => IdentityManager,
   IdentityServiceImpl: () => IdentityServiceImpl,
@@ -46,12 +48,14 @@ __export(chunk_42TXJ32V_exports, {
   SpaceInvitationProtocol: () => SpaceInvitationProtocol,
   SpacesServiceImpl: () => SpacesServiceImpl,
   TrustedKeySetAuthVerifier: () => TrustedKeySetAuthVerifier,
+  createAdmissionKeypair: () => createAdmissionKeypair,
   createAuthProvider: () => createAuthProvider,
+  createCollectDiagnosticsBroadcastHandler: () => createCollectDiagnosticsBroadcastHandler,
+  createCollectDiagnosticsBroadcastSender: () => createCollectDiagnosticsBroadcastSender,
   createDiagnostics: () => createDiagnostics,
   createLevel: () => createLevel,
   createStorageObjects: () => createStorageObjects,
   getNetworkPeers: () => getNetworkPeers,
-  invitationExpired: () => invitationExpired,
   isLocked: () => isLocked,
   subscribeToFeedBlocks: () => subscribeToFeedBlocks,
   subscribeToFeeds: () => subscribeToFeeds,
@@ -61,7 +65,7 @@ __export(chunk_42TXJ32V_exports, {
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo
 });
-module.exports = __toCommonJS(chunk_42TXJ32V_exports);
+module.exports = __toCommonJS(chunk_CLDZACGI_exports);
 var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_feed_store = require("@dxos/feed-store");
@@ -116,6 +120,7 @@ var import_async7 = require("@dxos/async");
 var import_client_protocol2 = require("@dxos/client-protocol");
 var import_context4 = require("@dxos/context");
 var import_credentials7 = require("@dxos/credentials");
+var import_crypto = require("@dxos/crypto");
 var import_invariant5 = require("@dxos/invariant");
 var import_keys5 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
@@ -125,6 +130,7 @@ var import_services3 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_async8 = require("@dxos/async");
 var import_context5 = require("@dxos/context");
+var import_crypto2 = require("@dxos/crypto");
 var import_invariant6 = require("@dxos/invariant");
 var import_keys6 = require("@dxos/keys");
 var import_log5 = require("@dxos/log");
@@ -135,6 +141,7 @@ var import_teleport = require("@dxos/teleport");
 var import_async9 = require("@dxos/async");
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
 var import_context6 = require("@dxos/context");
+var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_invariant7 = require("@dxos/invariant");
 var import_log6 = require("@dxos/log");
 var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
@@ -148,121 +155,127 @@ var import_codec_protobuf9 = require("@dxos/codec-protobuf");
 var import_debug2 = require("@dxos/debug");
 var import_rpc = require("@dxos/rpc");
 var import_tracing3 = require("@dxos/tracing");
-var import_codec_protobuf10 = require("@dxos/codec-protobuf");
-var import_credentials9 = require("@dxos/credentials");
-var import_invariant9 = require("@dxos/invariant");
-var import_protocols7 = require("@dxos/protocols");
-var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
-var import_tracing4 = require("@dxos/tracing");
-var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
 var import_async10 = require("@dxos/async");
 var import_client_protocol3 = require("@dxos/client-protocol");
 var import_context7 = require("@dxos/context");
 var import_debug3 = require("@dxos/debug");
 var import_echo_db = require("@dxos/echo-db");
-var import_echo_pipeline = require("@dxos/echo-pipeline");
 var import_echo_pipeline2 = require("@dxos/echo-pipeline");
-var import_invariant10 = require("@dxos/invariant");
+var import_echo_pipeline3 = require("@dxos/echo-pipeline");
+var import_invariant9 = require("@dxos/invariant");
 var import_keys7 = require("@dxos/keys");
 var import_log8 = require("@dxos/log");
-var import_protocols8 = require("@dxos/protocols");
-var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials10 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_protocols7 = require("@dxos/protocols");
+var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
+var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe2 = require("@dxos/timeframe");
-var import_tracing5 = require("@dxos/tracing");
+var import_tracing4 = require("@dxos/tracing");
 var import_util4 = require("@dxos/util");
 var import_async11 = require("@dxos/async");
-var import_credentials11 = require("@dxos/credentials");
+var import_credentials10 = require("@dxos/credentials");
 var import_async12 = require("@dxos/async");
 var import_context8 = require("@dxos/context");
-var import_invariant11 = require("@dxos/invariant");
+var import_invariant10 = require("@dxos/invariant");
 var import_keys8 = require("@dxos/keys");
 var import_log9 = require("@dxos/log");
-var import_protocols9 = require("@dxos/protocols");
+var import_protocols8 = require("@dxos/protocols");
 var import_teleport2 = require("@dxos/teleport");
 var import_util5 = require("@dxos/util");
 var import_async13 = require("@dxos/async");
 var import_context9 = require("@dxos/context");
-var import_credentials12 = require("@dxos/credentials");
-var import_invariant12 = require("@dxos/invariant");
+var import_credentials11 = require("@dxos/credentials");
+var import_invariant11 = require("@dxos/invariant");
 var import_keys9 = require("@dxos/keys");
 var import_log10 = require("@dxos/log");
-var import_protocols10 = require("@dxos/protocols");
-var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
+var import_protocols9 = require("@dxos/protocols");
+var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_gossip2 = require("@dxos/teleport-extension-gossip");
 var import_util6 = require("@dxos/util");
-var import_credentials13 = require("@dxos/credentials");
+var import_credentials12 = require("@dxos/credentials");
 var import_debug4 = require("@dxos/debug");
-var import_credentials14 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials13 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe3 = require("@dxos/timeframe");
 var import_async14 = require("@dxos/async");
-var import_codec_protobuf11 = require("@dxos/codec-protobuf");
+var import_codec_protobuf10 = require("@dxos/codec-protobuf");
 var import_debug5 = require("@dxos/debug");
-var import_invariant13 = require("@dxos/invariant");
+var import_invariant12 = require("@dxos/invariant");
 var import_log11 = require("@dxos/log");
-var import_protocols11 = require("@dxos/protocols");
-var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
+var import_protocols10 = require("@dxos/protocols");
+var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 var import_async15 = require("@dxos/async");
 var import_context10 = require("@dxos/context");
-var import_credentials15 = require("@dxos/credentials");
+var import_credentials14 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
-var import_echo_pipeline3 = require("@dxos/echo-pipeline");
+var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_indexing = require("@dxos/indexing");
-var import_invariant14 = require("@dxos/invariant");
+var import_invariant13 = require("@dxos/invariant");
 var import_keyring = require("@dxos/keyring");
 var import_keys10 = require("@dxos/keys");
 var import_log12 = require("@dxos/log");
-var import_protocols12 = require("@dxos/protocols");
-var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
+var import_protocols11 = require("@dxos/protocols");
+var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_object_sync = require("@dxos/teleport-extension-object-sync");
-var import_tracing6 = require("@dxos/tracing");
+var import_tracing5 = require("@dxos/tracing");
 var import_util7 = require("@dxos/util");
 var import_automerge = require("@dxos/automerge/automerge");
 var import_debug7 = require("@dxos/debug");
+var import_protocols12 = require("@dxos/protocols");
+var import_codec_protobuf11 = require("@dxos/codec-protobuf");
+var import_credentials15 = require("@dxos/credentials");
+var import_invariant14 = require("@dxos/invariant");
 var import_protocols13 = require("@dxos/protocols");
-var import_invariant15 = require("@dxos/invariant");
-var import_lock_file = require("@dxos/lock-file");
-var import_log13 = require("@dxos/log");
-var import_protocols14 = require("@dxos/protocols");
-var import_config = require("@dxos/protocols/proto/dxos/config");
-var import_random_access_storage = require("@dxos/random-access-storage");
-var import_client_protocol4 = require("@dxos/client-protocol");
-var import_config2 = require("@dxos/protocols/proto/dxos/config");
+var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
+var import_tracing6 = require("@dxos/tracing");
+var import_services12 = require("@dxos/protocols/proto/dxos/client/services");
+var import_config = require("@dxos/config");
+var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
+var import_tracing7 = require("@dxos/tracing");
 var import_util8 = require("@dxos/util");
-var import_level = require("level");
-var import_node_path = __toESM(require("node:path"));
-var import_keys11 = require("@dxos/keys");
 var import_async16 = require("@dxos/async");
-var import_client_protocol5 = require("@dxos/client-protocol");
+var import_client_protocol4 = require("@dxos/client-protocol");
 var import_context11 = require("@dxos/context");
-var import_echo_pipeline4 = require("@dxos/echo-pipeline");
-var E = __toESM(require("@dxos/echo-schema"));
+var import_echo_pipeline5 = require("@dxos/echo-pipeline");
+var import_echo_schema = require("@dxos/echo-schema");
 var import_indexing2 = require("@dxos/indexing");
-var import_invariant16 = require("@dxos/invariant");
-var import_keys12 = require("@dxos/keys");
-var import_log14 = require("@dxos/log");
+var import_invariant15 = require("@dxos/invariant");
+var import_keys11 = require("@dxos/keys");
+var import_log13 = require("@dxos/log");
 var import_messaging = require("@dxos/messaging");
 var import_network_manager2 = require("@dxos/network-manager");
-var import_protocols15 = require("@dxos/protocols");
-var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
-var import_tracing7 = require("@dxos/tracing");
+var import_protocols14 = require("@dxos/protocols");
+var import_services14 = require("@dxos/protocols/proto/dxos/client/services");
+var import_tracing8 = require("@dxos/tracing");
 var import_util9 = require("@dxos/util");
 var import_websocket_rpc = require("@dxos/websocket-rpc");
 var import_async17 = require("@dxos/async");
 var import_codec_protobuf12 = require("@dxos/codec-protobuf");
+var import_invariant16 = require("@dxos/invariant");
+var import_services15 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invariant17 = require("@dxos/invariant");
-var import_services14 = require("@dxos/protocols/proto/dxos/client/services");
+var import_lock_file = require("@dxos/lock-file");
+var import_log14 = require("@dxos/log");
 var import_async18 = require("@dxos/async");
 var import_codec_protobuf13 = require("@dxos/codec-protobuf");
-var import_keys13 = require("@dxos/keys");
+var import_keys12 = require("@dxos/keys");
 var import_log15 = require("@dxos/log");
-var import_services15 = require("@dxos/protocols/proto/dxos/client/services");
+var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util10 = require("@dxos/util");
 var import_codec_protobuf14 = require("@dxos/codec-protobuf");
-var import_codec_protobuf15 = require("@dxos/codec-protobuf");
-var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
+var import_protocols15 = require("@dxos/protocols");
+var import_config2 = require("@dxos/protocols/proto/dxos/config");
+var import_random_access_storage = require("@dxos/random-access-storage");
+var import_client_protocol5 = require("@dxos/client-protocol");
+var import_config3 = require("@dxos/protocols/proto/dxos/config");
 var import_util11 = require("@dxos/util");
+var import_level = require("level");
+var import_node_path = __toESM(require("node:path"));
+var import_keys13 = require("@dxos/keys");
+var import_codec_protobuf15 = require("@dxos/codec-protobuf");
+var import_services17 = require("@dxos/protocols/proto/dxos/client/services");
+var import_util12 = require("@dxos/util");
+var import_keys14 = require("@dxos/keys");
+var import_util13 = require("@dxos/util");
 var subscribeToFeeds = ({ feedStore }, { feedKeys }) => {
   return new import_codec_protobuf.Stream(({ next }) => {
     const subscriptions = new import_async.EventSubscriptions();
@@ -1475,6 +1488,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
     this._callbacks = _callbacks;
     this._ctx = new import_context5.Context();
     this._remoteOptionsTrigger = new import_async8.Trigger();
+    this._challenge = void 0;
     this.invitation = void 0;
     this.guestProfile = void 0;
     this.authenticationPassed = false;
@@ -1489,7 +1503,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
         options: async (options) => {
           (0, import_invariant6.invariant)(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 87,
+            L: 90,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1506,7 +1520,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 96,
+            L: 99,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1516,7 +1530,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               invitationId
             }, {
               F: __dxlog_file6,
-              L: 100,
+              L: 103,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1530,7 +1544,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             guestProfile: profile
           }, {
             F: __dxlog_file6,
-            L: 109,
+            L: 112,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1539,25 +1553,27 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             ...this.invitation,
             state: import_services4.Invitation.State.READY_FOR_AUTHENTICATION
           });
+          this._challenge = this.invitation.authMethod === import_services4.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? (0, import_crypto2.randomBytes)(32) : void 0;
           import_log5.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols5.trace.end({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 116,
+            L: 122,
             S: this,
             C: (f, a) => f(...a)
           });
           return {
-            authMethod: this.invitation.authMethod
+            authMethod: this.invitation.authMethod,
+            challenge: this._challenge
           };
         },
-        authenticate: async ({ authCode: code }) => {
+        authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = import_keys6.PublicKey.random().toHex();
           import_log5.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols5.trace.begin({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 124,
+            L: 131,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1565,14 +1581,14 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             authCode: code
           }, {
             F: __dxlog_file6,
-            L: 125,
+            L: 132,
             S: this,
             C: (f, a) => f(...a)
           });
           let status = import_invitations2.AuthenticationResponse.Status.OK;
           (0, import_invariant6.invariant)(this.invitation, "Invitation is not set.", {
             F: __dxlog_file6,
-            L: 128,
+            L: 135,
             S: this,
             A: [
               "this.invitation",
@@ -1583,7 +1599,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             case import_services4.Invitation.AuthMethod.NONE: {
               (0, import_log5.log)("authentication not required", void 0, {
                 F: __dxlog_file6,
-                L: 131,
+                L: 138,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1603,12 +1619,25 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               }
               break;
             }
+            case import_services4.Invitation.AuthMethod.KNOWN_PUBLIC_KEY: {
+              if (!this.invitation.guestKeypair) {
+                status = import_invitations2.AuthenticationResponse.Status.INTERNAL_ERROR;
+                break;
+              }
+              const isSignatureValid = this._challenge && (0, import_crypto2.verify)(this._challenge, Buffer.from(signedChallenge ?? []), this.invitation.guestKeypair.publicKey.asBuffer());
+              if (isSignatureValid) {
+                this.authenticationPassed = true;
+              } else {
+                status = import_invitations2.AuthenticationResponse.Status.INVALID_SIGNATURE;
+              }
+              break;
+            }
             default: {
               import_log5.log.error("invalid authentication method", {
                 authMethod: this.invitation.authMethod
               }, {
                 F: __dxlog_file6,
-                L: 149,
+                L: 176,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1623,7 +1652,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             }
           }), {
             F: __dxlog_file6,
-            L: 155,
+            L: 182,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1637,14 +1666,14 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 161,
+            L: 188,
             S: this,
             C: (f, a) => f(...a)
           });
           try {
             (0, import_invariant6.invariant)(this.invitation, "Invitation is not set.", {
               F: __dxlog_file6,
-              L: 164,
+              L: 191,
               S: this,
               A: [
                 "this.invitation",
@@ -1659,7 +1688,7 @@ var InvitationHostExtension = class extends import_teleport.RpcExtension {
               id: traceId
             }), {
               F: __dxlog_file6,
-              L: 172,
+              L: 199,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1716,7 +1745,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
         options: async (options) => {
           (0, import_invariant6.invariant)(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 239,
+            L: 266,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1743,7 +1772,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     try {
       (0, import_log5.log)("begin options", void 0, {
         F: __dxlog_file6,
-        L: 260,
+        L: 287,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1755,7 +1784,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
       }));
       (0, import_log5.log)("end options", void 0, {
         F: __dxlog_file6,
-        L: 263,
+        L: 290,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1769,7 +1798,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
     } catch (err) {
       (0, import_log5.log)("openError", err, {
         F: __dxlog_file6,
-        L: 273,
+        L: 300,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1779,7 +1808,7 @@ var InvitationGuestExtension = class extends import_teleport.RpcExtension {
   async onClose() {
     (0, import_log5.log)("onClose", void 0, {
       F: __dxlog_file6,
-      L: 279,
+      L: 306,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1796,11 +1825,11 @@ var InvitationsHandler = class {
     this._networkManager = _networkManager;
   }
   createInvitation(protocol, options) {
-    const { invitationId = import_keys5.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys5.PublicKey.random(), persistent = true, created = /* @__PURE__ */ new Date(), lifetime = 86400 } = options ?? {};
+    const { invitationId = import_keys5.PublicKey.random().toHex(), type = import_services3.Invitation.Type.INTERACTIVE, authMethod = import_services3.Invitation.AuthMethod.SHARED_SECRET, state = import_services3.Invitation.State.INIT, timeout = import_client_protocol2.INVITATION_TIMEOUT, swarmKey = import_keys5.PublicKey.random(), persistent = options?.authMethod !== import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
     const authCode = options?.authCode ?? (authMethod === import_services3.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials7.generatePasscode)(import_client_protocol2.AUTHENTICATION_CODE_LENGTH) : void 0);
     (0, import_invariant5.invariant)(protocol, void 0, {
       F: __dxlog_file7,
-      L: 84,
+      L: 87,
       S: this,
       A: [
         "protocol",
@@ -1815,9 +1844,11 @@ var InvitationsHandler = class {
       swarmKey,
       authCode,
       timeout,
-      persistent,
+      persistent: persistent && type !== import_services3.Invitation.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
       created,
       lifetime,
+      multiUse,
       ...protocol.getInvitationContext()
     };
     const stream = new import_async7.PushStream();
@@ -1832,7 +1863,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 109,
+        L: 115,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1857,7 +1888,7 @@ var InvitationsHandler = class {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             (0, import_invariant5.invariant)(deviceKey, void 0, {
               F: __dxlog_file7,
-              L: 130,
+              L: 136,
               S: this,
               A: [
                 "deviceKey",
@@ -1880,7 +1911,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 148,
+                L: 154,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1888,7 +1919,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 149,
+                L: 155,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1904,7 +1935,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 152,
+                L: 158,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1916,7 +1947,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 154,
+                L: 160,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1926,7 +1957,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 157,
+                  L: 163,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1937,7 +1968,7 @@ var InvitationsHandler = class {
               } else {
                 import_log4.log.error("failed", err, {
                   F: __dxlog_file7,
-                  L: 160,
+                  L: 166,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1948,12 +1979,12 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 163,
+                L: 169,
                 S: this,
                 C: (f, a) => f(...a)
               });
             } finally {
-              if (type !== import_services3.Invitation.Type.MULTIUSE) {
+              if (!multiUse) {
                 await swarmConnection.close();
                 await ctx.dispose();
               }
@@ -1969,7 +2000,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 178,
+              L: 184,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1980,7 +2011,7 @@ var InvitationsHandler = class {
           } else {
             import_log4.log.error("failed", err, {
               F: __dxlog_file7,
-              L: 181,
+              L: 187,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1994,7 +2025,7 @@ var InvitationsHandler = class {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
         import_log4.log.warn("invitation has already expired", void 0, {
           F: __dxlog_file7,
-          L: 192,
+          L: 198,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2045,7 +2076,7 @@ var InvitationsHandler = class {
     const { timeout = import_client_protocol2.INVITATION_TIMEOUT } = invitation;
     (0, import_invariant5.invariant)(protocol, void 0, {
       F: __dxlog_file7,
-      L: 246,
+      L: 252,
       S: this,
       A: [
         "protocol",
@@ -2055,7 +2086,7 @@ var InvitationsHandler = class {
     if (deviceProfile) {
       (0, import_invariant5.invariant)(invitation.kind === import_services3.Invitation.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
         F: __dxlog_file7,
-        L: 250,
+        L: 256,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -2070,7 +2101,7 @@ var InvitationsHandler = class {
     const setState = (newData) => {
       (0, import_invariant5.invariant)(newData.state !== void 0, void 0, {
         F: __dxlog_file7,
-        L: 261,
+        L: 267,
         S: this,
         A: [
           "newData.state !== undefined",
@@ -2090,7 +2121,7 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             F: __dxlog_file7,
-            L: 269,
+            L: 275,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2100,7 +2131,7 @@ var InvitationsHandler = class {
         } else {
           import_log4.log.warn("auth failed", err, {
             F: __dxlog_file7,
-            L: 272,
+            L: 278,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2114,7 +2145,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 280,
+        L: 286,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2129,7 +2160,7 @@ var InvitationsHandler = class {
               currentState
             }, {
               F: __dxlog_file7,
-              L: 290,
+              L: 296,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2144,7 +2175,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 299,
+                L: 305,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2156,7 +2187,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 307,
+                L: 313,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2167,7 +2198,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 311,
+                L: 317,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2177,62 +2208,28 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 F: __dxlog_file7,
-                L: 315,
+                L: 321,
                 S: this,
                 C: (f, a) => f(...a)
               });
               invitation.authMethod = introductionResponse.authMethod;
               if (isAuthenticationRequired(invitation)) {
-                for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  (0, import_log4.log)("guest waiting for authentication code...", void 0, {
-                    F: __dxlog_file7,
-                    L: 321,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
-                  });
-                  const authCode = await authenticated.wait({
-                    timeout
-                  });
-                  (0, import_log4.log)("sending authentication request", void 0, {
-                    F: __dxlog_file7,
-                    L: 325,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: import_services3.Invitation.State.AUTHENTICATING
-                  });
-                  const response = await extension.rpc.InvitationHostService.authenticate({
-                    authCode
-                  });
-                  if (response.status === void 0 || response.status === import_invitations.AuthenticationResponse.Status.OK) {
+                switch (invitation.authMethod) {
+                  case import_services3.Invitation.AuthMethod.SHARED_SECRET:
+                    await this._handleGuestOtpAuth(extension, setState, authenticated, {
+                      timeout
+                    });
+                    break;
+                  case import_services3.Invitation.AuthMethod.KNOWN_PUBLIC_KEY:
+                    await this._handleGuestKpkAuth(extension, setState, invitation, introductionResponse);
                     break;
-                  }
-                  if (response.status === import_invitations.AuthenticationResponse.Status.INVALID_OTP) {
-                    if (attempt === MAX_OTP_ATTEMPTS) {
-                      throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
-                    } else {
-                      (0, import_log4.log)("retrying invalid code", {
-                        attempt
-                      }, {
-                        F: __dxlog_file7,
-                        L: 336,
-                        S: this,
-                        C: (f, a) => f(...a)
-                      });
-                      authenticated.reset();
-                    }
-                  }
                 }
               }
               (0, import_log4.log)("request admission", {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 344,
+                L: 337,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2244,7 +2241,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 355,
+                L: 348,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2257,7 +2254,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 357,
+                L: 350,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2267,7 +2264,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 360,
+                  L: 353,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2277,7 +2274,7 @@ var InvitationsHandler = class {
               } else {
                 (0, import_log4.log)("auth failed", err, {
                   F: __dxlog_file7,
-                  L: 363,
+                  L: 356,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2288,7 +2285,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 366,
+                L: 359,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2306,7 +2303,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 377,
+              L: 370,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2316,7 +2313,7 @@ var InvitationsHandler = class {
           } else {
             (0, import_log4.log)("auth failed", err, {
               F: __dxlog_file7,
-              L: 380,
+              L: 373,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2333,7 +2330,7 @@ var InvitationsHandler = class {
       } else {
         (0, import_invariant5.invariant)(invitation.swarmKey, void 0, {
           F: __dxlog_file7,
-          L: 394,
+          L: 387,
           S: this,
           A: [
             "invitation.swarmKey",
@@ -2371,9 +2368,81 @@ var InvitationsHandler = class {
     });
     return observable;
   }
+  async _handleGuestOtpAuth(extension, setState, authenticated, options) {
+    for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
+      (0, import_log4.log)("guest waiting for authentication code...", void 0, {
+        F: __dxlog_file7,
+        L: 427,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: import_services3.Invitation.State.READY_FOR_AUTHENTICATION
+      });
+      const authCode = await authenticated.wait(options);
+      (0, import_log4.log)("sending authentication request", void 0, {
+        F: __dxlog_file7,
+        L: 431,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: import_services3.Invitation.State.AUTHENTICATING
+      });
+      const response = await extension.rpc.InvitationHostService.authenticate({
+        authCode
+      });
+      if (response.status === void 0 || response.status === import_invitations.AuthenticationResponse.Status.OK) {
+        break;
+      }
+      if (response.status === import_invitations.AuthenticationResponse.Status.INVALID_OTP) {
+        if (attempt === MAX_OTP_ATTEMPTS) {
+          throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
+        } else {
+          (0, import_log4.log)("retrying invalid code", {
+            attempt
+          }, {
+            F: __dxlog_file7,
+            L: 442,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          authenticated.reset();
+        }
+      }
+    }
+  }
+  async _handleGuestKpkAuth(extension, setState, invitation, introductionResponse) {
+    if (invitation.guestKeypair?.privateKey == null) {
+      throw new Error("keypair missing in the invitation");
+    }
+    if (introductionResponse.challenge == null) {
+      throw new Error("challenge missing in the introduction");
+    }
+    (0, import_log4.log)("sending authentication request", void 0, {
+      F: __dxlog_file7,
+      L: 461,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    setState({
+      state: import_services3.Invitation.State.AUTHENTICATING
+    });
+    const signature = (0, import_crypto.sign)(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
+    const response = await extension.rpc.InvitationHostService.authenticate({
+      signedChallenge: signature
+    });
+    if (response.status !== import_invitations.AuthenticationResponse.Status.OK) {
+      throw new Error(`Authentication failed with code: ${response.status}`);
+    }
+  }
 };
-var invitationExpired = (invitation) => {
-  return invitation.created && invitation.lifetime && invitation.lifetime !== 0 && invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now();
+var createAdmissionKeypair = () => {
+  const keypair = (0, import_crypto.createKeyPair)();
+  return {
+    publicKey: import_keys5.PublicKey.from(keypair.publicKey),
+    privateKey: keypair.secretKey
+  };
 };
 var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-service.ts";
 var InvitationsServiceImpl = class {
@@ -2430,7 +2499,7 @@ var InvitationsServiceImpl = class {
           await this._metadataStore.removeInvitation(invitation.get().invitationId);
         }
         this._createInvitations.delete(invitation.get().invitationId);
-        if (invitation.get().type !== import_services5.Invitation.Type.MULTIUSE) {
+        if (!invitation.get().multiUse) {
           this._removedCreated.emit(invitation.get());
         }
       });
@@ -2438,7 +2507,7 @@ var InvitationsServiceImpl = class {
   }
   async loadPersistentInvitations() {
     const persistentInvitations = this._metadataStore.getInvitations();
-    const freshInvitations = persistentInvitations.filter(async (invitation) => !invitationExpired(invitation));
+    const freshInvitations = persistentInvitations.filter(async (invitation) => !(0, import_echo_pipeline.hasInvitationExpired)(invitation));
     const cInvitations = freshInvitations.map((persistentInvitation) => {
       (0, import_invariant7.invariant)(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
         F: __dxlog_file8,
@@ -2491,7 +2560,7 @@ var InvitationsServiceImpl = class {
       }, () => {
         close();
         this._acceptInvitations.delete(invitation.get().invitationId);
-        if (invitation.get().type !== import_services5.Invitation.Type.MULTIUSE) {
+        if (!invitation.get().multiUse) {
           this._removedAccepted.emit(invitation.get());
         }
       });
@@ -2864,215 +2933,80 @@ _ts_decorate3([
 ClientRpcServer = _ts_decorate3([
   import_tracing3.trace.resource()
 ], ClientRpcServer);
-var getPlatform = () => {
-  if (process.browser) {
-    if (typeof window !== "undefined") {
-      const { userAgent } = window.navigator;
-      return {
-        type: import_services8.Platform.PLATFORM_TYPE.BROWSER,
-        userAgent,
-        uptime: Math.floor((Date.now() - window.performance.timeOrigin) / 1e3)
-      };
-    } else {
-      return {
-        type: import_services8.Platform.PLATFORM_TYPE.SHARED_WORKER,
-        uptime: Math.floor((Date.now() - performance.timeOrigin) / 1e3)
-      };
+var AutomergeSpaceState = class {
+  constructor(_onNewRoot) {
+    this._onNewRoot = _onNewRoot;
+    this.rootUrl = void 0;
+    this.lastEpoch = void 0;
+    this.onNewEpoch = new import_async11.Event();
+    this._isProcessingRootDocs = false;
+  }
+  async processCredential(credential) {
+    if (!(0, import_credentials10.checkCredentialType)(credential, "dxos.halo.credentials.Epoch")) {
+      return;
     }
-  } else {
-    const { platform: platform2, version, arch } = process;
-    return {
-      type: import_services8.Platform.PLATFORM_TYPE.NODE,
-      platform: platform2,
-      arch,
-      runtime: version,
-      uptime: Math.floor(process.uptime()),
-      memory: process.memoryUsage()
-    };
+    this.lastEpoch = credential;
+    if (credential.subject.assertion.automergeRoot) {
+      this.rootUrl = credential.subject.assertion.automergeRoot;
+      if (this._isProcessingRootDocs) {
+        this._onNewRoot(this.rootUrl);
+      }
+    }
+    this.onNewEpoch.emit(credential);
+  }
+  startProcessingRootDocs() {
+    if (this._isProcessingRootDocs) {
+      return;
+    }
+    if (this.rootUrl) {
+      this._onNewRoot(this.rootUrl);
+    }
+    this._isProcessingRootDocs = true;
+  }
+  async ensureEpochInitialized() {
+    await this.onNewEpoch.waitForCondition(() => !!this.lastEpoch);
   }
 };
-var DXOS_VERSION = "0.4.10-main.eedd150";
-var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/diagnostics.ts";
-var DEFAULT_TIMEOUT = 1e3;
-var createDiagnostics = async (clientServices, serviceContext, config) => {
-  const diagnostics = {
-    created: (/* @__PURE__ */ new Date()).toISOString(),
-    platform: getPlatform(),
-    client: {
-      version: DXOS_VERSION,
-      storage: {
-        version: import_protocols7.STORAGE_VERSION
-      }
-    },
-    trace: import_tracing4.TRACE_PROCESSOR.getDiagnostics()
-  };
-  {
-    (0, import_invariant9.invariant)(clientServices.LoggingService, "SystemService is not available.", {
+var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
+var DEFAULT_RETRY_TIMEOUT = 1e3;
+var DEFAULT_SUCCESS_DELAY = 1e3;
+var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
+var WRITER_NOT_SET_ERROR_CODE = "WRITER_NOT_SET";
+var NotarizationPlugin = class {
+  constructor() {
+    this._ctx = new import_context8.Context();
+    this._extensionOpened = new import_async12.Event();
+    this._extensions = /* @__PURE__ */ new Set();
+    this._processedCredentials = new import_util5.ComplexSet(import_keys8.PublicKey.hash);
+    this._processCredentialsTriggers = new import_util5.ComplexMap(import_keys8.PublicKey.hash);
+  }
+  get hasWriter() {
+    return !!this._writer;
+  }
+  async open() {
+  }
+  async close() {
+    await this._ctx.dispose();
+  }
+  /**
+  * Request credentials to be notarized.
+  */
+  async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
+    (0, import_log9.log)("notarize", {
+      credentials
+    }, {
       F: __dxlog_file10,
-      L: 108,
-      S: void 0,
+      L: 90,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    (0, import_invariant10.invariant)(credentials.every((credential) => credential.id), "Credentials must have an id", {
+      F: __dxlog_file10,
+      L: 91,
+      S: this,
       A: [
-        "clientServices.LoggingService",
-        "'SystemService is not available.'"
-      ]
-    });
-    diagnostics.metrics = await (0, import_codec_protobuf10.getFirstStreamValue)(clientServices.LoggingService.queryMetrics({}), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0);
-  }
-  if (typeof navigator !== "undefined" && navigator.storage) {
-    const map = /* @__PURE__ */ new Map();
-    const dir = await navigator.storage.getDirectory();
-    for await (const filename of dir?.keys()) {
-      const idx = filename.indexOf("-", filename.indexOf("-") + 1);
-      if (idx === -1) {
-        continue;
-      }
-      map.set(filename.slice(0, idx), (map.get(filename.slice(0, idx)) ?? 0) + 1);
-    }
-    diagnostics.storage = Array.from(map.entries()).sort((a, b) => b[1] - a[1]).map(([file, count]) => ({
-      file,
-      count
-    }));
-  }
-  const identity = serviceContext.identityManager.identity;
-  if (identity) {
-    diagnostics.identity = {
-      identityKey: identity.identityKey,
-      spaceKey: identity.space.key,
-      profile: identity.profileDocument
-    };
-    const { devices } = await (0, import_codec_protobuf10.getFirstStreamValue)(clientServices.DevicesService.queryDevices(), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0) ?? {};
-    diagnostics.devices = devices;
-    if (serviceContext.dataSpaceManager) {
-      diagnostics.spaces = await Promise.all(Array.from(serviceContext.dataSpaceManager.spaces.values()).map((space) => getSpaceStats(space)) ?? []);
-    }
-    const { feeds = [] } = await (0, import_codec_protobuf10.getFirstStreamValue)(clientServices.DevtoolsHost.subscribeToFeeds({}), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0) ?? {};
-    diagnostics.feeds = feeds.map(({ feedKey, bytes, length }) => ({
-      feedKey,
-      bytes,
-      length
-    }));
-    const status = await (0, import_codec_protobuf10.getFirstStreamValue)(clientServices.NetworkService.queryStatus(), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0);
-    diagnostics.networkStatus = status;
-    diagnostics.swarms = serviceContext.networkManager.connectionLog?.swarms;
-  }
-  diagnostics.config = config.values;
-  return diagnostics;
-};
-var getSpaceStats = async (space) => {
-  const stats = {
-    key: space.key,
-    metrics: space.metrics,
-    epochs: space.inner.spaceState.credentials.filter((0, import_credentials9.credentialTypeFilter)("dxos.halo.credentials.Epoch")).map((credential) => ({
-      ...credential.subject.assertion,
-      id: credential.id
-    })),
-    members: Array.from(space.inner.spaceState.members.values()).map((member) => ({
-      identity: {
-        identityKey: member.key,
-        profile: {
-          displayName: member.assertion.profile?.displayName
-        }
-      },
-      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services7.SpaceMember.PresenceState.ONLINE : import_services7.SpaceMember.PresenceState.OFFLINE
-    })),
-    pipeline: {
-      // TODO(burdon): Pick properties from credentials if needed.
-      currentEpoch: space.automergeSpaceState.lastEpoch,
-      appliedEpoch: space.automergeSpaceState.lastEpoch,
-      controlFeeds: space.inner.controlPipeline.state.feeds.map((feed) => feed.key),
-      currentControlTimeframe: space.inner.controlPipeline.state.timeframe,
-      targetControlTimeframe: space.inner.controlPipeline.state.targetTimeframe,
-      totalControlTimeframe: space.inner.controlPipeline.state.endTimeframe
-    }
-  };
-  if (stats.metrics) {
-    const { open, ready } = stats.metrics;
-    stats.metrics.startupTime = open && ready && ready.getTime() - open.getTime();
-  }
-  return stats;
-};
-var AutomergeSpaceState = class {
-  constructor(_onNewRoot) {
-    this._onNewRoot = _onNewRoot;
-    this.rootUrl = void 0;
-    this.lastEpoch = void 0;
-    this.onNewEpoch = new import_async11.Event();
-    this._isProcessingRootDocs = false;
-  }
-  async processCredential(credential) {
-    if (!(0, import_credentials11.checkCredentialType)(credential, "dxos.halo.credentials.Epoch")) {
-      return;
-    }
-    this.lastEpoch = credential;
-    if (credential.subject.assertion.automergeRoot) {
-      this.rootUrl = credential.subject.assertion.automergeRoot;
-      if (this._isProcessingRootDocs) {
-        this._onNewRoot(this.rootUrl);
-      }
-    }
-    this.onNewEpoch.emit(credential);
-  }
-  startProcessingRootDocs() {
-    if (this._isProcessingRootDocs) {
-      return;
-    }
-    if (this.rootUrl) {
-      this._onNewRoot(this.rootUrl);
-    }
-    this._isProcessingRootDocs = true;
-  }
-  async ensureEpochInitialized() {
-    await this.onNewEpoch.waitForCondition(() => !!this.lastEpoch);
-  }
-};
-var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
-var DEFAULT_RETRY_TIMEOUT = 1e3;
-var DEFAULT_SUCCESS_DELAY = 1e3;
-var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
-var WRITER_NOT_SET_ERROR_CODE = "WRITER_NOT_SET";
-var NotarizationPlugin = class {
-  constructor() {
-    this._ctx = new import_context8.Context();
-    this._extensionOpened = new import_async12.Event();
-    this._extensions = /* @__PURE__ */ new Set();
-    this._processedCredentials = new import_util5.ComplexSet(import_keys8.PublicKey.hash);
-    this._processCredentialsTriggers = new import_util5.ComplexMap(import_keys8.PublicKey.hash);
-  }
-  get hasWriter() {
-    return !!this._writer;
-  }
-  async open() {
-  }
-  async close() {
-    await this._ctx.dispose();
-  }
-  /**
-  * Request credentials to be notarized.
-  */
-  async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
-    (0, import_log9.log)("notarize", {
-      credentials
-    }, {
-      F: __dxlog_file11,
-      L: 90,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    (0, import_invariant11.invariant)(credentials.every((credential) => credential.id), "Credentials must have an id", {
-      F: __dxlog_file11,
-      L: 91,
-      S: this,
-      A: [
-        "credentials.every((credential) => credential.id)",
-        "'Credentials must have an id'"
+        "credentials.every((credential) => credential.id)",
+        "'Credentials must have an id'"
       ]
     });
     const errors = new import_async12.Trigger();
@@ -3081,7 +3015,7 @@ var NotarizationPlugin = class {
         import_log9.log.warn("Notarization error", {
           err
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 99,
           S: this,
           C: (f, a) => f(...a)
@@ -3097,7 +3031,7 @@ var NotarizationPlugin = class {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 111,
           S: this,
           C: (f, a) => f(...a)
@@ -3120,7 +3054,7 @@ var NotarizationPlugin = class {
           import_log9.log.info("Exhausted all peers to notarize with", {
             retryIn: retryTimeout
           }, {
-            F: __dxlog_file11,
+            F: __dxlog_file10,
             L: 136,
             S: this,
             C: (f, a) => f(...a)
@@ -3134,7 +3068,7 @@ var NotarizationPlugin = class {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 143,
           S: this,
           C: (f, a) => f(...a)
@@ -3143,7 +3077,7 @@ var NotarizationPlugin = class {
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
         (0, import_log9.log)("success", void 0, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 147,
           S: this,
           C: (f, a) => f(...a)
@@ -3152,7 +3086,7 @@ var NotarizationPlugin = class {
       } catch (err) {
         if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
           import_log9.log.info("error notarizing (recoverable)", err, {
-            F: __dxlog_file11,
+            F: __dxlog_file10,
             L: 151,
             S: this,
             C: (f, a) => f(...a)
@@ -3170,7 +3104,7 @@ var NotarizationPlugin = class {
         errors.wait()
       ]);
       (0, import_log9.log)("done", void 0, {
-        F: __dxlog_file11,
+        F: __dxlog_file10,
         L: 162,
         S: this,
         C: (f, a) => f(...a)
@@ -3191,8 +3125,8 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    (0, import_invariant11.invariant)(!this._writer, "Writer already set.", {
-      F: __dxlog_file11,
+    (0, import_invariant10.invariant)(!this._writer, "Writer already set.", {
+      F: __dxlog_file10,
       L: 181,
       S: this,
       A: [
@@ -3216,8 +3150,8 @@ var NotarizationPlugin = class {
       throw new Error(WRITER_NOT_SET_ERROR_CODE);
     }
     for (const credential of request.credentials ?? []) {
-      (0, import_invariant11.invariant)(credential.id, "Credential must have an id", {
-        F: __dxlog_file11,
+      (0, import_invariant10.invariant)(credential.id, "Credential must have an id", {
+        F: __dxlog_file10,
         L: 200,
         S: this,
         A: [
@@ -3237,7 +3171,7 @@ var NotarizationPlugin = class {
         (0, import_log9.log)("extension opened", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 211,
           S: this,
           C: (f, a) => f(...a)
@@ -3249,7 +3183,7 @@ var NotarizationPlugin = class {
         (0, import_log9.log)("extension closed", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 216,
           S: this,
           C: (f, a) => f(...a)
@@ -3265,10 +3199,10 @@ var NotarizationTeleportExtension = class extends import_teleport2.RpcExtension
   constructor(_params) {
     super({
       requested: {
-        NotarizationService: import_protocols9.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: import_protocols8.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
       },
       exposed: {
-        NotarizationService: import_protocols9.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
+        NotarizationService: import_protocols8.schema.getService("dxos.mesh.teleport.notarization.NotarizationService")
       }
     });
     this._params = _params;
@@ -3301,14 +3235,14 @@ function _ts_decorate4(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
+var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
 var DataSpace = class {
   constructor(params) {
     this._ctx = new import_context7.Context();
     this._notarizationPlugin = new NotarizationPlugin();
     this._cache = void 0;
     this._automergeSpaceState = new AutomergeSpaceState((rootUrl) => this._onNewAutomergeRoot(rootUrl));
-    this._state = import_services9.SpaceState.CLOSED;
+    this._state = import_services7.SpaceState.CLOSED;
     this.error = void 0;
     this.stateUpdate = new import_async10.Event();
     this.metrics = {};
@@ -3330,9 +3264,9 @@ var DataSpace = class {
     this._cache = params.cache;
     this._state = params.initialState;
     (0, import_log8.log)("new state", {
-      state: import_services9.SpaceState[this._state]
+      state: import_services7.SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file11,
       L: 140,
       S: this,
       C: (f, a) => f(...a)
@@ -3378,11 +3312,11 @@ var DataSpace = class {
     await this._inner.spaceState.addCredentialProcessor(this._notarizationPlugin);
     await this._inner.spaceState.addCredentialProcessor(this._automergeSpaceState);
     await this._inner.open(new import_context7.Context());
-    this._state = import_services9.SpaceState.CONTROL_ONLY;
+    this._state = import_services7.SpaceState.CONTROL_ONLY;
     (0, import_log8.log)("new state", {
-      state: import_services9.SpaceState[this._state]
+      state: import_services7.SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file11,
       L: 198,
       S: this,
       C: (f, a) => f(...a)
@@ -3396,11 +3330,11 @@ var DataSpace = class {
   }
   async _close() {
     await this._callbacks.beforeClose?.();
-    this._state = import_services9.SpaceState.CLOSED;
+    this._state = import_services7.SpaceState.CLOSED;
     (0, import_log8.log)("new state", {
-      state: import_services9.SpaceState[this._state]
+      state: import_services7.SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file11,
       L: 212,
       S: this,
       C: (f, a) => f(...a)
@@ -3430,9 +3364,9 @@ var DataSpace = class {
         this.metrics.pipelineInitBegin = /* @__PURE__ */ new Date();
         await this.initializeDataPipeline();
       } catch (err) {
-        if (err instanceof import_protocols8.CancelledError || err instanceof import_context7.ContextDisposedError) {
+        if (err instanceof import_protocols7.CancelledError || err instanceof import_context7.ContextDisposedError) {
           (0, import_log8.log)("data pipeline initialization cancelled", err, {
-            F: __dxlog_file12,
+            F: __dxlog_file11,
             L: 245,
             S: this,
             C: (f, a) => f(...a)
@@ -3440,16 +3374,16 @@ var DataSpace = class {
           return;
         }
         import_log8.log.error("Error initializing data pipeline", err, {
-          F: __dxlog_file12,
+          F: __dxlog_file11,
           L: 249,
           S: this,
           C: (f, a) => f(...a)
         });
-        this._state = import_services9.SpaceState.ERROR;
+        this._state = import_services7.SpaceState.ERROR;
         (0, import_log8.log)("new state", {
-          state: import_services9.SpaceState[this._state]
+          state: import_services7.SpaceState[this._state]
         }, {
-          F: __dxlog_file12,
+          F: __dxlog_file11,
           L: 251,
           S: this,
           C: (f, a) => f(...a)
@@ -3462,14 +3396,14 @@ var DataSpace = class {
     });
   }
   async initializeDataPipeline() {
-    if (this._state !== import_services9.SpaceState.CONTROL_ONLY) {
-      throw new import_protocols8.SystemError("Invalid operation");
+    if (this._state !== import_services7.SpaceState.CONTROL_ONLY) {
+      throw new import_protocols7.SystemError("Invalid operation");
     }
-    this._state = import_services9.SpaceState.INITIALIZING;
+    this._state = import_services7.SpaceState.INITIALIZING;
     (0, import_log8.log)("new state", {
-      state: import_services9.SpaceState[this._state]
+      state: import_services7.SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file11,
       L: 267,
       S: this,
       C: (f, a) => f(...a)
@@ -3479,17 +3413,17 @@ var DataSpace = class {
     this._automergeSpaceState.startProcessingRootDocs();
     await (0, import_context7.cancelWithContext)(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
     (0, import_log8.log)("data pipeline ready", void 0, {
-      F: __dxlog_file12,
+      F: __dxlog_file11,
       L: 279,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._callbacks.beforeReady?.();
-    this._state = import_services9.SpaceState.READY;
+    this._state = import_services7.SpaceState.READY;
     (0, import_log8.log)("new state", {
-      state: import_services9.SpaceState[this._state]
+      state: import_services7.SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file11,
       L: 283,
       S: this,
       C: (f, a) => f(...a)
@@ -3505,14 +3439,14 @@ var DataSpace = class {
     this.metrics.controlPipelineReady = /* @__PURE__ */ new Date();
     await this._createWritableFeeds();
     (0, import_log8.log)("writable feeds created", void 0, {
-      F: __dxlog_file12,
+      F: __dxlog_file11,
       L: 299,
       S: this,
       C: (f, a) => f(...a)
     });
     this.stateUpdate.emit();
     if (!this.notarizationPlugin.hasWriter) {
-      this.notarizationPlugin.setWriter((0, import_echo_pipeline.createMappedFeedWriter)((credential) => ({
+      this.notarizationPlugin.setWriter((0, import_echo_pipeline2.createMappedFeedWriter)((credential) => ({
         credential: {
           credential
         }
@@ -3533,7 +3467,7 @@ var DataSpace = class {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials10.AdmittedFeed.Designation.CONTROL
+          designation: import_credentials9.AdmittedFeed.Designation.CONTROL
         }
       }));
     }
@@ -3550,7 +3484,7 @@ var DataSpace = class {
           spaceKey: this.key,
           deviceKey: this._signingContext.deviceKey,
           identityKey: this._signingContext.identityKey,
-          designation: import_credentials10.AdmittedFeed.Designation.DATA
+          designation: import_credentials9.AdmittedFeed.Designation.DATA
         }
       }));
     }
@@ -3568,7 +3502,7 @@ var DataSpace = class {
       space: this.key,
       rootUrl
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file11,
       L: 365,
       S: this,
       C: (f, a) => f(...a)
@@ -3583,7 +3517,7 @@ var DataSpace = class {
         if (this._ctx.disposed) {
           return;
         }
-        const doc = handle.docSync() ?? (0, import_invariant10.failedInvariant)();
+        const doc = handle.docSync() ?? (0, import_invariant9.failedInvariant)();
         if (!doc.access?.spaceKey) {
           handle.change((doc2) => {
             doc2.access = {
@@ -3600,7 +3534,7 @@ var DataSpace = class {
           rootUrl,
           err
         }, {
-          F: __dxlog_file12,
+          F: __dxlog_file11,
           L: 388,
           S: this,
           C: (f, a) => f(...a)
@@ -3627,7 +3561,7 @@ var DataSpace = class {
     let epoch;
     switch (options?.migration) {
       case void 0:
-      case import_services9.CreateEpochRequest.Migration.NONE:
+      case import_services7.CreateEpochRequest.Migration.NONE:
         {
           epoch = {
             previousId: this._automergeSpaceState.lastEpoch?.id,
@@ -3637,7 +3571,7 @@ var DataSpace = class {
           };
         }
         break;
-      case import_services9.CreateEpochRequest.Migration.INIT_AUTOMERGE:
+      case import_services7.CreateEpochRequest.Migration.INIT_AUTOMERGE:
         {
           const document = this._automergeHost.repo.create();
           epoch = {
@@ -3648,14 +3582,14 @@ var DataSpace = class {
           };
         }
         break;
-      case import_services9.CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY:
+      case import_services7.CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY:
         {
           const currentRootUrl = this._automergeSpaceState.rootUrl;
           const rootHandle = this._automergeHost.repo.find(currentRootUrl);
           await (0, import_context7.cancelWithContext)(this._ctx, (0, import_async10.asyncTimeout)(rootHandle.whenReady(), 1e4));
           const newRoot = this._automergeHost.repo.create(rootHandle.docSync());
-          (0, import_invariant10.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
-            F: __dxlog_file12,
+          (0, import_invariant9.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
+            F: __dxlog_file11,
             L: 438,
             S: this,
             A: [
@@ -3671,10 +3605,10 @@ var DataSpace = class {
           };
         }
         break;
-      case import_services9.CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT:
+      case import_services7.CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT:
         {
           import_log8.log.info("Fragmenting", void 0, {
-            F: __dxlog_file12,
+            F: __dxlog_file11,
             L: 450,
             S: this,
             C: (f, a) => f(...a)
@@ -3685,8 +3619,8 @@ var DataSpace = class {
           const objects = Object.entries(rootHandle.docSync().objects);
           const properties = objects.find(([_, value]) => value.system.type?.itemId === import_echo_db.TYPE_PROPERTIES);
           const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
-          (0, import_invariant10.invariant)(properties, "Properties not found", {
-            F: __dxlog_file12,
+          (0, import_invariant9.invariant)(properties, "Properties not found", {
+            F: __dxlog_file11,
             L: 460,
             S: this,
             A: [
@@ -3701,8 +3635,8 @@ var DataSpace = class {
             ])
           };
           const newRoot = this._automergeHost.repo.create(newSpaceDoc);
-          (0, import_invariant10.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
-            F: __dxlog_file12,
+          (0, import_invariant9.invariant)(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
+            F: __dxlog_file11,
             L: 465,
             S: this,
             A: [
@@ -3710,7 +3644,7 @@ var DataSpace = class {
               ""
             ]
           });
-          const docLoader = new import_echo_pipeline2.AutomergeDocumentLoaderImpl(this.key, this._automergeHost.repo);
+          const docLoader = new import_echo_pipeline3.AutomergeDocumentLoaderImpl(this.key, this._automergeHost.repo);
           await docLoader.loadSpaceRootDocHandle(this._ctx, {
             rootUrl: newRoot.url
           });
@@ -3754,24 +3688,24 @@ var DataSpace = class {
     ]));
   }
   async activate() {
-    if (this._state !== import_services9.SpaceState.INACTIVE) {
+    if (this._state !== import_services7.SpaceState.INACTIVE) {
       return;
     }
-    await this._metadataStore.setSpaceState(this.key, import_services9.SpaceState.ACTIVE);
+    await this._metadataStore.setSpaceState(this.key, import_services7.SpaceState.ACTIVE);
     await this._open();
     this.initializeDataPipelineAsync();
   }
   async deactivate() {
-    if (this._state === import_services9.SpaceState.INACTIVE) {
+    if (this._state === import_services7.SpaceState.INACTIVE) {
       return;
     }
-    await this._metadataStore.setSpaceState(this.key, import_services9.SpaceState.INACTIVE);
+    await this._metadataStore.setSpaceState(this.key, import_services7.SpaceState.INACTIVE);
     await this._close();
-    this._state = import_services9.SpaceState.INACTIVE;
+    this._state = import_services7.SpaceState.INACTIVE;
     (0, import_log8.log)("new state", {
-      state: import_services9.SpaceState[this._state]
+      state: import_services7.SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
+      F: __dxlog_file11,
       L: 531,
       S: this,
       C: (f, a) => f(...a)
@@ -3780,18 +3714,18 @@ var DataSpace = class {
   }
 };
 _ts_decorate4([
-  import_tracing5.trace.info()
+  import_tracing4.trace.info()
 ], DataSpace.prototype, "_inner", void 0);
 _ts_decorate4([
-  import_tracing5.trace.info()
+  import_tracing4.trace.info()
 ], DataSpace.prototype, "key", null);
 _ts_decorate4([
-  import_tracing5.trace.info({
-    enum: import_services9.SpaceState
+  import_tracing4.trace.info({
+    enum: import_services7.SpaceState
   })
 ], DataSpace.prototype, "state", null);
 _ts_decorate4([
-  import_tracing5.trace.info({
+  import_tracing4.trace.info({
     depth: null
   })
 ], DataSpace.prototype, "_automergeInfo", null);
@@ -3802,12 +3736,12 @@ _ts_decorate4([
   import_async10.synchronized
 ], DataSpace.prototype, "close", null);
 _ts_decorate4([
-  import_tracing5.trace.span({
+  import_tracing4.trace.span({
     showInBrowserTimeline: true
   })
 ], DataSpace.prototype, "initializeDataPipeline", null);
 _ts_decorate4([
-  import_tracing5.trace.span({
+  import_tracing4.trace.span({
     showInBrowserTimeline: true
   })
 ], DataSpace.prototype, "_initializeAndReadControlPipeline", null);
@@ -3822,11 +3756,11 @@ _ts_decorate4([
 ], DataSpace.prototype, "deactivate", null);
 DataSpace = _ts_decorate4([
   (0, import_async10.trackLeaks)("open", "close"),
-  import_tracing5.trace.resource()
+  import_tracing4.trace.resource()
 ], DataSpace);
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
-    await (0, import_credentials13.createCredential)({
+    await (0, import_credentials12.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: space.key,
@@ -3835,14 +3769,14 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key
       }
     }),
-    await (0, import_credentials13.createCredential)({
+    await (0, import_credentials12.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: signingContext.identityKey,
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey: space.key,
-        role: import_credentials14.SpaceMember.Role.ADMIN,
+        role: import_credentials13.SpaceMember.Role.ADMIN,
         profile: signingContext.getProfile(),
         genesisFeedKey: space.controlFeedKey ?? (0, import_debug4.failUndefined)()
       }
@@ -3854,7 +3788,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials14.AdmittedFeed.Designation.CONTROL
+        designation: import_credentials13.AdmittedFeed.Designation.CONTROL
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -3864,7 +3798,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials14.AdmittedFeed.Designation.DATA
+        designation: import_credentials13.AdmittedFeed.Designation.DATA
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -3898,7 +3832,7 @@ function _ts_decorate5(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
+var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
 var PRESENCE_ANNOUNCE_INTERVAL = 1e4;
 var PRESENCE_OFFLINE_TIMEOUT = 2e4;
 var DataSpaceManager = class {
@@ -3924,15 +3858,15 @@ var DataSpaceManager = class {
   }
   async open() {
     (0, import_log10.log)("open", void 0, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 98,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log10.log.trace("dxos.echo.data-space-manager.open", import_protocols10.trace.begin({
+    import_log10.log.trace("dxos.echo.data-space-manager.open", import_protocols9.trace.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 99,
       S: this,
       C: (f, a) => f(...a)
@@ -3940,7 +3874,7 @@ var DataSpaceManager = class {
     (0, import_log10.log)("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 100,
       S: this,
       C: (f, a) => f(...a)
@@ -3950,7 +3884,7 @@ var DataSpaceManager = class {
         (0, import_log10.log)("load space", {
           spaceMetadata
         }, {
-          F: __dxlog_file13,
+          F: __dxlog_file12,
           L: 104,
           S: this,
           C: (f, a) => f(...a)
@@ -3961,7 +3895,7 @@ var DataSpaceManager = class {
           spaceMetadata,
           err
         }, {
-          F: __dxlog_file13,
+          F: __dxlog_file12,
           L: 107,
           S: this,
           C: (f, a) => f(...a)
@@ -3971,14 +3905,14 @@ var DataSpaceManager = class {
     this._isOpen = true;
     this.updated.emit();
     for (const space of this._spaces.values()) {
-      if (space.state !== import_services10.SpaceState.INACTIVE) {
+      if (space.state !== import_services8.SpaceState.INACTIVE) {
         space.initializeDataPipelineAsync();
       }
     }
-    import_log10.log.trace("dxos.echo.data-space-manager.open", import_protocols10.trace.end({
+    import_log10.log.trace("dxos.echo.data-space-manager.open", import_protocols9.trace.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 120,
       S: this,
       C: (f, a) => f(...a)
@@ -3986,7 +3920,7 @@ var DataSpaceManager = class {
   }
   async close() {
     (0, import_log10.log)("close", void 0, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 125,
       S: this,
       C: (f, a) => f(...a)
@@ -4001,8 +3935,8 @@ var DataSpaceManager = class {
   * Creates a new space writing the genesis credentials to the control feed.
   */
   async createSpace() {
-    (0, import_invariant12.invariant)(this._isOpen, "Not open.", {
-      F: __dxlog_file13,
+    (0, import_invariant11.invariant)(this._isOpen, "Not open.", {
+      F: __dxlog_file12,
       L: 138,
       S: this,
       A: [
@@ -4018,12 +3952,12 @@ var DataSpaceManager = class {
       genesisFeedKey: controlFeedKey,
       controlFeedKey,
       dataFeedKey,
-      state: import_services10.SpaceState.ACTIVE
+      state: import_services8.SpaceState.ACTIVE
     };
     (0, import_log10.log)("creating space...", {
       spaceKey
     }, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 150,
       S: this,
       C: (f, a) => f(...a)
@@ -4038,8 +3972,8 @@ var DataSpaceManager = class {
     const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRoot.url);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    (0, import_invariant12.invariant)((0, import_credentials12.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file13,
+    (0, import_invariant11.invariant)((0, import_credentials11.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file12,
       L: 163,
       S: this,
       A: [
@@ -4057,13 +3991,13 @@ var DataSpaceManager = class {
     (0, import_log10.log)("accept space", {
       opts
     }, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 175,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_invariant12.invariant)(this._isOpen, "Not open.", {
-      F: __dxlog_file13,
+    (0, import_invariant11.invariant)(this._isOpen, "Not open.", {
+      F: __dxlog_file12,
       L: 176,
       S: this,
       A: [
@@ -4071,8 +4005,8 @@ var DataSpaceManager = class {
         "'Not open.'"
       ]
     });
-    (0, import_invariant12.invariant)(!this._spaces.has(opts.spaceKey), "Space already exists.", {
-      F: __dxlog_file13,
+    (0, import_invariant11.invariant)(!this._spaces.has(opts.spaceKey), "Space already exists.", {
+      F: __dxlog_file12,
       L: 177,
       S: this,
       A: [
@@ -4100,14 +4034,14 @@ var DataSpaceManager = class {
   async waitUntilSpaceReady(spaceKey) {
     await (0, import_context9.cancelWithContext)(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
-      return !!space && space.state === import_services10.SpaceState.READY;
+      return !!space && space.state === import_services8.SpaceState.READY;
     }));
   }
   async _constructSpace(metadata) {
     (0, import_log10.log)("construct space", {
       metadata
     }, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 210,
       S: this,
       C: (f, a) => f(...a)
@@ -4145,7 +4079,7 @@ var DataSpaceManager = class {
       },
       onAuthFailure: () => {
         import_log10.log.warn("auth failure", void 0, {
-          F: __dxlog_file13,
+          F: __dxlog_file12,
           L: 247,
           S: this,
           C: (f, a) => f(...a)
@@ -4157,7 +4091,7 @@ var DataSpaceManager = class {
     dataFeed && await space.setDataFeed(dataFeed);
     const dataSpace = new DataSpace({
       inner: space,
-      initialState: metadata.state === import_services10.SpaceState.INACTIVE ? import_services10.SpaceState.INACTIVE : import_services10.SpaceState.CLOSED,
+      initialState: metadata.state === import_services8.SpaceState.INACTIVE ? import_services8.SpaceState.INACTIVE : import_services8.SpaceState.CLOSED,
       metadataStore: this._metadataStore,
       gossip,
       presence,
@@ -4169,7 +4103,7 @@ var DataSpaceManager = class {
           (0, import_log10.log)("before space ready", {
             space: space.key
           }, {
-            F: __dxlog_file13,
+            F: __dxlog_file12,
             L: 265,
             S: this,
             C: (f, a) => f(...a)
@@ -4180,7 +4114,7 @@ var DataSpaceManager = class {
             space: space.key,
             open: this._isOpen
           }, {
-            F: __dxlog_file13,
+            F: __dxlog_file12,
             L: 268,
             S: this,
             C: (f, a) => f(...a)
@@ -4193,7 +4127,7 @@ var DataSpaceManager = class {
           (0, import_log10.log)("before space close", {
             space: space.key
           }, {
-            F: __dxlog_file13,
+            F: __dxlog_file12,
             L: 274,
             S: this,
             C: (f, a) => f(...a)
@@ -4203,7 +4137,7 @@ var DataSpaceManager = class {
       cache: metadata.cache,
       automergeHost: this._automergeHost
     });
-    if (metadata.state !== import_services10.SpaceState.INACTIVE) {
+    if (metadata.state !== import_services8.SpaceState.INACTIVE) {
       await dataSpace.open();
     }
     if (metadata.controlTimeframe) {
@@ -4228,7 +4162,7 @@ _ts_decorate5([
 DataSpaceManager = _ts_decorate5([
   (0, import_async13.trackLeaks)("open", "close")
 ], DataSpaceManager);
-var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
+var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _getDataSpaceManager) {
     this._identityManager = _identityManager;
@@ -4245,29 +4179,29 @@ var SpacesServiceImpl = class {
   }
   async updateSpace({ spaceKey, state }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
     if (state) {
       switch (state) {
-        case import_services11.SpaceState.ACTIVE:
+        case import_services9.SpaceState.ACTIVE:
           await space.activate();
           break;
-        case import_services11.SpaceState.INACTIVE:
+        case import_services9.SpaceState.INACTIVE:
           await space.deactivate();
           break;
         default:
-          throw new import_protocols11.ApiError("Invalid space state");
+          throw new import_protocols10.ApiError("Invalid space state");
       }
     }
   }
   querySpaces() {
-    return new import_codec_protobuf11.Stream(({ next, ctx }) => {
+    return new import_codec_protobuf10.Stream(({ next, ctx }) => {
       const scheduler = new import_async14.UpdateScheduler(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space));
         (0, import_log11.log)("update", {
           spaces
         }, {
-          F: __dxlog_file14,
+          F: __dxlog_file13,
           L: 77,
           S: this,
           C: (f, a) => f(...a)
@@ -4307,14 +4241,14 @@ var SpacesServiceImpl = class {
   }
   async postMessage({ spaceKey, channel, message }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
     await space.postMessage(getChannelId(channel), message);
   }
   subscribeMessages({ spaceKey, channel }) {
-    return new import_codec_protobuf11.Stream(({ ctx, next }) => {
+    return new import_codec_protobuf10.Stream(({ ctx, next }) => {
       (0, import_async14.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
+        const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
         const handle = space.listen(getChannelId(channel), (message) => {
           next(message);
         });
@@ -4323,8 +4257,8 @@ var SpacesServiceImpl = class {
     });
   }
   queryCredentials({ spaceKey, noTail }) {
-    return new import_codec_protobuf11.Stream(({ ctx, next, close }) => {
-      const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
+    return new import_codec_protobuf10.Stream(({ ctx, next, close }) => {
+      const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
       const processor = {
         processCredential: async (credential) => {
           next(credential);
@@ -4340,7 +4274,7 @@ var SpacesServiceImpl = class {
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
-    const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
+    const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
     for (const credential of credentials ?? []) {
       if (credential.proof) {
         await space.controlPipeline.writer.write({
@@ -4349,8 +4283,8 @@ var SpacesServiceImpl = class {
           }
         });
       } else {
-        (0, import_invariant13.invariant)(!credential.id, "Id on unsigned credentials is not allowed", {
-          F: __dxlog_file14,
+        (0, import_invariant12.invariant)(!credential.id, "Id on unsigned credentials is not allowed", {
+          F: __dxlog_file13,
           L: 164,
           S: this,
           A: [
@@ -4358,8 +4292,8 @@ var SpacesServiceImpl = class {
             "'Id on unsigned credentials is not allowed'"
           ]
         });
-        (0, import_invariant13.invariant)(this._identityManager.identity, "Identity is not available", {
-          F: __dxlog_file14,
+        (0, import_invariant12.invariant)(this._identityManager.identity, "Identity is not available", {
+          F: __dxlog_file13,
           L: 165,
           S: this,
           A: [
@@ -4368,8 +4302,8 @@ var SpacesServiceImpl = class {
           ]
         });
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
-        (0, import_invariant13.invariant)(credential.issuer.equals(signer.getIssuer()), void 0, {
-          F: __dxlog_file14,
+        (0, import_invariant12.invariant)(credential.issuer.equals(signer.getIssuer()), void 0, {
+          F: __dxlog_file13,
           L: 167,
           S: this,
           A: [
@@ -4391,7 +4325,7 @@ var SpacesServiceImpl = class {
   }
   async createEpoch({ spaceKey, migration }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols11.SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug5.raise)(new import_protocols10.SpaceNotFoundError(spaceKey));
     await space.createEpoch({
       migration
     });
@@ -4400,7 +4334,7 @@ var SpacesServiceImpl = class {
     return {
       spaceKey: space.key,
       state: space.state,
-      error: space.error ? (0, import_protocols11.encodeError)(space.error) : void 0,
+      error: space.error ? (0, import_protocols10.encodeError)(space.error) : void 0,
       pipeline: {
         currentEpoch: space.automergeSpaceState.lastEpoch,
         appliedEpoch: space.automergeSpaceState.lastEpoch,
@@ -4425,7 +4359,7 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.removed ? import_services11.SpaceMember.PresenceState.REMOVED : isMe || peers.length > 0 ? import_services11.SpaceMember.PresenceState.ONLINE : import_services11.SpaceMember.PresenceState.OFFLINE,
+          presence: member.removed ? import_services9.SpaceMember.PresenceState.REMOVED : isMe || peers.length > 0 ? import_services9.SpaceMember.PresenceState.ONLINE : import_services9.SpaceMember.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4444,7 +4378,7 @@ var createSelectedDocumentsIterator = (automergeHost) => (
   // TODO(mykola): Unload automerge handles after usage.
   async function* loadDocuments(ids) {
     for (const id of ids) {
-      const { documentId, objectId } = import_protocols13.idCodec.decode(id);
+      const { documentId, objectId } = import_protocols12.idCodec.decode(id);
       const handle = automergeHost.repo.find(documentId);
       await (0, import_debug7.warnAfterTimeout)(5e3, "to long to load doc", () => handle.whenReady());
       const doc = handle.docSync();
@@ -4477,7 +4411,7 @@ var createDocumentsIterator = (automergeHost) => (
       if (doc.objects) {
         yield Object.entries(doc.objects).map(([objectId, object]) => {
           return {
-            id: import_protocols13.idCodec.encode({
+            id: import_protocols12.idCodec.encode({
               documentId: handle.documentId,
               objectId
             }),
@@ -4520,9 +4454,10 @@ function _ts_decorate6(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
-var ServiceContext = class {
+var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
+var ServiceContext = class extends import_context10.Resource {
   constructor(storage, level, networkManager, signalManager, _runtimeParams) {
+    super();
     this.storage = storage;
     this.level = level;
     this.networkManager = networkManager;
@@ -4531,8 +4466,8 @@ var ServiceContext = class {
     this.initialized = new import_async15.Trigger();
     this._handlerFactories = /* @__PURE__ */ new Map();
     this._instanceId = import_keys10.PublicKey.random().toHex();
-    this.metadataStore = new import_echo_pipeline3.MetadataStore(storage.createDirectory("metadata"));
-    this.snapshotStore = new import_echo_pipeline3.SnapshotStore(storage.createDirectory("snapshots"));
+    this.metadataStore = new import_echo_pipeline4.MetadataStore(storage.createDirectory("metadata"));
+    this.snapshotStore = new import_echo_pipeline4.SnapshotStore(storage.createDirectory("snapshots"));
     this.blobStore = new import_teleport_extension_object_sync.BlobStore(storage.createDirectory("blobs"));
     this.keyring = new import_keyring.Keyring(storage.createDirectory("keyring"));
     this.feedStore = new import_feed_store4.FeedStore({
@@ -4540,12 +4475,12 @@ var ServiceContext = class {
         root: storage.createDirectory("feeds"),
         signer: this.keyring,
         hypercore: {
-          valueEncoding: import_echo_pipeline3.valueEncoding,
+          valueEncoding: import_echo_pipeline4.valueEncoding,
           stats: true
         }
       })
     });
-    this.spaceManager = new import_echo_pipeline3.SpaceManager({
+    this.spaceManager = new import_echo_pipeline4.SpaceManager({
       feedStore: this.feedStore,
       networkManager: this.networkManager,
       blobStore: this.blobStore,
@@ -4556,64 +4491,69 @@ var ServiceContext = class {
     this.indexMetadata = new import_indexing.IndexMetadataStore({
       db: level.sublevel("index-metadata")
     });
-    this.automergeHost = new import_echo_pipeline3.AutomergeHost({
+    this.automergeHost = new import_echo_pipeline4.AutomergeHost({
       directory: storage.createDirectory("automerge"),
-      metadata: this.indexMetadata
+      db: level.sublevel("automerge"),
+      storageCallbacks: (0, import_indexing.createStorageCallbacks)({
+        host: () => this.automergeHost,
+        metadata: this.indexMetadata
+      })
     });
     this.indexer = new import_indexing.Indexer({
       indexStore: new import_indexing.IndexStore({
-        directory: storage.createDirectory("index-store")
+        db: level.sublevel("index-store")
       }),
       metadataStore: this.indexMetadata,
       loadDocuments: createSelectedDocumentsIterator(this.automergeHost),
       getAllDocuments: createDocumentsIterator(this.automergeHost)
     });
     this.invitations = new InvitationsHandler(this.networkManager);
-    this._handlerFactories.set(import_services12.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? (0, import_debug6.failUndefined)(), this._acceptIdentity.bind(this)));
+    this._handlerFactories.set(import_services10.Invitation.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? (0, import_debug6.failUndefined)(), this._acceptIdentity.bind(this)));
   }
-  async open(ctx) {
+  async _open(ctx) {
     await this._checkStorageVersion();
     (0, import_log12.log)("opening...", void 0, {
-      F: __dxlog_file15,
-      L: 154,
+      F: __dxlog_file14,
+      L: 157,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log12.log.trace("dxos.sdk.service-context.open", import_protocols12.trace.begin({
+    import_log12.log.trace("dxos.sdk.service-context.open", import_protocols11.trace.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file15,
-      L: 155,
+      F: __dxlog_file14,
+      L: 158,
       S: this,
       C: (f, a) => f(...a)
     });
     await this.signalManager.open();
     await this.networkManager.open();
+    await this.automergeHost.open();
     await this.metadataStore.load();
     await this.spaceManager.open();
     await this.identityManager.open(ctx);
     if (this.identityManager.identity) {
       await this._initialize(ctx);
     }
-    import_log12.log.trace("dxos.sdk.service-context.open", import_protocols12.trace.end({
+    import_log12.log.trace("dxos.sdk.service-context.open", import_protocols11.trace.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file15,
-      L: 165,
+      F: __dxlog_file14,
+      L: 169,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_log12.log)("opened", void 0, {
-      F: __dxlog_file15,
-      L: 166,
+      F: __dxlog_file14,
+      L: 170,
       S: this,
       C: (f, a) => f(...a)
     });
   }
-  async close() {
+  async _close() {
     (0, import_log12.log)("closing...", void 0, {
-      F: __dxlog_file15,
-      L: 170,
+      F: __dxlog_file14,
+      L: 174,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4630,8 +4570,8 @@ var ServiceContext = class {
     await this.metadataStore.close();
     await this.indexer.destroy();
     (0, import_log12.log)("closed", void 0, {
-      F: __dxlog_file15,
-      L: 183,
+      F: __dxlog_file14,
+      L: 187,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4643,9 +4583,9 @@ var ServiceContext = class {
   }
   getInvitationHandler(invitation) {
     const factory = this._handlerFactories.get(invitation.kind);
-    (0, import_invariant14.invariant)(factory, `Unknown invitation kind: ${invitation.kind}`, {
-      F: __dxlog_file15,
-      L: 194,
+    (0, import_invariant13.invariant)(factory, `Unknown invitation kind: ${invitation.kind}`, {
+      F: __dxlog_file14,
+      L: 198,
       S: this,
       A: [
         "factory",
@@ -4669,15 +4609,15 @@ var ServiceContext = class {
   }
   async _checkStorageVersion() {
     await this.metadataStore.load();
-    if (this.metadataStore.version !== import_protocols12.STORAGE_VERSION) {
-      throw new import_protocols12.InvalidStorageVersionError(import_protocols12.STORAGE_VERSION, this.metadataStore.version);
+    if (this.metadataStore.version !== import_protocols11.STORAGE_VERSION) {
+      throw new import_protocols11.InvalidStorageVersionError(import_protocols11.STORAGE_VERSION, this.metadataStore.version);
     }
   }
   // Called when identity is created.
   async _initialize(ctx) {
     (0, import_log12.log)("initializing spaces...", void 0, {
-      F: __dxlog_file15,
-      L: 225,
+      F: __dxlog_file14,
+      L: 229,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4697,10 +4637,10 @@ var ServiceContext = class {
     };
     this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.keyring, signingContext, this.feedStore, this.automergeHost, this._runtimeParams);
     await this.dataSpaceManager.open();
-    this._handlerFactories.set(import_services12.Invitation.Kind.SPACE, (invitation) => {
-      (0, import_invariant14.invariant)(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
-        F: __dxlog_file15,
-        L: 249,
+    this._handlerFactories.set(import_services10.Invitation.Kind.SPACE, (invitation) => {
+      (0, import_invariant13.invariant)(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
+        F: __dxlog_file14,
+        L: 253,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -4712,7 +4652,7 @@ var ServiceContext = class {
     this.initialized.wake();
     this._deviceSpaceSync = {
       processCredential: async (credential) => {
-        const assertion = (0, import_credentials15.getCredentialAssertion)(credential);
+        const assertion = (0, import_credentials14.getCredentialAssertion)(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
         }
@@ -4723,8 +4663,8 @@ var ServiceContext = class {
           (0, import_log12.log)("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file15,
-            L: 265,
+            F: __dxlog_file14,
+            L: 269,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4734,8 +4674,8 @@ var ServiceContext = class {
           (0, import_log12.log)("space already exists, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file15,
-            L: 269,
+            F: __dxlog_file14,
+            L: 273,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4745,8 +4685,8 @@ var ServiceContext = class {
           (0, import_log12.log)("accepting space recorded in halo", {
             details: assertion
           }, {
-            F: __dxlog_file15,
-            L: 274,
+            F: __dxlog_file14,
+            L: 278,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4756,8 +4696,8 @@ var ServiceContext = class {
           });
         } catch (err) {
           import_log12.log.catch(err, void 0, {
-            F: __dxlog_file15,
-            L: 280,
+            F: __dxlog_file14,
+            L: 284,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4768,14 +4708,14 @@ var ServiceContext = class {
   }
 };
 _ts_decorate6([
-  import_tracing6.trace.span()
-], ServiceContext.prototype, "open", null);
+  import_tracing5.trace.span()
+], ServiceContext.prototype, "_open", null);
 _ts_decorate6([
-  import_tracing6.trace.span()
+  import_tracing5.trace.span()
 ], ServiceContext.prototype, "_initialize", null);
 ServiceContext = _ts_decorate6([
   (0, import_util7.safeInstanceof)("dxos.client-services.ServiceContext"),
-  import_tracing6.trace.resource()
+  import_tracing5.trace.resource()
 ], ServiceContext);
 var ServiceRegistry = class {
   // prettier-ignore
@@ -4799,118 +4739,155 @@ var ServiceRegistry = class {
     delete this._handlers[name];
   }
 };
-function _ts_decorate7(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
-    r = Reflect.decorate(decorators, target, key, desc);
-  else
-    for (var i = decorators.length - 1; i >= 0; i--)
-      if (d = decorators[i])
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/node.ts";
-var Lock = class {
-  constructor({ lockKey: lockPath, onAcquire, onRelease }) {
-    this._lockPath = lockPath;
-    this._onAcquire = onAcquire;
-    this._onRelease = onRelease;
-  }
-  get lockKey() {
-    return this._lockPath;
-  }
-  async acquire() {
-    (0, import_log13.log)("acquiring lock...", void 0, {
-      F: __dxlog_file16,
-      L: 32,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    this._fileHandle = await import_lock_file.LockFile.acquire(this._lockPath);
-    await this._onAcquire?.();
-    (0, import_log13.log)("acquired lock", void 0, {
-      F: __dxlog_file16,
-      L: 37,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+var DXOS_VERSION = "0.4.10-main.f635fb0";
+var getPlatform = () => {
+  if (process.browser) {
+    if (typeof window !== "undefined") {
+      const { userAgent } = window.navigator;
+      return {
+        type: import_services12.Platform.PLATFORM_TYPE.BROWSER,
+        userAgent,
+        uptime: Math.floor((Date.now() - window.performance.timeOrigin) / 1e3)
+      };
+    } else {
+      return {
+        type: import_services12.Platform.PLATFORM_TYPE.SHARED_WORKER,
+        uptime: Math.floor((Date.now() - performance.timeOrigin) / 1e3)
+      };
+    }
+  } else {
+    const { platform: platform2, version, arch } = process;
+    return {
+      type: import_services12.Platform.PLATFORM_TYPE.NODE,
+      platform: platform2,
+      arch,
+      runtime: version,
+      uptime: Math.floor(process.uptime()),
+      memory: process.memoryUsage()
+    };
   }
-  async release() {
-    await this._onRelease?.();
-    (0, import_invariant15.invariant)(this._fileHandle, "Lock is not acquired", {
-      F: __dxlog_file16,
-      L: 42,
-      S: this,
+};
+var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts";
+var DEFAULT_TIMEOUT = 1e3;
+var createDiagnostics = async (clientServices, serviceContext, config) => {
+  const diagnostics = {
+    created: (/* @__PURE__ */ new Date()).toISOString(),
+    platform: getPlatform(),
+    client: {
+      version: DXOS_VERSION,
+      storage: {
+        version: import_protocols13.STORAGE_VERSION
+      }
+    },
+    trace: import_tracing6.TRACE_PROCESSOR.getDiagnostics()
+  };
+  {
+    (0, import_invariant14.invariant)(clientServices.LoggingService, "SystemService is not available.", {
+      F: __dxlog_file15,
+      L: 108,
+      S: void 0,
       A: [
-        "this._fileHandle",
-        "'Lock is not acquired'"
+        "clientServices.LoggingService",
+        "'SystemService is not available.'"
       ]
     });
-    await import_lock_file.LockFile.release(this._fileHandle);
-  }
-};
-_ts_decorate7([
-  import_log13.logInfo
-], Lock.prototype, "lockKey", null);
-var isLocked = (lockPath) => import_lock_file.LockFile.isLocked(lockPath);
-var getRootPath = (config) => {
-  const { dataRoot = (0, import_util8.isNode)() ? import_client_protocol4.DX_DATA : "dxos/storage" } = config ?? {};
-  return `${dataRoot}/`;
-};
-var isPersistent = (config) => {
-  const { persistent = false } = config ?? {};
-  return config.dataStore !== void 0 && config.dataStore !== import_config2.Runtime.Client.Storage.StorageDriver.RAM || persistent;
-};
-var StorageDriver = import_config.Runtime.Client.Storage.StorageDriver;
-var createStorageObjects = (config) => {
-  const { persistent = false, keyStore, dataStore } = config ?? {};
-  if (persistent && dataStore === StorageDriver.RAM) {
-    throw new import_protocols14.InvalidConfigError("RAM storage cannot be used in persistent mode.");
+    diagnostics.metrics = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.LoggingService.queryMetrics({}), {
+      timeout: DEFAULT_TIMEOUT
+    }).catch(() => void 0);
   }
-  if (!persistent && dataStore !== void 0 && dataStore !== StorageDriver.RAM) {
-    throw new import_protocols14.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+  if (typeof navigator !== "undefined" && navigator.storage) {
+    const map = /* @__PURE__ */ new Map();
+    const dir = await navigator.storage.getDirectory();
+    for await (const filename of dir?.keys()) {
+      const idx = filename.indexOf("-", filename.indexOf("-") + 1);
+      if (idx === -1) {
+        continue;
+      }
+      map.set(filename.slice(0, idx), (map.get(filename.slice(0, idx)) ?? 0) + 1);
+    }
+    diagnostics.storage = Array.from(map.entries()).sort((a, b) => b[1] - a[1]).map(([file, count]) => ({
+      file,
+      count
+    }));
   }
-  if (persistent && keyStore === StorageDriver.RAM) {
-    throw new import_protocols14.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+  const identity = serviceContext.identityManager.identity;
+  if (identity) {
+    diagnostics.identity = {
+      identityKey: identity.identityKey,
+      spaceKey: identity.space.key,
+      profile: identity.profileDocument
+    };
+    const { devices } = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.DevicesService.queryDevices(), {
+      timeout: DEFAULT_TIMEOUT
+    }).catch(() => void 0) ?? {};
+    diagnostics.devices = devices;
+    if (serviceContext.dataSpaceManager) {
+      diagnostics.spaces = await Promise.all(Array.from(serviceContext.dataSpaceManager.spaces.values()).map((space) => getSpaceStats(space)) ?? []);
+    }
+    const { feeds = [] } = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.DevtoolsHost.subscribeToFeeds({}), {
+      timeout: DEFAULT_TIMEOUT
+    }).catch(() => void 0) ?? {};
+    diagnostics.feeds = feeds.map(({ feedKey, bytes, length }) => ({
+      feedKey,
+      bytes,
+      length
+    }));
+    const status = await (0, import_codec_protobuf11.getFirstStreamValue)(clientServices.NetworkService.queryStatus(), {
+      timeout: DEFAULT_TIMEOUT
+    }).catch(() => void 0);
+    diagnostics.networkStatus = status;
+    diagnostics.swarms = serviceContext.networkManager.connectionLog?.swarms;
   }
-  if (!persistent && keyStore !== StorageDriver.RAM && keyStore !== void 0) {
-    throw new import_protocols14.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+  diagnostics.config = config.values;
+  return diagnostics;
+};
+var getSpaceStats = async (space) => {
+  const stats = {
+    key: space.key,
+    metrics: space.metrics,
+    epochs: space.inner.spaceState.credentials.filter((0, import_credentials15.credentialTypeFilter)("dxos.halo.credentials.Epoch")).map((credential) => ({
+      ...credential.subject.assertion,
+      id: credential.id
+    })),
+    members: Array.from(space.inner.spaceState.members.values()).map((member) => ({
+      identity: {
+        identityKey: member.key,
+        profile: {
+          displayName: member.assertion.profile?.displayName
+        }
+      },
+      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? import_services11.SpaceMember.PresenceState.ONLINE : import_services11.SpaceMember.PresenceState.OFFLINE
+    })),
+    pipeline: {
+      // TODO(burdon): Pick properties from credentials if needed.
+      currentEpoch: space.automergeSpaceState.lastEpoch,
+      appliedEpoch: space.automergeSpaceState.lastEpoch,
+      controlFeeds: space.inner.controlPipeline.state.feeds.map((feed) => feed.key),
+      currentControlTimeframe: space.inner.controlPipeline.state.timeframe,
+      targetControlTimeframe: space.inner.controlPipeline.state.targetTimeframe,
+      totalControlTimeframe: space.inner.controlPipeline.state.endTimeframe
+    }
+  };
+  if (stats.metrics) {
+    const { open, ready } = stats.metrics;
+    stats.metrics.startupTime = open && ready && ready.getTime() - open.getTime();
   }
+  return stats;
+};
+var createCollectDiagnosticsBroadcastSender = () => {
   return {
-    storage: (0, import_random_access_storage.createStorage)({
-      type: persistent ? toStorageType(dataStore) : import_random_access_storage.StorageType.RAM,
-      root: getRootPath(config)
-    })
+    broadcastDiagnosticsRequest: async () => void 0
   };
 };
-var toStorageType = (type) => {
-  switch (type) {
-    case void 0:
-      return void 0;
-    case StorageDriver.RAM:
-      return import_random_access_storage.StorageType.RAM;
-    case StorageDriver.CHROME:
-      return import_random_access_storage.StorageType.CHROME;
-    case StorageDriver.FIREFOX:
-      return import_random_access_storage.StorageType.FIREFOX;
-    case StorageDriver.IDB:
-      return import_random_access_storage.StorageType.IDB;
-    case StorageDriver.NODE:
-      return import_random_access_storage.StorageType.NODE;
-    case StorageDriver.WEBFS:
-      return import_random_access_storage.StorageType.WEBFS;
-    default:
-      throw new Error(`Invalid storage type: ${StorageDriver[type]}`);
-  }
-};
-var createLevel = async (config) => {
-  const persistent = isPersistent(config);
-  const storagePath = persistent ? getRootPath(config) : import_node_path.default.join("tmp", "level", import_keys11.PublicKey.random().toHex());
-  const level = new import_level.Level(storagePath);
-  await level.open();
-  return level;
+var createCollectDiagnosticsBroadcastHandler = (_) => {
+  return {
+    start: () => {
+    },
+    stop: () => {
+    }
+  };
 };
-var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
+var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
     this._identityManager = _identityManager;
@@ -4927,8 +4904,8 @@ var DevicesServiceImpl = class {
             devices: []
           });
         } else {
-          (0, import_invariant17.invariant)(this._identityManager.identity?.presence, "presence not present", {
-            F: __dxlog_file17,
+          (0, import_invariant16.invariant)(this._identityManager.identity?.presence, "presence not present", {
+            F: __dxlog_file16,
             L: 32,
             S: this,
             A: [
@@ -4943,9 +4920,9 @@ var DevicesServiceImpl = class {
               const peerState = peers.find((peer) => peer.identityKey.equals(key));
               return {
                 deviceKey: key,
-                kind: this._identityManager.identity?.deviceKey.equals(key) ? import_services14.DeviceKind.CURRENT : import_services14.DeviceKind.TRUSTED,
+                kind: this._identityManager.identity?.deviceKey.equals(key) ? import_services15.DeviceKind.CURRENT : import_services15.DeviceKind.TRUSTED,
                 profile,
-                presence: isMe ? import_services14.Device.PresenceState.ONLINE : peerState ? import_services14.Device.PresenceState.ONLINE : import_services14.Device.PresenceState.OFFLINE
+                presence: isMe ? import_services15.Device.PresenceState.ONLINE : peerState ? import_services15.Device.PresenceState.ONLINE : import_services15.Device.PresenceState.OFFLINE
               };
             })
           });
@@ -4986,11 +4963,65 @@ var DevicesServiceImpl = class {
     });
   }
 };
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/node.ts";
+var Lock = class {
+  constructor({ lockKey: lockPath, onAcquire, onRelease }) {
+    this._lockPath = lockPath;
+    this._onAcquire = onAcquire;
+    this._onRelease = onRelease;
+  }
+  get lockKey() {
+    return this._lockPath;
+  }
+  async acquire() {
+    (0, import_log14.log)("acquiring lock...", void 0, {
+      F: __dxlog_file17,
+      L: 32,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    this._fileHandle = await import_lock_file.LockFile.acquire(this._lockPath);
+    await this._onAcquire?.();
+    (0, import_log14.log)("acquired lock", void 0, {
+      F: __dxlog_file17,
+      L: 37,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+  }
+  async release() {
+    await this._onRelease?.();
+    (0, import_invariant17.invariant)(this._fileHandle, "Lock is not acquired", {
+      F: __dxlog_file17,
+      L: 42,
+      S: this,
+      A: [
+        "this._fileHandle",
+        "'Lock is not acquired'"
+      ]
+    });
+    await import_lock_file.LockFile.release(this._fileHandle);
+  }
+};
+_ts_decorate7([
+  import_log14.logInfo
+], Lock.prototype, "lockKey", null);
+var isLocked = (lockPath) => import_lock_file.LockFile.isLocked(lockPath);
 var LoggingServiceImpl = class {
   constructor() {
     this._logs = new import_async18.Event();
     this._started = Date.now();
-    this._sessionId = import_keys13.PublicKey.random().toHex();
+    this._sessionId = import_keys12.PublicKey.random().toHex();
     this._logProcessor = (_config, entry2) => {
       this._logs.emit(entry2);
     };
@@ -5087,16 +5118,16 @@ var LoggingServiceImpl = class {
 };
 var matchFilter = (filter, level, path2, options) => {
   switch (options) {
-    case import_services15.QueryLogsRequest.MatchingOptions.INCLUSIVE:
+    case import_services16.QueryLogsRequest.MatchingOptions.INCLUSIVE:
       return level >= filter.level && (!filter.pattern || path2.includes(filter.pattern));
-    case import_services15.QueryLogsRequest.MatchingOptions.EXPLICIT:
+    case import_services16.QueryLogsRequest.MatchingOptions.EXPLICIT:
       return level === filter.level && (!filter.pattern || path2.includes(filter.pattern));
   }
 };
 var shouldLog = (entry2, request) => {
-  const options = request.options ?? import_services15.QueryLogsRequest.MatchingOptions.INCLUSIVE;
+  const options = request.options ?? import_services16.QueryLogsRequest.MatchingOptions.INCLUSIVE;
   if (request.filters === void 0) {
-    return options === import_services15.QueryLogsRequest.MatchingOptions.INCLUSIVE;
+    return options === import_services16.QueryLogsRequest.MatchingOptions.INCLUSIVE;
   } else {
     return request.filters.some((filter) => matchFilter(filter, entry2.level, entry2.meta?.F ?? "", options));
   }
@@ -5132,6 +5163,63 @@ var NetworkServiceImpl = class {
     await this.networkManager.setConnectionState(request.swarm);
   }
 };
+var getRootPath = (config) => {
+  const { dataRoot = (0, import_util11.isNode)() ? import_client_protocol5.DX_DATA : "dxos/storage" } = config ?? {};
+  return `${dataRoot}/`;
+};
+var isPersistent = (config) => {
+  const { persistent = false } = config ?? {};
+  return config.dataStore !== void 0 && config.dataStore !== import_config3.Runtime.Client.Storage.StorageDriver.RAM || persistent;
+};
+var StorageDriver = import_config2.Runtime.Client.Storage.StorageDriver;
+var createStorageObjects = (config) => {
+  const { persistent = false, keyStore, dataStore } = config ?? {};
+  if (persistent && dataStore === StorageDriver.RAM) {
+    throw new import_protocols15.InvalidConfigError("RAM storage cannot be used in persistent mode.");
+  }
+  if (!persistent && dataStore !== void 0 && dataStore !== StorageDriver.RAM) {
+    throw new import_protocols15.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+  }
+  if (persistent && keyStore === StorageDriver.RAM) {
+    throw new import_protocols15.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+  }
+  if (!persistent && keyStore !== StorageDriver.RAM && keyStore !== void 0) {
+    throw new import_protocols15.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+  }
+  return {
+    storage: (0, import_random_access_storage.createStorage)({
+      type: persistent ? toStorageType(dataStore) : import_random_access_storage.StorageType.RAM,
+      root: getRootPath(config)
+    })
+  };
+};
+var toStorageType = (type) => {
+  switch (type) {
+    case void 0:
+      return void 0;
+    case StorageDriver.RAM:
+      return import_random_access_storage.StorageType.RAM;
+    case StorageDriver.CHROME:
+      return import_random_access_storage.StorageType.CHROME;
+    case StorageDriver.FIREFOX:
+      return import_random_access_storage.StorageType.FIREFOX;
+    case StorageDriver.IDB:
+      return import_random_access_storage.StorageType.IDB;
+    case StorageDriver.NODE:
+      return import_random_access_storage.StorageType.NODE;
+    case StorageDriver.WEBFS:
+      return import_random_access_storage.StorageType.WEBFS;
+    default:
+      throw new Error(`Invalid storage type: ${StorageDriver[type]}`);
+  }
+};
+var createLevel = async (config) => {
+  const persistent = isPersistent(config);
+  const storagePath = persistent ? import_node_path.default.join(getRootPath(config), "level") : `/tmp/dxos-${import_keys13.PublicKey.random().toHex()}`;
+  const level = new import_level.Level(storagePath);
+  await level.open();
+  return level;
+};
 var SystemServiceImpl = class {
   constructor({ config, statusUpdate, getDiagnostics, onUpdateStatus, getCurrentStatus, onReset }) {
     this._config = config;
@@ -5151,9 +5239,9 @@ var SystemServiceImpl = class {
     const diagnostics = await this._getDiagnostics();
     return {
       timestamp: /* @__PURE__ */ new Date(),
-      diagnostics: JSON.parse(JSON.stringify(diagnostics, (0, import_util11.jsonKeyReplacer)({
-        truncate: keys === import_services16.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE,
-        humanize: keys === import_services16.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE
+      diagnostics: JSON.parse(JSON.stringify(diagnostics, (0, import_util12.jsonKeyReplacer)({
+        truncate: keys === import_services17.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE,
+        humanize: keys === import_services17.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE
       })))
     };
   }
@@ -5201,16 +5289,18 @@ var ClientServicesHost = class {
     transportFactory,
     signalManager,
     storage,
+    level,
     // TODO(wittjosiah): Turn this on by default.
     lockKey,
     callbacks,
     runtimeParams
   } = {}) {
-    this._tracingService = import_tracing7.TRACE_PROCESSOR.createTraceSender();
+    this._tracingService = import_tracing8.TRACE_PROCESSOR.createTraceSender();
     this._statusUpdate = new import_async16.Event();
     this._opening = false;
     this._open = false;
     this._storage = storage;
+    this._level = level;
     this._callbacks = callbacks;
     this._runtimeParams = runtimeParams;
     if (config) {
@@ -5234,14 +5324,14 @@ var ClientServicesHost = class {
     this._systemService = new SystemServiceImpl({
       config: () => this._config,
       statusUpdate: this._statusUpdate,
-      getCurrentStatus: () => this.isOpen ? import_services13.SystemStatus.ACTIVE : import_services13.SystemStatus.INACTIVE,
+      getCurrentStatus: () => this.isOpen ? import_services14.SystemStatus.ACTIVE : import_services14.SystemStatus.INACTIVE,
       getDiagnostics: () => {
         return createDiagnostics(this._serviceRegistry.services, this._serviceContext, this._config);
       },
       onUpdateStatus: async (status) => {
-        if (!this.isOpen && status === import_services13.SystemStatus.ACTIVE) {
+        if (!this.isOpen && status === import_services14.SystemStatus.ACTIVE) {
           await this._resourceLock?.acquire();
-        } else if (this.isOpen && status === import_services13.SystemStatus.INACTIVE) {
+        } else if (this.isOpen && status === import_services14.SystemStatus.INACTIVE) {
           await this._resourceLock?.release();
         }
       },
@@ -5249,8 +5339,9 @@ var ClientServicesHost = class {
         await this.reset();
       }
     });
+    this.diagnosticsBroadcastHandler = createCollectDiagnosticsBroadcastHandler(this._systemService);
     this._loggingService = new LoggingServiceImpl();
-    this._serviceRegistry = new ServiceRegistry(import_client_protocol5.clientServiceBundle, {
+    this._serviceRegistry = new ServiceRegistry(import_client_protocol4.clientServiceBundle, {
       SystemService: this._systemService,
       TracingService: this._tracingService
     });
@@ -5279,25 +5370,25 @@ var ClientServicesHost = class {
   * Can only be called once.
   */
   initialize({ config, ...options }) {
-    (0, import_invariant16.invariant)(!this._open, "service host is open", {
+    (0, import_invariant15.invariant)(!this._open, "service host is open", {
       F: __dxlog_file18,
-      L: 182,
+      L: 197,
       S: this,
       A: [
         "!this._open",
         "'service host is open'"
       ]
     });
-    (0, import_log14.log)("initializing...", void 0, {
+    (0, import_log13.log)("initializing...", void 0, {
       F: __dxlog_file18,
-      L: 183,
+      L: 198,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
-      (0, import_invariant16.invariant)(!this._config, "config already set", {
+      (0, import_invariant15.invariant)(!this._config, "config already set", {
         F: __dxlog_file18,
-        L: 186,
+        L: 201,
         S: this,
         A: [
           "!this._config",
@@ -5310,9 +5401,9 @@ var ClientServicesHost = class {
       }
     }
     if (!options.signalManager) {
-      import_log14.log.warn("running signaling without telemetry metadata.", void 0, {
+      import_log13.log.warn("running signaling without telemetry metadata.", void 0, {
         F: __dxlog_file18,
-        L: 194,
+        L: 209,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -5321,9 +5412,9 @@ var ClientServicesHost = class {
       iceServers: this._config?.get("runtime.services.ice")
     }), signalManager = new import_messaging.WebsocketSignalManager(this._config?.get("runtime.services.signaling") ?? []) } = options;
     this._signalManager = signalManager;
-    (0, import_invariant16.invariant)(!this._networkManager, "network manager already set", {
+    (0, import_invariant15.invariant)(!this._networkManager, "network manager already set", {
       F: __dxlog_file18,
-      L: 205,
+      L: 220,
       S: this,
       A: [
         "!this._networkManager",
@@ -5335,9 +5426,9 @@ var ClientServicesHost = class {
       transportFactory,
       signalManager
     });
-    (0, import_log14.log)("initialized", void 0, {
+    (0, import_log13.log)("initialized", void 0, {
       F: __dxlog_file18,
-      L: 212,
+      L: 227,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5346,45 +5437,45 @@ var ClientServicesHost = class {
     if (this._open) {
       return;
     }
-    const traceId = import_keys12.PublicKey.random().toHex();
-    import_log14.log.trace("dxos.client-services.host.open", import_protocols15.trace.begin({
+    const traceId = import_keys11.PublicKey.random().toHex();
+    import_log13.log.trace("dxos.client-services.host.open", import_protocols14.trace.begin({
       id: traceId
     }), {
       F: __dxlog_file18,
-      L: 223,
+      L: 238,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_invariant16.invariant)(this._config, "config not set", {
+    (0, import_invariant15.invariant)(this._config, "config not set", {
       F: __dxlog_file18,
-      L: 225,
+      L: 240,
       S: this,
       A: [
         "this._config",
         "'config not set'"
       ]
     });
-    (0, import_invariant16.invariant)(this._storage, "storage not set", {
+    (0, import_invariant15.invariant)(this._storage, "storage not set", {
       F: __dxlog_file18,
-      L: 226,
+      L: 241,
       S: this,
       A: [
         "this._storage",
         "'storage not set'"
       ]
     });
-    (0, import_invariant16.invariant)(this._signalManager, "signal manager not set", {
+    (0, import_invariant15.invariant)(this._signalManager, "signal manager not set", {
       F: __dxlog_file18,
-      L: 227,
+      L: 242,
       S: this,
       A: [
         "this._signalManager",
         "'signal manager not set'"
       ]
     });
-    (0, import_invariant16.invariant)(this._networkManager, "network manager not set", {
+    (0, import_invariant15.invariant)(this._networkManager, "network manager not set", {
       F: __dxlog_file18,
-      L: 228,
+      L: 243,
       S: this,
       A: [
         "this._networkManager",
@@ -5392,17 +5483,18 @@ var ClientServicesHost = class {
       ]
     });
     this._opening = true;
-    (0, import_log14.log)("opening...", {
+    (0, import_log13.log)("opening...", {
       lockKey: this._resourceLock?.lockKey
     }, {
       F: __dxlog_file18,
-      L: 231,
+      L: 246,
       S: this,
       C: (f, a) => f(...a)
     });
     if (!this._level) {
       this._level = await createLevel(this._config.get("runtime.client.storage", {}));
     }
+    await this._level.open();
     await this._resourceLock?.acquire();
     await this._loggingService.open();
     this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._runtimeParams);
@@ -5415,7 +5507,7 @@ var ClientServicesHost = class {
         await this._serviceContext.initialized.wait();
         return this._serviceContext.dataSpaceManager;
       }),
-      DataService: new import_echo_pipeline4.DataServiceImpl(this._serviceContext.automergeHost),
+      DataService: new import_echo_pipeline5.DataServiceImpl(this._serviceContext.automergeHost),
       IndexService: new import_indexing2.IndexServiceImpl({
         indexer: this._serviceContext.indexer,
         automergeHost: this._serviceContext.automergeHost
@@ -5431,9 +5523,9 @@ var ClientServicesHost = class {
       })
     });
     await this._serviceContext.open(ctx);
-    (0, import_invariant16.invariant)(this.serviceRegistry.services.InvitationsService, void 0, {
+    (0, import_invariant15.invariant)(this.serviceRegistry.services.InvitationsService, void 0, {
       F: __dxlog_file18,
-      L: 297,
+      L: 314,
       S: this,
       A: [
         "this.serviceRegistry.services.InvitationsService",
@@ -5441,11 +5533,11 @@ var ClientServicesHost = class {
       ]
     });
     const loadedInvitations = await this.serviceRegistry.services.InvitationsService.loadPersistentInvitations();
-    (0, import_log14.log)("loaded persistent invitations", {
+    (0, import_log13.log)("loaded persistent invitations", {
       count: loadedInvitations.invitations?.length
     }, {
       F: __dxlog_file18,
-      L: 300,
+      L: 317,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5454,28 +5546,29 @@ var ClientServicesHost = class {
       this._devtoolsProxy = new import_websocket_rpc.WebsocketRpcClient({
         url: devtoolsProxy,
         requested: {},
-        exposed: import_client_protocol5.clientServiceBundle,
+        exposed: import_client_protocol4.clientServiceBundle,
         handlers: this.services
       });
       void this._devtoolsProxy.open();
     }
+    this.diagnosticsBroadcastHandler.start();
     this._opening = false;
     this._open = true;
     this._statusUpdate.emit();
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    (0, import_log14.log)("opened", {
+    (0, import_log13.log)("opened", {
       deviceKey
     }, {
       F: __dxlog_file18,
-      L: 317,
+      L: 335,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log14.log.trace("dxos.client-services.host.open", import_protocols15.trace.end({
+    import_log13.log.trace("dxos.client-services.host.open", import_protocols14.trace.end({
       id: traceId
     }), {
       F: __dxlog_file18,
-      L: 318,
+      L: 336,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5485,14 +5578,15 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    (0, import_log14.log)("closing...", {
+    (0, import_log13.log)("closing...", {
       deviceKey
     }, {
       F: __dxlog_file18,
-      L: 329,
+      L: 347,
       S: this,
       C: (f, a) => f(...a)
     });
+    this.diagnosticsBroadcastHandler.stop();
     await this._devtoolsProxy?.close();
     this._serviceRegistry.setServices({
       SystemService: this._systemService
@@ -5502,44 +5596,44 @@ var ClientServicesHost = class {
     await this._level?.close();
     this._open = false;
     this._statusUpdate.emit();
-    (0, import_log14.log)("closed", {
+    (0, import_log13.log)("closed", {
       deviceKey
     }, {
       F: __dxlog_file18,
-      L: 337,
+      L: 356,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async reset() {
-    const traceId = import_keys12.PublicKey.random().toHex();
-    import_log14.log.trace("dxos.sdk.client-services-host.reset", import_protocols15.trace.begin({
+    const traceId = import_keys11.PublicKey.random().toHex();
+    import_log13.log.trace("dxos.sdk.client-services-host.reset", import_protocols14.trace.begin({
       id: traceId
     }), {
       F: __dxlog_file18,
-      L: 342,
+      L: 361,
       S: this,
       C: (f, a) => f(...a)
     });
-    (0, import_log14.log)("resetting...", void 0, {
+    (0, import_log13.log)("resetting...", void 0, {
       F: __dxlog_file18,
-      L: 344,
+      L: 363,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._serviceContext?.close();
     await this._storage.reset();
-    (0, import_log14.log)("reset", void 0, {
+    (0, import_log13.log)("reset", void 0, {
       F: __dxlog_file18,
-      L: 347,
+      L: 366,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log14.log.trace("dxos.sdk.client-services-host.reset", import_protocols15.trace.end({
+    import_log13.log.trace("dxos.sdk.client-services-host.reset", import_protocols14.trace.end({
       id: traceId
     }), {
       F: __dxlog_file18,
-      L: 348,
+      L: 367,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5550,9 +5644,9 @@ var ClientServicesHost = class {
     await this._serviceContext.initialized.wait();
     const space = await this._serviceContext.dataSpaceManager.createSpace();
     const automergeIndex = space.automergeSpaceState.rootUrl;
-    (0, import_invariant16.invariant)(automergeIndex, void 0, {
+    (0, import_invariant15.invariant)(automergeIndex, void 0, {
       F: __dxlog_file18,
-      L: 360,
+      L: 379,
       S: this,
       A: [
         "automergeIndex",
@@ -5563,16 +5657,16 @@ var ClientServicesHost = class {
     await document.whenReady();
     const properties = {
       system: {
-        type: (0, import_echo_pipeline4.encodeReference)(E.getTypeReference(import_client_protocol5.Properties))
+        type: (0, import_echo_pipeline5.encodeReference)((0, import_echo_schema.getTypeReference)(import_client_protocol4.Properties))
       },
       data: {
-        [import_client_protocol5.defaultKey]: identity.identityKey.toHex()
+        [import_client_protocol4.defaultKey]: identity.identityKey.toHex()
       },
       meta: {
         keys: []
       }
     };
-    const propertiesId = import_keys12.PublicKey.random().toHex();
+    const propertiesId = import_keys11.PublicKey.random().toHex();
     document.change((doc) => {
       (0, import_util9.assignDeep)(doc, [
         "objects",
@@ -5584,31 +5678,65 @@ var ClientServicesHost = class {
   }
 };
 _ts_decorate8([
-  import_tracing7.trace.info()
+  import_tracing8.trace.info()
 ], ClientServicesHost.prototype, "_opening", void 0);
 _ts_decorate8([
-  import_tracing7.trace.info()
+  import_tracing8.trace.info()
 ], ClientServicesHost.prototype, "_open", void 0);
 _ts_decorate8([
   import_async16.synchronized,
-  import_tracing7.trace.span()
+  import_tracing8.trace.span()
 ], ClientServicesHost.prototype, "open", null);
 _ts_decorate8([
   import_async16.synchronized,
-  import_tracing7.trace.span()
+  import_tracing8.trace.span()
 ], ClientServicesHost.prototype, "close", null);
 ClientServicesHost = _ts_decorate8([
-  import_tracing7.trace.resource()
+  import_tracing8.trace.resource()
 ], ClientServicesHost);
+var ClientServicesProviderResource = Symbol.for("dxos.resource.ClientServices");
+var DiagnosticsCollector = class {
+  static {
+    this.broadcastSender = createCollectDiagnosticsBroadcastSender();
+  }
+  static async collect(config = findConfigs(), services = findSystemServiceProvider(), options = {}) {
+    const serviceDiagnostics = await services?.services?.SystemService?.getDiagnostics({
+      keys: options.humanize ? import_services13.GetDiagnosticsRequest.KEY_OPTION.HUMANIZE : options.truncate ? import_services13.GetDiagnosticsRequest.KEY_OPTION.TRUNCATE : void 0
+    });
+    const clientDiagnostics = {
+      config,
+      trace: import_tracing7.TRACE_PROCESSOR.getDiagnostics()
+    };
+    const diagnostics = serviceDiagnostics != null ? {
+      client: clientDiagnostics,
+      services: serviceDiagnostics
+    } : {
+      client: clientDiagnostics,
+      broadcast: await this.broadcastSender.broadcastDiagnosticsRequest()
+    };
+    return JSON.parse(JSON.stringify(diagnostics, (0, import_util8.jsonKeyReplacer)(options)));
+  }
+};
+var findSystemServiceProvider = () => {
+  const serviceProviders = import_tracing7.TRACE_PROCESSOR.findByAnnotation(ClientServicesProviderResource);
+  const providerResource = serviceProviders.find((r) => r.instance.deref()?.services?.SystemService != null);
+  return providerResource?.instance?.deref() ?? null;
+};
+var findConfigs = () => {
+  const configs = import_tracing7.TRACE_PROCESSOR.findByAnnotation(import_config.ConfigResource);
+  return configs.map((r) => r.instance.deref()).filter(import_util8.nonNullable);
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ClientRpcServer,
   ClientServicesHost,
+  ClientServicesProviderResource,
   DataSpace,
   DataSpaceManager,
   DeviceInvitationProtocol,
   DevtoolsHostEvents,
   DevtoolsServiceImpl,
+  DiagnosticsCollector,
   Identity,
   IdentityManager,
   IdentityServiceImpl,
@@ -5620,12 +5748,14 @@ ClientServicesHost = _ts_decorate8([
   SpaceInvitationProtocol,
   SpacesServiceImpl,
   TrustedKeySetAuthVerifier,
+  createAdmissionKeypair,
   createAuthProvider,
+  createCollectDiagnosticsBroadcastHandler,
+  createCollectDiagnosticsBroadcastSender,
   createDiagnostics,
   createLevel,
   createStorageObjects,
   getNetworkPeers,
-  invitationExpired,
   isLocked,
   subscribeToFeedBlocks,
   subscribeToFeeds,
@@ -5635,4 +5765,4 @@ ClientServicesHost = _ts_decorate8([
   subscribeToSpaces,
   subscribeToSwarmInfo
 });
-//# sourceMappingURL=chunk-42TXJ32V.cjs.map
+//# sourceMappingURL=chunk-CLDZACGI.cjs.map