@dxos/client-services 0.4.10-main.fa5a270 → 0.4.10-main.fe71b4c

package/dist/lib/browser/{chunk-7PYX6UUA.mjs → chunk-7S34JE6M.mjs}

@@ -1282,6 +1282,7 @@ import { PushStream, scheduleTask as scheduleTask2, TimeoutError, Trigger as Tri
 import { AuthenticatingInvitation, AUTHENTICATION_CODE_LENGTH, CancellableInvitation, INVITATION_TIMEOUT } from "@dxos/client-protocol";
 import { Context as Context5 } from "@dxos/context";
 import { generatePasscode } from "@dxos/credentials";
+import { createKeyPair, sign } from "@dxos/crypto";
 import { invariant as invariant6 } from "@dxos/invariant";
 import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { log as log5 } from "@dxos/log";
@@ -1293,6 +1294,7 @@ import { AuthenticationResponse as AuthenticationResponse2 } from "@dxos/protoco
 // packages/sdk/client-services/src/packlets/invitations/invitation-extension.ts
 import { Trigger as Trigger2 } from "@dxos/async";
 import { cancelWithContext, Context as Context4 } from "@dxos/context";
+import { randomBytes, verify } from "@dxos/crypto";
 import { invariant as invariant5 } from "@dxos/invariant";
 import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log as log4 } from "@dxos/log";
@@ -1316,6 +1318,7 @@ var InvitationHostExtension = class extends RpcExtension {
     this._callbacks = _callbacks;
     this._ctx = new Context4();
     this._remoteOptionsTrigger = new Trigger2();
+    this._challenge = void 0;
     this.invitation = void 0;
     this.guestProfile = void 0;
     this.authenticationPassed = false;
@@ -1330,7 +1333,7 @@ var InvitationHostExtension = class extends RpcExtension {
         options: async (options) => {
           invariant5(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 87,
+            L: 90,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1347,7 +1350,7 @@ var InvitationHostExtension = class extends RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 96,
+            L: 99,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1357,7 +1360,7 @@ var InvitationHostExtension = class extends RpcExtension {
               invitationId
             }, {
               F: __dxlog_file6,
-              L: 100,
+              L: 103,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1371,7 +1374,7 @@ var InvitationHostExtension = class extends RpcExtension {
             guestProfile: profile
           }, {
             F: __dxlog_file6,
-            L: 109,
+            L: 112,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1380,25 +1383,27 @@ var InvitationHostExtension = class extends RpcExtension {
             ...this.invitation,
             state: Invitation2.State.READY_FOR_AUTHENTICATION
           });
+          this._challenge = this.invitation.authMethod === Invitation2.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : void 0;
           log4.trace("dxos.sdk.invitation-handler.host.introduce", trace3.end({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 116,
+            L: 122,
             S: this,
             C: (f, a) => f(...a)
           });
           return {
-            authMethod: this.invitation.authMethod
+            authMethod: this.invitation.authMethod,
+            challenge: this._challenge
           };
         },
-        authenticate: async ({ authCode: code }) => {
+        authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = PublicKey5.random().toHex();
           log4.trace("dxos.sdk.invitation-handler.host.authenticate", trace3.begin({
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 124,
+            L: 131,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1406,14 +1411,14 @@ var InvitationHostExtension = class extends RpcExtension {
             authCode: code
           }, {
             F: __dxlog_file6,
-            L: 125,
+            L: 132,
             S: this,
             C: (f, a) => f(...a)
           });
           let status = AuthenticationResponse.Status.OK;
           invariant5(this.invitation, "Invitation is not set.", {
             F: __dxlog_file6,
-            L: 128,
+            L: 135,
             S: this,
             A: [
               "this.invitation",
@@ -1424,7 +1429,7 @@ var InvitationHostExtension = class extends RpcExtension {
             case Invitation2.AuthMethod.NONE: {
               log4("authentication not required", void 0, {
                 F: __dxlog_file6,
-                L: 131,
+                L: 138,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1444,12 +1449,25 @@ var InvitationHostExtension = class extends RpcExtension {
               }
               break;
             }
+            case Invitation2.AuthMethod.KNOWN_PUBLIC_KEY: {
+              if (!this.invitation.guestKeypair) {
+                status = AuthenticationResponse.Status.INTERNAL_ERROR;
+                break;
+              }
+              const isSignatureValid = this._challenge && verify(this._challenge, Buffer.from(signedChallenge ?? []), this.invitation.guestKeypair.publicKey.asBuffer());
+              if (isSignatureValid) {
+                this.authenticationPassed = true;
+              } else {
+                status = AuthenticationResponse.Status.INVALID_SIGNATURE;
+              }
+              break;
+            }
             default: {
               log4.error("invalid authentication method", {
                 authMethod: this.invitation.authMethod
               }, {
                 F: __dxlog_file6,
-                L: 149,
+                L: 176,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1464,7 +1482,7 @@ var InvitationHostExtension = class extends RpcExtension {
             }
           }), {
             F: __dxlog_file6,
-            L: 155,
+            L: 182,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1478,14 +1496,14 @@ var InvitationHostExtension = class extends RpcExtension {
             id: traceId
           }), {
             F: __dxlog_file6,
-            L: 161,
+            L: 188,
             S: this,
             C: (f, a) => f(...a)
           });
           try {
             invariant5(this.invitation, "Invitation is not set.", {
               F: __dxlog_file6,
-              L: 164,
+              L: 191,
               S: this,
               A: [
                 "this.invitation",
@@ -1500,7 +1518,7 @@ var InvitationHostExtension = class extends RpcExtension {
               id: traceId
             }), {
               F: __dxlog_file6,
-              L: 172,
+              L: 199,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1557,7 +1575,7 @@ var InvitationGuestExtension = class extends RpcExtension {
         options: async (options) => {
           invariant5(!this._remoteOptions, "Remote options already set.", {
             F: __dxlog_file6,
-            L: 239,
+            L: 266,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -1584,7 +1602,7 @@ var InvitationGuestExtension = class extends RpcExtension {
     try {
       log4("begin options", void 0, {
         F: __dxlog_file6,
-        L: 260,
+        L: 287,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1596,7 +1614,7 @@ var InvitationGuestExtension = class extends RpcExtension {
       }));
       log4("end options", void 0, {
         F: __dxlog_file6,
-        L: 263,
+        L: 290,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1610,7 +1628,7 @@ var InvitationGuestExtension = class extends RpcExtension {
     } catch (err) {
       log4("openError", err, {
         F: __dxlog_file6,
-        L: 273,
+        L: 300,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1620,7 +1638,7 @@ var InvitationGuestExtension = class extends RpcExtension {
   async onClose() {
     log4("onClose", void 0, {
       F: __dxlog_file6,
-      L: 279,
+      L: 306,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1639,11 +1657,11 @@ var InvitationsHandler = class {
     this._networkManager = _networkManager;
   }
   createInvitation(protocol, options) {
-    const { invitationId = PublicKey6.random().toHex(), type = Invitation3.Type.INTERACTIVE, authMethod = Invitation3.AuthMethod.SHARED_SECRET, state = Invitation3.State.INIT, timeout = INVITATION_TIMEOUT, swarmKey = PublicKey6.random(), persistent = true, created = /* @__PURE__ */ new Date(), lifetime = 86400 } = options ?? {};
+    const { invitationId = PublicKey6.random().toHex(), type = Invitation3.Type.INTERACTIVE, authMethod = Invitation3.AuthMethod.SHARED_SECRET, state = Invitation3.State.INIT, timeout = INVITATION_TIMEOUT, swarmKey = PublicKey6.random(), persistent = options?.authMethod !== Invitation3.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, lifetime = 86400, multiUse = false } = options ?? {};
     const authCode = options?.authCode ?? (authMethod === Invitation3.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0);
     invariant6(protocol, void 0, {
       F: __dxlog_file7,
-      L: 84,
+      L: 87,
       S: this,
       A: [
         "protocol",
@@ -1658,9 +1676,11 @@ var InvitationsHandler = class {
       swarmKey,
       authCode,
       timeout,
-      persistent,
+      persistent: persistent && type !== Invitation3.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === Invitation3.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
       created,
       lifetime,
+      multiUse,
       ...protocol.getInvitationContext()
     };
     const stream = new PushStream();
@@ -1675,7 +1695,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 109,
+        L: 115,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1700,7 +1720,7 @@ var InvitationsHandler = class {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             invariant6(deviceKey, void 0, {
               F: __dxlog_file7,
-              L: 130,
+              L: 136,
               S: this,
               A: [
                 "deviceKey",
@@ -1723,7 +1743,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 148,
+                L: 154,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1731,7 +1751,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 149,
+                L: 155,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1747,7 +1767,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 152,
+                L: 158,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1759,7 +1779,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 154,
+                L: 160,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1769,7 +1789,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 157,
+                  L: 163,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1780,7 +1800,7 @@ var InvitationsHandler = class {
               } else {
                 log5.error("failed", err, {
                   F: __dxlog_file7,
-                  L: 160,
+                  L: 166,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -1791,12 +1811,12 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 163,
+                L: 169,
                 S: this,
                 C: (f, a) => f(...a)
               });
             } finally {
-              if (type !== Invitation3.Type.MULTIUSE) {
+              if (!multiUse) {
                 await swarmConnection.close();
                 await ctx.dispose();
               }
@@ -1812,7 +1832,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 178,
+              L: 184,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1823,7 +1843,7 @@ var InvitationsHandler = class {
           } else {
             log5.error("failed", err, {
               F: __dxlog_file7,
-              L: 181,
+              L: 187,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1837,7 +1857,7 @@ var InvitationsHandler = class {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
         log5.warn("invitation has already expired", void 0, {
           F: __dxlog_file7,
-          L: 192,
+          L: 198,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1888,7 +1908,7 @@ var InvitationsHandler = class {
     const { timeout = INVITATION_TIMEOUT } = invitation;
     invariant6(protocol, void 0, {
       F: __dxlog_file7,
-      L: 246,
+      L: 252,
       S: this,
       A: [
         "protocol",
@@ -1898,7 +1918,7 @@ var InvitationsHandler = class {
     if (deviceProfile) {
       invariant6(invitation.kind === Invitation3.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
         F: __dxlog_file7,
-        L: 250,
+        L: 256,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -1913,7 +1933,7 @@ var InvitationsHandler = class {
     const setState = (newData) => {
       invariant6(newData.state !== void 0, void 0, {
         F: __dxlog_file7,
-        L: 261,
+        L: 267,
         S: this,
         A: [
           "newData.state !== undefined",
@@ -1933,7 +1953,7 @@ var InvitationsHandler = class {
             ...protocol.toJSON()
           }, {
             F: __dxlog_file7,
-            L: 269,
+            L: 275,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1943,7 +1963,7 @@ var InvitationsHandler = class {
         } else {
           log5.warn("auth failed", err, {
             F: __dxlog_file7,
-            L: 272,
+            L: 278,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1957,7 +1977,7 @@ var InvitationsHandler = class {
         ...protocol.toJSON()
       }, {
         F: __dxlog_file7,
-        L: 280,
+        L: 286,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1972,7 +1992,7 @@ var InvitationsHandler = class {
               currentState
             }, {
               F: __dxlog_file7,
-              L: 290,
+              L: 296,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1987,7 +2007,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 299,
+                L: 305,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1999,7 +2019,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 307,
+                L: 313,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2010,7 +2030,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 311,
+                L: 317,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2020,62 +2040,28 @@ var InvitationsHandler = class {
                 response: introductionResponse
               }, {
                 F: __dxlog_file7,
-                L: 315,
+                L: 321,
                 S: this,
                 C: (f, a) => f(...a)
               });
               invitation.authMethod = introductionResponse.authMethod;
               if (isAuthenticationRequired(invitation)) {
-                for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-                  log5("guest waiting for authentication code...", void 0, {
-                    F: __dxlog_file7,
-                    L: 321,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: Invitation3.State.READY_FOR_AUTHENTICATION
-                  });
-                  const authCode = await authenticated.wait({
-                    timeout
-                  });
-                  log5("sending authentication request", void 0, {
-                    F: __dxlog_file7,
-                    L: 325,
-                    S: this,
-                    C: (f, a) => f(...a)
-                  });
-                  setState({
-                    state: Invitation3.State.AUTHENTICATING
-                  });
-                  const response = await extension.rpc.InvitationHostService.authenticate({
-                    authCode
-                  });
-                  if (response.status === void 0 || response.status === AuthenticationResponse2.Status.OK) {
+                switch (invitation.authMethod) {
+                  case Invitation3.AuthMethod.SHARED_SECRET:
+                    await this._handleGuestOtpAuth(extension, setState, authenticated, {
+                      timeout
+                    });
+                    break;
+                  case Invitation3.AuthMethod.KNOWN_PUBLIC_KEY:
+                    await this._handleGuestKpkAuth(extension, setState, invitation, introductionResponse);
                     break;
-                  }
-                  if (response.status === AuthenticationResponse2.Status.INVALID_OTP) {
-                    if (attempt === MAX_OTP_ATTEMPTS) {
-                      throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
-                    } else {
-                      log5("retrying invalid code", {
-                        attempt
-                      }, {
-                        F: __dxlog_file7,
-                        L: 336,
-                        S: this,
-                        C: (f, a) => f(...a)
-                      });
-                      authenticated.reset();
-                    }
-                  }
                 }
               }
               log5("request admission", {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 344,
+                L: 337,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2087,7 +2073,7 @@ var InvitationsHandler = class {
                 ...protocol.toJSON()
               }, {
                 F: __dxlog_file7,
-                L: 355,
+                L: 348,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2100,7 +2086,7 @@ var InvitationsHandler = class {
                 id: traceId
               }), {
                 F: __dxlog_file7,
-                L: 357,
+                L: 350,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2110,7 +2096,7 @@ var InvitationsHandler = class {
                   ...protocol.toJSON()
                 }, {
                   F: __dxlog_file7,
-                  L: 360,
+                  L: 353,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2120,7 +2106,7 @@ var InvitationsHandler = class {
               } else {
                 log5("auth failed", err, {
                   F: __dxlog_file7,
-                  L: 363,
+                  L: 356,
                   S: this,
                   C: (f, a) => f(...a)
                 });
@@ -2131,7 +2117,7 @@ var InvitationsHandler = class {
                 error: err
               }), {
                 F: __dxlog_file7,
-                L: 366,
+                L: 359,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -2149,7 +2135,7 @@ var InvitationsHandler = class {
               ...protocol.toJSON()
             }, {
               F: __dxlog_file7,
-              L: 377,
+              L: 370,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2159,7 +2145,7 @@ var InvitationsHandler = class {
           } else {
             log5("auth failed", err, {
               F: __dxlog_file7,
-              L: 380,
+              L: 373,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -2176,7 +2162,7 @@ var InvitationsHandler = class {
       } else {
         invariant6(invitation.swarmKey, void 0, {
           F: __dxlog_file7,
-          L: 394,
+          L: 387,
           S: this,
           A: [
             "invitation.swarmKey",
@@ -2214,15 +2200,88 @@ var InvitationsHandler = class {
     });
     return observable;
   }
+  async _handleGuestOtpAuth(extension, setState, authenticated, options) {
+    for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
+      log5("guest waiting for authentication code...", void 0, {
+        F: __dxlog_file7,
+        L: 427,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: Invitation3.State.READY_FOR_AUTHENTICATION
+      });
+      const authCode = await authenticated.wait(options);
+      log5("sending authentication request", void 0, {
+        F: __dxlog_file7,
+        L: 431,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      setState({
+        state: Invitation3.State.AUTHENTICATING
+      });
+      const response = await extension.rpc.InvitationHostService.authenticate({
+        authCode
+      });
+      if (response.status === void 0 || response.status === AuthenticationResponse2.Status.OK) {
+        break;
+      }
+      if (response.status === AuthenticationResponse2.Status.INVALID_OTP) {
+        if (attempt === MAX_OTP_ATTEMPTS) {
+          throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
+        } else {
+          log5("retrying invalid code", {
+            attempt
+          }, {
+            F: __dxlog_file7,
+            L: 442,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          authenticated.reset();
+        }
+      }
+    }
+  }
+  async _handleGuestKpkAuth(extension, setState, invitation, introductionResponse) {
+    if (invitation.guestKeypair?.privateKey == null) {
+      throw new Error("keypair missing in the invitation");
+    }
+    if (introductionResponse.challenge == null) {
+      throw new Error("challenge missing in the introduction");
+    }
+    log5("sending authentication request", void 0, {
+      F: __dxlog_file7,
+      L: 461,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    setState({
+      state: Invitation3.State.AUTHENTICATING
+    });
+    const signature = sign(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
+    const response = await extension.rpc.InvitationHostService.authenticate({
+      signedChallenge: signature
+    });
+    if (response.status !== AuthenticationResponse2.Status.OK) {
+      throw new Error(`Authentication failed with code: ${response.status}`);
+    }
+  }
 };
-var invitationExpired = (invitation) => {
-  return invitation.created && invitation.lifetime && invitation.lifetime !== 0 && invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now();
+var createAdmissionKeypair = () => {
+  const keypair = createKeyPair();
+  return {
+    publicKey: PublicKey6.from(keypair.publicKey),
+    privateKey: keypair.secretKey
+  };
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-service.ts
 import { Event as Event3, scheduleTask as scheduleTask3 } from "@dxos/async";
 import { Stream as Stream8 } from "@dxos/codec-protobuf";
 import { Context as Context6 } from "@dxos/context";
+import { hasInvitationExpired } from "@dxos/echo-pipeline";
 import { invariant as invariant7 } from "@dxos/invariant";
 import { log as log6 } from "@dxos/log";
 import { Invitation as Invitation4, QueryInvitationsResponse } from "@dxos/protocols/proto/dxos/client/services";
@@ -2281,7 +2340,7 @@ var InvitationsServiceImpl = class {
           await this._metadataStore.removeInvitation(invitation.get().invitationId);
         }
         this._createInvitations.delete(invitation.get().invitationId);
-        if (invitation.get().type !== Invitation4.Type.MULTIUSE) {
+        if (!invitation.get().multiUse) {
           this._removedCreated.emit(invitation.get());
         }
       });
@@ -2289,7 +2348,7 @@ var InvitationsServiceImpl = class {
   }
   async loadPersistentInvitations() {
     const persistentInvitations = this._metadataStore.getInvitations();
-    const freshInvitations = persistentInvitations.filter(async (invitation) => !invitationExpired(invitation));
+    const freshInvitations = persistentInvitations.filter(async (invitation) => !hasInvitationExpired(invitation));
     const cInvitations = freshInvitations.map((persistentInvitation) => {
       invariant7(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
         F: __dxlog_file8,
@@ -2342,7 +2401,7 @@ var InvitationsServiceImpl = class {
       }, () => {
         close();
         this._acceptInvitations.delete(invitation.get().invitationId);
-        if (invitation.get().type !== Invitation4.Type.MULTIUSE) {
+        if (!invitation.get().multiUse) {
           this._removedAccepted.emit(invitation.get());
         }
       });
@@ -2730,163 +2789,15 @@ ClientRpcServer = _ts_decorate3([
   trace5.resource()
 ], ClientRpcServer);
 
-// packages/sdk/client-services/src/packlets/services/diagnostics.ts
-import { getFirstStreamValue } from "@dxos/codec-protobuf";
-import { credentialTypeFilter } from "@dxos/credentials";
-import { invariant as invariant9 } from "@dxos/invariant";
-import { STORAGE_VERSION } from "@dxos/protocols";
-import { SpaceMember } from "@dxos/protocols/proto/dxos/client/services";
-import { TRACE_PROCESSOR } from "@dxos/tracing";
-
-// packages/sdk/client-services/src/packlets/services/platform.ts
-import { Platform } from "@dxos/protocols/proto/dxos/client/services";
-var getPlatform = () => {
-  if (process.browser) {
-    if (typeof window !== "undefined") {
-      const { userAgent } = window.navigator;
-      return {
-        type: Platform.PLATFORM_TYPE.BROWSER,
-        userAgent,
-        uptime: Math.floor((Date.now() - window.performance.timeOrigin) / 1e3)
-      };
-    } else {
-      return {
-        type: Platform.PLATFORM_TYPE.SHARED_WORKER,
-        uptime: Math.floor((Date.now() - performance.timeOrigin) / 1e3)
-      };
-    }
-  } else {
-    const { platform: platform2, version, arch } = process;
-    return {
-      type: Platform.PLATFORM_TYPE.NODE,
-      platform: platform2,
-      arch,
-      runtime: version,
-      uptime: Math.floor(process.uptime()),
-      memory: process.memoryUsage()
-    };
-  }
-};
-
-// packages/sdk/client-services/src/version.ts
-var DXOS_VERSION = "0.4.10-main.fa5a270";
-
-// packages/sdk/client-services/src/packlets/services/diagnostics.ts
-var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/diagnostics.ts";
-var DEFAULT_TIMEOUT = 1e3;
-var createDiagnostics = async (clientServices, serviceContext, config) => {
-  const diagnostics = {
-    created: (/* @__PURE__ */ new Date()).toISOString(),
-    platform: getPlatform(),
-    client: {
-      version: DXOS_VERSION,
-      storage: {
-        version: STORAGE_VERSION
-      }
-    },
-    trace: TRACE_PROCESSOR.getDiagnostics()
-  };
-  {
-    invariant9(clientServices.LoggingService, "SystemService is not available.", {
-      F: __dxlog_file10,
-      L: 108,
-      S: void 0,
-      A: [
-        "clientServices.LoggingService",
-        "'SystemService is not available.'"
-      ]
-    });
-    diagnostics.metrics = await getFirstStreamValue(clientServices.LoggingService.queryMetrics({}), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0);
-  }
-  if (typeof navigator !== "undefined" && navigator.storage) {
-    const map = /* @__PURE__ */ new Map();
-    const dir = await navigator.storage.getDirectory();
-    for await (const filename of dir?.keys()) {
-      const idx = filename.indexOf("-", filename.indexOf("-") + 1);
-      if (idx === -1) {
-        continue;
-      }
-      map.set(filename.slice(0, idx), (map.get(filename.slice(0, idx)) ?? 0) + 1);
-    }
-    diagnostics.storage = Array.from(map.entries()).sort((a, b) => b[1] - a[1]).map(([file, count]) => ({
-      file,
-      count
-    }));
-  }
-  const identity = serviceContext.identityManager.identity;
-  if (identity) {
-    diagnostics.identity = {
-      identityKey: identity.identityKey,
-      spaceKey: identity.space.key,
-      profile: identity.profileDocument
-    };
-    const { devices } = await getFirstStreamValue(clientServices.DevicesService.queryDevices(), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0) ?? {};
-    diagnostics.devices = devices;
-    if (serviceContext.dataSpaceManager) {
-      diagnostics.spaces = await Promise.all(Array.from(serviceContext.dataSpaceManager.spaces.values()).map((space) => getSpaceStats(space)) ?? []);
-    }
-    const { feeds = [] } = await getFirstStreamValue(clientServices.DevtoolsHost.subscribeToFeeds({}), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0) ?? {};
-    diagnostics.feeds = feeds.map(({ feedKey, bytes, length }) => ({
-      feedKey,
-      bytes,
-      length
-    }));
-    const status = await getFirstStreamValue(clientServices.NetworkService.queryStatus(), {
-      timeout: DEFAULT_TIMEOUT
-    }).catch(() => void 0);
-    diagnostics.networkStatus = status;
-    diagnostics.swarms = serviceContext.networkManager.connectionLog?.swarms;
-  }
-  diagnostics.config = config.values;
-  return diagnostics;
-};
-var getSpaceStats = async (space) => {
-  const stats = {
-    key: space.key,
-    metrics: space.metrics,
-    epochs: space.inner.spaceState.credentials.filter(credentialTypeFilter("dxos.halo.credentials.Epoch")).map((credential) => ({
-      ...credential.subject.assertion,
-      id: credential.id
-    })),
-    members: Array.from(space.inner.spaceState.members.values()).map((member) => ({
-      identity: {
-        identityKey: member.key,
-        profile: {
-          displayName: member.assertion.profile?.displayName
-        }
-      },
-      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember.PresenceState.ONLINE : SpaceMember.PresenceState.OFFLINE
-    })),
-    pipeline: {
-      // TODO(burdon): Pick properties from credentials if needed.
-      currentEpoch: space.automergeSpaceState.lastEpoch,
-      appliedEpoch: space.automergeSpaceState.lastEpoch,
-      controlFeeds: space.inner.controlPipeline.state.feeds.map((feed) => feed.key),
-      currentControlTimeframe: space.inner.controlPipeline.state.timeframe,
-      targetControlTimeframe: space.inner.controlPipeline.state.targetTimeframe,
-      totalControlTimeframe: space.inner.controlPipeline.state.endTimeframe
-    }
-  };
-  if (stats.metrics) {
-    const { open, ready } = stats.metrics;
-    stats.metrics.startupTime = open && ready && ready.getTime() - open.getTime();
-  }
-  return stats;
-};
-
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
 import { Event as Event6, asyncTimeout, scheduleTask as scheduleTask5, sleep as sleep2, synchronized, trackLeaks } from "@dxos/async";
 import { AUTH_TIMEOUT as AUTH_TIMEOUT2 } from "@dxos/client-protocol";
 import { cancelWithContext as cancelWithContext2, Context as Context8, ContextDisposedError } from "@dxos/context";
 import { timed, warnAfterTimeout } from "@dxos/debug";
+import { TYPE_PROPERTIES } from "@dxos/echo-db";
 import { createMappedFeedWriter } from "@dxos/echo-pipeline";
-import { failedInvariant, invariant as invariant11 } from "@dxos/invariant";
+import { AutomergeDocumentLoaderImpl } from "@dxos/echo-pipeline";
+import { failedInvariant, invariant as invariant10 } from "@dxos/invariant";
 import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log9 } from "@dxos/log";
 import { CancelledError, SystemError } from "@dxos/protocols";
@@ -2894,7 +2805,7 @@ import { SpaceState, CreateEpochRequest } from "@dxos/protocols/proto/dxos/clien
 import { AdmittedFeed as AdmittedFeed3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe2 } from "@dxos/timeframe";
 import { trace as trace6 } from "@dxos/tracing";
-import { ComplexSet as ComplexSet3 } from "@dxos/util";
+import { ComplexSet as ComplexSet3, assignDeep } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/automerge-space-state.ts
 import { Event as Event4 } from "@dxos/async";
@@ -2937,13 +2848,13 @@ var AutomergeSpaceState = class {
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
 import { DeferredTask, Event as Event5, scheduleTask as scheduleTask4, sleep, TimeoutError as TimeoutError2, Trigger as Trigger4 } from "@dxos/async";
 import { Context as Context7, rejectOnDispose } from "@dxos/context";
-import { invariant as invariant10 } from "@dxos/invariant";
+import { invariant as invariant9 } from "@dxos/invariant";
 import { PublicKey as PublicKey7 } from "@dxos/keys";
 import { log as log8 } from "@dxos/log";
 import { schema as schema3 } from "@dxos/protocols";
 import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
 import { ComplexMap as ComplexMap2, ComplexSet as ComplexSet2, entry } from "@dxos/util";
-var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
+var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
@@ -2971,13 +2882,13 @@ var NotarizationPlugin = class {
     log8("notarize", {
       credentials
     }, {
-      F: __dxlog_file11,
+      F: __dxlog_file10,
       L: 90,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant10(credentials.every((credential) => credential.id), "Credentials must have an id", {
-      F: __dxlog_file11,
+    invariant9(credentials.every((credential) => credential.id), "Credentials must have an id", {
+      F: __dxlog_file10,
       L: 91,
       S: this,
       A: [
@@ -2991,7 +2902,7 @@ var NotarizationPlugin = class {
         log8.warn("Notarization error", {
           err
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 99,
           S: this,
           C: (f, a) => f(...a)
@@ -3007,7 +2918,7 @@ var NotarizationPlugin = class {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 111,
           S: this,
           C: (f, a) => f(...a)
@@ -3030,7 +2941,7 @@ var NotarizationPlugin = class {
           log8.info("Exhausted all peers to notarize with", {
             retryIn: retryTimeout
           }, {
-            F: __dxlog_file11,
+            F: __dxlog_file10,
             L: 136,
             S: this,
             C: (f, a) => f(...a)
@@ -3044,7 +2955,7 @@ var NotarizationPlugin = class {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 143,
           S: this,
           C: (f, a) => f(...a)
@@ -3053,7 +2964,7 @@ var NotarizationPlugin = class {
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
         log8("success", void 0, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 147,
           S: this,
           C: (f, a) => f(...a)
@@ -3062,7 +2973,7 @@ var NotarizationPlugin = class {
       } catch (err) {
         if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
           log8.info("error notarizing (recoverable)", err, {
-            F: __dxlog_file11,
+            F: __dxlog_file10,
             L: 151,
             S: this,
             C: (f, a) => f(...a)
@@ -3080,7 +2991,7 @@ var NotarizationPlugin = class {
         errors.wait()
       ]);
       log8("done", void 0, {
-        F: __dxlog_file11,
+        F: __dxlog_file10,
         L: 162,
         S: this,
         C: (f, a) => f(...a)
@@ -3101,8 +3012,8 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    invariant10(!this._writer, "Writer already set.", {
-      F: __dxlog_file11,
+    invariant9(!this._writer, "Writer already set.", {
+      F: __dxlog_file10,
       L: 181,
       S: this,
       A: [
@@ -3126,8 +3037,8 @@ var NotarizationPlugin = class {
       throw new Error(WRITER_NOT_SET_ERROR_CODE);
     }
     for (const credential of request.credentials ?? []) {
-      invariant10(credential.id, "Credential must have an id", {
-        F: __dxlog_file11,
+      invariant9(credential.id, "Credential must have an id", {
+        F: __dxlog_file10,
         L: 200,
         S: this,
         A: [
@@ -3147,7 +3058,7 @@ var NotarizationPlugin = class {
         log8("extension opened", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 211,
           S: this,
           C: (f, a) => f(...a)
@@ -3159,7 +3070,7 @@ var NotarizationPlugin = class {
         log8("extension closed", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file11,
+          F: __dxlog_file10,
           L: 216,
           S: this,
           C: (f, a) => f(...a)
@@ -3213,7 +3124,7 @@ function _ts_decorate4(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
+var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
 var DataSpace = class {
   constructor(params) {
     this._ctx = new Context8();
@@ -3248,8 +3159,8 @@ var DataSpace = class {
     log9("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
-      L: 132,
+      F: __dxlog_file11,
+      L: 140,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3298,8 +3209,8 @@ var DataSpace = class {
     log9("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
-      L: 190,
+      F: __dxlog_file11,
+      L: 198,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3316,8 +3227,8 @@ var DataSpace = class {
     log9("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
-      L: 204,
+      F: __dxlog_file11,
+      L: 212,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3348,16 +3259,16 @@ var DataSpace = class {
       } catch (err) {
         if (err instanceof CancelledError || err instanceof ContextDisposedError) {
           log9("data pipeline initialization cancelled", err, {
-            F: __dxlog_file12,
-            L: 237,
+            F: __dxlog_file11,
+            L: 245,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
         log9.error("Error initializing data pipeline", err, {
-          F: __dxlog_file12,
-          L: 241,
+          F: __dxlog_file11,
+          L: 249,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3365,8 +3276,8 @@ var DataSpace = class {
         log9("new state", {
           state: SpaceState[this._state]
         }, {
-          F: __dxlog_file12,
-          L: 243,
+          F: __dxlog_file11,
+          L: 251,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3385,8 +3296,8 @@ var DataSpace = class {
     log9("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
-      L: 259,
+      F: __dxlog_file11,
+      L: 267,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3395,8 +3306,8 @@ var DataSpace = class {
     this._automergeSpaceState.startProcessingRootDocs();
     await cancelWithContext2(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
     log9("data pipeline ready", void 0, {
-      F: __dxlog_file12,
-      L: 271,
+      F: __dxlog_file11,
+      L: 279,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3405,8 +3316,8 @@ var DataSpace = class {
     log9("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
-      L: 275,
+      F: __dxlog_file11,
+      L: 283,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3421,8 +3332,8 @@ var DataSpace = class {
     this.metrics.controlPipelineReady = /* @__PURE__ */ new Date();
     await this._createWritableFeeds();
     log9("writable feeds created", void 0, {
-      F: __dxlog_file12,
-      L: 291,
+      F: __dxlog_file11,
+      L: 299,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3484,8 +3395,8 @@ var DataSpace = class {
       space: this.key,
       rootUrl
     }, {
-      F: __dxlog_file12,
-      L: 357,
+      F: __dxlog_file11,
+      L: 365,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3516,8 +3427,8 @@ var DataSpace = class {
           rootUrl,
           err
         }, {
-          F: __dxlog_file12,
-          L: 380,
+          F: __dxlog_file11,
+          L: 388,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3570,9 +3481,9 @@ var DataSpace = class {
           const rootHandle = this._automergeHost.repo.find(currentRootUrl);
           await cancelWithContext2(this._ctx, asyncTimeout(rootHandle.whenReady(), 1e4));
           const newRoot = this._automergeHost.repo.create(rootHandle.docSync());
-          invariant11(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
-            F: __dxlog_file12,
-            L: 430,
+          invariant10(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
+            F: __dxlog_file11,
+            L: 438,
             S: this,
             A: [
               "typeof newRoot.url === 'string' && newRoot.url.length > 0",
@@ -3587,30 +3498,90 @@ var DataSpace = class {
           };
         }
         break;
-    }
-    if (!epoch) {
-      return;
-    }
-    const receipt = await this.inner.controlPipeline.writer.write({
-      credential: {
-        credential: await this._signingContext.credentialSigner.createCredential({
-          subject: this.key,
-          assertion: {
-            "@type": "dxos.halo.credentials.Epoch",
-            ...epoch
-          }
-        })
-      }
-    });
-    await this.inner.controlPipeline.state.waitUntilTimeframe(new Timeframe2([
-      [
-        receipt.feedKey,
-        receipt.seq
-      ]
-    ]));
-  }
-  async activate() {
-    if (this._state !== SpaceState.INACTIVE) {
+      case CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT:
+        {
+          log9.info("Fragmenting", void 0, {
+            F: __dxlog_file11,
+            L: 450,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          const currentRootUrl = this._automergeSpaceState.rootUrl;
+          const rootHandle = this._automergeHost.repo.find(currentRootUrl);
+          await cancelWithContext2(this._ctx, asyncTimeout(rootHandle.whenReady(), 1e4));
+          const objects = Object.entries(rootHandle.docSync().objects);
+          const properties = objects.find(([_, value]) => value.system.type?.itemId === TYPE_PROPERTIES);
+          const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
+          invariant10(properties, "Properties not found", {
+            F: __dxlog_file11,
+            L: 460,
+            S: this,
+            A: [
+              "properties",
+              "'Properties not found'"
+            ]
+          });
+          const newSpaceDoc = {
+            ...rootHandle.docSync(),
+            objects: Object.fromEntries([
+              properties
+            ])
+          };
+          const newRoot = this._automergeHost.repo.create(newSpaceDoc);
+          invariant10(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
+            F: __dxlog_file11,
+            L: 465,
+            S: this,
+            A: [
+              "typeof newRoot.url === 'string' && newRoot.url.length > 0",
+              ""
+            ]
+          });
+          const docLoader = new AutomergeDocumentLoaderImpl(this.key, this._automergeHost.repo);
+          await docLoader.loadSpaceRootDocHandle(this._ctx, {
+            rootUrl: newRoot.url
+          });
+          otherObjects.forEach(([key, value]) => {
+            const handle = docLoader.createDocumentForObject(key);
+            handle.change((doc) => {
+              assignDeep(doc, [
+                "objects",
+                key
+              ], value);
+            });
+          });
+          epoch = {
+            previousId: this._automergeSpaceState.lastEpoch?.id,
+            number: (this._automergeSpaceState.lastEpoch?.subject.assertion.number ?? -1) + 1,
+            timeframe: this._automergeSpaceState.lastEpoch?.subject.assertion.timeframe ?? new Timeframe2(),
+            automergeRoot: newRoot.url
+          };
+        }
+        break;
+    }
+    if (!epoch) {
+      return;
+    }
+    const receipt = await this.inner.controlPipeline.writer.write({
+      credential: {
+        credential: await this._signingContext.credentialSigner.createCredential({
+          subject: this.key,
+          assertion: {
+            "@type": "dxos.halo.credentials.Epoch",
+            ...epoch
+          }
+        })
+      }
+    });
+    await this.inner.controlPipeline.state.waitUntilTimeframe(new Timeframe2([
+      [
+        receipt.feedKey,
+        receipt.seq
+      ]
+    ]));
+  }
+  async activate() {
+    if (this._state !== SpaceState.INACTIVE) {
       return;
     }
     await this._metadataStore.setSpaceState(this.key, SpaceState.ACTIVE);
@@ -3627,8 +3598,8 @@ var DataSpace = class {
     log9("new state", {
       state: SpaceState[this._state]
     }, {
-      F: __dxlog_file12,
-      L: 482,
+      F: __dxlog_file11,
+      L: 531,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3685,7 +3656,7 @@ DataSpace = _ts_decorate4([
 import { Event as Event7, synchronized as synchronized2, trackLeaks as trackLeaks2 } from "@dxos/async";
 import { Context as Context9, cancelWithContext as cancelWithContext3 } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
-import { invariant as invariant12 } from "@dxos/invariant";
+import { invariant as invariant11 } from "@dxos/invariant";
 import { PublicKey as PublicKey9 } from "@dxos/keys";
 import { log as log10 } from "@dxos/log";
 import { trace as trace7 } from "@dxos/protocols";
@@ -3696,7 +3667,7 @@ import { ComplexMap as ComplexMap3, deferFunction as deferFunction2, forEachAsyn
 // packages/sdk/client-services/src/packlets/spaces/genesis.ts
 import { createCredential } from "@dxos/credentials";
 import { failUndefined } from "@dxos/debug";
-import { AdmittedFeed as AdmittedFeed4, SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { AdmittedFeed as AdmittedFeed4, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe3 } from "@dxos/timeframe";
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
@@ -3716,7 +3687,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey: space.key,
-        role: SpaceMember2.Role.ADMIN,
+        role: SpaceMember.Role.ADMIN,
         profile: signingContext.getProfile(),
         genesisFeedKey: space.controlFeedKey ?? failUndefined()
       }
@@ -3774,7 +3745,7 @@ function _ts_decorate5(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
+var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
 var PRESENCE_ANNOUNCE_INTERVAL = 1e4;
 var PRESENCE_OFFLINE_TIMEOUT = 2e4;
 var DataSpaceManager = class {
@@ -3800,7 +3771,7 @@ var DataSpaceManager = class {
   }
   async open() {
     log10("open", void 0, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 98,
       S: this,
       C: (f, a) => f(...a)
@@ -3808,7 +3779,7 @@ var DataSpaceManager = class {
     log10.trace("dxos.echo.data-space-manager.open", trace7.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 99,
       S: this,
       C: (f, a) => f(...a)
@@ -3816,7 +3787,7 @@ var DataSpaceManager = class {
     log10("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 100,
       S: this,
       C: (f, a) => f(...a)
@@ -3826,7 +3797,7 @@ var DataSpaceManager = class {
         log10("load space", {
           spaceMetadata
         }, {
-          F: __dxlog_file13,
+          F: __dxlog_file12,
           L: 104,
           S: this,
           C: (f, a) => f(...a)
@@ -3837,7 +3808,7 @@ var DataSpaceManager = class {
           spaceMetadata,
           err
         }, {
-          F: __dxlog_file13,
+          F: __dxlog_file12,
           L: 107,
           S: this,
           C: (f, a) => f(...a)
@@ -3854,7 +3825,7 @@ var DataSpaceManager = class {
     log10.trace("dxos.echo.data-space-manager.open", trace7.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 120,
       S: this,
       C: (f, a) => f(...a)
@@ -3862,7 +3833,7 @@ var DataSpaceManager = class {
   }
   async close() {
     log10("close", void 0, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 125,
       S: this,
       C: (f, a) => f(...a)
@@ -3877,8 +3848,8 @@ var DataSpaceManager = class {
   * Creates a new space writing the genesis credentials to the control feed.
   */
   async createSpace() {
-    invariant12(this._isOpen, "Not open.", {
-      F: __dxlog_file13,
+    invariant11(this._isOpen, "Not open.", {
+      F: __dxlog_file12,
       L: 138,
       S: this,
       A: [
@@ -3899,7 +3870,7 @@ var DataSpaceManager = class {
     log10("creating space...", {
       spaceKey
     }, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 150,
       S: this,
       C: (f, a) => f(...a)
@@ -3914,8 +3885,8 @@ var DataSpaceManager = class {
     const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, automergeRoot.url);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    invariant12(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file13,
+    invariant11(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file12,
       L: 163,
       S: this,
       A: [
@@ -3933,13 +3904,13 @@ var DataSpaceManager = class {
     log10("accept space", {
       opts
     }, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 175,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant12(this._isOpen, "Not open.", {
-      F: __dxlog_file13,
+    invariant11(this._isOpen, "Not open.", {
+      F: __dxlog_file12,
       L: 176,
       S: this,
       A: [
@@ -3947,8 +3918,8 @@ var DataSpaceManager = class {
         "'Not open.'"
       ]
     });
-    invariant12(!this._spaces.has(opts.spaceKey), "Space already exists.", {
-      F: __dxlog_file13,
+    invariant11(!this._spaces.has(opts.spaceKey), "Space already exists.", {
+      F: __dxlog_file12,
       L: 177,
       S: this,
       A: [
@@ -3983,7 +3954,7 @@ var DataSpaceManager = class {
     log10("construct space", {
       metadata
     }, {
-      F: __dxlog_file13,
+      F: __dxlog_file12,
       L: 210,
       S: this,
       C: (f, a) => f(...a)
@@ -4021,7 +3992,7 @@ var DataSpaceManager = class {
       },
       onAuthFailure: () => {
         log10.warn("auth failure", void 0, {
-          F: __dxlog_file13,
+          F: __dxlog_file12,
           L: 247,
           S: this,
           C: (f, a) => f(...a)
@@ -4045,7 +4016,7 @@ var DataSpaceManager = class {
           log10("before space ready", {
             space: space.key
           }, {
-            F: __dxlog_file13,
+            F: __dxlog_file12,
             L: 265,
             S: this,
             C: (f, a) => f(...a)
@@ -4056,7 +4027,7 @@ var DataSpaceManager = class {
             space: space.key,
             open: this._isOpen
           }, {
-            F: __dxlog_file13,
+            F: __dxlog_file12,
             L: 268,
             S: this,
             C: (f, a) => f(...a)
@@ -4069,7 +4040,7 @@ var DataSpaceManager = class {
           log10("before space close", {
             space: space.key
           }, {
-            F: __dxlog_file13,
+            F: __dxlog_file12,
             L: 274,
             S: this,
             C: (f, a) => f(...a)
@@ -4109,11 +4080,11 @@ DataSpaceManager = _ts_decorate5([
 import { EventSubscriptions as EventSubscriptions2, UpdateScheduler, scheduleTask as scheduleTask6 } from "@dxos/async";
 import { Stream as Stream10 } from "@dxos/codec-protobuf";
 import { raise as raise2 } from "@dxos/debug";
-import { invariant as invariant13 } from "@dxos/invariant";
+import { invariant as invariant12 } from "@dxos/invariant";
 import { log as log11 } from "@dxos/log";
 import { ApiError, SpaceNotFoundError, encodeError } from "@dxos/protocols";
-import { SpaceMember as SpaceMember3, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
-var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
+import { SpaceMember as SpaceMember2, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
+var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _getDataSpaceManager) {
     this._identityManager = _identityManager;
@@ -4152,7 +4123,7 @@ var SpacesServiceImpl = class {
         log11("update", {
           spaces
         }, {
-          F: __dxlog_file14,
+          F: __dxlog_file13,
           L: 77,
           S: this,
           C: (f, a) => f(...a)
@@ -4234,8 +4205,8 @@ var SpacesServiceImpl = class {
           }
         });
       } else {
-        invariant13(!credential.id, "Id on unsigned credentials is not allowed", {
-          F: __dxlog_file14,
+        invariant12(!credential.id, "Id on unsigned credentials is not allowed", {
+          F: __dxlog_file13,
           L: 164,
           S: this,
           A: [
@@ -4243,8 +4214,8 @@ var SpacesServiceImpl = class {
             "'Id on unsigned credentials is not allowed'"
           ]
         });
-        invariant13(this._identityManager.identity, "Identity is not available", {
-          F: __dxlog_file14,
+        invariant12(this._identityManager.identity, "Identity is not available", {
+          F: __dxlog_file13,
           L: 165,
           S: this,
           A: [
@@ -4253,8 +4224,8 @@ var SpacesServiceImpl = class {
           ]
         });
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
-        invariant13(credential.issuer.equals(signer.getIssuer()), void 0, {
-          F: __dxlog_file14,
+        invariant12(credential.issuer.equals(signer.getIssuer()), void 0, {
+          F: __dxlog_file13,
           L: 167,
           S: this,
           A: [
@@ -4310,7 +4281,7 @@ var SpacesServiceImpl = class {
             identityKey: member.key,
             profile: member.profile ?? {}
           },
-          presence: member.removed ? SpaceMember3.PresenceState.REMOVED : isMe || peers.length > 0 ? SpaceMember3.PresenceState.ONLINE : SpaceMember3.PresenceState.OFFLINE,
+          presence: member.removed ? SpaceMember2.PresenceState.REMOVED : isMe || peers.length > 0 ? SpaceMember2.PresenceState.ONLINE : SpaceMember2.PresenceState.OFFLINE,
           peerStates: peers
         };
       }),
@@ -4324,17 +4295,17 @@ var getChannelId = (channel) => `user-channel/${channel}`;
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
 import { Trigger as Trigger5 } from "@dxos/async";
-import { Context as Context10 } from "@dxos/context";
+import { Context as Context10, Resource } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
 import { failUndefined as failUndefined2 } from "@dxos/debug";
 import { AutomergeHost, MetadataStore, SnapshotStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
 import { FeedFactory, FeedStore } from "@dxos/feed-store";
-import { IndexMetadataStore, IndexStore, Indexer } from "@dxos/indexing";
-import { invariant as invariant14 } from "@dxos/invariant";
+import { IndexMetadataStore, IndexStore, Indexer, createStorageCallbacks } from "@dxos/indexing";
+import { invariant as invariant13 } from "@dxos/invariant";
 import { Keyring } from "@dxos/keyring";
 import { PublicKey as PublicKey10 } from "@dxos/keys";
 import { log as log12 } from "@dxos/log";
-import { InvalidStorageVersionError, STORAGE_VERSION as STORAGE_VERSION2, trace as trace8 } from "@dxos/protocols";
+import { InvalidStorageVersionError, STORAGE_VERSION, trace as trace8 } from "@dxos/protocols";
 import { Invitation as Invitation6 } from "@dxos/protocols/proto/dxos/client/services";
 import { BlobStore } from "@dxos/teleport-extension-object-sync";
 import { trace as Trace2 } from "@dxos/tracing";
@@ -4344,7 +4315,7 @@ import { safeInstanceof } from "@dxos/util";
 import { getHeads } from "@dxos/automerge/automerge";
 import { warnAfterTimeout as warnAfterTimeout2 } from "@dxos/debug";
 import { idCodec } from "@dxos/protocols";
-var createLoadDocuments = (automergeHost) => (
+var createSelectedDocumentsIterator = (automergeHost) => (
   /**
   * Get object data blobs from Automerge Repo by ids.
   * @param ids
@@ -4357,17 +4328,17 @@ var createLoadDocuments = (automergeHost) => (
       await warnAfterTimeout2(5e3, "to long to load doc", () => handle.whenReady());
       const doc = handle.docSync();
       const hash = getHeads(doc).join("");
-      yield [
+      yield doc.objects?.[objectId] ? [
         {
           id,
           object: doc.objects[objectId],
           currentHash: hash
         }
-      ];
+      ] : [];
     }
   }
 );
-var createGetAllDocuments = (automergeHost) => (
+var createDocumentsIterator = (automergeHost) => (
   /**
   * Recursively get all object data blobs from Automerge Repo.
   * @param ids
@@ -4390,7 +4361,7 @@ var createGetAllDocuments = (automergeHost) => (
               objectId
             }),
             object,
-            currentHash: heads.at(-1)
+            currentHash: heads.join("")
           };
         });
       }
@@ -4430,10 +4401,12 @@ function _ts_decorate6(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
-var ServiceContext = class {
-  constructor(storage, networkManager, signalManager, _runtimeParams) {
+var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
+var ServiceContext = class extends Resource {
+  constructor(storage, level, networkManager, signalManager, _runtimeParams) {
+    super();
     this.storage = storage;
+    this.level = level;
     this.networkManager = networkManager;
     this.signalManager = signalManager;
     this._runtimeParams = _runtimeParams;
@@ -4463,41 +4436,46 @@ var ServiceContext = class {
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager, this._runtimeParams);
     this.indexMetadata = new IndexMetadataStore({
-      directory: storage.createDirectory("index-metadata")
+      db: level.sublevel("index-metadata")
     });
     this.automergeHost = new AutomergeHost({
       directory: storage.createDirectory("automerge"),
-      metadata: this.indexMetadata
+      db: level.sublevel("automerge"),
+      storageCallbacks: createStorageCallbacks({
+        host: () => this.automergeHost,
+        metadata: this.indexMetadata
+      })
     });
     this.indexer = new Indexer({
       indexStore: new IndexStore({
-        directory: storage.createDirectory("index-store")
+        db: level.sublevel("index-storage")
       }),
       metadataStore: this.indexMetadata,
-      loadDocuments: createLoadDocuments(this.automergeHost),
-      getAllDocuments: createGetAllDocuments(this.automergeHost)
+      loadDocuments: createSelectedDocumentsIterator(this.automergeHost),
+      getAllDocuments: createDocumentsIterator(this.automergeHost)
     });
     this.invitations = new InvitationsHandler(this.networkManager);
     this._handlerFactories.set(Invitation6.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? failUndefined2(), this._acceptIdentity.bind(this)));
   }
-  async open(ctx) {
+  async _open(ctx) {
     await this._checkStorageVersion();
     log12("opening...", void 0, {
-      F: __dxlog_file15,
-      L: 151,
+      F: __dxlog_file14,
+      L: 157,
       S: this,
       C: (f, a) => f(...a)
     });
     log12.trace("dxos.sdk.service-context.open", trace8.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file15,
-      L: 152,
+      F: __dxlog_file14,
+      L: 158,
       S: this,
       C: (f, a) => f(...a)
     });
     await this.signalManager.open();
     await this.networkManager.open();
+    await this.automergeHost.open();
     await this.metadataStore.load();
     await this.spaceManager.open();
     await this.identityManager.open(ctx);
@@ -4507,22 +4485,22 @@ var ServiceContext = class {
     log12.trace("dxos.sdk.service-context.open", trace8.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file15,
-      L: 162,
+      F: __dxlog_file14,
+      L: 169,
       S: this,
       C: (f, a) => f(...a)
     });
     log12("opened", void 0, {
-      F: __dxlog_file15,
-      L: 163,
+      F: __dxlog_file14,
+      L: 170,
       S: this,
       C: (f, a) => f(...a)
     });
   }
-  async close() {
+  async _close() {
     log12("closing...", void 0, {
-      F: __dxlog_file15,
-      L: 167,
+      F: __dxlog_file14,
+      L: 174,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4539,8 +4517,8 @@ var ServiceContext = class {
     await this.metadataStore.close();
     await this.indexer.destroy();
     log12("closed", void 0, {
-      F: __dxlog_file15,
-      L: 180,
+      F: __dxlog_file14,
+      L: 187,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4552,9 +4530,9 @@ var ServiceContext = class {
   }
   getInvitationHandler(invitation) {
     const factory = this._handlerFactories.get(invitation.kind);
-    invariant14(factory, `Unknown invitation kind: ${invitation.kind}`, {
-      F: __dxlog_file15,
-      L: 191,
+    invariant13(factory, `Unknown invitation kind: ${invitation.kind}`, {
+      F: __dxlog_file14,
+      L: 198,
       S: this,
       A: [
         "factory",
@@ -4578,15 +4556,15 @@ var ServiceContext = class {
   }
   async _checkStorageVersion() {
     await this.metadataStore.load();
-    if (this.metadataStore.version !== STORAGE_VERSION2) {
-      throw new InvalidStorageVersionError(STORAGE_VERSION2, this.metadataStore.version);
+    if (this.metadataStore.version !== STORAGE_VERSION) {
+      throw new InvalidStorageVersionError(STORAGE_VERSION, this.metadataStore.version);
     }
   }
   // Called when identity is created.
   async _initialize(ctx) {
     log12("initializing spaces...", void 0, {
-      F: __dxlog_file15,
-      L: 222,
+      F: __dxlog_file14,
+      L: 229,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4607,9 +4585,9 @@ var ServiceContext = class {
     this.dataSpaceManager = new DataSpaceManager(this.spaceManager, this.metadataStore, this.keyring, signingContext, this.feedStore, this.automergeHost, this._runtimeParams);
     await this.dataSpaceManager.open();
     this._handlerFactories.set(Invitation6.Kind.SPACE, (invitation) => {
-      invariant14(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
-        F: __dxlog_file15,
-        L: 246,
+      invariant13(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
+        F: __dxlog_file14,
+        L: 253,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -4632,8 +4610,8 @@ var ServiceContext = class {
           log12("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file15,
-            L: 262,
+            F: __dxlog_file14,
+            L: 269,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4643,8 +4621,8 @@ var ServiceContext = class {
           log12("space already exists, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file15,
-            L: 266,
+            F: __dxlog_file14,
+            L: 273,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4654,8 +4632,8 @@ var ServiceContext = class {
           log12("accepting space recorded in halo", {
             details: assertion
           }, {
-            F: __dxlog_file15,
-            L: 271,
+            F: __dxlog_file14,
+            L: 278,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4665,8 +4643,8 @@ var ServiceContext = class {
           });
         } catch (err) {
           log12.catch(err, void 0, {
-            F: __dxlog_file15,
-            L: 277,
+            F: __dxlog_file14,
+            L: 284,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4678,7 +4656,7 @@ var ServiceContext = class {
 };
 _ts_decorate6([
   Trace2.span()
-], ServiceContext.prototype, "open", null);
+], ServiceContext.prototype, "_open", null);
 _ts_decorate6([
   Trace2.span()
 ], ServiceContext.prototype, "_initialize", null);
@@ -4711,195 +4689,271 @@ var ServiceRegistry = class {
   }
 };
 
-// packages/sdk/client-services/src/packlets/locks/browser.ts
-import { asyncTimeout as asyncTimeout2, Trigger as Trigger6 } from "@dxos/async";
-import { RESOURCE_LOCK_TIMEOUT } from "@dxos/client-protocol";
-import { log as log13, logInfo } from "@dxos/log";
-function _ts_decorate7(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
-    r = Reflect.decorate(decorators, target, key, desc);
-  else
-    for (var i = decorators.length - 1; i >= 0; i--)
-      if (d = decorators[i])
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/browser.ts";
-var Message;
-(function(Message2) {
-  Message2["ACQUIRING"] = "acquiring";
-})(Message || (Message = {}));
-var Lock = class {
-  constructor({ lockKey, onAcquire, onRelease }) {
-    this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
-    this._releaseTrigger = new Trigger6();
-    this._lockKey = lockKey;
-    this._onAcquire = onAcquire;
-    this._onRelease = onRelease;
-    this._broadcastChannel.onmessage = this._onMessage.bind(this);
-  }
-  get lockKey() {
-    return this._lockKey;
-  }
-  async acquire() {
-    this._broadcastChannel.postMessage({
-      message: "acquiring"
-    });
-    try {
-      log13("aquiring lock...", void 0, {
-        F: __dxlog_file16,
-        L: 42,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      await asyncTimeout2(this._requestLock(), RESOURCE_LOCK_TIMEOUT);
-      log13("acquired lock", void 0, {
-        F: __dxlog_file16,
-        L: 44,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    } catch {
-      log13("stealing lock...", void 0, {
-        F: __dxlog_file16,
-        L: 46,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      await this._requestLock(true);
-      log13("stolen lock", void 0, {
-        F: __dxlog_file16,
-        L: 48,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+// packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts
+import { getFirstStreamValue } from "@dxos/codec-protobuf";
+import { credentialTypeFilter } from "@dxos/credentials";
+import { invariant as invariant14 } from "@dxos/invariant";
+import { STORAGE_VERSION as STORAGE_VERSION2 } from "@dxos/protocols";
+import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/client/services";
+import { TRACE_PROCESSOR } from "@dxos/tracing";
+
+// packages/sdk/client-services/src/version.ts
+var DXOS_VERSION = "0.4.10-main.fe71b4c";
+
+// packages/sdk/client-services/src/packlets/services/platform.ts
+import { Platform } from "@dxos/protocols/proto/dxos/client/services";
+var getPlatform = () => {
+  if (process.browser) {
+    if (typeof window !== "undefined") {
+      const { userAgent } = window.navigator;
+      return {
+        type: Platform.PLATFORM_TYPE.BROWSER,
+        userAgent,
+        uptime: Math.floor((Date.now() - window.performance.timeOrigin) / 1e3)
+      };
+    } else {
+      return {
+        type: Platform.PLATFORM_TYPE.SHARED_WORKER,
+        uptime: Math.floor((Date.now() - performance.timeOrigin) / 1e3)
+      };
     }
+  } else {
+    const { platform: platform2, version, arch } = process;
+    return {
+      type: Platform.PLATFORM_TYPE.NODE,
+      platform: platform2,
+      arch,
+      runtime: version,
+      uptime: Math.floor(process.uptime()),
+      memory: process.memoryUsage()
+    };
   }
-  async release() {
-    this._releaseTrigger.wake();
+};
+
+// packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts
+var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts";
+var DEFAULT_TIMEOUT = 1e3;
+var createDiagnostics = async (clientServices, serviceContext, config) => {
+  const diagnostics = {
+    created: (/* @__PURE__ */ new Date()).toISOString(),
+    platform: getPlatform(),
+    client: {
+      version: DXOS_VERSION,
+      storage: {
+        version: STORAGE_VERSION2
+      }
+    },
+    trace: TRACE_PROCESSOR.getDiagnostics()
+  };
+  {
+    invariant14(clientServices.LoggingService, "SystemService is not available.", {
+      F: __dxlog_file15,
+      L: 108,
+      S: void 0,
+      A: [
+        "clientServices.LoggingService",
+        "'SystemService is not available.'"
+      ]
+    });
+    diagnostics.metrics = await getFirstStreamValue(clientServices.LoggingService.queryMetrics({}), {
+      timeout: DEFAULT_TIMEOUT
+    }).catch(() => void 0);
   }
-  _onMessage(event) {
-    if (event.data.message === "acquiring") {
-      this._releaseTrigger.wake();
+  if (typeof navigator !== "undefined" && navigator.storage) {
+    const map = /* @__PURE__ */ new Map();
+    const dir = await navigator.storage.getDirectory();
+    for await (const filename of dir?.keys()) {
+      const idx = filename.indexOf("-", filename.indexOf("-") + 1);
+      if (idx === -1) {
+        continue;
+      }
+      map.set(filename.slice(0, idx), (map.get(filename.slice(0, idx)) ?? 0) + 1);
     }
+    diagnostics.storage = Array.from(map.entries()).sort((a, b) => b[1] - a[1]).map(([file, count]) => ({
+      file,
+      count
+    }));
   }
-  async _requestLock(steal = false) {
-    log13("requesting lock...", {
-      steal
-    }, {
-      F: __dxlog_file16,
-      L: 63,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    const acquired = new Trigger6();
-    void navigator.locks.request(this._lockKey, {
-      steal
-    }, async () => {
-      await this._onAcquire?.();
-      acquired.wake();
-      this._releaseTrigger = new Trigger6();
-      await this._releaseTrigger.wait();
-      log13("releasing lock...", void 0, {
-        F: __dxlog_file16,
-        L: 72,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      await this._onRelease?.();
-      log13("released lock", void 0, {
-        F: __dxlog_file16,
-        L: 74,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    }).catch(async () => {
-      await this._onRelease?.();
-    });
-    await acquired.wait();
-    log13("recieved lock", {
-      steal
-    }, {
-      F: __dxlog_file16,
-      L: 81,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+  const identity = serviceContext.identityManager.identity;
+  if (identity) {
+    diagnostics.identity = {
+      identityKey: identity.identityKey,
+      spaceKey: identity.space.key,
+      profile: identity.profileDocument
+    };
+    const { devices } = await getFirstStreamValue(clientServices.DevicesService.queryDevices(), {
+      timeout: DEFAULT_TIMEOUT
+    }).catch(() => void 0) ?? {};
+    diagnostics.devices = devices;
+    if (serviceContext.dataSpaceManager) {
+      diagnostics.spaces = await Promise.all(Array.from(serviceContext.dataSpaceManager.spaces.values()).map((space) => getSpaceStats(space)) ?? []);
+    }
+    const { feeds = [] } = await getFirstStreamValue(clientServices.DevtoolsHost.subscribeToFeeds({}), {
+      timeout: DEFAULT_TIMEOUT
+    }).catch(() => void 0) ?? {};
+    diagnostics.feeds = feeds.map(({ feedKey, bytes, length }) => ({
+      feedKey,
+      bytes,
+      length
+    }));
+    const status = await getFirstStreamValue(clientServices.NetworkService.queryStatus(), {
+      timeout: DEFAULT_TIMEOUT
+    }).catch(() => void 0);
+    diagnostics.networkStatus = status;
+    diagnostics.swarms = serviceContext.networkManager.connectionLog?.swarms;
   }
+  diagnostics.config = config.values;
+  return diagnostics;
 };
-_ts_decorate7([
-  logInfo
-], Lock.prototype, "lockKey", null);
-var isLocked = (lockPath) => {
-  throw new Error("Not implemented");
+var getSpaceStats = async (space) => {
+  const stats = {
+    key: space.key,
+    metrics: space.metrics,
+    epochs: space.inner.spaceState.credentials.filter(credentialTypeFilter("dxos.halo.credentials.Epoch")).map((credential) => ({
+      ...credential.subject.assertion,
+      id: credential.id
+    })),
+    members: Array.from(space.inner.spaceState.members.values()).map((member) => ({
+      identity: {
+        identityKey: member.key,
+        profile: {
+          displayName: member.assertion.profile?.displayName
+        }
+      },
+      presence: space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key)).length > 0 ? SpaceMember3.PresenceState.ONLINE : SpaceMember3.PresenceState.OFFLINE
+    })),
+    pipeline: {
+      // TODO(burdon): Pick properties from credentials if needed.
+      currentEpoch: space.automergeSpaceState.lastEpoch,
+      appliedEpoch: space.automergeSpaceState.lastEpoch,
+      controlFeeds: space.inner.controlPipeline.state.feeds.map((feed) => feed.key),
+      currentControlTimeframe: space.inner.controlPipeline.state.timeframe,
+      targetControlTimeframe: space.inner.controlPipeline.state.targetTimeframe,
+      totalControlTimeframe: space.inner.controlPipeline.state.endTimeframe
+    }
+  };
+  if (stats.metrics) {
+    const { open, ready } = stats.metrics;
+    stats.metrics.startupTime = open && ready && ready.getTime() - open.getTime();
+  }
+  return stats;
 };
 
-// packages/sdk/client-services/src/packlets/storage/storage.ts
-import { DX_DATA } from "@dxos/client-protocol";
-import { InvalidConfigError } from "@dxos/protocols";
-import { Runtime } from "@dxos/protocols/proto/dxos/config";
-import { createStorage, StorageType } from "@dxos/random-access-storage";
-import { isNode as isNode2 } from "@dxos/util";
-var StorageDriver = Runtime.Client.Storage.StorageDriver;
-var createStorageObjects = (config) => {
-  const { persistent = false, keyStore, dataStore, dataRoot = isNode2() ? DX_DATA : "dxos/storage" } = config ?? {};
-  if (persistent && dataStore === StorageDriver.RAM) {
-    throw new InvalidConfigError("RAM storage cannot be used in persistent mode.");
-  }
-  if (!persistent && dataStore !== void 0 && dataStore !== StorageDriver.RAM) {
-    throw new InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
-  }
-  if (persistent && keyStore === StorageDriver.RAM) {
-    throw new InvalidConfigError("RAM key storage cannot be used in persistent mode.");
-  }
-  if (!persistent && keyStore !== StorageDriver.RAM && keyStore !== void 0) {
-    throw new InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
-  }
+// packages/sdk/client-services/src/packlets/diagnostics/browser-diagnostics-broadcast.ts
+import { Trigger as Trigger6 } from "@dxos/async";
+import { log as log13 } from "@dxos/log";
+var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/browser-diagnostics-broadcast.ts";
+var CHANNEL_NAME = "dxos.diagnostics.broadcast";
+var MessageType;
+(function(MessageType2) {
+  MessageType2["PROBE"] = "probe";
+  MessageType2["PROBE_ACK"] = "probe-ack";
+  MessageType2["REQUEST_DIAGNOSTICS"] = "request-diagnostics";
+  MessageType2["RECEIVE_DIAGNOSTICS"] = "receive-diagnostics";
+})(MessageType || (MessageType = {}));
+var createCollectDiagnosticsBroadcastSender = () => {
   return {
-    storage: createStorage({
-      type: persistent ? toStorageType(dataStore) : StorageType.RAM,
-      root: `${dataRoot}/`
-    })
+    broadcastDiagnosticsRequest: async () => {
+      let expectedResponse = "probe-ack";
+      let channel;
+      try {
+        const trigger = new Trigger6();
+        channel = new BroadcastChannel(CHANNEL_NAME);
+        channel.onmessage = (msg) => {
+          if (expectedResponse === msg.data.type) {
+            trigger.wake(msg.data);
+          }
+        };
+        channel.postMessage({
+          type: "probe"
+        });
+        await trigger.wait({
+          timeout: 200
+        });
+        expectedResponse = "receive-diagnostics";
+        trigger.reset();
+        channel.postMessage({
+          type: "request-diagnostics"
+        });
+        const diagnostics = await trigger.wait({
+          timeout: 5e3
+        });
+        return diagnostics.payload;
+      } catch (e) {
+        const errorDescription = e instanceof Error ? e.message : JSON.stringify(e);
+        return {
+          expectedResponse,
+          errorDescription
+        };
+      } finally {
+        safeClose(channel);
+      }
+    }
   };
 };
-var toStorageType = (type) => {
-  switch (type) {
-    case void 0:
-      return void 0;
-    case StorageDriver.RAM:
-      return StorageType.RAM;
-    case StorageDriver.CHROME:
-      return StorageType.CHROME;
-    case StorageDriver.FIREFOX:
-      return StorageType.FIREFOX;
-    case StorageDriver.IDB:
-      return StorageType.IDB;
-    case StorageDriver.NODE:
-      return StorageType.NODE;
-    case StorageDriver.WEBFS:
-      return StorageType.WEBFS;
-    default:
-      throw new Error(`Invalid storage type: ${StorageDriver[type]}`);
+var createCollectDiagnosticsBroadcastHandler = (systemService) => {
+  let channel;
+  return {
+    start: () => {
+      channel = new BroadcastChannel(CHANNEL_NAME);
+      channel.onmessage = async (message) => {
+        try {
+          if (message.data.type === "probe") {
+            channel?.postMessage({
+              type: "probe-ack"
+            });
+          } else if (message.data.type === "request-diagnostics") {
+            const diagnostics = await systemService.getDiagnostics({});
+            channel?.postMessage({
+              type: "receive-diagnostics",
+              payload: diagnostics
+            });
+          }
+        } catch (error) {
+          log13.catch(error, void 0, {
+            F: __dxlog_file16,
+            L: 77,
+            S: void 0,
+            C: (f, a) => f(...a)
+          });
+        }
+      };
+    },
+    stop: () => {
+      safeClose(channel);
+      channel = void 0;
+    }
+  };
+};
+var safeClose = (channel) => {
+  try {
+    channel?.close();
+  } catch (e) {
   }
 };
 
+// packages/sdk/client-services/src/packlets/diagnostics/diagnostics-collector.ts
+import { ConfigResource } from "@dxos/config";
+import { GetDiagnosticsRequest as GetDiagnosticsRequest2 } from "@dxos/protocols/proto/dxos/client/services";
+import { TRACE_PROCESSOR as TRACE_PROCESSOR3 } from "@dxos/tracing";
+import { jsonKeyReplacer as jsonKeyReplacer2, nonNullable } from "@dxos/util";
+
 // packages/sdk/client-services/src/packlets/services/service-host.ts
 import { Event as Event9, synchronized as synchronized3 } from "@dxos/async";
-import { Properties, clientServiceBundle, defaultKey } from "@dxos/client-protocol";
+import { clientServiceBundle, defaultKey, Properties } from "@dxos/client-protocol";
 import { Context as Context11 } from "@dxos/context";
-import { DataServiceImpl } from "@dxos/echo-pipeline";
-import { getAutomergeObjectCore, getRawDoc } from "@dxos/echo-schema";
+import { DataServiceImpl, encodeReference } from "@dxos/echo-pipeline";
+import { getTypeReference } from "@dxos/echo-schema";
 import { IndexServiceImpl } from "@dxos/indexing";
 import { invariant as invariant16 } from "@dxos/invariant";
-import { PublicKey as PublicKey12 } from "@dxos/keys";
-import { log as log15 } from "@dxos/log";
+import { PublicKey as PublicKey13 } from "@dxos/keys";
+import { log as log16 } from "@dxos/log";
 import { WebsocketSignalManager } from "@dxos/messaging";
 import { NetworkManager, createSimplePeerTransportFactory } from "@dxos/network-manager";
 import { trace as trace9 } from "@dxos/protocols";
 import { SystemStatus } from "@dxos/protocols/proto/dxos/client/services";
 import { TRACE_PROCESSOR as TRACE_PROCESSOR2, trace as Trace3 } from "@dxos/tracing";
-import { assignDeep } from "@dxos/util";
+import { assignDeep as assignDeep2 } from "@dxos/util";
 import { WebsocketRpcClient } from "@dxos/websocket-rpc";
 
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
@@ -4984,11 +5038,135 @@ var DevicesServiceImpl = class {
   }
 };
 
+// packages/sdk/client-services/src/packlets/locks/browser.ts
+import { asyncTimeout as asyncTimeout2, Trigger as Trigger7 } from "@dxos/async";
+import { RESOURCE_LOCK_TIMEOUT } from "@dxos/client-protocol";
+import { log as log14, logInfo } from "@dxos/log";
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
+    r = Reflect.decorate(decorators, target, key, desc);
+  else
+    for (var i = decorators.length - 1; i >= 0; i--)
+      if (d = decorators[i])
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/browser.ts";
+var Message;
+(function(Message2) {
+  Message2["ACQUIRING"] = "acquiring";
+})(Message || (Message = {}));
+var Lock = class {
+  constructor({ lockKey, onAcquire, onRelease }) {
+    this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
+    this._releaseTrigger = new Trigger7();
+    this._lockKey = lockKey;
+    this._onAcquire = onAcquire;
+    this._onRelease = onRelease;
+    this._broadcastChannel.onmessage = this._onMessage.bind(this);
+  }
+  get lockKey() {
+    return this._lockKey;
+  }
+  async acquire() {
+    this._broadcastChannel.postMessage({
+      message: "acquiring"
+    });
+    try {
+      log14("aquiring lock...", void 0, {
+        F: __dxlog_file18,
+        L: 42,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await asyncTimeout2(this._requestLock(), RESOURCE_LOCK_TIMEOUT);
+      log14("acquired lock", void 0, {
+        F: __dxlog_file18,
+        L: 44,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    } catch {
+      log14("stealing lock...", void 0, {
+        F: __dxlog_file18,
+        L: 46,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await this._requestLock(true);
+      log14("stolen lock", void 0, {
+        F: __dxlog_file18,
+        L: 48,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
+  }
+  async release() {
+    this._releaseTrigger.wake();
+  }
+  _onMessage(event) {
+    if (event.data.message === "acquiring") {
+      this._releaseTrigger.wake();
+    }
+  }
+  async _requestLock(steal = false) {
+    log14("requesting lock...", {
+      steal
+    }, {
+      F: __dxlog_file18,
+      L: 63,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const acquired = new Trigger7();
+    void navigator.locks.request(this._lockKey, {
+      steal
+    }, async () => {
+      await this._onAcquire?.();
+      acquired.wake();
+      this._releaseTrigger = new Trigger7();
+      await this._releaseTrigger.wait();
+      log14("releasing lock...", void 0, {
+        F: __dxlog_file18,
+        L: 72,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await this._onRelease?.();
+      log14("released lock", void 0, {
+        F: __dxlog_file18,
+        L: 74,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }).catch(async () => {
+      await this._onRelease?.();
+    });
+    await acquired.wait();
+    log14("recieved lock", {
+      steal
+    }, {
+      F: __dxlog_file18,
+      L: 81,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+  }
+};
+_ts_decorate7([
+  logInfo
+], Lock.prototype, "lockKey", null);
+var isLocked = (lockPath) => {
+  throw new Error("Not implemented");
+};
+
 // packages/sdk/client-services/src/packlets/logging/logging-service.ts
 import { Event as Event8 } from "@dxos/async";
 import { Stream as Stream12 } from "@dxos/codec-protobuf";
 import { PublicKey as PublicKey11 } from "@dxos/keys";
-import { getContextFromEntry, log as log14 } from "@dxos/log";
+import { getContextFromEntry, log as log15 } from "@dxos/log";
 import { QueryLogsRequest } from "@dxos/protocols/proto/dxos/client/services";
 import { getDebugName, jsonify, numericalValues, tracer } from "@dxos/util";
 var LoggingServiceImpl = class {
@@ -5001,11 +5179,11 @@ var LoggingServiceImpl = class {
     };
   }
   async open() {
-    log14.runtimeConfig.processors.push(this._logProcessor);
+    log15.runtimeConfig.processors.push(this._logProcessor);
   }
   async close() {
-    const index = log14.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
-    log14.runtimeConfig.processors.splice(index, 1);
+    const index = log15.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
+    log15.runtimeConfig.processors.splice(index, 1);
   }
   async controlMetrics({ reset, record }) {
     if (reset) {
@@ -5090,12 +5268,12 @@ var LoggingServiceImpl = class {
     });
   }
 };
-var matchFilter = (filter, level, path, options) => {
+var matchFilter = (filter, level, path2, options) => {
   switch (options) {
     case QueryLogsRequest.MatchingOptions.INCLUSIVE:
-      return level >= filter.level && (!filter.pattern || path.includes(filter.pattern));
+      return level >= filter.level && (!filter.pattern || path2.includes(filter.pattern));
     case QueryLogsRequest.MatchingOptions.EXPLICIT:
-      return level === filter.level && (!filter.pattern || path.includes(filter.pattern));
+      return level === filter.level && (!filter.pattern || path2.includes(filter.pattern));
   }
 };
 var shouldLog = (entry2, request) => {
@@ -5141,6 +5319,80 @@ var NetworkServiceImpl = class {
   }
 };
 
+// packages/sdk/client-services/src/packlets/storage/storage.ts
+import { InvalidConfigError } from "@dxos/protocols";
+import { Runtime as Runtime2 } from "@dxos/protocols/proto/dxos/config";
+import { createStorage, StorageType } from "@dxos/random-access-storage";
+
+// packages/sdk/client-services/src/packlets/storage/util.ts
+import { DX_DATA } from "@dxos/client-protocol";
+import { Runtime } from "@dxos/protocols/proto/dxos/config";
+import { isNode as isNode2 } from "@dxos/util";
+var getRootPath = (config) => {
+  const { dataRoot = isNode2() ? DX_DATA : "dxos/storage" } = config ?? {};
+  return `${dataRoot}/`;
+};
+var isPersistent = (config) => {
+  const { persistent = false } = config ?? {};
+  return config.dataStore !== void 0 && config.dataStore !== Runtime.Client.Storage.StorageDriver.RAM || persistent;
+};
+
+// packages/sdk/client-services/src/packlets/storage/storage.ts
+var StorageDriver = Runtime2.Client.Storage.StorageDriver;
+var createStorageObjects = (config) => {
+  const { persistent = false, keyStore, dataStore } = config ?? {};
+  if (persistent && dataStore === StorageDriver.RAM) {
+    throw new InvalidConfigError("RAM storage cannot be used in persistent mode.");
+  }
+  if (!persistent && dataStore !== void 0 && dataStore !== StorageDriver.RAM) {
+    throw new InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+  }
+  if (persistent && keyStore === StorageDriver.RAM) {
+    throw new InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+  }
+  if (!persistent && keyStore !== StorageDriver.RAM && keyStore !== void 0) {
+    throw new InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+  }
+  return {
+    storage: createStorage({
+      type: persistent ? toStorageType(dataStore) : StorageType.RAM,
+      root: getRootPath(config)
+    })
+  };
+};
+var toStorageType = (type) => {
+  switch (type) {
+    case void 0:
+      return void 0;
+    case StorageDriver.RAM:
+      return StorageType.RAM;
+    case StorageDriver.CHROME:
+      return StorageType.CHROME;
+    case StorageDriver.FIREFOX:
+      return StorageType.FIREFOX;
+    case StorageDriver.IDB:
+      return StorageType.IDB;
+    case StorageDriver.NODE:
+      return StorageType.NODE;
+    case StorageDriver.WEBFS:
+      return StorageType.WEBFS;
+    default:
+      throw new Error(`Invalid storage type: ${StorageDriver[type]}`);
+  }
+};
+
+// packages/sdk/client-services/src/packlets/storage/level.ts
+import { Level } from "level";
+import path from "@dxos/node-std/path";
+import { PublicKey as PublicKey12 } from "@dxos/keys";
+var createLevel = async (config) => {
+  const persistent = isPersistent(config);
+  const storagePath = persistent ? path.join(getRootPath(config), "level") : `/tmp/dxos-${PublicKey12.random().toHex()}`;
+  const level = new Level(storagePath);
+  await level.open();
+  return level;
+};
+
 // packages/sdk/client-services/src/packlets/system/system-service.ts
 import { Stream as Stream14 } from "@dxos/codec-protobuf";
 import { GetDiagnosticsRequest } from "@dxos/protocols/proto/dxos/client/services";
@@ -5209,13 +5461,14 @@ function _ts_decorate8(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
+var __dxlog_file19 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
 var ClientServicesHost = class {
   constructor({
     config,
     transportFactory,
     signalManager,
     storage,
+    level,
     // TODO(wittjosiah): Turn this on by default.
     lockKey,
     callbacks,
@@ -5226,6 +5479,7 @@ var ClientServicesHost = class {
     this._opening = false;
     this._open = false;
     this._storage = storage;
+    this._level = level;
     this._callbacks = callbacks;
     this._runtimeParams = runtimeParams;
     if (config) {
@@ -5264,6 +5518,7 @@ var ClientServicesHost = class {
         await this.reset();
       }
     });
+    this.diagnosticsBroadcastHandler = createCollectDiagnosticsBroadcastHandler(this._systemService);
     this._loggingService = new LoggingServiceImpl();
     this._serviceRegistry = new ServiceRegistry(clientServiceBundle, {
       SystemService: this._systemService,
@@ -5295,24 +5550,24 @@ var ClientServicesHost = class {
   */
   initialize({ config, ...options }) {
     invariant16(!this._open, "service host is open", {
-      F: __dxlog_file18,
-      L: 179,
+      F: __dxlog_file19,
+      L: 197,
       S: this,
       A: [
         "!this._open",
         "'service host is open'"
       ]
     });
-    log15("initializing...", void 0, {
-      F: __dxlog_file18,
-      L: 180,
+    log16("initializing...", void 0, {
+      F: __dxlog_file19,
+      L: 198,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
       invariant16(!this._config, "config already set", {
-        F: __dxlog_file18,
-        L: 183,
+        F: __dxlog_file19,
+        L: 201,
         S: this,
         A: [
           "!this._config",
@@ -5324,13 +5579,21 @@ var ClientServicesHost = class {
         this._storage = createStorageObjects(config.get("runtime.client.storage", {})).storage;
       }
     }
+    if (!options.signalManager) {
+      log16.warn("running signaling without telemetry metadata.", void 0, {
+        F: __dxlog_file19,
+        L: 209,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
     const { connectionLog = true, transportFactory = createSimplePeerTransportFactory({
       iceServers: this._config?.get("runtime.services.ice")
     }), signalManager = new WebsocketSignalManager(this._config?.get("runtime.services.signaling") ?? []) } = options;
     this._signalManager = signalManager;
     invariant16(!this._networkManager, "network manager already set", {
-      F: __dxlog_file18,
-      L: 199,
+      F: __dxlog_file19,
+      L: 220,
       S: this,
       A: [
         "!this._networkManager",
@@ -5342,9 +5605,9 @@ var ClientServicesHost = class {
       transportFactory,
       signalManager
     });
-    log15("initialized", void 0, {
-      F: __dxlog_file18,
-      L: 206,
+    log16("initialized", void 0, {
+      F: __dxlog_file19,
+      L: 227,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5353,18 +5616,18 @@ var ClientServicesHost = class {
     if (this._open) {
       return;
     }
-    const traceId = PublicKey12.random().toHex();
-    log15.trace("dxos.client-services.host.open", trace9.begin({
+    const traceId = PublicKey13.random().toHex();
+    log16.trace("dxos.client-services.host.open", trace9.begin({
       id: traceId
     }), {
-      F: __dxlog_file18,
-      L: 217,
+      F: __dxlog_file19,
+      L: 238,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant16(this._config, "config not set", {
-      F: __dxlog_file18,
-      L: 219,
+      F: __dxlog_file19,
+      L: 240,
       S: this,
       A: [
         "this._config",
@@ -5372,8 +5635,8 @@ var ClientServicesHost = class {
       ]
     });
     invariant16(this._storage, "storage not set", {
-      F: __dxlog_file18,
-      L: 220,
+      F: __dxlog_file19,
+      L: 241,
       S: this,
       A: [
         "this._storage",
@@ -5381,8 +5644,8 @@ var ClientServicesHost = class {
       ]
     });
     invariant16(this._signalManager, "signal manager not set", {
-      F: __dxlog_file18,
-      L: 221,
+      F: __dxlog_file19,
+      L: 242,
       S: this,
       A: [
         "this._signalManager",
@@ -5390,8 +5653,8 @@ var ClientServicesHost = class {
       ]
     });
     invariant16(this._networkManager, "network manager not set", {
-      F: __dxlog_file18,
-      L: 222,
+      F: __dxlog_file19,
+      L: 243,
       S: this,
       A: [
         "this._networkManager",
@@ -5399,17 +5662,21 @@ var ClientServicesHost = class {
       ]
     });
     this._opening = true;
-    log15("opening...", {
+    log16("opening...", {
       lockKey: this._resourceLock?.lockKey
     }, {
-      F: __dxlog_file18,
-      L: 225,
+      F: __dxlog_file19,
+      L: 246,
       S: this,
       C: (f, a) => f(...a)
     });
+    if (!this._level) {
+      this._level = await createLevel(this._config.get("runtime.client.storage", {}));
+    }
+    await this._level.open();
     await this._resourceLock?.acquire();
     await this._loggingService.open();
-    this._serviceContext = new ServiceContext(this._storage, this._networkManager, this._signalManager, this._runtimeParams);
+    this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._runtimeParams);
     this._serviceRegistry.setServices({
       SystemService: this._systemService,
       IdentityService: new IdentityServiceImpl((params) => this._createIdentity(params), this._serviceContext.identityManager, this._serviceContext.keyring, (profile) => this._serviceContext.broadcastProfileUpdate(profile)),
@@ -5436,8 +5703,8 @@ var ClientServicesHost = class {
     });
     await this._serviceContext.open(ctx);
     invariant16(this.serviceRegistry.services.InvitationsService, void 0, {
-      F: __dxlog_file18,
-      L: 286,
+      F: __dxlog_file19,
+      L: 314,
       S: this,
       A: [
         "this.serviceRegistry.services.InvitationsService",
@@ -5445,11 +5712,11 @@ var ClientServicesHost = class {
       ]
     });
     const loadedInvitations = await this.serviceRegistry.services.InvitationsService.loadPersistentInvitations();
-    log15("loaded persistent invitations", {
+    log16("loaded persistent invitations", {
       count: loadedInvitations.invitations?.length
     }, {
-      F: __dxlog_file18,
-      L: 289,
+      F: __dxlog_file19,
+      L: 317,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5463,23 +5730,24 @@ var ClientServicesHost = class {
       });
       void this._devtoolsProxy.open();
     }
+    this.diagnosticsBroadcastHandler.start();
     this._opening = false;
     this._open = true;
     this._statusUpdate.emit();
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    log15("opened", {
+    log16("opened", {
       deviceKey
     }, {
-      F: __dxlog_file18,
-      L: 306,
+      F: __dxlog_file19,
+      L: 335,
       S: this,
       C: (f, a) => f(...a)
     });
-    log15.trace("dxos.client-services.host.open", trace9.end({
+    log16.trace("dxos.client-services.host.open", trace9.end({
       id: traceId
     }), {
-      F: __dxlog_file18,
-      L: 307,
+      F: __dxlog_file19,
+      L: 336,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5489,60 +5757,62 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    log15("closing...", {
+    log16("closing...", {
       deviceKey
     }, {
-      F: __dxlog_file18,
-      L: 318,
+      F: __dxlog_file19,
+      L: 347,
       S: this,
       C: (f, a) => f(...a)
     });
+    this.diagnosticsBroadcastHandler.stop();
     await this._devtoolsProxy?.close();
     this._serviceRegistry.setServices({
       SystemService: this._systemService
     });
     await this._loggingService.close();
     await this._serviceContext.close();
+    await this._level?.close();
     this._open = false;
     this._statusUpdate.emit();
-    log15("closed", {
+    log16("closed", {
       deviceKey
     }, {
-      F: __dxlog_file18,
-      L: 325,
+      F: __dxlog_file19,
+      L: 356,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async reset() {
-    const traceId = PublicKey12.random().toHex();
-    log15.trace("dxos.sdk.client-services-host.reset", trace9.begin({
+    const traceId = PublicKey13.random().toHex();
+    log16.trace("dxos.sdk.client-services-host.reset", trace9.begin({
       id: traceId
     }), {
-      F: __dxlog_file18,
-      L: 330,
+      F: __dxlog_file19,
+      L: 361,
       S: this,
       C: (f, a) => f(...a)
     });
-    log15("resetting...", void 0, {
-      F: __dxlog_file18,
-      L: 332,
+    log16("resetting...", void 0, {
+      F: __dxlog_file19,
+      L: 363,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._serviceContext?.close();
     await this._storage.reset();
-    log15("reset", void 0, {
-      F: __dxlog_file18,
-      L: 335,
+    log16("reset", void 0, {
+      F: __dxlog_file19,
+      L: 366,
       S: this,
       C: (f, a) => f(...a)
     });
-    log15.trace("dxos.sdk.client-services-host.reset", trace9.end({
+    log16.trace("dxos.sdk.client-services-host.reset", trace9.end({
       id: traceId
     }), {
-      F: __dxlog_file18,
-      L: 336,
+      F: __dxlog_file19,
+      L: 367,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5552,12 +5822,10 @@ var ClientServicesHost = class {
     const identity = await this._serviceContext.createIdentity(params);
     await this._serviceContext.initialized.wait();
     const space = await this._serviceContext.dataSpaceManager.createSpace();
-    const obj = new Properties(void 0);
-    obj[defaultKey] = identity.identityKey.toHex();
     const automergeIndex = space.automergeSpaceState.rootUrl;
     invariant16(automergeIndex, void 0, {
-      F: __dxlog_file18,
-      L: 351,
+      F: __dxlog_file19,
+      L: 379,
       S: this,
       A: [
         "automergeIndex",
@@ -5566,12 +5834,25 @@ var ClientServicesHost = class {
     });
     const document = await this._serviceContext.automergeHost.repo.find(automergeIndex);
     await document.whenReady();
+    const properties = {
+      system: {
+        type: encodeReference(getTypeReference(Properties))
+      },
+      data: {
+        [defaultKey]: identity.identityKey.toHex()
+      },
+      meta: {
+        keys: []
+      }
+    };
+    const propertiesId = PublicKey13.random().toHex();
     document.change((doc) => {
-      assignDeep(doc, [
+      assignDeep2(doc, [
         "objects",
-        getAutomergeObjectCore(obj).id
-      ], getRawDoc(obj).handle.docSync());
+        propertiesId
+      ], properties);
     });
+    await this._serviceContext.automergeHost.repo.flush();
     return identity;
   }
 };
@@ -5593,6 +5874,44 @@ ClientServicesHost = _ts_decorate8([
   Trace3.resource()
 ], ClientServicesHost);
 
+// packages/sdk/client-services/src/packlets/services/util.ts
+import { PublicKey as PublicKey14 } from "@dxos/keys";
+import { humanize } from "@dxos/util";
+var ClientServicesProviderResource = Symbol.for("dxos.resource.ClientServices");
+
+// packages/sdk/client-services/src/packlets/diagnostics/diagnostics-collector.ts
+var DiagnosticsCollector = class {
+  static {
+    this.broadcastSender = createCollectDiagnosticsBroadcastSender();
+  }
+  static async collect(config = findConfigs(), services = findSystemServiceProvider(), options = {}) {
+    const serviceDiagnostics = await services?.services?.SystemService?.getDiagnostics({
+      keys: options.humanize ? GetDiagnosticsRequest2.KEY_OPTION.HUMANIZE : options.truncate ? GetDiagnosticsRequest2.KEY_OPTION.TRUNCATE : void 0
+    });
+    const clientDiagnostics = {
+      config,
+      trace: TRACE_PROCESSOR3.getDiagnostics()
+    };
+    const diagnostics = serviceDiagnostics != null ? {
+      client: clientDiagnostics,
+      services: serviceDiagnostics
+    } : {
+      client: clientDiagnostics,
+      broadcast: await this.broadcastSender.broadcastDiagnosticsRequest()
+    };
+    return JSON.parse(JSON.stringify(diagnostics, jsonKeyReplacer2(options)));
+  }
+};
+var findSystemServiceProvider = () => {
+  const serviceProviders = TRACE_PROCESSOR3.findByAnnotation(ClientServicesProviderResource);
+  const providerResource = serviceProviders.find((r) => r.instance.deref()?.services?.SystemService != null);
+  return providerResource?.instance?.deref() ?? null;
+};
+var findConfigs = () => {
+  const configs = TRACE_PROCESSOR3.findByAnnotation(ConfigResource);
+  return configs.map((r) => r.instance.deref()).filter(nonNullable);
+};
+
 export {
   Buffer,
   subscribeToFeeds,
@@ -5612,19 +5931,24 @@ export {
   IdentityServiceImpl,
   DeviceInvitationProtocol,
   InvitationsHandler,
-  invitationExpired,
+  createAdmissionKeypair,
   InvitationsServiceImpl,
   SpaceInvitationProtocol,
   ClientRpcServer,
-  createDiagnostics,
   DataSpace,
   DataSpaceManager,
   SpacesServiceImpl,
   ServiceContext,
   ServiceRegistry,
+  createDiagnostics,
+  createCollectDiagnosticsBroadcastSender,
+  createCollectDiagnosticsBroadcastHandler,
+  DiagnosticsCollector,
   Lock,
   isLocked,
   createStorageObjects,
-  ClientServicesHost
+  createLevel,
+  ClientServicesHost,
+  ClientServicesProviderResource
 };
-//# sourceMappingURL=chunk-7PYX6UUA.mjs.map
+//# sourceMappingURL=chunk-7S34JE6M.mjs.map