@dxos/client-services 0.5.9-main.2dbe289 → 0.5.9-main.3179d45

package/dist/lib/browser/{chunk-QWL2M4EU.mjs → chunk-M35K3NOZ.mjs}

@@ -85,6 +85,7 @@ var subscribeToFeedBlocks = ({ feedStore }, { feedKey, maxBlocks = 10 }) => {
 import { Stream as Stream2 } from "@dxos/codec-protobuf";
 import { Context } from "@dxos/context";
 import { PublicKey as PublicKey2 } from "@dxos/keys";
+var __dxlog_file = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devtools/network.ts";
 var subscribeToNetworkStatus = ({ signalManager }) => new Stream2(({ next, close }) => {
   const update = () => {
     try {
@@ -100,7 +101,10 @@ var subscribeToNetworkStatus = ({ signalManager }) => new Stream2(({ next, close
   update();
 });
 var subscribeToSignal = ({ signalManager }) => new Stream2(({ next }) => {
-  const ctx = new Context();
+  const ctx = new Context(void 0, {
+    F: __dxlog_file,
+    L: 36
+  });
   signalManager.onMessage.on(ctx, (message) => {
     next({
       message: {
@@ -355,7 +359,7 @@ import { SpaceMember } from "@dxos/protocols/proto/dxos/client/services";
 import { TRACE_PROCESSOR } from "@dxos/tracing";
 
 // packages/sdk/client-services/src/version.ts
-var DXOS_VERSION = "0.5.9-main.2dbe289";
+var DXOS_VERSION = "0.5.9-main.3179d45";
 
 // packages/sdk/client-services/src/packlets/services/platform.ts
 import { Platform } from "@dxos/protocols/proto/dxos/client/services";
@@ -388,7 +392,7 @@ var getPlatform = () => {
 };
 
 // packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts
-var __dxlog_file = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts";
+var __dxlog_file2 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/diagnostics.ts";
 var DEFAULT_TIMEOUT = 1e3;
 var createDiagnostics = async (clientServices, serviceContext, config) => {
   const diagnostics = {
@@ -405,7 +409,7 @@ var createDiagnostics = async (clientServices, serviceContext, config) => {
   await Promise.all([
     (async () => {
       invariant(clientServices.LoggingService, "SystemService is not available.", {
-        F: __dxlog_file,
+        F: __dxlog_file2,
         L: 110,
         S: void 0,
         A: [
@@ -510,7 +514,7 @@ var getStorageDiagnostics = async () => {
 // packages/sdk/client-services/src/packlets/diagnostics/browser-diagnostics-broadcast.ts
 import { Trigger } from "@dxos/async";
 import { log } from "@dxos/log";
-var __dxlog_file2 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/browser-diagnostics-broadcast.ts";
+var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/diagnostics/browser-diagnostics-broadcast.ts";
 var CHANNEL_NAME = "dxos.diagnostics.broadcast";
 var MessageType;
 (function(MessageType2) {
@@ -579,7 +583,7 @@ var createCollectDiagnosticsBroadcastHandler = (systemService) => {
           }
         } catch (error) {
           log.catch(error, void 0, {
-            F: __dxlog_file2,
+            F: __dxlog_file3,
             L: 77,
             S: void 0,
             C: (f, a) => f(...a)
@@ -687,7 +691,7 @@ import { Context as Context2 } from "@dxos/context";
 import { verifyCredential } from "@dxos/credentials";
 import { log as log2 } from "@dxos/log";
 import { schema } from "@dxos/protocols";
-var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts";
+var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/authenticator.ts";
 var Credential = schema.getCodecForType("dxos.halo.credentials.Credential");
 var createAuthProvider = (signer) => async (nonce) => {
   const credential = await signer.createCredential({
@@ -702,7 +706,10 @@ var createAuthProvider = (signer) => async (nonce) => {
 var TrustedKeySetAuthVerifier = class {
   constructor(_params) {
     this._params = _params;
-    this._ctx = new Context2();
+    this._ctx = new Context2(void 0, {
+      F: __dxlog_file4,
+      L: 45
+    });
   }
   async close() {
     await this._ctx.dispose();
@@ -713,7 +720,7 @@ var TrustedKeySetAuthVerifier = class {
       log2("authenticating...", {
         credential
       }, {
-        F: __dxlog_file3,
+        F: __dxlog_file4,
         L: 56,
         S: this,
         C: (f, a) => f(...a)
@@ -723,7 +730,7 @@ var TrustedKeySetAuthVerifier = class {
         log2("Invalid credential", {
           result
         }, {
-          F: __dxlog_file3,
+          F: __dxlog_file4,
           L: 60,
           S: this,
           C: (f, a) => f(...a)
@@ -735,7 +742,7 @@ var TrustedKeySetAuthVerifier = class {
           nonce,
           credential
         }, {
-          F: __dxlog_file3,
+          F: __dxlog_file4,
           L: 65,
           S: this,
           C: (f, a) => f(...a)
@@ -746,7 +753,7 @@ var TrustedKeySetAuthVerifier = class {
         log2("key is not currently in trusted set, waiting...", {
           key: credential.issuer
         }, {
-          F: __dxlog_file3,
+          F: __dxlog_file4,
           L: 70,
           S: this,
           C: (f, a) => f(...a)
@@ -762,7 +769,7 @@ var TrustedKeySetAuthVerifier = class {
           log2("auth success", {
             key: credential.issuer
           }, {
-            F: __dxlog_file3,
+            F: __dxlog_file4,
             L: 81,
             S: this,
             C: (f, a) => f(...a)
@@ -772,7 +779,7 @@ var TrustedKeySetAuthVerifier = class {
           log2("key is not currently in trusted set, waiting...", {
             key: credential.issuer
           }, {
-            F: __dxlog_file3,
+            F: __dxlog_file4,
             L: 84,
             S: this,
             C: (f, a) => f(...a)
@@ -803,10 +810,59 @@ import { DeviceStateMachine, createCredentialSignerWithKey, createCredentialSign
 import { writeMessages } from "@dxos/feed-store";
 import { invariant as invariant2 } from "@dxos/invariant";
 import { PublicKey as PublicKey3 } from "@dxos/keys";
-import { log as log3 } from "@dxos/log";
+import { log as log4 } from "@dxos/log";
 import { AdmittedFeed } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { Timeframe } from "@dxos/timeframe";
 import { trace as trace2 } from "@dxos/tracing";
 import { ComplexSet } from "@dxos/util";
+
+// packages/sdk/client-services/src/packlets/identity/default-space-state-machine.ts
+import { getCredentialAssertion } from "@dxos/credentials";
+import { SpaceId } from "@dxos/keys";
+import { log as log3 } from "@dxos/log";
+var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/default-space-state-machine.ts";
+var DefaultSpaceStateMachine = class {
+  constructor(_params) {
+    this._params = _params;
+  }
+  get spaceId() {
+    return this._spaceId;
+  }
+  async processCredential(credential) {
+    const assertion = getCredentialAssertion(credential);
+    switch (assertion["@type"]) {
+      case "dxos.halo.credentials.DefaultSpace": {
+        if (!credential.subject.id.equals(this._params.identityKey)) {
+          log3.warn("Invalid default space credential", {
+            expectedIdentity: this._params.identityKey,
+            credential
+          }, {
+            F: __dxlog_file5,
+            L: 32,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return;
+        }
+        if (!SpaceId.isValid(assertion.spaceId)) {
+          log3.warn("Invalid default space id", {
+            id: assertion.spaceId
+          }, {
+            F: __dxlog_file5,
+            L: 36,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return;
+        }
+        this._spaceId = assertion.spaceId;
+        break;
+      }
+    }
+  }
+};
+
+// packages/sdk/client-services/src/packlets/identity/identity.ts
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -817,7 +873,7 @@ function _ts_decorate2(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity.ts";
+var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity.ts";
 var Identity = class {
   constructor({ space, signer, identityKey, deviceKey, presence }) {
     this.stateUpdate = new Event();
@@ -826,11 +882,11 @@ var Identity = class {
     this._presence = presence;
     this.identityKey = identityKey;
     this.deviceKey = deviceKey;
-    log3.trace("dxos.halo.device", {
+    log4.trace("dxos.halo.device", {
       deviceKey
     }, {
-      F: __dxlog_file4,
-      L: 67,
+      F: __dxlog_file6,
+      L: 70,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -843,6 +899,10 @@ var Identity = class {
       identityKey: this.identityKey,
       onUpdate: () => this.stateUpdate.emit()
     });
+    this._defaultSpaceStateMachine = new DefaultSpaceStateMachine({
+      identityKey: this.identityKey,
+      onUpdate: () => this.stateUpdate.emit()
+    });
     this.authVerifier = new TrustedKeySetAuthVerifier({
       trustedKeysProvider: () => new ComplexSet(PublicKey3.hash, this.authorizedDeviceKeys.keys()),
       update: this.stateUpdate,
@@ -853,14 +913,20 @@ var Identity = class {
   get authorizedDeviceKeys() {
     return this._deviceStateMachine.authorizedDeviceKeys;
   }
+  get defaultSpaceId() {
+    return this._defaultSpaceStateMachine.spaceId;
+  }
   async open(ctx) {
+    await this._presence?.open();
     await this.space.spaceState.addCredentialProcessor(this._deviceStateMachine);
     await this.space.spaceState.addCredentialProcessor(this._profileStateMachine);
+    await this.space.spaceState.addCredentialProcessor(this._defaultSpaceStateMachine);
     await this.space.open(ctx);
   }
   async close(ctx) {
-    await this._presence?.destroy();
+    await this._presence?.close();
     await this.authVerifier.close();
+    await this.space.spaceState.removeCredentialProcessor(this._defaultSpaceStateMachine);
     await this.space.spaceState.removeCredentialProcessor(this._profileStateMachine);
     await this.space.spaceState.removeCredentialProcessor(this._deviceStateMachine);
     await this.space.close();
@@ -898,8 +964,8 @@ var Identity = class {
   */
   getIdentityCredentialSigner() {
     invariant2(this._deviceStateMachine.deviceCredentialChain, "Device credential chain is not ready.", {
-      F: __dxlog_file4,
-      L: 145,
+      F: __dxlog_file6,
+      L: 159,
       S: this,
       A: [
         "this._deviceStateMachine.deviceCredentialChain",
@@ -914,16 +980,36 @@ var Identity = class {
   getDeviceCredentialSigner() {
     return createCredentialSignerWithKey(this._signer, this.deviceKey);
   }
+  async updateDefaultSpace(spaceId) {
+    const credential = await this.getDeviceCredentialSigner().createCredential({
+      subject: this.identityKey,
+      assertion: {
+        "@type": "dxos.halo.credentials.DefaultSpace",
+        spaceId
+      }
+    });
+    const receipt = await this.controlPipeline.writer.write({
+      credential: {
+        credential
+      }
+    });
+    await this.controlPipeline.state.waitUntilTimeframe(new Timeframe([
+      [
+        receipt.feedKey,
+        receipt.seq
+      ]
+    ]));
+  }
   async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }) {
-    log3("Admitting device:", {
+    log4("Admitting device:", {
       identityKey: this.identityKey,
       hostDevice: this.deviceKey,
       deviceKey,
       controlFeedKey,
       dataFeedKey
     }, {
-      F: __dxlog_file4,
-      L: 161,
+      F: __dxlog_file6,
+      L: 184,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -981,12 +1067,12 @@ import { Context as Context3 } from "@dxos/context";
 import { createCredentialSignerWithKey as createCredentialSignerWithKey2, CredentialGenerator } from "@dxos/credentials";
 import { invariant as invariant3 } from "@dxos/invariant";
 import { PublicKey as PublicKey4 } from "@dxos/keys";
-import { log as log4 } from "@dxos/log";
+import { log as log5 } from "@dxos/log";
 import { trace as trace3 } from "@dxos/protocols";
 import { Device, DeviceKind } from "@dxos/protocols/proto/dxos/client/services";
 import { AdmittedFeed as AdmittedFeed2, DeviceType } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Gossip, Presence } from "@dxos/teleport-extension-gossip";
-import { Timeframe } from "@dxos/timeframe";
+import { Timeframe as Timeframe2 } from "@dxos/timeframe";
 import { trace as Trace } from "@dxos/tracing";
 import { isNode, deferFunction } from "@dxos/util";
 function _ts_decorate3(decorators, target, key, desc) {
@@ -999,7 +1085,7 @@ function _ts_decorate3(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts";
+var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-manager.ts";
 var DEVICE_PRESENCE_ANNOUNCE_INTERVAL = 1e4;
 var DEVICE_PRESENCE_OFFLINE_TIMEOUT = 2e4;
 var IdentityManager = class {
@@ -1020,19 +1106,19 @@ var IdentityManager = class {
   }
   async open(ctx) {
     const traceId = PublicKey4.random().toHex();
-    log4.trace("dxos.halo.identity-manager.open", trace3.begin({
+    log5.trace("dxos.halo.identity-manager.open", trace3.begin({
       id: traceId
     }), {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 104,
       S: this,
       C: (f, a) => f(...a)
     });
     const identityRecord = this._metadataStore.getIdentityRecord();
-    log4("identity record", {
+    log5("identity record", {
       identityRecord
     }, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 107,
       S: this,
       C: (f, a) => f(...a)
@@ -1041,32 +1127,35 @@ var IdentityManager = class {
       this._identity = await this._constructIdentity(identityRecord);
       await this._identity.open(ctx);
       await this._identity.ready();
-      log4.trace("dxos.halo.identity", {
+      log5.trace("dxos.halo.identity", {
         identityKey: identityRecord.identityKey,
         displayName: this._identity.profileDocument?.displayName
       }, {
-        F: __dxlog_file5,
+        F: __dxlog_file7,
         L: 112,
         S: this,
         C: (f, a) => f(...a)
       });
       this.stateUpdate.emit();
     }
-    log4.trace("dxos.halo.identity-manager.open", trace3.end({
+    log5.trace("dxos.halo.identity-manager.open", trace3.end({
       id: traceId
     }), {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 119,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async close() {
-    await this._identity?.close(new Context3());
+    await this._identity?.close(new Context3(void 0, {
+      F: __dxlog_file7,
+      L: 123
+    }));
   }
   async createIdentity({ displayName, deviceProfile } = {}) {
     invariant3(!this._identity, "Identity already exists.", {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 128,
       S: this,
       A: [
@@ -1074,8 +1163,8 @@ var IdentityManager = class {
         "'Identity already exists.'"
       ]
     });
-    log4("creating identity...", void 0, {
-      F: __dxlog_file5,
+    log5("creating identity...", void 0, {
+      F: __dxlog_file7,
       L: 129,
       S: this,
       C: (f, a) => f(...a)
@@ -1092,11 +1181,14 @@ var IdentityManager = class {
       }
     };
     const identity = await this._constructIdentity(identityRecord);
-    await identity.open(new Context3());
+    await identity.open(new Context3(void 0, {
+      F: __dxlog_file7,
+      L: 144
+    }));
     {
       const generator = new CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
       invariant3(identityRecord.haloSpace.genesisFeedKey, "Genesis feed key is required.", {
-        F: __dxlog_file5,
+        F: __dxlog_file7,
         L: 148,
         S: this,
         A: [
@@ -1105,7 +1197,7 @@ var IdentityManager = class {
         ]
       });
       invariant3(identityRecord.haloSpace.dataFeedKey, "Data feed key is required.", {
-        F: __dxlog_file5,
+        F: __dxlog_file7,
         L: 149,
         S: this,
         A: [
@@ -1140,22 +1232,22 @@ var IdentityManager = class {
     await this._metadataStore.setIdentityRecord(identityRecord);
     this._identity = identity;
     await this._identity.ready();
-    log4.trace("dxos.halo.identity", {
+    log5.trace("dxos.halo.identity", {
       identityKey: identityRecord.identityKey,
       displayName: this._identity.profileDocument?.displayName
     }, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 191,
       S: this,
       C: (f, a) => f(...a)
     });
     this.stateUpdate.emit();
-    log4("created identity", {
+    log5("created identity", {
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey,
       profile: identity.profileDocument
     }, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 197,
       S: this,
       C: (f, a) => f(...a)
@@ -1189,16 +1281,16 @@ var IdentityManager = class {
   * Accept an existing identity. Expects its device key to be authorized (now or later).
   */
   async acceptIdentity(params) {
-    log4("accepting identity", {
+    log5("accepting identity", {
       params
     }, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 235,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant3(!this._identity, "Identity already exists.", {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 236,
       S: this,
       A: [
@@ -1218,15 +1310,18 @@ var IdentityManager = class {
       }
     };
     const identity = await this._constructIdentity(identityRecord);
-    await identity.open(new Context3());
+    await identity.open(new Context3(void 0, {
+      F: __dxlog_file7,
+      L: 251
+    }));
     this._identity = identity;
     await this._metadataStore.setIdentityRecord(identityRecord);
     await this._identity.ready();
-    log4.trace("dxos.halo.identity", {
+    log5.trace("dxos.halo.identity", {
       identityKey: identityRecord.identityKey,
       displayName: this._identity.profileDocument?.displayName
     }, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 255,
       S: this,
       C: (f, a) => f(...a)
@@ -1236,11 +1331,11 @@ var IdentityManager = class {
       ...params.deviceProfile
     });
     this.stateUpdate.emit();
-    log4("accepted identity", {
+    log5("accepted identity", {
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey
     }, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 265,
       S: this,
       C: (f, a) => f(...a)
@@ -1252,7 +1347,7 @@ var IdentityManager = class {
   */
   async updateProfile(profile) {
     invariant3(this._identity, "Identity not initialized.", {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 273,
       S: this,
       A: [
@@ -1272,7 +1367,7 @@ var IdentityManager = class {
         credential
       }
     });
-    await this._identity.controlPipeline.state.waitUntilTimeframe(new Timeframe([
+    await this._identity.controlPipeline.state.waitUntilTimeframe(new Timeframe2([
       [
         receipt.feedKey,
         receipt.seq
@@ -1283,7 +1378,7 @@ var IdentityManager = class {
   }
   async updateDeviceProfile(profile) {
     invariant3(this._identity, "Identity not initialized.", {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 290,
       S: this,
       A: [
@@ -1303,7 +1398,7 @@ var IdentityManager = class {
         credential
       }
     });
-    await this._identity.controlPipeline.state.waitUntilTimeframe(new Timeframe([
+    await this._identity.controlPipeline.state.waitUntilTimeframe(new Timeframe2([
       [
         receipt.feedKey,
         receipt.seq
@@ -1319,7 +1414,7 @@ var IdentityManager = class {
   }
   async _constructIdentity(identityRecord) {
     invariant3(!this._identity, void 0, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 316,
       S: this,
       A: [
@@ -1327,10 +1422,10 @@ var IdentityManager = class {
         ""
       ]
     });
-    log4("constructing identity", {
+    log5("constructing identity", {
       identityRecord
     }, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 317,
       S: this,
       C: (f, a) => f(...a)
@@ -1345,7 +1440,7 @@ var IdentityManager = class {
       gossip
     });
     invariant3(identityRecord.haloSpace.controlFeedKey, void 0, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 330,
       S: this,
       A: [
@@ -1357,7 +1452,7 @@ var IdentityManager = class {
       writable: true
     });
     invariant3(identityRecord.haloSpace.dataFeedKey, void 0, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 334,
       S: this,
       A: [
@@ -1388,10 +1483,10 @@ var IdentityManager = class {
       identityKey: identityRecord.identityKey,
       deviceKey: identityRecord.deviceKey
     });
-    log4("done", {
+    log5("done", {
       identityKey: identityRecord.identityKey
     }, {
-      F: __dxlog_file5,
+      F: __dxlog_file7,
       L: 360,
       S: this,
       C: (f, a) => f(...a)
@@ -1415,8 +1510,8 @@ var IdentityManager = class {
         }));
       },
       onAuthFailure: () => {
-        log4.warn("auth failure", void 0, {
-          F: __dxlog_file5,
+        log5.warn("auth failure", void 0, {
+          F: __dxlog_file7,
           L: 385,
           S: this,
           C: (f, a) => f(...a)
@@ -1440,25 +1535,55 @@ IdentityManager = _ts_decorate3([
 ], IdentityManager);
 
 // packages/sdk/client-services/src/packlets/identity/identity-service.ts
+import { Trigger as Trigger3, sleep } from "@dxos/async";
 import { Stream as Stream8 } from "@dxos/codec-protobuf";
+import { Resource } from "@dxos/context";
 import { signPresentation } from "@dxos/credentials";
 import { todo } from "@dxos/debug";
 import { invariant as invariant4 } from "@dxos/invariant";
-var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-service.ts";
-var IdentityServiceImpl = class {
-  constructor(_createIdentity, _identityManager, _keyring, _onProfileUpdate) {
-    this._createIdentity = _createIdentity;
+import { log as log6 } from "@dxos/log";
+import { SpaceState } from "@dxos/protocols/proto/dxos/client/services";
+import { safeAwaitAll } from "@dxos/util";
+var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-service.ts";
+var DEFAULT_SPACE_SEARCH_TIMEOUT = 1e4;
+var IdentityServiceImpl = class extends Resource {
+  constructor(_identityManager, _keyring, _dataSpaceManagerProvider, _createIdentity, _onProfileUpdate) {
+    super();
     this._identityManager = _identityManager;
     this._keyring = _keyring;
+    this._dataSpaceManagerProvider = _dataSpaceManagerProvider;
+    this._createIdentity = _createIdentity;
     this._onProfileUpdate = _onProfileUpdate;
   }
+  async _open() {
+    const identity = this._identityManager.identity;
+    if (identity && !identity.defaultSpaceId) {
+      await this._fixIdentityWithoutDefaultSpace(identity);
+    }
+  }
   async createIdentity(request) {
     await this._createIdentity({
       displayName: request.profile?.displayName,
       deviceProfile: request.deviceProfile
     });
+    const dataSpaceManager = this._dataSpaceManagerProvider();
+    await this._createDefaultSpace(dataSpaceManager);
     return this._getIdentity();
   }
+  async _createDefaultSpace(dataSpaceManager) {
+    const space = await dataSpaceManager.createDefaultSpace();
+    const identity = this._identityManager.identity;
+    invariant4(identity, void 0, {
+      F: __dxlog_file8,
+      L: 59,
+      S: this,
+      A: [
+        "identity",
+        ""
+      ]
+    });
+    await identity.updateDefaultSpace(space.id);
+  }
   async recoverIdentity(request) {
     return todo();
   }
@@ -1483,8 +1608,8 @@ var IdentityServiceImpl = class {
   }
   async updateProfile(profile) {
     invariant4(this._identityManager.identity, "Identity not initialized.", {
-      F: __dxlog_file6,
-      L: 61,
+      F: __dxlog_file8,
+      L: 89,
       S: this,
       A: [
         "this._identityManager.identity",
@@ -1497,8 +1622,8 @@ var IdentityServiceImpl = class {
   }
   async signPresentation({ presentation, nonce }) {
     invariant4(this._identityManager.identity, "Identity not initialized.", {
-      F: __dxlog_file6,
-      L: 68,
+      F: __dxlog_file8,
+      L: 96,
       S: this,
       A: [
         "this._identityManager.identity",
@@ -1513,13 +1638,54 @@ var IdentityServiceImpl = class {
       nonce
     });
   }
+  async _fixIdentityWithoutDefaultSpace(identity) {
+    let recodedDefaultSpace = false;
+    let foundDefaultSpace = false;
+    const dataSpaceManager = this._dataSpaceManagerProvider();
+    const recordedDefaultSpaceTrigger = new Trigger3();
+    const allProcessed = safeAwaitAll(dataSpaceManager.spaces.values(), async (space) => {
+      if (space.state === SpaceState.CLOSED) {
+        await space.open();
+        const requiresMigration = space.stateUpdate.waitForCondition(() => space.state === SpaceState.REQUIRES_MIGRATION);
+        await Promise.race([
+          space.initializeDataPipeline(),
+          requiresMigration
+        ]);
+      }
+      if (await dataSpaceManager.isDefaultSpace(space)) {
+        if (foundDefaultSpace) {
+          log6.warn("Multiple default spaces found. Using the first one.", {
+            duplicate: space.id
+          }, {
+            F: __dxlog_file8,
+            L: 127,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return;
+        }
+        foundDefaultSpace = true;
+        await identity.updateDefaultSpace(space.id);
+        recodedDefaultSpace = true;
+        recordedDefaultSpaceTrigger.wake();
+      }
+    });
+    await Promise.race([
+      allProcessed,
+      recordedDefaultSpaceTrigger.wait(),
+      sleep(DEFAULT_SPACE_SEARCH_TIMEOUT)
+    ]);
+    if (!recodedDefaultSpace) {
+      await this._createDefaultSpace(dataSpaceManager);
+    }
+  }
 };
 
 // packages/sdk/client-services/src/packlets/invitations/device-invitation-protocol.ts
 import { invariant as invariant5 } from "@dxos/invariant";
 import { AlreadyJoinedError } from "@dxos/protocols";
 import { Invitation } from "@dxos/protocols/proto/dxos/client/services";
-var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/device-invitation-protocol.ts";
+var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/device-invitation-protocol.ts";
 var DeviceInvitationProtocol = class {
   constructor(_keyring, _getIdentity, _acceptIdentity) {
     this._keyring = _keyring;
@@ -1545,7 +1711,7 @@ var DeviceInvitationProtocol = class {
   }
   async admit(_, request) {
     invariant5(request.device, void 0, {
-      F: __dxlog_file7,
+      F: __dxlog_file9,
       L: 50,
       S: this,
       A: [
@@ -1591,7 +1757,7 @@ var DeviceInvitationProtocol = class {
   }
   async accept(response, request) {
     invariant5(response.device, void 0, {
-      F: __dxlog_file7,
+      F: __dxlog_file9,
       L: 95,
       S: this,
       A: [
@@ -1601,7 +1767,7 @@ var DeviceInvitationProtocol = class {
     });
     const { identityKey, haloSpaceKey, genesisFeedKey, controlTimeframe } = response.device;
     invariant5(request.device, void 0, {
-      F: __dxlog_file7,
+      F: __dxlog_file9,
       L: 98,
       S: this,
       A: [
@@ -1633,7 +1799,7 @@ import { ContextDisposedError as ContextDisposedError2 } from "@dxos/context";
 import { createKeyPair, sign } from "@dxos/crypto";
 import { invariant as invariant9 } from "@dxos/invariant";
 import { PublicKey as PublicKey7 } from "@dxos/keys";
-import { log as log8 } from "@dxos/log";
+import { log as log10 } from "@dxos/log";
 import { createTeleportProtocolFactory } from "@dxos/network-manager";
 import { InvalidInvitationExtensionRoleError as InvalidInvitationExtensionRoleError3, trace as trace5 } from "@dxos/protocols";
 import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
@@ -1642,10 +1808,10 @@ import { Options as Options4 } from "@dxos/protocols/proto/dxos/halo/invitations
 import { ComplexSet as ComplexSet3 } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts
-import { Trigger as Trigger3 } from "@dxos/async";
+import { Trigger as Trigger4 } from "@dxos/async";
 import { cancelWithContext as cancelWithContext2, Context as Context4 } from "@dxos/context";
 import { invariant as invariant6 } from "@dxos/invariant";
-import { log as log5 } from "@dxos/log";
+import { log as log7 } from "@dxos/log";
 import { InvalidInvitationExtensionRoleError, schema as schema2 } from "@dxos/protocols";
 import { Options } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { RpcExtension } from "@dxos/teleport";
@@ -1670,7 +1836,7 @@ var tryAcquireBeforeContextDisposed = async (ctx, mutex) => {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts
-var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts";
+var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts";
 var OPTIONS_TIMEOUT = 1e4;
 var InvitationGuestExtension = class extends RpcExtension {
   constructor(_invitationFlowMutex, _callbacks) {
@@ -1684,8 +1850,11 @@ var InvitationGuestExtension = class extends RpcExtension {
     });
     this._invitationFlowMutex = _invitationFlowMutex;
     this._callbacks = _callbacks;
-    this._ctx = new Context4();
-    this._remoteOptionsTrigger = new Trigger3();
+    this._ctx = new Context4(void 0, {
+      F: __dxlog_file10,
+      L: 33
+    });
+    this._remoteOptionsTrigger = new Trigger4();
     this._invitationFlowLock = null;
   }
   hasFlowLock() {
@@ -1696,7 +1865,7 @@ var InvitationGuestExtension = class extends RpcExtension {
       InvitationHostService: {
         options: async (options) => {
           invariant6(!this._remoteOptions, "Remote options already set.", {
-            F: __dxlog_file8,
+            F: __dxlog_file10,
             L: 63,
             S: this,
             A: [
@@ -1722,15 +1891,15 @@ var InvitationGuestExtension = class extends RpcExtension {
   async onOpen(context) {
     await super.onOpen(context);
     try {
-      log5("guest acquire lock", void 0, {
-        F: __dxlog_file8,
+      log7("guest acquire lock", void 0, {
+        F: __dxlog_file10,
         L: 84,
         S: this,
         C: (f, a) => f(...a)
       });
       this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
-      log5("guest lock acquired", void 0, {
-        F: __dxlog_file8,
+      log7("guest lock acquired", void 0, {
+        F: __dxlog_file10,
         L: 86,
         S: this,
         C: (f, a) => f(...a)
@@ -1738,8 +1907,8 @@ var InvitationGuestExtension = class extends RpcExtension {
       await cancelWithContext2(this._ctx, this.rpc.InvitationHostService.options({
         role: Options.Role.GUEST
       }));
-      log5("options sent", void 0, {
-        F: __dxlog_file8,
+      log7("options sent", void 0, {
+        F: __dxlog_file10,
         L: 88,
         S: this,
         C: (f, a) => f(...a)
@@ -1747,8 +1916,8 @@ var InvitationGuestExtension = class extends RpcExtension {
       await cancelWithContext2(this._ctx, this._remoteOptionsTrigger.wait({
         timeout: OPTIONS_TIMEOUT
       }));
-      log5("options received", void 0, {
-        F: __dxlog_file8,
+      log7("options received", void 0, {
+        F: __dxlog_file10,
         L: 90,
         S: this,
         C: (f, a) => f(...a)
@@ -1781,8 +1950,8 @@ var InvitationGuestExtension = class extends RpcExtension {
     if (this._invitationFlowLock != null) {
       this._invitationFlowLock.release();
       this._invitationFlowLock = null;
-      log5("invitation flow lock released", void 0, {
-        F: __dxlog_file8,
+      log7("invitation flow lock released", void 0, {
+        F: __dxlog_file10,
         L: 123,
         S: this,
         C: (f, a) => f(...a)
@@ -1792,17 +1961,17 @@ var InvitationGuestExtension = class extends RpcExtension {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitation-host-extension.ts
-import { Trigger as Trigger4, scheduleTask as scheduleTask2 } from "@dxos/async";
+import { Trigger as Trigger5, scheduleTask as scheduleTask2 } from "@dxos/async";
 import { cancelWithContext as cancelWithContext3, Context as Context5 } from "@dxos/context";
 import { randomBytes, verify } from "@dxos/crypto";
 import { invariant as invariant7, InvariantViolation } from "@dxos/invariant";
 import { PublicKey as PublicKey5 } from "@dxos/keys";
-import { log as log6 } from "@dxos/log";
+import { log as log8 } from "@dxos/log";
 import { InvalidInvitationExtensionRoleError as InvalidInvitationExtensionRoleError2, schema as schema3, trace as trace4 } from "@dxos/protocols";
 import { Invitation as Invitation3 } from "@dxos/protocols/proto/dxos/client/services";
 import { AuthenticationResponse, Options as Options2 } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
-var __dxlog_file9 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-host-extension.ts";
+var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-host-extension.ts";
 var OPTIONS_TIMEOUT2 = 1e4;
 var MAX_OTP_ATTEMPTS = 3;
 var InvitationHostExtension = class extends RpcExtension2 {
@@ -1817,13 +1986,16 @@ var InvitationHostExtension = class extends RpcExtension2 {
     });
     this._invitationFlowMutex = _invitationFlowMutex;
     this._callbacks = _callbacks;
-    this._ctx = new Context5();
-    this._remoteOptionsTrigger = new Trigger4();
+    this._ctx = new Context5(void 0, {
+      F: __dxlog_file11,
+      L: 52
+    });
+    this._remoteOptionsTrigger = new Trigger5();
     this._challenge = void 0;
     this.guestProfile = void 0;
     this.authenticationPassed = false;
     this.authenticationRetry = 0;
-    this.completedTrigger = new Trigger4();
+    this.completedTrigger = new Trigger5();
     this._invitationFlowLock = null;
   }
   hasFlowLock() {
@@ -1836,7 +2008,7 @@ var InvitationHostExtension = class extends RpcExtension2 {
       InvitationHostService: {
         options: async (options) => {
           invariant7(!this._remoteOptions, "Remote options already set.", {
-            F: __dxlog_file9,
+            F: __dxlog_file11,
             L: 101,
             S: this,
             A: [
@@ -1850,10 +2022,10 @@ var InvitationHostExtension = class extends RpcExtension2 {
         introduce: async (request) => {
           const { profile, invitationId } = request;
           const traceId = PublicKey5.random().toHex();
-          log6.trace("dxos.sdk.invitation-handler.host.introduce", trace4.begin({
+          log8.trace("dxos.sdk.invitation-handler.host.introduce", trace4.begin({
             id: traceId
           }), {
-            F: __dxlog_file9,
+            F: __dxlog_file11,
             L: 110,
             S: this,
             C: (f, a) => f(...a)
@@ -1861,11 +2033,11 @@ var InvitationHostExtension = class extends RpcExtension2 {
           const invitation = this._requireActiveInvitation();
           this._assertInvitationState(Invitation3.State.CONNECTED);
           if (invitationId !== invitation?.invitationId) {
-            log6.warn("incorrect invitationId", {
+            log8.warn("incorrect invitationId", {
               expected: invitation.invitationId,
               actual: invitationId
             }, {
-              F: __dxlog_file9,
+              F: __dxlog_file11,
               L: 116,
               S: this,
               C: (f, a) => f(...a)
@@ -1876,10 +2048,10 @@ var InvitationHostExtension = class extends RpcExtension2 {
               authMethod: Invitation3.AuthMethod.NONE
             };
           }
-          log6("guest introduced themselves", {
+          log8("guest introduced themselves", {
             guestProfile: profile
           }, {
-            F: __dxlog_file9,
+            F: __dxlog_file11,
             L: 125,
             S: this,
             C: (f, a) => f(...a)
@@ -1887,10 +2059,10 @@ var InvitationHostExtension = class extends RpcExtension2 {
           this.guestProfile = profile;
           this._callbacks.onStateUpdate(Invitation3.State.READY_FOR_AUTHENTICATION);
           this._challenge = invitation.authMethod === Invitation3.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : void 0;
-          log6.trace("dxos.sdk.invitation-handler.host.introduce", trace4.end({
+          log8.trace("dxos.sdk.invitation-handler.host.introduce", trace4.end({
             id: traceId
           }), {
-            F: __dxlog_file9,
+            F: __dxlog_file11,
             L: 132,
             S: this,
             C: (f, a) => f(...a)
@@ -1902,19 +2074,19 @@ var InvitationHostExtension = class extends RpcExtension2 {
         },
         authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = PublicKey5.random().toHex();
-          log6.trace("dxos.sdk.invitation-handler.host.authenticate", trace4.begin({
+          log8.trace("dxos.sdk.invitation-handler.host.authenticate", trace4.begin({
             id: traceId
           }), {
-            F: __dxlog_file9,
+            F: __dxlog_file11,
             L: 141,
             S: this,
             C: (f, a) => f(...a)
           });
           const invitation = this._requireActiveInvitation();
-          log6("received authentication request", {
+          log8("received authentication request", {
             authCode: code
           }, {
-            F: __dxlog_file9,
+            F: __dxlog_file11,
             L: 144,
             S: this,
             C: (f, a) => f(...a)
@@ -1927,8 +2099,8 @@ var InvitationHostExtension = class extends RpcExtension2 {
           this._callbacks.onStateUpdate(Invitation3.State.AUTHENTICATING);
           switch (invitation.authMethod) {
             case Invitation3.AuthMethod.NONE: {
-              log6("authentication not required", void 0, {
-                F: __dxlog_file9,
+              log8("authentication not required", void 0, {
+                F: __dxlog_file11,
                 L: 152,
                 S: this,
                 C: (f, a) => f(...a)
@@ -1963,10 +2135,10 @@ var InvitationHostExtension = class extends RpcExtension2 {
               break;
             }
             default: {
-              log6.error("invalid authentication method", {
+              log8.error("invalid authentication method", {
                 authMethod: invitation.authMethod
               }, {
-                F: __dxlog_file9,
+                F: __dxlog_file11,
                 L: 190,
                 S: this,
                 C: (f, a) => f(...a)
@@ -1985,13 +2157,13 @@ var InvitationHostExtension = class extends RpcExtension2 {
               status
             };
           }
-          log6.trace("dxos.sdk.invitation-handler.host.authenticate", trace4.end({
+          log8.trace("dxos.sdk.invitation-handler.host.authenticate", trace4.end({
             id: traceId,
             data: {
               status
             }
           }), {
-            F: __dxlog_file9,
+            F: __dxlog_file11,
             L: 202,
             S: this,
             C: (f, a) => f(...a)
@@ -2002,10 +2174,10 @@ var InvitationHostExtension = class extends RpcExtension2 {
         },
         admit: async (request) => {
           const traceId = PublicKey5.random().toHex();
-          log6.trace("dxos.sdk.invitation-handler.host.admit", trace4.begin({
+          log8.trace("dxos.sdk.invitation-handler.host.admit", trace4.begin({
             id: traceId
           }), {
-            F: __dxlog_file9,
+            F: __dxlog_file11,
             L: 208,
             S: this,
             C: (f, a) => f(...a)
@@ -2019,10 +2191,10 @@ var InvitationHostExtension = class extends RpcExtension2 {
               }
             }
             const response = await this._callbacks.admit(request);
-            log6.trace("dxos.sdk.invitation-handler.host.admit", trace4.end({
+            log8.trace("dxos.sdk.invitation-handler.host.admit", trace4.end({
               id: traceId
             }), {
-              F: __dxlog_file9,
+              F: __dxlog_file11,
               L: 222,
               S: this,
               C: (f, a) => f(...a)
@@ -2039,15 +2211,15 @@ var InvitationHostExtension = class extends RpcExtension2 {
   async onOpen(context) {
     await super.onOpen(context);
     try {
-      log6("host acquire lock", void 0, {
-        F: __dxlog_file9,
+      log8("host acquire lock", void 0, {
+        F: __dxlog_file11,
         L: 237,
         S: this,
         C: (f, a) => f(...a)
       });
       this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
-      log6("host lock acquired", void 0, {
-        F: __dxlog_file9,
+      log8("host lock acquired", void 0, {
+        F: __dxlog_file11,
         L: 239,
         S: this,
         C: (f, a) => f(...a)
@@ -2057,8 +2229,8 @@ var InvitationHostExtension = class extends RpcExtension2 {
       await this.rpc.InvitationHostService.options({
         role: Options2.Role.HOST
       });
-      log6("options sent", void 0, {
-        F: __dxlog_file9,
+      log8("options sent", void 0, {
+        F: __dxlog_file11,
         L: 243,
         S: this,
         C: (f, a) => f(...a)
@@ -2066,8 +2238,8 @@ var InvitationHostExtension = class extends RpcExtension2 {
       await cancelWithContext3(this._ctx, this._remoteOptionsTrigger.wait({
         timeout: OPTIONS_TIMEOUT2
       }));
-      log6("options received", void 0, {
-        F: __dxlog_file9,
+      log8("options received", void 0, {
+        F: __dxlog_file11,
         L: 245,
         S: this,
         C: (f, a) => f(...a)
@@ -2120,8 +2292,8 @@ var InvitationHostExtension = class extends RpcExtension2 {
     if (this._invitationFlowLock != null) {
       this._invitationFlowLock?.release();
       this._invitationFlowLock = null;
-      log6("invitation flow lock released", void 0, {
-        F: __dxlog_file9,
+      log8("invitation flow lock released", void 0, {
+        F: __dxlog_file11,
         L: 300,
         S: this,
         C: (f, a) => f(...a)
@@ -2134,10 +2306,10 @@ var isAuthenticationRequired = (invitation) => invitation.authMethod !== Invitat
 // packages/sdk/client-services/src/packlets/invitations/invitation-topology.ts
 import { invariant as invariant8 } from "@dxos/invariant";
 import { PublicKey as PublicKey6 } from "@dxos/keys";
-import { log as log7 } from "@dxos/log";
+import { log as log9 } from "@dxos/log";
 import { Options as Options3 } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { ComplexSet as ComplexSet2 } from "@dxos/util";
-var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-topology.ts";
+var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-topology.ts";
 var InvitationTopology = class {
   constructor(_role) {
     this._role = _role;
@@ -2145,7 +2317,7 @@ var InvitationTopology = class {
   }
   init(controller) {
     invariant8(!this._controller, "Already initialized.", {
-      F: __dxlog_file10,
+      F: __dxlog_file12,
       L: 42,
       S: this,
       A: [
@@ -2157,7 +2329,7 @@ var InvitationTopology = class {
   }
   update() {
     invariant8(this._controller, "Not initialized.", {
-      F: __dxlog_file10,
+      F: __dxlog_file12,
       L: 47,
       S: this,
       A: [
@@ -2176,11 +2348,11 @@ var InvitationTopology = class {
     const firstUnknownPeer = candidates.find((peerId) => !this._seenPeers.has(peerId));
     this._seenPeers = new ComplexSet2(PublicKey6.hash, allPeers.filter((peerId) => this._seenPeers.has(peerId)));
     if (firstUnknownPeer != null) {
-      log7("invitation connect", {
+      log9("invitation connect", {
         ownPeerId,
         remotePeerId: firstUnknownPeer
       }, {
-        F: __dxlog_file10,
+        F: __dxlog_file12,
         L: 69,
         S: this,
         C: (f, a) => f(...a)
@@ -2191,7 +2363,7 @@ var InvitationTopology = class {
   }
   async onOffer(peer) {
     invariant8(this._controller, "Not initialized.", {
-      F: __dxlog_file10,
+      F: __dxlog_file12,
       L: 76,
       S: this,
       A: [
@@ -2210,7 +2382,7 @@ var InvitationTopology = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-var __dxlog_file11 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts";
+var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts";
 var MAX_DELEGATED_INVITATION_HOST_TRIES = 3;
 var InvitationsHandler = class {
   /**
@@ -2235,7 +2407,7 @@ var InvitationsHandler = class {
           try {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             invariant9(deviceKey, void 0, {
-              F: __dxlog_file11,
+              F: __dxlog_file13,
               L: 90,
               S: this,
               A: [
@@ -2261,18 +2433,18 @@ var InvitationsHandler = class {
           scheduleTask3(connectionCtx, async () => {
             const traceId = PublicKey7.random().toHex();
             try {
-              log8.trace("dxos.sdk.invitations-handler.host.onOpen", trace5.begin({
+              log10.trace("dxos.sdk.invitations-handler.host.onOpen", trace5.begin({
                 id: traceId
               }), {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 115,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              log8("connected", {
+              log10("connected", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 116,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2280,20 +2452,20 @@ var InvitationsHandler = class {
               const deviceKey = await extension.completedTrigger.wait({
                 timeout: invitation.timeout
               });
-              log8("admitted guest", {
+              log10("admitted guest", {
                 guest: deviceKey,
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 118,
                 S: this,
                 C: (f, a) => f(...a)
               });
               guardedState.set(extension, Invitation4.State.SUCCESS);
-              log8.trace("dxos.sdk.invitations-handler.host.onOpen", trace5.end({
+              log10.trace("dxos.sdk.invitations-handler.host.onOpen", trace5.end({
                 id: traceId
               }), {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 120,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2305,10 +2477,10 @@ var InvitationsHandler = class {
             } catch (err) {
               if (err instanceof TimeoutError) {
                 if (guardedState.set(extension, Invitation4.State.TIMEOUT)) {
-                  log8("timeout", {
+                  log10("timeout", {
                     ...protocol.toJSON()
                   }, {
-                    F: __dxlog_file11,
+                    F: __dxlog_file13,
                     L: 129,
                     S: this,
                     C: (f, a) => f(...a)
@@ -2316,19 +2488,19 @@ var InvitationsHandler = class {
                 }
               } else {
                 if (guardedState.error(extension, err)) {
-                  log8.error("failed", err, {
-                    F: __dxlog_file11,
+                  log10.error("failed", err, {
+                    F: __dxlog_file13,
                     L: 133,
                     S: this,
                     C: (f, a) => f(...a)
                   });
                 }
               }
-              log8.trace("dxos.sdk.invitations-handler.host.onOpen", trace5.error({
+              log10.trace("dxos.sdk.invitations-handler.host.onOpen", trace5.error({
                 id: traceId,
                 error: err
               }), {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 136,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2339,10 +2511,10 @@ var InvitationsHandler = class {
         },
         onError: (err) => {
           if (err instanceof InvalidInvitationExtensionRoleError3) {
-            log8("invalid role", {
+            log10("invalid role", {
               ...err.context
             }, {
-              F: __dxlog_file11,
+              F: __dxlog_file13,
               L: 144,
               S: this,
               C: (f, a) => f(...a)
@@ -2351,10 +2523,10 @@ var InvitationsHandler = class {
           }
           if (err instanceof TimeoutError) {
             if (guardedState.set(extension, Invitation4.State.TIMEOUT)) {
-              log8("timeout", {
+              log10("timeout", {
                 err
               }, {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 149,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2362,8 +2534,8 @@ var InvitationsHandler = class {
             }
           } else {
             if (guardedState.error(extension, err)) {
-              log8.error("failed", err, {
-                F: __dxlog_file11,
+              log10.error("failed", err, {
+                F: __dxlog_file13,
                 L: 153,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2376,8 +2548,8 @@ var InvitationsHandler = class {
     };
     if (invitation.lifetime && invitation.created) {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
-        log8.warn("invitation has already expired", void 0, {
-          F: __dxlog_file11,
+        log10.warn("invitation has already expired", void 0, {
+          F: __dxlog_file13,
           L: 164,
           S: this,
           C: (f, a) => f(...a)
@@ -2400,7 +2572,7 @@ var InvitationsHandler = class {
     const { timeout = INVITATION_TIMEOUT } = invitation;
     if (deviceProfile) {
       invariant9(invitation.kind === Invitation4.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
-        F: __dxlog_file11,
+        F: __dxlog_file13,
         L: 197,
         S: this,
         A: [
@@ -2413,12 +2585,12 @@ var InvitationsHandler = class {
     const guardedState = this._createGuardedState(ctx, invitation, stream);
     const shouldCancelInvitationFlow = (extension) => {
       const isLockedByAnotherConnection = guardedState.mutex.isLocked() && !extension.hasFlowLock();
-      log8("should cancel invitation flow", {
+      log10("should cancel invitation flow", {
         isLockedByAnotherConnection,
         invitationType: Invitation4.Type.DELEGATED,
         triedPeers: triedPeersIds.size
       }, {
-        F: __dxlog_file11,
+        F: __dxlog_file13,
         L: 205,
         S: this,
         C: (f, a) => f(...a)
@@ -2441,11 +2613,11 @@ var InvitationsHandler = class {
             return;
           }
           connectionCtx.onDispose(async () => {
-            log8("extension disposed", {
+            log10("extension disposed", {
               admitted,
               currentState: guardedState.current.state
             }, {
-              F: __dxlog_file11,
+              F: __dxlog_file13,
               L: 233,
               S: this,
               C: (f, a) => f(...a)
@@ -2460,10 +2632,10 @@ var InvitationsHandler = class {
           scheduleTask3(connectionCtx, async () => {
             const traceId = PublicKey7.random().toHex();
             try {
-              log8.trace("dxos.sdk.invitations-handler.guest.onOpen", trace5.begin({
+              log10.trace("dxos.sdk.invitations-handler.guest.onOpen", trace5.begin({
                 id: traceId
               }), {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 245,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2472,19 +2644,19 @@ var InvitationsHandler = class {
                 guardedState.set(extension, Invitation4.State.TIMEOUT);
                 extensionCtx.close();
               }, timeout);
-              log8("connected", {
+              log10("connected", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 256,
                 S: this,
                 C: (f, a) => f(...a)
               });
               guardedState.set(extension, Invitation4.State.CONNECTED);
-              log8("introduce", {
+              log10("introduce", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 260,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2493,11 +2665,11 @@ var InvitationsHandler = class {
                 invitationId: invitation.invitationId,
                 ...protocol.createIntroduction()
               });
-              log8("introduce response", {
+              log10("introduce response", {
                 ...protocol.toJSON(),
                 response: introductionResponse
               }, {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 265,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2515,10 +2687,10 @@ var InvitationsHandler = class {
                     break;
                 }
               }
-              log8("request admission", {
+              log10("request admission", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 291,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2527,10 +2699,10 @@ var InvitationsHandler = class {
               const admissionResponse = await extension.rpc.InvitationHostService.admit(admissionRequest);
               admitted = true;
               const result = await protocol.accept(admissionResponse, admissionRequest);
-              log8("admitted by host", {
+              log10("admitted by host", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 302,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2540,28 +2712,28 @@ var InvitationsHandler = class {
                 ...result,
                 state: Invitation4.State.SUCCESS
               });
-              log8.trace("dxos.sdk.invitations-handler.guest.onOpen", trace5.end({
+              log10.trace("dxos.sdk.invitations-handler.guest.onOpen", trace5.end({
                 id: traceId
               }), {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 308,
                 S: this,
                 C: (f, a) => f(...a)
               });
             } catch (err) {
               if (err instanceof TimeoutError) {
-                log8("timeout", {
+                log10("timeout", {
                   ...protocol.toJSON()
                 }, {
-                  F: __dxlog_file11,
+                  F: __dxlog_file13,
                   L: 311,
                   S: this,
                   C: (f, a) => f(...a)
                 });
                 guardedState.set(extension, Invitation4.State.TIMEOUT);
               } else {
-                log8("auth failed", err, {
-                  F: __dxlog_file11,
+                log10("auth failed", err, {
+                  F: __dxlog_file13,
                   L: 314,
                   S: this,
                   C: (f, a) => f(...a)
@@ -2569,11 +2741,11 @@ var InvitationsHandler = class {
                 guardedState.error(extension, err);
               }
               extensionCtx.close(err);
-              log8.trace("dxos.sdk.invitations-handler.guest.onOpen", trace5.error({
+              log10.trace("dxos.sdk.invitations-handler.guest.onOpen", trace5.error({
                 id: traceId,
                 error: err
               }), {
-                F: __dxlog_file11,
+                F: __dxlog_file13,
                 L: 318,
                 S: this,
                 C: (f, a) => f(...a)
@@ -2586,18 +2758,18 @@ var InvitationsHandler = class {
             return;
           }
           if (err instanceof TimeoutError) {
-            log8("timeout", {
+            log10("timeout", {
               ...protocol.toJSON()
             }, {
-              F: __dxlog_file11,
+              F: __dxlog_file13,
               L: 327,
               S: this,
               C: (f, a) => f(...a)
             });
             guardedState.set(extension, Invitation4.State.TIMEOUT);
           } else {
-            log8("auth failed", err, {
-              F: __dxlog_file11,
+            log10("auth failed", err, {
+              F: __dxlog_file13,
               L: 330,
               S: this,
               C: (f, a) => f(...a)
@@ -2615,7 +2787,7 @@ var InvitationsHandler = class {
         await ctx.dispose();
       } else {
         invariant9(invitation.swarmKey, void 0, {
-          F: __dxlog_file11,
+          F: __dxlog_file13,
           L: 345,
           S: this,
           A: [
@@ -2709,16 +2881,29 @@ var InvitationsHandler = class {
     };
   }
   _logStateUpdate(invitation, actor, newState) {
-    log8("invitation state update", {
-      actor: actor?.constructor.name,
-      newState: stateToString(newState),
-      oldState: stateToString(invitation.state)
-    }, {
-      F: __dxlog_file11,
-      L: 438,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    if (this._isNotTerminal(newState)) {
+      log10("invitation state update", {
+        actor: actor?.constructor.name,
+        newState: stateToString(newState),
+        oldState: stateToString(invitation.state)
+      }, {
+        F: __dxlog_file13,
+        L: 439,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    } else {
+      log10.info("invitation state update", {
+        actor: actor?.constructor.name,
+        newState: stateToString(newState),
+        oldState: stateToString(invitation.state)
+      }, {
+        F: __dxlog_file13,
+        L: 445,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
   }
   _isNotTerminal(currentState) {
     return ![
@@ -2731,17 +2916,17 @@ var InvitationsHandler = class {
   }
   async _handleGuestOtpAuth(extension, setState, authenticated, options) {
     for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-      log8("guest waiting for authentication code...", void 0, {
-        F: __dxlog_file11,
-        L: 462,
+      log10("guest waiting for authentication code...", void 0, {
+        F: __dxlog_file13,
+        L: 470,
         S: this,
         C: (f, a) => f(...a)
       });
       setState(Invitation4.State.READY_FOR_AUTHENTICATION);
       const authCode = await authenticated.wait(options);
-      log8("sending authentication request", void 0, {
-        F: __dxlog_file11,
-        L: 466,
+      log10("sending authentication request", void 0, {
+        F: __dxlog_file13,
+        L: 474,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2756,11 +2941,11 @@ var InvitationsHandler = class {
         if (attempt === MAX_OTP_ATTEMPTS) {
           throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
         } else {
-          log8("retrying invalid code", {
+          log10("retrying invalid code", {
             attempt
           }, {
-            F: __dxlog_file11,
-            L: 477,
+            F: __dxlog_file13,
+            L: 485,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2776,9 +2961,9 @@ var InvitationsHandler = class {
     if (introductionResponse.challenge == null) {
       throw new Error("challenge missing in the introduction");
     }
-    log8("sending authentication request", void 0, {
-      F: __dxlog_file11,
-      L: 496,
+    log10("sending authentication request", void 0, {
+      F: __dxlog_file13,
+      L: 504,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2898,14 +3083,14 @@ var InvitationsServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts
-import { createAdmissionCredentials, createCancelDelegatedSpaceInvitationCredential, createDelegatedSpaceInvitationCredential, getCredentialAssertion } from "@dxos/credentials";
+import { createCancelDelegatedSpaceInvitationCredential, createDelegatedSpaceInvitationCredential, getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
 import { writeMessages as writeMessages2 } from "@dxos/feed-store";
 import { invariant as invariant10 } from "@dxos/invariant";
-import { log as log9 } from "@dxos/log";
+import { log as log11 } from "@dxos/log";
 import { AlreadyJoinedError as AlreadyJoinedError2, AuthorizationError, InvalidInvitationError, SpaceNotFoundError } from "@dxos/protocols";
 import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
 import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
-var __dxlog_file12 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
+var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -2939,99 +3124,63 @@ var SpaceInvitationProtocol = class {
     };
   }
   async admit(invitation, request, guestProfile) {
-    invariant10(this._spaceKey, void 0, {
-      F: __dxlog_file12,
-      L: 76,
+    invariant10(this._spaceKey && request.space, void 0, {
+      F: __dxlog_file14,
+      L: 74,
       S: this,
       A: [
-        "this._spaceKey",
+        "this._spaceKey && request.space",
         ""
       ]
     });
+    log11("writing guest credentials", {
+      host: this._signingContext.deviceKey,
+      guest: request.space.deviceKey
+    }, {
+      F: __dxlog_file14,
+      L: 75,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const spaceMemberCredential = await this._spaceManager.admitMember({
+      spaceKey: this._spaceKey,
+      identityKey: request.space.identityKey,
+      role: invitation.role ?? SpaceMember2.Role.ADMIN,
+      profile: guestProfile,
+      delegationCredentialId: invitation.delegationCredentialId
+    });
     const space = this._spaceManager.spaces.get(this._spaceKey);
-    invariant10(space, void 0, {
-      F: __dxlog_file12,
-      L: 78,
+    return {
+      space: {
+        credential: spaceMemberCredential,
+        controlTimeframe: space?.inner.controlPipeline.state.timeframe
+      }
+    };
+  }
+  async delegate(invitation) {
+    invariant10(this._spaceKey, void 0, {
+      F: __dxlog_file14,
+      L: 95,
       S: this,
       A: [
-        "space",
+        "this._spaceKey",
         ""
       ]
     });
-    invariant10(request.space, void 0, {
-      F: __dxlog_file12,
-      L: 80,
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    invariant10(space, void 0, {
+      F: __dxlog_file14,
+      L: 97,
       S: this,
       A: [
-        "request.space",
-        ""
-      ]
-    });
-    const { identityKey, deviceKey } = request.space;
-    if (space.inner.spaceState.getMemberRole(identityKey) !== SpaceMember2.Role.REMOVED) {
-      throw new AlreadyJoinedError2();
-    }
-    log9("writing guest credentials", {
-      host: this._signingContext.deviceKey,
-      guest: deviceKey
-    }, {
-      F: __dxlog_file12,
-      L: 87,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, identityKey, space.key, space.inner.genesisFeedKey, invitation.role ?? SpaceMember2.Role.ADMIN, space.inner.spaceState.membershipChainHeads, guestProfile, invitation.delegationCredentialId);
-    invariant10(credentials[0].credential, void 0, {
-      F: __dxlog_file12,
-      L: 101,
-      S: this,
-      A: [
-        "credentials[0].credential",
-        ""
-      ]
-    });
-    const spaceMemberCredential = credentials[0].credential.credential;
-    invariant10(getCredentialAssertion(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file12,
-      L: 103,
-      S: this,
-      A: [
-        "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
-        ""
-      ]
-    });
-    await writeMessages2(space.inner.controlPipeline.writer, credentials);
-    return {
-      space: {
-        credential: spaceMemberCredential,
-        controlTimeframe: space.inner.controlPipeline.state.timeframe
-      }
-    };
-  }
-  async delegate(invitation) {
-    invariant10(this._spaceKey, void 0, {
-      F: __dxlog_file12,
-      L: 116,
-      S: this,
-      A: [
-        "this._spaceKey",
-        ""
-      ]
-    });
-    const space = this._spaceManager.spaces.get(this._spaceKey);
-    invariant10(space, void 0, {
-      F: __dxlog_file12,
-      L: 118,
-      S: this,
-      A: [
-        "space",
+        "space",
         ""
       ]
     });
     if (invitation.authMethod === Invitation5.AuthMethod.KNOWN_PUBLIC_KEY) {
       invariant10(invitation.guestKeypair?.publicKey, void 0, {
-        F: __dxlog_file12,
-        L: 120,
+        F: __dxlog_file14,
+        L: 99,
         S: this,
         A: [
           "invitation.guestKeypair?.publicKey",
@@ -3039,12 +3188,12 @@ var SpaceInvitationProtocol = class {
         ]
       });
     }
-    log9("writing delegate space invitation", {
+    log11("writing delegate space invitation", {
       host: this._signingContext.deviceKey,
       id: invitation.invitationId
     }, {
-      F: __dxlog_file12,
-      L: 123,
+      F: __dxlog_file14,
+      L: 102,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3058,8 +3207,8 @@ var SpaceInvitationProtocol = class {
       guestKey: invitation.authMethod === Invitation5.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
     });
     invariant10(credential.credential, void 0, {
-      F: __dxlog_file12,
-      L: 143,
+      F: __dxlog_file14,
+      L: 122,
       S: this,
       A: [
         "credential.credential",
@@ -3073,8 +3222,8 @@ var SpaceInvitationProtocol = class {
   }
   async cancelDelegation(invitation) {
     invariant10(this._spaceKey, void 0, {
-      F: __dxlog_file12,
-      L: 149,
+      F: __dxlog_file14,
+      L: 128,
       S: this,
       A: [
         "this._spaceKey",
@@ -3082,8 +3231,8 @@ var SpaceInvitationProtocol = class {
       ]
     });
     invariant10(invitation.type === Invitation5.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
-      F: __dxlog_file12,
-      L: 150,
+      F: __dxlog_file14,
+      L: 129,
       S: this,
       A: [
         "invitation.type === Invitation.Type.DELEGATED && invitation.delegationCredentialId",
@@ -3092,27 +3241,27 @@ var SpaceInvitationProtocol = class {
     });
     const space = this._spaceManager.spaces.get(this._spaceKey);
     invariant10(space, void 0, {
-      F: __dxlog_file12,
-      L: 152,
+      F: __dxlog_file14,
+      L: 131,
       S: this,
       A: [
         "space",
         ""
       ]
     });
-    log9("cancelling delegated space invitation", {
+    log11("cancelling delegated space invitation", {
       host: this._signingContext.deviceKey,
       id: invitation.invitationId
     }, {
-      F: __dxlog_file12,
-      L: 154,
+      F: __dxlog_file14,
+      L: 133,
       S: this,
       C: (f, a) => f(...a)
     });
     const credential = await createCancelDelegatedSpaceInvitationCredential(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
     invariant10(credential.credential, void 0, {
-      F: __dxlog_file12,
-      L: 161,
+      F: __dxlog_file14,
+      L: 140,
       S: this,
       A: [
         "credential.credential",
@@ -3150,8 +3299,8 @@ var SpaceInvitationProtocol = class {
   }
   async accept(response) {
     invariant10(response.space, void 0, {
-      F: __dxlog_file12,
-      L: 196,
+      F: __dxlog_file14,
+      L: 175,
       S: this,
       A: [
         "response.space",
@@ -3159,10 +3308,10 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { credential, controlTimeframe, dataTimeframe } = response.space;
-    const assertion = getCredentialAssertion(credential);
+    const assertion = getCredentialAssertion2(credential);
     invariant10(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
-      F: __dxlog_file12,
-      L: 199,
+      F: __dxlog_file14,
+      L: 178,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -3170,8 +3319,8 @@ var SpaceInvitationProtocol = class {
       ]
     });
     invariant10(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
-      F: __dxlog_file12,
-      L: 200,
+      F: __dxlog_file14,
+      L: 179,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -3195,17 +3344,17 @@ var SpaceInvitationProtocol = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts
-import { Event as Event3, PushStream, TimeoutError as TimeoutError2, Trigger as Trigger5 } from "@dxos/async";
+import { Event as Event3, PushStream, TimeoutError as TimeoutError2, Trigger as Trigger6 } from "@dxos/async";
 import { AuthenticatingInvitation, AUTHENTICATION_CODE_LENGTH, CancellableInvitation, INVITATION_TIMEOUT as INVITATION_TIMEOUT2 } from "@dxos/client-protocol";
 import { Context as Context6 } from "@dxos/context";
 import { generatePasscode } from "@dxos/credentials";
 import { hasInvitationExpired } from "@dxos/echo-pipeline";
 import { invariant as invariant11 } from "@dxos/invariant";
 import { PublicKey as PublicKey8 } from "@dxos/keys";
-import { log as log10 } from "@dxos/log";
+import { log as log12 } from "@dxos/log";
 import { Invitation as Invitation6 } from "@dxos/protocols/proto/dxos/client/services";
 import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
-var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
+var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
 var InvitationsManager = class {
   constructor(_invitationsHandler, _getHandler, _metadataStore) {
     this._invitationsHandler = _invitationsHandler;
@@ -3247,8 +3396,8 @@ var InvitationsManager = class {
     try {
       await this._persistIfRequired(handler, stream, invitation);
     } catch (err) {
-      log10.catch(err, void 0, {
-        F: __dxlog_file13,
+      log12.catch(err, void 0, {
+        F: __dxlog_file15,
         L: 82,
         S: this,
         C: (f, a) => f(...a)
@@ -3271,7 +3420,7 @@ var InvitationsManager = class {
       const freshInvitations = persistentInvitations.filter((invitation) => !hasInvitationExpired(invitation));
       const loadTasks = freshInvitations.map((persistentInvitation) => {
         invariant11(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
-          F: __dxlog_file13,
+          F: __dxlog_file15,
           L: 103,
           S: this,
           A: [
@@ -3289,8 +3438,8 @@ var InvitationsManager = class {
         invitations: cInvitations.map((invitation) => invitation.get())
       };
     } catch (err) {
-      log10.catch(err, void 0, {
-        F: __dxlog_file13,
+      log12.catch(err, void 0, {
+        F: __dxlog_file15,
         L: 110,
         S: this,
         C: (f, a) => f(...a)
@@ -3321,14 +3470,14 @@ var InvitationsManager = class {
     return invitation;
   }
   async authenticate({ invitationId, authCode }) {
-    log10("authenticating...", void 0, {
-      F: __dxlog_file13,
+    log12("authenticating...", void 0, {
+      F: __dxlog_file15,
       L: 140,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant11(invitationId, void 0, {
-      F: __dxlog_file13,
+      F: __dxlog_file15,
       L: 141,
       S: this,
       A: [
@@ -3338,10 +3487,10 @@ var InvitationsManager = class {
     });
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
-      log10.warn("invalid invitation", {
+      log12.warn("invalid invitation", {
         invitationId
       }, {
-        F: __dxlog_file13,
+        F: __dxlog_file15,
         L: 144,
         S: this,
         C: (f, a) => f(...a)
@@ -3351,16 +3500,16 @@ var InvitationsManager = class {
     }
   }
   async cancelInvitation({ invitationId }) {
-    log10("cancelInvitation...", {
+    log12("cancelInvitation...", {
       invitationId
     }, {
-      F: __dxlog_file13,
+      F: __dxlog_file15,
       L: 151,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant11(invitationId, void 0, {
-      F: __dxlog_file13,
+      F: __dxlog_file15,
       L: 152,
       S: this,
       A: [
@@ -3434,12 +3583,15 @@ var InvitationsManager = class {
         stream.error(err);
         void ctx.dispose();
       }
+    }, {
+      F: __dxlog_file15,
+      L: 234
     });
     ctx.onDispose(() => {
-      log10("complete", {
+      log12("complete", {
         ...handler.toJSON()
       }, {
-        F: __dxlog_file13,
+        F: __dxlog_file15,
         L: 241,
         S: this,
         C: (f, a) => f(...a)
@@ -3464,15 +3616,15 @@ var InvitationsManager = class {
     };
   }
   _createObservableAcceptingInvitation(handler, initialState) {
-    const otpEnteredTrigger = new Trigger5();
+    const otpEnteredTrigger = new Trigger6();
     const stream = new PushStream();
     const ctx = new Context6({
       onError: (err) => {
         if (err instanceof TimeoutError2) {
-          log10("timeout", {
+          log12("timeout", {
             ...handler.toJSON()
           }, {
-            F: __dxlog_file13,
+            F: __dxlog_file15,
             L: 261,
             S: this,
             C: (f, a) => f(...a)
@@ -3482,8 +3634,8 @@ var InvitationsManager = class {
             state: Invitation6.State.TIMEOUT
           });
         } else {
-          log10.warn("auth failed", err, {
-            F: __dxlog_file13,
+          log12.warn("auth failed", err, {
+            F: __dxlog_file15,
             L: 264,
             S: this,
             C: (f, a) => f(...a)
@@ -3495,12 +3647,15 @@ var InvitationsManager = class {
         }
         void ctx.dispose();
       }
+    }, {
+      F: __dxlog_file15,
+      L: 258
     });
     ctx.onDispose(() => {
-      log10("complete", {
+      log12("complete", {
         ...handler.toJSON()
       }, {
-        F: __dxlog_file13,
+        F: __dxlog_file15,
         L: 271,
         S: this,
         C: (f, a) => f(...a)
@@ -3544,8 +3699,8 @@ var InvitationsManager = class {
     try {
       await this._metadataStore.removeInvitation(invitation.invitationId);
     } catch (err) {
-      log10.catch(err, void 0, {
-        F: __dxlog_file13,
+      log12.catch(err, void 0, {
+        F: __dxlog_file15,
         L: 307,
         S: this,
         C: (f, a) => f(...a)
@@ -3560,33 +3715,40 @@ var InvitationsManager = class {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-import { Event as Event6, asyncTimeout as asyncTimeout2, scheduleTask as scheduleTask5, sleep as sleep2, synchronized, trackLeaks } from "@dxos/async";
+import { Event as Event6, Mutex as Mutex2, scheduleTask as scheduleTask5, sleep as sleep3, synchronized, trackLeaks } from "@dxos/async";
 import { AUTH_TIMEOUT as AUTH_TIMEOUT2 } from "@dxos/client-protocol";
-import { Context as Context8, ContextDisposedError as ContextDisposedError3, cancelWithContext as cancelWithContext4 } from "@dxos/context";
+import { Context as Context8, ContextDisposedError as ContextDisposedError3, cancelWithContext as cancelWithContext5 } from "@dxos/context";
 import { timed, warnAfterTimeout } from "@dxos/debug";
-import { AutomergeDocumentLoaderImpl, createIdFromSpaceKey, createMappedFeedWriter } from "@dxos/echo-pipeline";
-import { TYPE_PROPERTIES } from "@dxos/echo-schema";
-import { failedInvariant, invariant as invariant13 } from "@dxos/invariant";
+import { createMappedFeedWriter } from "@dxos/echo-pipeline";
+import { SpaceDocVersion } from "@dxos/echo-protocol";
+import { failedInvariant } from "@dxos/invariant";
 import { PublicKey as PublicKey10 } from "@dxos/keys";
-import { log as log12 } from "@dxos/log";
+import { log as log15 } from "@dxos/log";
 import { CancelledError, SystemError } from "@dxos/protocols";
-import { CreateEpochRequest, SpaceState } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceState as SpaceState2 } from "@dxos/protocols/proto/dxos/client/services";
 import { AdmittedFeed as AdmittedFeed3, SpaceMember as SpaceMember4 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { Timeframe as Timeframe2 } from "@dxos/timeframe";
+import { Timeframe as Timeframe3 } from "@dxos/timeframe";
 import { trace as trace6 } from "@dxos/tracing";
-import { ComplexSet as ComplexSet5, assignDeep } from "@dxos/util";
+import { ComplexSet as ComplexSet5 } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/automerge-space-state.ts
 import { Event as Event4 } from "@dxos/async";
+import { Resource as Resource2 } from "@dxos/context";
 import { checkCredentialType } from "@dxos/credentials";
-var AutomergeSpaceState = class {
+var AutomergeSpaceState = class extends Resource2 {
   constructor(_onNewRoot) {
+    super();
     this._onNewRoot = _onNewRoot;
     this.rootUrl = void 0;
     this.lastEpoch = void 0;
     this.onNewEpoch = new Event4();
     this._isProcessingRootDocs = false;
   }
+  async _open(ctx) {
+  }
+  async _close(ctx) {
+    this._isProcessingRootDocs = false;
+  }
   async processCredential(credential) {
     if (!checkCredentialType(credential, "dxos.halo.credentials.Epoch")) {
       return;
@@ -3614,23 +3776,172 @@ var AutomergeSpaceState = class {
   }
 };
 
+// packages/sdk/client-services/src/packlets/spaces/epoch-migrations.ts
+import { asyncTimeout as asyncTimeout2 } from "@dxos/async";
+import { next as am } from "@dxos/automerge/automerge";
+import { cancelWithContext as cancelWithContext4 } from "@dxos/context";
+import { convertLegacyReferences, convertLegacySpaceRootDoc, findInlineObjectOfType, migrateDocument } from "@dxos/echo-db";
+import { AutomergeDocumentLoaderImpl } from "@dxos/echo-pipeline";
+import { TYPE_PROPERTIES } from "@dxos/echo-schema";
+import { invariant as invariant12 } from "@dxos/invariant";
+import { log as log13 } from "@dxos/log";
+import { CreateEpochRequest } from "@dxos/protocols/proto/dxos/client/services";
+import { assignDeep } from "@dxos/util";
+var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/epoch-migrations.ts";
+var runEpochMigration = async (ctx, context) => {
+  switch (context.migration) {
+    case CreateEpochRequest.Migration.INIT_AUTOMERGE: {
+      const document = context.repo.create();
+      await context.repo.flush();
+      return {
+        newRoot: document.url
+      };
+    }
+    case CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY: {
+      if (!context.currentRoot) {
+        throw new Error("Space does not have an automerge root");
+      }
+      const rootHandle = context.repo.find(context.currentRoot);
+      await cancelWithContext4(ctx, asyncTimeout2(rootHandle.whenReady(), 1e4));
+      const newRoot = context.repo.create(rootHandle.docSync());
+      await context.repo.flush();
+      return {
+        newRoot: newRoot.url
+      };
+    }
+    case CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT: {
+      log13.info("Fragmenting", void 0, {
+        F: __dxlog_file16,
+        L: 63,
+        S: void 0,
+        C: (f, a) => f(...a)
+      });
+      const currentRootUrl = context.currentRoot;
+      const rootHandle = context.repo.find(currentRootUrl);
+      await cancelWithContext4(ctx, asyncTimeout2(rootHandle.whenReady(), 1e4));
+      const objects = Object.entries(rootHandle.docSync().objects);
+      const properties = findInlineObjectOfType(rootHandle.docSync(), TYPE_PROPERTIES);
+      const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
+      invariant12(properties, "Properties not found", {
+        F: __dxlog_file16,
+        L: 73,
+        S: void 0,
+        A: [
+          "properties",
+          "'Properties not found'"
+        ]
+      });
+      const newSpaceDoc = {
+        ...rootHandle.docSync(),
+        objects: Object.fromEntries([
+          properties
+        ])
+      };
+      const newRoot = context.repo.create(newSpaceDoc);
+      invariant12(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
+        F: __dxlog_file16,
+        L: 78,
+        S: void 0,
+        A: [
+          "typeof newRoot.url === 'string' && newRoot.url.length > 0",
+          ""
+        ]
+      });
+      const docLoader = new AutomergeDocumentLoaderImpl(context.spaceId, context.repo, context.spaceKey);
+      await docLoader.loadSpaceRootDocHandle(ctx, {
+        rootUrl: newRoot.url
+      });
+      otherObjects.forEach(([key, value]) => {
+        const handle = docLoader.createDocumentForObject(key);
+        handle.change((doc) => {
+          assignDeep(doc, [
+            "objects",
+            key
+          ], value);
+        });
+      });
+      await context.repo.flush();
+      return {
+        newRoot: newRoot.url
+      };
+    }
+    case CreateEpochRequest.Migration.MIGRATE_REFERENCES_TO_DXN: {
+      const currentRootUrl = context.currentRoot;
+      const rootHandle = context.repo.find(currentRootUrl);
+      await cancelWithContext4(ctx, asyncTimeout2(rootHandle.whenReady(), 1e4));
+      invariant12(rootHandle.docSync(), "Root doc not found", {
+        F: __dxlog_file16,
+        L: 100,
+        S: void 0,
+        A: [
+          "rootHandle.docSync()",
+          "'Root doc not found'"
+        ]
+      });
+      const newRootContent = await convertLegacySpaceRootDoc(structuredClone(rootHandle.docSync()));
+      for (const [id, url] of Object.entries(newRootContent.links ?? {})) {
+        const handle = context.repo.find(url);
+        await cancelWithContext4(ctx, asyncTimeout2(handle.whenReady(), 1e4));
+        invariant12(handle.docSync(), "Doc not found", {
+          F: __dxlog_file16,
+          L: 107,
+          S: void 0,
+          A: [
+            "handle.docSync()",
+            "'Doc not found'"
+          ]
+        });
+        const newDoc = await convertLegacyReferences(structuredClone(handle.docSync()));
+        const migratedDoc = migrateDocument(handle.docSync(), newDoc);
+        const newHandle = context.repo.import(am.save(migratedDoc));
+        newRootContent.links[id] = newHandle.url;
+      }
+      const migratedRoot = migrateDocument(rootHandle.docSync(), newRootContent);
+      const newRoot = context.repo.import(am.save(migratedRoot));
+      await context.repo.flush();
+      return {
+        newRoot: newRoot.url
+      };
+    }
+    case CreateEpochRequest.Migration.REPLACE_AUTOMERGE_ROOT: {
+      invariant12(context.newAutomergeRoot, void 0, {
+        F: __dxlog_file16,
+        L: 124,
+        S: void 0,
+        A: [
+          "context.newAutomergeRoot",
+          ""
+        ]
+      });
+      await context.repo.flush();
+      return {
+        newRoot: context.newAutomergeRoot
+      };
+    }
+  }
+  return {};
+};
+
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
-import { DeferredTask, Event as Event5, scheduleTask as scheduleTask4, sleep, TimeoutError as TimeoutError3, Trigger as Trigger6 } from "@dxos/async";
+import { DeferredTask, Event as Event5, scheduleTask as scheduleTask4, sleep as sleep2, TimeoutError as TimeoutError3, Trigger as Trigger7 } from "@dxos/async";
 import { Context as Context7, rejectOnDispose } from "@dxos/context";
-import { invariant as invariant12 } from "@dxos/invariant";
+import { invariant as invariant13 } from "@dxos/invariant";
 import { PublicKey as PublicKey9 } from "@dxos/keys";
-import { log as log11 } from "@dxos/log";
+import { log as log14 } from "@dxos/log";
 import { schema as schema4 } from "@dxos/protocols";
 import { RpcExtension as RpcExtension3 } from "@dxos/teleport";
 import { ComplexMap as ComplexMap2, ComplexSet as ComplexSet4, entry } from "@dxos/util";
-var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
+var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
 var WRITER_NOT_SET_ERROR_CODE = "WRITER_NOT_SET";
 var NotarizationPlugin = class {
   constructor() {
-    this._ctx = new Context7();
+    this._ctx = new Context7(void 0, {
+      F: __dxlog_file17,
+      L: 62
+    });
     this._extensionOpened = new Event5();
     this._extensions = /* @__PURE__ */ new Set();
     this._processedCredentials = new ComplexSet4(PublicKey9.hash);
@@ -3648,16 +3959,16 @@ var NotarizationPlugin = class {
   * Request credentials to be notarized.
   */
   async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
-    log11("notarize", {
+    log14("notarize", {
       credentials
     }, {
-      F: __dxlog_file14,
+      F: __dxlog_file17,
       L: 90,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant12(credentials.every((credential) => credential.id), "Credentials must have an id", {
-      F: __dxlog_file14,
+    invariant13(credentials.every((credential) => credential.id), "Credentials must have an id", {
+      F: __dxlog_file17,
       L: 91,
       S: this,
       A: [
@@ -3665,13 +3976,13 @@ var NotarizationPlugin = class {
         "'Credentials must have an id'"
       ]
     });
-    const errors = new Trigger6();
+    const errors = new Trigger7();
     const ctx = this._ctx.derive({
       onError: (err) => {
-        log11.warn("Notarization error", {
+        log14.warn("Notarization error", {
           err
         }, {
-          F: __dxlog_file14,
+          F: __dxlog_file17,
           L: 99,
           S: this,
           C: (f, a) => f(...a)
@@ -3683,11 +3994,11 @@ var NotarizationPlugin = class {
     opCtx?.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
       scheduleTask4(ctx, () => {
-        log11.warn("Notarization timeout", {
+        log14.warn("Notarization timeout", {
           timeout,
           peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
         }, {
-          F: __dxlog_file14,
+          F: __dxlog_file17,
           L: 111,
           S: this,
           C: (f, a) => f(...a)
@@ -3707,10 +4018,10 @@ var NotarizationPlugin = class {
           ...this._extensions
         ].find((peer2) => !peersTried.has(peer2));
         if (!peer) {
-          log11.info("Exhausted all peers to notarize with", {
+          log14.info("Exhausted all peers to notarize with", {
             retryIn: retryTimeout
           }, {
-            F: __dxlog_file14,
+            F: __dxlog_file17,
             L: 136,
             S: this,
             C: (f, a) => f(...a)
@@ -3720,11 +4031,11 @@ var NotarizationPlugin = class {
           return;
         }
         peersTried.add(peer);
-        log11("try notarizing", {
+        log14("try notarizing", {
           peer: peer.localPeerId,
           credentialId: credentials.map((credential) => credential.id)
         }, {
-          F: __dxlog_file14,
+          F: __dxlog_file17,
           L: 143,
           S: this,
           C: (f, a) => f(...a)
@@ -3732,17 +4043,17 @@ var NotarizationPlugin = class {
         await peer.rpc.NotarizationService.notarize({
           credentials: credentials.filter((credential) => !this._processedCredentials.has(credential.id))
         });
-        log11("success", void 0, {
-          F: __dxlog_file14,
+        log14("success", void 0, {
+          F: __dxlog_file17,
           L: 147,
           S: this,
           C: (f, a) => f(...a)
         });
-        await sleep(successDelay);
+        await sleep2(successDelay);
       } catch (err) {
         if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
-          log11.info("error notarizing (recoverable)", err, {
-            F: __dxlog_file14,
+          log14.info("error notarizing (recoverable)", err, {
+            F: __dxlog_file17,
             L: 151,
             S: this,
             C: (f, a) => f(...a)
@@ -3759,8 +4070,8 @@ var NotarizationPlugin = class {
         allNotarized,
         errors.wait()
       ]);
-      log11("done", void 0, {
-        F: __dxlog_file14,
+      log14("done", void 0, {
+        F: __dxlog_file17,
         L: 162,
         S: this,
         C: (f, a) => f(...a)
@@ -3781,8 +4092,8 @@ var NotarizationPlugin = class {
     this._processCredentialsTriggers.delete(credential.id);
   }
   setWriter(writer) {
-    invariant12(!this._writer, "Writer already set.", {
-      F: __dxlog_file14,
+    invariant13(!this._writer, "Writer already set.", {
+      F: __dxlog_file17,
       L: 181,
       S: this,
       A: [
@@ -3796,7 +4107,7 @@ var NotarizationPlugin = class {
     if (this._processedCredentials.has(id)) {
       return;
     }
-    await entry(this._processCredentialsTriggers, id).orInsert(new Trigger6()).value.wait();
+    await entry(this._processCredentialsTriggers, id).orInsert(new Trigger7()).value.wait();
   }
   /**
   * Requests from other peers to notarize credentials.
@@ -3806,8 +4117,8 @@ var NotarizationPlugin = class {
       throw new Error(WRITER_NOT_SET_ERROR_CODE);
     }
     for (const credential of request.credentials ?? []) {
-      invariant12(credential.id, "Credential must have an id", {
-        F: __dxlog_file14,
+      invariant13(credential.id, "Credential must have an id", {
+        F: __dxlog_file17,
         L: 200,
         S: this,
         A: [
@@ -3824,10 +4135,10 @@ var NotarizationPlugin = class {
   createExtension() {
     const extension = new NotarizationTeleportExtension({
       onOpen: async () => {
-        log11("extension opened", {
+        log14("extension opened", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file14,
+          F: __dxlog_file17,
           L: 211,
           S: this,
           C: (f, a) => f(...a)
@@ -3836,10 +4147,10 @@ var NotarizationPlugin = class {
         this._extensionOpened.emit();
       },
       onClose: async () => {
-        log11("extension closed", {
+        log14("extension closed", {
           peer: extension.localPeerId
         }, {
-          F: __dxlog_file14,
+          F: __dxlog_file17,
           L: 216,
           S: this,
           C: (f, a) => f(...a)
@@ -3893,15 +4204,83 @@ function _ts_decorate4(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file15 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
+function _using_ctx() {
+  var _disposeSuppressedError = typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed) {
+    var err = new Error();
+    err.name = "SuppressedError";
+    err.suppressed = suppressed;
+    err.error = error;
+    return err;
+  }, empty = {}, stack = [];
+  function using(isAwait, value) {
+    if (value != null) {
+      if (Object(value) !== value) {
+        throw new TypeError("using declarations can only be used with objects, functions, null, or undefined.");
+      }
+      if (isAwait) {
+        var dispose = value[Symbol.asyncDispose || Symbol.for("Symbol.asyncDispose")];
+      }
+      if (dispose == null) {
+        dispose = value[Symbol.dispose || Symbol.for("Symbol.dispose")];
+      }
+      if (typeof dispose !== "function") {
+        throw new TypeError(`Property [Symbol.dispose] is not a function.`);
+      }
+      stack.push({
+        v: value,
+        d: dispose,
+        a: isAwait
+      });
+    } else if (isAwait) {
+      stack.push({
+        d: value,
+        a: isAwait
+      });
+    }
+    return value;
+  }
+  return {
+    e: empty,
+    u: using.bind(null, false),
+    a: using.bind(null, true),
+    d: function() {
+      var error = this.e;
+      function next() {
+        while (resource = stack.pop()) {
+          try {
+            var resource, disposalResult = resource.d && resource.d.call(resource.v);
+            if (resource.a) {
+              return Promise.resolve(disposalResult).then(next, err);
+            }
+          } catch (e) {
+            return err(e);
+          }
+        }
+        if (error !== empty)
+          throw error;
+      }
+      function err(e) {
+        error = error !== empty ? new _disposeSuppressedError(error, e) : e;
+        return next();
+      }
+      return next();
+    }
+  };
+}
+var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space.ts";
 var DataSpace = class {
   constructor(params) {
-    this._ctx = new Context8();
+    this._ctx = new Context8(void 0, {
+      F: __dxlog_file18,
+      L: 84
+    });
     this._notarizationPlugin = new NotarizationPlugin();
     this._cache = void 0;
     // TODO(dmaretskyi): Move into Space?
     this._automergeSpaceState = new AutomergeSpaceState((rootUrl) => this._onNewAutomergeRoot(rootUrl));
-    this._state = SpaceState.CLOSED;
+    this._epochProcessingMutex = new Mutex2();
+    this._state = SpaceState2.CLOSED;
+    this._databaseRoot = null;
     /**
     * Error for _state === SpaceState.ERROR.
     */
@@ -3925,11 +4304,11 @@ var DataSpace = class {
     });
     this._cache = params.cache;
     this._state = params.initialState;
-    log12("new state", {
-      state: SpaceState[this._state]
+    log15("new state", {
+      state: SpaceState2[this._state]
     }, {
-      F: __dxlog_file15,
-      L: 143,
+      F: __dxlog_file18,
+      L: 146,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3962,6 +4341,9 @@ var DataSpace = class {
   get automergeSpaceState() {
     return this._automergeSpaceState;
   }
+  get databaseRoot() {
+    return this._databaseRoot;
+  }
   get _automergeInfo() {
     return {
       rootUrl: this._automergeSpaceState.rootUrl,
@@ -3969,20 +4351,27 @@ var DataSpace = class {
     };
   }
   async open() {
-    await this._open();
+    if (this._state === SpaceState2.CLOSED) {
+      await this._open();
+    }
   }
   async _open() {
+    await this._presence.open();
     await this._gossip.open();
     await this._notarizationPlugin.open();
     await this._inner.spaceState.addCredentialProcessor(this._notarizationPlugin);
+    await this._automergeSpaceState.open();
     await this._inner.spaceState.addCredentialProcessor(this._automergeSpaceState);
-    await this._inner.open(new Context8());
-    this._state = SpaceState.CONTROL_ONLY;
-    log12("new state", {
-      state: SpaceState[this._state]
+    await this._inner.open(new Context8(void 0, {
+      F: __dxlog_file18,
+      L: 215
+    }));
+    this._state = SpaceState2.CONTROL_ONLY;
+    log15("new state", {
+      state: SpaceState2[this._state]
     }, {
-      F: __dxlog_file15,
-      L: 206,
+      F: __dxlog_file18,
+      L: 217,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3995,23 +4384,27 @@ var DataSpace = class {
   }
   async _close() {
     await this._callbacks.beforeClose?.();
-    this._state = SpaceState.CLOSED;
-    log12("new state", {
-      state: SpaceState[this._state]
+    this._state = SpaceState2.CLOSED;
+    log15("new state", {
+      state: SpaceState2[this._state]
     }, {
-      F: __dxlog_file15,
-      L: 220,
+      F: __dxlog_file18,
+      L: 231,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._ctx.dispose();
-    this._ctx = new Context8();
+    this._ctx = new Context8(void 0, {
+      F: __dxlog_file18,
+      L: 233
+    });
     await this.authVerifier.close();
     await this._inner.close();
     await this._inner.spaceState.removeCredentialProcessor(this._automergeSpaceState);
+    await this._automergeSpaceState.close();
     await this._inner.spaceState.removeCredentialProcessor(this._notarizationPlugin);
     await this._notarizationPlugin.close();
-    await this._presence.destroy();
+    await this._presence.close();
     await this._gossip.close();
   }
   async postMessage(channel, message) {
@@ -4030,26 +4423,26 @@ var DataSpace = class {
         await this.initializeDataPipeline();
       } catch (err) {
         if (err instanceof CancelledError || err instanceof ContextDisposedError3) {
-          log12("data pipeline initialization cancelled", err, {
-            F: __dxlog_file15,
-            L: 253,
+          log15("data pipeline initialization cancelled", err, {
+            F: __dxlog_file18,
+            L: 265,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
-        log12.error("Error initializing data pipeline", err, {
-          F: __dxlog_file15,
-          L: 257,
+        log15.error("Error initializing data pipeline", err, {
+          F: __dxlog_file18,
+          L: 269,
           S: this,
           C: (f, a) => f(...a)
         });
-        this._state = SpaceState.ERROR;
-        log12("new state", {
-          state: SpaceState[this._state]
+        this._state = SpaceState2.ERROR;
+        log15("new state", {
+          state: SpaceState2[this._state]
         }, {
-          F: __dxlog_file15,
-          L: 259,
+          F: __dxlog_file18,
+          L: 271,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4061,35 +4454,32 @@ var DataSpace = class {
     });
   }
   async initializeDataPipeline() {
-    if (this._state !== SpaceState.CONTROL_ONLY) {
+    if (this._state !== SpaceState2.CONTROL_ONLY) {
       throw new SystemError("Invalid operation");
     }
-    this._state = SpaceState.INITIALIZING;
-    log12("new state", {
-      state: SpaceState[this._state]
+    this._state = SpaceState2.INITIALIZING;
+    log15("new state", {
+      state: SpaceState2[this._state]
     }, {
-      F: __dxlog_file15,
-      L: 275,
+      F: __dxlog_file18,
+      L: 287,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._initializeAndReadControlPipeline();
-    await sleep2(1);
+    await sleep3(1);
+    const ready = this.stateUpdate.waitForCondition(() => this._state === SpaceState2.READY);
     this._automergeSpaceState.startProcessingRootDocs();
-    await cancelWithContext4(this._ctx, this.automergeSpaceState.ensureEpochInitialized());
-    log12("data pipeline ready", void 0, {
-      F: __dxlog_file15,
-      L: 287,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    await ready;
+  }
+  async _enterReadyState() {
     await this._callbacks.beforeReady?.();
-    this._state = SpaceState.READY;
-    log12("new state", {
-      state: SpaceState[this._state]
+    this._state = SpaceState2.READY;
+    log15("new state", {
+      state: SpaceState2[this._state]
     }, {
-      F: __dxlog_file15,
-      L: 291,
+      F: __dxlog_file18,
+      L: 306,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4103,9 +4493,9 @@ var DataSpace = class {
     });
     this.metrics.controlPipelineReady = /* @__PURE__ */ new Date();
     await this._createWritableFeeds();
-    log12("writable feeds created", void 0, {
-      F: __dxlog_file15,
-      L: 307,
+    log15("writable feeds created", void 0, {
+      F: __dxlog_file18,
+      L: 322,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4163,57 +4553,66 @@ var DataSpace = class {
     }
   }
   _onNewAutomergeRoot(rootUrl) {
-    log12("loading automerge root doc for space", {
+    log15("loading automerge root doc for space", {
       space: this.key,
       rootUrl
     }, {
-      F: __dxlog_file15,
-      L: 373,
+      F: __dxlog_file18,
+      L: 388,
       S: this,
       C: (f, a) => f(...a)
     });
-    this._echoHost.replicateDocument(rootUrl);
     const handle = this._echoHost.automergeRepo.find(rootUrl);
     queueMicrotask(async () => {
       try {
-        await warnAfterTimeout(5e3, "Automerge root doc load timeout (DataSpace)", async () => {
-          await cancelWithContext4(this._ctx, handle.whenReady());
-        });
-        if (this._ctx.disposed) {
-          return;
-        }
-        const doc = handle.docSync() ?? failedInvariant();
-        if (!doc.access?.spaceKey) {
-          handle.change((doc2) => {
-            doc2.access = {
-              spaceKey: this.key.toHex()
-            };
-          });
-        }
-        if (!this._echoHost.roots.has(handle.documentId)) {
-          await this._echoHost.openSpaceRoot(handle.url);
-        } else {
-          log12.warn("echo database root already exists", {
-            space: this.key,
-            rootUrl
-          }, {
-            F: __dxlog_file15,
-            L: 400,
-            S: this,
-            C: (f, a) => f(...a)
+        try {
+          var _usingCtx = _using_ctx();
+          await warnAfterTimeout(5e3, "Automerge root doc load timeout (DataSpace)", async () => {
+            await cancelWithContext5(this._ctx, handle.whenReady());
           });
+          if (this._ctx.disposed) {
+            return;
+          }
+          const _guard = (
+            // Ensure only one root is processed at a time.
+            _usingCtx.u(await this._epochProcessingMutex.acquire())
+          );
+          const doc = handle.docSync() ?? failedInvariant();
+          if (!doc.access?.spaceKey) {
+            handle.change((doc2) => {
+              doc2.access = {
+                spaceKey: this.key.toHex()
+              };
+            });
+          }
+          const root = await this._echoHost.openSpaceRoot(handle.url);
+          this._databaseRoot = root;
+          if (root.getVersion() !== SpaceDocVersion.CURRENT) {
+            if (this._state !== SpaceState2.REQUIRES_MIGRATION) {
+              this._state = SpaceState2.REQUIRES_MIGRATION;
+              this.stateUpdate.emit();
+            }
+          } else {
+            if (this._state !== SpaceState2.READY) {
+              await this._enterReadyState();
+            }
+          }
+        } catch (_) {
+          _usingCtx.e = _;
+        } finally {
+          _usingCtx.d();
         }
       } catch (err) {
         if (err instanceof ContextDisposedError3) {
           return;
         }
-        log12.warn("error loading automerge root doc", {
+        log15.warn("error loading automerge root doc", {
           space: this.key,
           rootUrl,
           err
         }, {
-          F: __dxlog_file15,
-          L: 406,
+          F: __dxlog_file18,
+          L: 431,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4236,178 +4635,70 @@ var DataSpace = class {
     });
   }
   async createEpoch(options) {
-    let epoch;
-    switch (options?.migration) {
-      case void 0:
-      case CreateEpochRequest.Migration.NONE:
-        {
-          epoch = {
-            previousId: this._automergeSpaceState.lastEpoch?.id,
-            number: (this._automergeSpaceState.lastEpoch?.subject.assertion.number ?? -1) + 1,
-            timeframe: this._automergeSpaceState.lastEpoch?.subject.assertion.timeframe ?? new Timeframe2(),
-            automergeRoot: this._automergeSpaceState.lastEpoch?.subject.assertion?.automergeRoot
-          };
-        }
-        break;
-      case CreateEpochRequest.Migration.INIT_AUTOMERGE:
-        {
-          const document = this._echoHost.automergeRepo.create();
-          epoch = {
-            previousId: this._automergeSpaceState.lastEpoch?.id,
-            number: (this._automergeSpaceState.lastEpoch?.subject.assertion.number ?? -1) + 1,
-            timeframe: this._automergeSpaceState.lastEpoch?.subject.assertion.timeframe ?? new Timeframe2(),
-            automergeRoot: document.url
-          };
-        }
-        break;
-      case CreateEpochRequest.Migration.PRUNE_AUTOMERGE_ROOT_HISTORY:
-        {
-          const currentRootUrl = this._automergeSpaceState.rootUrl;
-          const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
-          await cancelWithContext4(this._ctx, asyncTimeout2(rootHandle.whenReady(), 1e4));
-          const newRoot = this._echoHost.automergeRepo.create(rootHandle.docSync());
-          await this._echoHost.automergeRepo.flush([
-            newRoot.documentId
-          ]);
-          invariant13(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
-            F: __dxlog_file15,
-            L: 457,
-            S: this,
-            A: [
-              "typeof newRoot.url === 'string' && newRoot.url.length > 0",
-              ""
-            ]
-          });
-          epoch = {
-            previousId: this._automergeSpaceState.lastEpoch?.id,
-            number: (this._automergeSpaceState.lastEpoch?.subject.assertion.number ?? -1) + 1,
-            timeframe: this._automergeSpaceState.lastEpoch?.subject.assertion.timeframe ?? new Timeframe2(),
-            automergeRoot: newRoot.url
-          };
-        }
-        break;
-      case CreateEpochRequest.Migration.FRAGMENT_AUTOMERGE_ROOT:
-        {
-          log12.info("Fragmenting", void 0, {
-            F: __dxlog_file15,
-            L: 469,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          const currentRootUrl = this._automergeSpaceState.rootUrl;
-          const rootHandle = this._echoHost.automergeRepo.find(currentRootUrl);
-          await cancelWithContext4(this._ctx, asyncTimeout2(rootHandle.whenReady(), 1e4));
-          const objects = Object.entries(rootHandle.docSync().objects);
-          const properties = findPropertiesObject(rootHandle.docSync());
-          const otherObjects = objects.filter(([key]) => key !== properties?.[0]);
-          invariant13(properties, "Properties not found", {
-            F: __dxlog_file15,
-            L: 479,
-            S: this,
-            A: [
-              "properties",
-              "'Properties not found'"
-            ]
-          });
-          const newSpaceDoc = {
-            ...rootHandle.docSync(),
-            objects: Object.fromEntries([
-              properties
-            ])
-          };
-          const newRoot = this._echoHost.automergeRepo.create(newSpaceDoc);
-          invariant13(typeof newRoot.url === "string" && newRoot.url.length > 0, void 0, {
-            F: __dxlog_file15,
-            L: 484,
-            S: this,
-            A: [
-              "typeof newRoot.url === 'string' && newRoot.url.length > 0",
-              ""
-            ]
-          });
-          const docLoader = new AutomergeDocumentLoaderImpl(await createIdFromSpaceKey(this.key), this._echoHost.automergeRepo, this.key);
-          await docLoader.loadSpaceRootDocHandle(this._ctx, {
-            rootUrl: newRoot.url
-          });
-          otherObjects.forEach(([key, value]) => {
-            const handle = docLoader.createDocumentForObject(key);
-            handle.change((doc) => {
-              assignDeep(doc, [
-                "objects",
-                key
-              ], value);
-            });
-          });
-          epoch = {
-            previousId: this._automergeSpaceState.lastEpoch?.id,
-            number: (this._automergeSpaceState.lastEpoch?.subject.assertion.number ?? -1) + 1,
-            timeframe: this._automergeSpaceState.lastEpoch?.subject.assertion.timeframe ?? new Timeframe2(),
-            automergeRoot: newRoot.url
-          };
-        }
-        break;
-      case CreateEpochRequest.Migration.REPLACE_AUTOMERGE_ROOT:
-        {
-          invariant13(options.newAutomergeRoot, void 0, {
-            F: __dxlog_file15,
-            L: 514,
-            S: this,
-            A: [
-              "options.newAutomergeRoot",
-              ""
-            ]
-          });
-          epoch = {
-            previousId: this._automergeSpaceState.lastEpoch?.id,
-            number: (this._automergeSpaceState.lastEpoch?.subject.assertion.number ?? -1) + 1,
-            timeframe: this._automergeSpaceState.lastEpoch?.subject.assertion.timeframe ?? new Timeframe2(),
-            automergeRoot: options.newAutomergeRoot
-          };
-        }
-        break;
-    }
-    if (!epoch) {
-      return;
+    const ctx = this._ctx.derive();
+    if (!options?.migration) {
+      return null;
     }
+    const { newRoot } = await runEpochMigration(ctx, {
+      repo: this._echoHost.automergeRepo,
+      spaceId: this.id,
+      spaceKey: this.key,
+      migration: options.migration,
+      currentRoot: this._automergeSpaceState.rootUrl ?? null,
+      newAutomergeRoot: options.newAutomergeRoot
+    });
+    const epoch = {
+      previousId: this._automergeSpaceState.lastEpoch?.id,
+      number: (this._automergeSpaceState.lastEpoch?.subject.assertion.number ?? -1) + 1,
+      timeframe: this._automergeSpaceState.lastEpoch?.subject.assertion.timeframe ?? new Timeframe3(),
+      automergeRoot: newRoot ?? this._automergeSpaceState.rootUrl
+    };
+    const credential = await this._signingContext.credentialSigner.createCredential({
+      subject: this.key,
+      assertion: {
+        "@type": "dxos.halo.credentials.Epoch",
+        ...epoch
+      }
+    });
     const receipt = await this.inner.controlPipeline.writer.write({
       credential: {
-        credential: await this._signingContext.credentialSigner.createCredential({
-          subject: this.key,
-          assertion: {
-            "@type": "dxos.halo.credentials.Epoch",
-            ...epoch
-          }
-        })
+        credential
       }
     });
-    await this.inner.controlPipeline.state.waitUntilTimeframe(new Timeframe2([
+    await this.inner.controlPipeline.state.waitUntilTimeframe(new Timeframe3([
       [
         receipt.feedKey,
         receipt.seq
       ]
     ]));
     await this._echoHost.updateIndexes();
+    return credential;
   }
   async activate() {
-    if (this._state !== SpaceState.INACTIVE) {
+    if (![
+      SpaceState2.CLOSED,
+      SpaceState2.INACTIVE
+    ].includes(this._state)) {
       return;
     }
-    await this._metadataStore.setSpaceState(this.key, SpaceState.ACTIVE);
+    await this._metadataStore.setSpaceState(this.key, SpaceState2.ACTIVE);
     await this._open();
     this.initializeDataPipelineAsync();
   }
   async deactivate() {
-    if (this._state === SpaceState.INACTIVE) {
+    if (this._state === SpaceState2.INACTIVE) {
       return;
     }
-    await this._metadataStore.setSpaceState(this.key, SpaceState.INACTIVE);
-    await this._close();
-    this._state = SpaceState.INACTIVE;
-    log12("new state", {
-      state: SpaceState[this._state]
+    await this._metadataStore.setSpaceState(this.key, SpaceState2.INACTIVE);
+    if (this._state !== SpaceState2.CLOSED) {
+      await this._close();
+    }
+    this._state = SpaceState2.INACTIVE;
+    log15("new state", {
+      state: SpaceState2[this._state]
     }, {
-      F: __dxlog_file15,
-      L: 567,
+      F: __dxlog_file18,
+      L: 512,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4425,7 +4716,7 @@ _ts_decorate4([
 ], DataSpace.prototype, "key", null);
 _ts_decorate4([
   trace6.info({
-    enum: SpaceState
+    enum: SpaceState2
   })
 ], DataSpace.prototype, "state", null);
 _ts_decorate4([
@@ -4462,39 +4753,33 @@ DataSpace = _ts_decorate4([
   trackLeaks("open", "close"),
   trace6.resource()
 ], DataSpace);
-var findPropertiesObject = (spaceDoc) => {
-  for (const id in spaceDoc.objects ?? {}) {
-    const obj = spaceDoc.objects[id];
-    if (obj.system.type?.itemId === TYPE_PROPERTIES) {
-      return [
-        id,
-        obj
-      ];
-    }
-  }
-  return void 0;
-};
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
 import { Event as Event7, synchronized as synchronized2, trackLeaks as trackLeaks2 } from "@dxos/async";
-import { cancelWithContext as cancelWithContext5, Context as Context9 } from "@dxos/context";
-import { getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
+import { PropertiesType } from "@dxos/client-protocol";
+import { Context as Context9, cancelWithContext as cancelWithContext6 } from "@dxos/context";
+import { getCredentialAssertion as getCredentialAssertion3, createAdmissionCredentials } from "@dxos/credentials";
+import { convertLegacyReferences as convertLegacyReferences2, findInlineObjectOfType as findInlineObjectOfType2 } from "@dxos/echo-db";
 import { AuthStatus } from "@dxos/echo-pipeline";
+import { CredentialServerExtension } from "@dxos/echo-pipeline";
+import { LEGACY_TYPE_PROPERTIES, SpaceDocVersion as SpaceDocVersion2, encodeReference } from "@dxos/echo-protocol";
+import { TYPE_PROPERTIES as TYPE_PROPERTIES2, generateEchoId, getTypeReference } from "@dxos/echo-schema";
+import { writeMessages as writeMessages3 } from "@dxos/feed-store";
 import { invariant as invariant14 } from "@dxos/invariant";
 import { PublicKey as PublicKey11 } from "@dxos/keys";
-import { log as log13 } from "@dxos/log";
-import { trace as Trace2 } from "@dxos/protocols";
-import { Invitation as Invitation7, SpaceState as SpaceState2 } from "@dxos/protocols/proto/dxos/client/services";
+import { log as log16 } from "@dxos/log";
+import { trace as Trace2, AlreadyJoinedError as AlreadyJoinedError3 } from "@dxos/protocols";
+import { Invitation as Invitation7, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
 import { SpaceMember as SpaceMember6 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Gossip as Gossip2, Presence as Presence2 } from "@dxos/teleport-extension-gossip";
 import { trace as trace7 } from "@dxos/tracing";
-import { ComplexMap as ComplexMap3, deferFunction as deferFunction2, forEachAsync } from "@dxos/util";
+import { ComplexMap as ComplexMap3, assignDeep as assignDeep2, deferFunction as deferFunction2, forEachAsync } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/genesis.ts
 import { createCredential } from "@dxos/credentials";
 import { failUndefined } from "@dxos/debug";
 import { AdmittedFeed as AdmittedFeed4, SpaceMember as SpaceMember5 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { Timeframe as Timeframe3 } from "@dxos/timeframe";
+import { Timeframe as Timeframe4 } from "@dxos/timeframe";
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
     await createCredential({
@@ -4544,7 +4829,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         "@type": "dxos.halo.credentials.Epoch",
         number: 0,
         previousId: void 0,
-        timeframe: new Timeframe3(),
+        timeframe: new Timeframe4(),
         snapshotCid: void 0,
         automergeRoot
       }
@@ -4571,11 +4856,12 @@ function _ts_decorate5(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file16 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
+var __dxlog_file19 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts";
 var PRESENCE_ANNOUNCE_INTERVAL = 1e4;
 var PRESENCE_OFFLINE_TIMEOUT = 2e4;
+var DEFAULT_SPACE_KEY = "__DEFAULT__";
 var DataSpaceManager = class {
-  constructor(_spaceManager, _metadataStore, _keyring, _signingContext, _feedStore, _echoHost, _invitationsManager, params) {
+  constructor(_spaceManager, _metadataStore, _keyring, _signingContext, _feedStore, _echoHost, _invitationsManager, _params) {
     this._spaceManager = _spaceManager;
     this._metadataStore = _metadataStore;
     this._keyring = _keyring;
@@ -4583,14 +4869,15 @@ var DataSpaceManager = class {
     this._feedStore = _feedStore;
     this._echoHost = _echoHost;
     this._invitationsManager = _invitationsManager;
-    this._ctx = new Context9();
+    this._params = _params;
+    this._ctx = new Context9(void 0, {
+      F: __dxlog_file19,
+      L: 104
+    });
     this.updated = new Event7();
     this._spaces = new ComplexMap3(PublicKey11.hash);
     this._isOpen = false;
     this._instanceId = PublicKey11.random().toHex();
-    const { spaceMemberPresenceAnnounceInterval = PRESENCE_ANNOUNCE_INTERVAL, spaceMemberPresenceOfflineTimeout = PRESENCE_OFFLINE_TIMEOUT } = params ?? {};
-    this._spaceMemberPresenceAnnounceInterval = spaceMemberPresenceAnnounceInterval;
-    this._spaceMemberPresenceOfflineTimeout = spaceMemberPresenceOfflineTimeout;
     trace7.diagnostic({
       id: "spaces",
       name: "Spaces",
@@ -4599,10 +4886,10 @@ var DataSpaceManager = class {
           const rootUrl = space.automergeSpaceState.rootUrl;
           const rootHandle = rootUrl ? this._echoHost.automergeRepo.find(rootUrl) : void 0;
           const rootDoc = rootHandle?.docSync();
-          const properties = rootDoc && findPropertiesObject(rootDoc);
+          const properties = rootDoc && findInlineObjectOfType2(rootDoc, TYPE_PROPERTIES2);
           return {
             key: space.key.toHex(),
-            state: SpaceState2[space.state],
+            state: SpaceState3[space.state],
             name: properties?.[1].data.name ?? null,
             inlineObjects: rootDoc ? Object.keys(rootDoc.objects ?? {}).length : null,
             linkedObjects: rootDoc ? Object.keys(rootDoc.links ?? {}).length : null,
@@ -4619,46 +4906,46 @@ var DataSpaceManager = class {
     return this._spaces;
   }
   async open() {
-    log13("open", void 0, {
-      F: __dxlog_file16,
-      L: 144,
+    log16("open", void 0, {
+      F: __dxlog_file19,
+      L: 156,
       S: this,
       C: (f, a) => f(...a)
     });
-    log13.trace("dxos.echo.data-space-manager.open", Trace2.begin({
+    log16.trace("dxos.echo.data-space-manager.open", Trace2.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file16,
-      L: 145,
+      F: __dxlog_file19,
+      L: 157,
       S: this,
       C: (f, a) => f(...a)
     });
-    log13("metadata loaded", {
+    log16("metadata loaded", {
       spaces: this._metadataStore.spaces.length
     }, {
-      F: __dxlog_file16,
-      L: 146,
+      F: __dxlog_file19,
+      L: 158,
       S: this,
       C: (f, a) => f(...a)
     });
     await forEachAsync(this._metadataStore.spaces, async (spaceMetadata) => {
       try {
-        log13("load space", {
+        log16("load space", {
           spaceMetadata
         }, {
-          F: __dxlog_file16,
-          L: 150,
+          F: __dxlog_file19,
+          L: 162,
           S: this,
           C: (f, a) => f(...a)
         });
         await this._constructSpace(spaceMetadata);
       } catch (err) {
-        log13.error("Error loading space", {
+        log16.error("Error loading space", {
           spaceMetadata,
           err
         }, {
-          F: __dxlog_file16,
-          L: 153,
+          F: __dxlog_file19,
+          L: 165,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4666,24 +4953,19 @@ var DataSpaceManager = class {
     });
     this._isOpen = true;
     this.updated.emit();
-    for (const space of this._spaces.values()) {
-      if (space.state !== SpaceState2.INACTIVE) {
-        space.initializeDataPipelineAsync();
-      }
-    }
-    log13.trace("dxos.echo.data-space-manager.open", Trace2.end({
+    log16.trace("dxos.echo.data-space-manager.open", Trace2.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file16,
-      L: 166,
+      F: __dxlog_file19,
+      L: 172,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async close() {
-    log13("close", void 0, {
-      F: __dxlog_file16,
-      L: 171,
+    log16("close", void 0, {
+      F: __dxlog_file19,
+      L: 177,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4692,14 +4974,15 @@ var DataSpaceManager = class {
     for (const space of this._spaces.values()) {
       await space.close();
     }
+    this._spaces.clear();
   }
   /**
   * Creates a new space writing the genesis credentials to the control feed.
   */
   async createSpace() {
     invariant14(this._isOpen, "Not open.", {
-      F: __dxlog_file16,
-      L: 184,
+      F: __dxlog_file19,
+      L: 191,
       S: this,
       A: [
         "this._isOpen",
@@ -4714,48 +4997,115 @@ var DataSpaceManager = class {
       genesisFeedKey: controlFeedKey,
       controlFeedKey,
       dataFeedKey,
-      state: SpaceState2.ACTIVE
+      state: SpaceState3.ACTIVE
+    };
+    log16("creating space...", {
+      spaceKey
+    }, {
+      F: __dxlog_file19,
+      L: 203,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const root = await this._echoHost.createSpaceRoot(spaceKey);
+    const space = await this._constructSpace(metadata);
+    await space.open();
+    const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, root.url);
+    await this._metadataStore.addSpace(metadata);
+    const memberCredential = credentials[1];
+    invariant14(getCredentialAssertion3(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file19,
+      L: 213,
+      S: this,
+      A: [
+        "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
+        ""
+      ]
+    });
+    await this._signingContext.recordCredential(memberCredential);
+    await space.initializeDataPipeline();
+    this.updated.emit();
+    return space;
+  }
+  async isDefaultSpace(space) {
+    if (!space.databaseRoot) {
+      return false;
+    }
+    switch (space.databaseRoot.getVersion()) {
+      case SpaceDocVersion2.CURRENT: {
+        const [_, properties] = findInlineObjectOfType2(space.databaseRoot.docSync(), TYPE_PROPERTIES2) ?? [];
+        return properties?.data?.[DEFAULT_SPACE_KEY] === this._signingContext.identityKey.toHex();
+      }
+      case SpaceDocVersion2.LEGACY: {
+        const convertedDoc = await convertLegacyReferences2(space.databaseRoot.docSync());
+        const [_, properties] = findInlineObjectOfType2(convertedDoc, LEGACY_TYPE_PROPERTIES) ?? [];
+        return properties?.data?.[DEFAULT_SPACE_KEY] === this._signingContext.identityKey.toHex();
+      }
+      default:
+        log16.warn("unknown space version", {
+          version: space.databaseRoot.getVersion(),
+          spaceId: space.id
+        }, {
+          F: __dxlog_file19,
+          L: 238,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        return false;
+    }
+  }
+  async createDefaultSpace() {
+    const space = await this.createSpace();
+    const document = await this._getSpaceRootDocument(space);
+    const properties = {
+      system: {
+        type: encodeReference(getTypeReference(PropertiesType))
+      },
+      data: {
+        [DEFAULT_SPACE_KEY]: this._signingContext.identityKey.toHex()
+      },
+      meta: {
+        keys: []
+      }
     };
-    log13("creating space...", {
-      spaceKey
-    }, {
-      F: __dxlog_file16,
-      L: 196,
-      S: this,
-      C: (f, a) => f(...a)
+    const propertiesId = generateEchoId();
+    document.change((doc) => {
+      assignDeep2(doc, [
+        "objects",
+        propertiesId
+      ], properties);
     });
-    const root = await this._echoHost.createSpaceRoot(spaceKey);
-    const space = await this._constructSpace(metadata);
-    const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, root.url);
-    await this._metadataStore.addSpace(metadata);
-    const memberCredential = credentials[1];
-    invariant14(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file16,
-      L: 205,
+    await this._echoHost.flush();
+    return space;
+  }
+  async _getSpaceRootDocument(space) {
+    const automergeIndex = space.automergeSpaceState.rootUrl;
+    invariant14(automergeIndex, void 0, {
+      F: __dxlog_file19,
+      L: 271,
       S: this,
       A: [
-        "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
+        "automergeIndex",
         ""
       ]
     });
-    await this._signingContext.recordCredential(memberCredential);
-    await space.initializeDataPipeline();
-    this.updated.emit();
-    return space;
+    const document = this._echoHost.automergeRepo.find(automergeIndex);
+    await document.whenReady();
+    return document;
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
-    log13("accept space", {
+    log16("accept space", {
       opts
     }, {
-      F: __dxlog_file16,
-      L: 217,
+      F: __dxlog_file19,
+      L: 280,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant14(this._isOpen, "Not open.", {
-      F: __dxlog_file16,
-      L: 218,
+      F: __dxlog_file19,
+      L: 281,
       S: this,
       A: [
         "this._isOpen",
@@ -4763,8 +5113,8 @@ var DataSpaceManager = class {
       ]
     });
     invariant14(!this._spaces.has(opts.spaceKey), "Space already exists.", {
-      F: __dxlog_file16,
-      L: 219,
+      F: __dxlog_file19,
+      L: 282,
       S: this,
       A: [
         "!this._spaces.has(opts.spaceKey)",
@@ -4778,28 +5128,78 @@ var DataSpaceManager = class {
       dataTimeframe: opts.dataTimeframe
     };
     const space = await this._constructSpace(metadata);
+    await space.open();
     await this._metadataStore.addSpace(metadata);
     space.initializeDataPipelineAsync();
     this.updated.emit();
     return space;
   }
+  async admitMember(options) {
+    const space = this._spaceManager.spaces.get(options.spaceKey);
+    invariant14(space, void 0, {
+      F: __dxlog_file19,
+      L: 302,
+      S: this,
+      A: [
+        "space",
+        ""
+      ]
+    });
+    if (space.spaceState.getMemberRole(options.identityKey) !== SpaceMember6.Role.REMOVED) {
+      throw new AlreadyJoinedError3();
+    }
+    const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, options.identityKey, space.key, space.genesisFeedKey, options.role, space.spaceState.membershipChainHeads, options.profile, options.delegationCredentialId);
+    invariant14(credentials[0].credential, void 0, {
+      F: __dxlog_file19,
+      L: 321,
+      S: this,
+      A: [
+        "credentials[0].credential",
+        ""
+      ]
+    });
+    const spaceMemberCredential = credentials[0].credential.credential;
+    invariant14(getCredentialAssertion3(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file19,
+      L: 323,
+      S: this,
+      A: [
+        "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
+        ""
+      ]
+    });
+    await writeMessages3(space.controlPipeline.writer, credentials);
+    return spaceMemberCredential;
+  }
   /**
   * Wait until the space data pipeline is fully initialized.
   * Used by invitation handler.
   * TODO(dmaretskyi): Consider removing.
   */
   async waitUntilSpaceReady(spaceKey) {
-    await cancelWithContext5(this._ctx, this.updated.waitForCondition(() => {
+    await cancelWithContext6(this._ctx, this.updated.waitForCondition(() => {
       const space = this._spaces.get(spaceKey);
-      return !!space && space.state === SpaceState2.READY;
+      return !!space && space.state === SpaceState3.READY;
     }));
   }
+  async requestSpaceAdmissionCredential(spaceKey) {
+    return this._spaceManager.requestSpaceAdmissionCredential({
+      spaceKey,
+      identityKey: this._signingContext.identityKey,
+      timeout: 15e3,
+      swarmIdentity: {
+        peerKey: this._signingContext.deviceKey,
+        credentialProvider: createAuthProvider(this._signingContext.credentialSigner),
+        credentialAuthenticator: async () => true
+      }
+    });
+  }
   async _constructSpace(metadata) {
-    log13("construct space", {
+    log16("construct space", {
       metadata
     }, {
-      F: __dxlog_file16,
-      L: 252,
+      F: __dxlog_file19,
+      L: 358,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4807,8 +5207,8 @@ var DataSpaceManager = class {
       localPeerId: this._signingContext.deviceKey
     });
     const presence = new Presence2({
-      announceInterval: this._spaceMemberPresenceAnnounceInterval,
-      offlineTimeout: this._spaceMemberPresenceOfflineTimeout,
+      announceInterval: this._params?.spaceMemberPresenceAnnounceInterval ?? PRESENCE_ANNOUNCE_INTERVAL,
+      offlineTimeout: this._params?.spaceMemberPresenceOfflineTimeout ?? PRESENCE_OFFLINE_TIMEOUT,
       identityKey: this._signingContext.identityKey,
       gossip
     });
@@ -4827,6 +5227,7 @@ var DataSpaceManager = class {
         credentialAuthenticator: deferFunction2(() => dataSpace.authVerifier.verifier)
       },
       onAuthorizedConnection: (session) => {
+        session.addExtension("dxos.mesh.teleport.admission-discovery", new CredentialServerExtension(space));
         session.addExtension("dxos.mesh.teleport.gossip", gossip.createExtension({
           remotePeerId: session.remotePeerId
         }));
@@ -4835,15 +5236,15 @@ var DataSpaceManager = class {
         session.addExtension("dxos.mesh.teleport.automerge", this._echoHost.createReplicationExtension());
       },
       onAuthFailure: () => {
-        log13.warn("auth failure", void 0, {
-          F: __dxlog_file16,
-          L: 289,
+        log16.warn("auth failure", void 0, {
+          F: __dxlog_file19,
+          L: 396,
           S: this,
           C: (f, a) => f(...a)
         });
       },
       onMemberRolesChanged: async (members) => {
-        if (dataSpace?.state === SpaceState2.READY) {
+        if (dataSpace?.state === SpaceState3.READY) {
           this._handleMemberRoleChanges(presence, space.protocol, members);
         }
       },
@@ -4856,7 +5257,7 @@ var DataSpaceManager = class {
     dataFeed && await space.setDataFeed(dataFeed);
     const dataSpace = new DataSpace({
       inner: space,
-      initialState: metadata.state === SpaceState2.INACTIVE ? SpaceState2.INACTIVE : SpaceState2.CLOSED,
+      initialState: metadata.state === SpaceState3.INACTIVE ? SpaceState3.INACTIVE : SpaceState3.CLOSED,
       metadataStore: this._metadataStore,
       gossip,
       presence,
@@ -4866,22 +5267,22 @@ var DataSpaceManager = class {
       signingContext: this._signingContext,
       callbacks: {
         beforeReady: async () => {
-          log13("before space ready", {
+          log16("before space ready", {
             space: space.key
           }, {
-            F: __dxlog_file16,
-            L: 316,
+            F: __dxlog_file19,
+            L: 423,
             S: this,
             C: (f, a) => f(...a)
           });
         },
         afterReady: async () => {
-          log13("after space ready", {
+          log16("after space ready", {
             space: space.key,
             open: this._isOpen
           }, {
-            F: __dxlog_file16,
-            L: 319,
+            F: __dxlog_file19,
+            L: 426,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4896,11 +5297,11 @@ var DataSpaceManager = class {
           }
         },
         beforeClose: async () => {
-          log13("before space close", {
+          log16("before space close", {
             space: space.key
           }, {
-            F: __dxlog_file16,
-            L: 327,
+            F: __dxlog_file19,
+            L: 434,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4909,13 +5310,10 @@ var DataSpaceManager = class {
       cache: metadata.cache
     });
     presence.newPeer.on((peerState) => {
-      if (dataSpace.state === SpaceState2.READY) {
+      if (dataSpace.state === SpaceState3.READY) {
         this._handleNewPeerConnected(space, peerState);
       }
     });
-    if (metadata.state !== SpaceState2.INACTIVE) {
-      await dataSpace.open();
-    }
     if (metadata.controlTimeframe) {
       dataSpace.inner.controlPipeline.state.setTargetTimeframe(metadata.controlTimeframe);
     }
@@ -4934,17 +5332,17 @@ var DataSpaceManager = class {
         return (s && member.role === SpaceMember6.Role.REMOVED !== (s.authStatus === AuthStatus.FAILURE)) ?? false;
       });
       sessionsToClose.forEach((session) => {
-        void session.close().catch(log13.error);
+        void session.close().catch(log16.error);
       });
       closedSessions += sessionsToClose.length;
     }
-    log13("processed member role changes", {
+    log16("processed member role changes", {
       roleChangeCount: memberInfo.length,
       peersOnline: presence.getPeersOnline().length,
       closedSessions
     }, {
-      F: __dxlog_file16,
-      L: 367,
+      F: __dxlog_file19,
+      L: 470,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4955,20 +5353,20 @@ var DataSpaceManager = class {
     if (role === SpaceMember6.Role.REMOVED) {
       const session = peerState.peerId && space.protocol.sessions.get(peerState.peerId);
       if (session != null) {
-        log13("closing a session with a removed peer", {
+        log16("closing a session with a removed peer", {
           peerId: peerState.peerId
         }, {
-          F: __dxlog_file16,
-          L: 381,
+          F: __dxlog_file19,
+          L: 484,
           S: this,
           C: (f, a) => f(...a)
         });
-        void session.close().catch(log13.error);
+        void session.close().catch(log16.error);
       }
     }
   }
   async _handleInvitationStatusChange(dataSpace, delegatedInvitation, isActive) {
-    if (dataSpace?.state !== SpaceState2.READY) {
+    if (dataSpace?.state !== SpaceState3.READY) {
       return;
     }
     if (isActive) {
@@ -5022,15 +5420,15 @@ DataSpaceManager = _ts_decorate5([
 // packages/sdk/client-services/src/packlets/spaces/spaces-service.ts
 import { EventSubscriptions as EventSubscriptions2, UpdateScheduler, scheduleTask as scheduleTask6 } from "@dxos/async";
 import { Stream as Stream10 } from "@dxos/codec-protobuf";
-import { createAdmissionCredentials as createAdmissionCredentials2, getCredentialAssertion as getCredentialAssertion3 } from "@dxos/credentials";
+import { createAdmissionCredentials as createAdmissionCredentials2, getCredentialAssertion as getCredentialAssertion4 } from "@dxos/credentials";
 import { raise as raise2 } from "@dxos/debug";
-import { writeMessages as writeMessages3 } from "@dxos/feed-store";
+import { writeMessages as writeMessages4 } from "@dxos/feed-store";
 import { invariant as invariant15 } from "@dxos/invariant";
-import { log as log14 } from "@dxos/log";
+import { log as log17 } from "@dxos/log";
 import { ApiError, SpaceNotFoundError as SpaceNotFoundError2, encodeError, IdentityNotInitializedError, AuthorizationError as AuthorizationError2 } from "@dxos/protocols";
-import { SpaceMember as SpaceMember7, SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/services";
+import { SpaceMember as SpaceMember7, SpaceState as SpaceState4 } from "@dxos/protocols/proto/dxos/client/services";
 import { trace as trace8 } from "@dxos/tracing";
-var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
+var __dxlog_file20 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
 var SpacesServiceImpl = class {
   constructor(_identityManager, _spaceManager, _getDataSpaceManager) {
     this._identityManager = _identityManager;
@@ -5049,10 +5447,10 @@ var SpacesServiceImpl = class {
     const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
     if (state) {
       switch (state) {
-        case SpaceState3.ACTIVE:
+        case SpaceState4.ACTIVE:
           await space.activate();
           break;
-        case SpaceState3.INACTIVE:
+        case SpaceState4.INACTIVE:
           await space.deactivate();
           break;
         default:
@@ -5074,8 +5472,8 @@ var SpacesServiceImpl = class {
     }
     const credentials = await createAdmissionCredentials2(identity.getIdentityCredentialSigner(), request.memberKey, space.key, space.genesisFeedKey, request.newRole, space.spaceState.membershipChainHeads);
     invariant15(credentials[0].credential, void 0, {
-      F: __dxlog_file17,
-      L: 97,
+      F: __dxlog_file20,
+      L: 102,
       S: this,
       A: [
         "credentials[0].credential",
@@ -5083,27 +5481,27 @@ var SpacesServiceImpl = class {
       ]
     });
     const spaceMemberCredential = credentials[0].credential.credential;
-    invariant15(getCredentialAssertion3(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
-      F: __dxlog_file17,
-      L: 99,
+    invariant15(getCredentialAssertion4(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+      F: __dxlog_file20,
+      L: 104,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
         ""
       ]
     });
-    await writeMessages3(space.controlPipeline.writer, credentials);
+    await writeMessages4(space.controlPipeline.writer, credentials);
   }
   querySpaces() {
     return new Stream10(({ next, ctx }) => {
       const scheduler = new UpdateScheduler(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
         const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space));
-        log14("update", {
+        log17("update", {
           spaces
         }, {
-          F: __dxlog_file17,
-          L: 110,
+          F: __dxlog_file20,
+          L: 115,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -5121,7 +5519,15 @@ var SpacesServiceImpl = class {
         const subscribeSpaces = () => {
           subscriptions.clear();
           for (const space of dataSpaceManager.spaces.values()) {
-            subscriptions.add(space.stateUpdate.on(ctx, () => scheduler.forceTrigger()));
+            let lastState;
+            subscriptions.add(space.stateUpdate.on(ctx, () => {
+              if (space.state !== lastState) {
+                scheduler.forceTrigger();
+              } else {
+                scheduler.trigger();
+              }
+              lastState = space.state;
+            }));
             subscriptions.add(space.presence.updated.on(ctx, () => scheduler.trigger()));
             subscriptions.add(space.automergeSpaceState.onNewEpoch.on(ctx, () => scheduler.trigger()));
             subscriptions.add(space.inner.controlPipeline.state.timeframeUpdate.on(ctx, () => scheduler.trigger()));
@@ -5186,8 +5592,8 @@ var SpacesServiceImpl = class {
         });
       } else {
         invariant15(!credential.id, "Id on unsigned credentials is not allowed", {
-          F: __dxlog_file17,
-          L: 198,
+          F: __dxlog_file20,
+          L: 213,
           S: this,
           A: [
             "!credential.id",
@@ -5195,8 +5601,8 @@ var SpacesServiceImpl = class {
           ]
         });
         invariant15(this._identityManager.identity, "Identity is not available", {
-          F: __dxlog_file17,
-          L: 199,
+          F: __dxlog_file20,
+          L: 214,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -5205,8 +5611,8 @@ var SpacesServiceImpl = class {
         });
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
         invariant15(credential.issuer.equals(signer.getIssuer()), void 0, {
-          F: __dxlog_file17,
-          L: 201,
+          F: __dxlog_file20,
+          L: 216,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -5228,10 +5634,66 @@ var SpacesServiceImpl = class {
   async createEpoch({ spaceKey, migration, automergeRootUrl }) {
     const dataSpaceManager = await this._getDataSpaceManager();
     const space = dataSpaceManager.spaces.get(spaceKey) ?? raise2(new SpaceNotFoundError2(spaceKey));
-    await space.createEpoch({
+    const credential = await space.createEpoch({
       migration,
       newAutomergeRoot: automergeRootUrl
     });
+    return {
+      epochCredential: credential ?? void 0
+    };
+  }
+  async admitContact(request) {
+    const dataSpaceManager = await this._getDataSpaceManager();
+    await dataSpaceManager.admitMember({
+      spaceKey: request.spaceKey,
+      identityKey: request.contact.identityKey,
+      role: request.role
+    });
+  }
+  async joinBySpaceKey({ spaceKey }) {
+    const dataSpaceManager = await this._getDataSpaceManager();
+    const credential = await dataSpaceManager.requestSpaceAdmissionCredential(spaceKey);
+    return this._joinByAdmission({
+      credential
+    });
+  }
+  async _joinByAdmission({ credential }) {
+    const assertion = getCredentialAssertion4(credential);
+    invariant15(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
+      F: __dxlog_file20,
+      L: 250,
+      S: this,
+      A: [
+        "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
+        "'Invalid credential'"
+      ]
+    });
+    const myIdentity = this._identityManager.identity;
+    invariant15(myIdentity && credential.subject.id.equals(myIdentity.identityKey), void 0, {
+      F: __dxlog_file20,
+      L: 252,
+      S: this,
+      A: [
+        "myIdentity && credential.subject.id.equals(myIdentity.identityKey)",
+        ""
+      ]
+    });
+    const dataSpaceManager = await this._getDataSpaceManager();
+    let dataSpace = dataSpaceManager.spaces.get(assertion.spaceKey);
+    if (!dataSpace) {
+      dataSpace = await dataSpaceManager.acceptSpace({
+        spaceKey: assertion.spaceKey,
+        genesisFeedKey: assertion.genesisFeedKey
+      });
+      await myIdentity.controlPipeline.writer.write({
+        credential: {
+          credential
+        }
+      });
+    }
+    return {
+      space: this._serializeSpace(dataSpace)
+    };
   }
   _serializeSpace(space) {
     return {
@@ -5294,9 +5756,9 @@ var SpacesServiceImpl = class {
 var getChannelId = (channel) => `user-channel/${channel}`;
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-import { Trigger as Trigger7 } from "@dxos/async";
-import { Context as Context10, Resource } from "@dxos/context";
-import { getCredentialAssertion as getCredentialAssertion4 } from "@dxos/credentials";
+import { Trigger as Trigger8 } from "@dxos/async";
+import { Context as Context10, Resource as Resource3 } from "@dxos/context";
+import { getCredentialAssertion as getCredentialAssertion5 } from "@dxos/credentials";
 import { failUndefined as failUndefined2 } from "@dxos/debug";
 import { EchoHost } from "@dxos/echo-db";
 import { MetadataStore, SnapshotStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
@@ -5304,7 +5766,7 @@ import { FeedFactory, FeedStore } from "@dxos/feed-store";
 import { invariant as invariant16 } from "@dxos/invariant";
 import { Keyring } from "@dxos/keyring";
 import { PublicKey as PublicKey12 } from "@dxos/keys";
-import { log as log15 } from "@dxos/log";
+import { log as log18 } from "@dxos/log";
 import { InvalidStorageVersionError, STORAGE_VERSION as STORAGE_VERSION2, trace as trace9 } from "@dxos/protocols";
 import { Invitation as Invitation8 } from "@dxos/protocols/proto/dxos/client/services";
 import { BlobStore } from "@dxos/teleport-extension-object-sync";
@@ -5320,8 +5782,8 @@ function _ts_decorate6(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
-var ServiceContext = class extends Resource {
+var __dxlog_file21 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
+var ServiceContext = class extends Resource3 {
   constructor(storage, level, networkManager, signalManager, _runtimeParams) {
     super();
     this.storage = storage;
@@ -5329,7 +5791,7 @@ var ServiceContext = class extends Resource {
     this.networkManager = networkManager;
     this.signalManager = signalManager;
     this._runtimeParams = _runtimeParams;
-    this.initialized = new Trigger7();
+    this.initialized = new Trigger8();
     this._handlerFactories = /* @__PURE__ */ new Map();
     this._instanceId = PublicKey12.random().toHex();
     this.metadataStore = new MetadataStore(storage.createDirectory("metadata"));
@@ -5355,8 +5817,7 @@ var ServiceContext = class extends Resource {
     });
     this.identityManager = new IdentityManager(this.metadataStore, this.keyring, this.feedStore, this.spaceManager, this._runtimeParams);
     this.echoHost = new EchoHost({
-      kv: this.level,
-      storage: this.storage
+      kv: this.level
     });
     this.invitations = new InvitationsHandler(this.networkManager, _runtimeParams?.invitationConnectionDefaultParams);
     this.invitationsManager = new InvitationsManager(this.invitations, (invitation) => this.getInvitationHandler(invitation), this.metadataStore);
@@ -5364,17 +5825,17 @@ var ServiceContext = class extends Resource {
   }
   async _open(ctx) {
     await this._checkStorageVersion();
-    log15("opening...", void 0, {
-      F: __dxlog_file18,
-      L: 152,
+    log18("opening...", void 0, {
+      F: __dxlog_file21,
+      L: 149,
       S: this,
       C: (f, a) => f(...a)
     });
-    log15.trace("dxos.sdk.service-context.open", trace9.begin({
+    log18.trace("dxos.sdk.service-context.open", trace9.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file18,
-      L: 153,
+      F: __dxlog_file21,
+      L: 150,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5388,33 +5849,33 @@ var ServiceContext = class extends Resource {
       await this._initialize(ctx);
     }
     const loadedInvitations = await this.invitationsManager.loadPersistentInvitations();
-    log15("loaded persistent invitations", {
+    log18("loaded persistent invitations", {
       count: loadedInvitations.invitations?.length
     }, {
-      F: __dxlog_file18,
-      L: 166,
+      F: __dxlog_file21,
+      L: 163,
       S: this,
       C: (f, a) => f(...a)
     });
-    log15.trace("dxos.sdk.service-context.open", trace9.end({
+    log18.trace("dxos.sdk.service-context.open", trace9.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file18,
-      L: 168,
+      F: __dxlog_file21,
+      L: 165,
       S: this,
       C: (f, a) => f(...a)
     });
-    log15("opened", void 0, {
-      F: __dxlog_file18,
-      L: 169,
+    log18("opened", void 0, {
+      F: __dxlog_file21,
+      L: 166,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async _close(ctx) {
-    log15("closing...", void 0, {
-      F: __dxlog_file18,
-      L: 173,
+    log18("closing...", void 0, {
+      F: __dxlog_file21,
+      L: 170,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5429,23 +5890,26 @@ var ServiceContext = class extends Resource {
     await this.echoHost.close(ctx);
     await this.networkManager.close();
     await this.signalManager.close();
-    log15("closed", void 0, {
-      F: __dxlog_file18,
-      L: 185,
+    log18("closed", void 0, {
+      F: __dxlog_file21,
+      L: 182,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async createIdentity(params = {}) {
     const identity = await this.identityManager.createIdentity(params);
-    await this._initialize(new Context10());
+    await this._initialize(new Context10(void 0, {
+      F: __dxlog_file21,
+      L: 187
+    }));
     return identity;
   }
   getInvitationHandler(invitation) {
     const factory = this._handlerFactories.get(invitation.kind);
     invariant16(factory, `Unknown invitation kind: ${invitation.kind}`, {
-      F: __dxlog_file18,
-      L: 196,
+      F: __dxlog_file21,
+      L: 193,
       S: this,
       A: [
         "factory",
@@ -5464,7 +5928,10 @@ var ServiceContext = class extends Resource {
   }
   async _acceptIdentity(params) {
     const identity = await this.identityManager.acceptIdentity(params);
-    await this._initialize(new Context10());
+    await this._initialize(new Context10(void 0, {
+      F: __dxlog_file21,
+      L: 209
+    }));
     return identity;
   }
   async _checkStorageVersion() {
@@ -5475,9 +5942,9 @@ var ServiceContext = class extends Resource {
   }
   // Called when identity is created.
   async _initialize(ctx) {
-    log15("initializing spaces...", void 0, {
-      F: __dxlog_file18,
-      L: 227,
+    log18("initializing spaces...", void 0, {
+      F: __dxlog_file21,
+      L: 224,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5499,8 +5966,8 @@ var ServiceContext = class extends Resource {
     await this.dataSpaceManager.open();
     this._handlerFactories.set(Invitation8.Kind.SPACE, (invitation) => {
       invariant16(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
-        F: __dxlog_file18,
-        L: 252,
+        F: __dxlog_file21,
+        L: 249,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -5512,7 +5979,7 @@ var ServiceContext = class extends Resource {
     this.initialized.wake();
     this._deviceSpaceSync = {
       processCredential: async (credential) => {
-        const assertion = getCredentialAssertion4(credential);
+        const assertion = getCredentialAssertion5(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
         }
@@ -5520,33 +5987,33 @@ var ServiceContext = class extends Resource {
           return;
         }
         if (!this.dataSpaceManager) {
-          log15("dataSpaceManager not initialized yet, ignoring space admission", {
+          log18("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file18,
-            L: 268,
+            F: __dxlog_file21,
+            L: 265,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
         if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
-          log15("space already exists, ignoring space admission", {
+          log18("space already exists, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file18,
-            L: 272,
+            F: __dxlog_file21,
+            L: 269,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
         try {
-          log15("accepting space recorded in halo", {
+          log18("accepting space recorded in halo", {
             details: assertion
           }, {
-            F: __dxlog_file18,
-            L: 277,
+            F: __dxlog_file21,
+            L: 274,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -5555,9 +6022,9 @@ var ServiceContext = class extends Resource {
             genesisFeedKey: assertion.genesisFeedKey
           });
         } catch (err) {
-          log15.catch(err, void 0, {
-            F: __dxlog_file18,
-            L: 283,
+          log18.catch(err, void 0, {
+            F: __dxlog_file21,
+            L: 280,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -5603,9 +6070,9 @@ var ServiceRegistry = class {
 };
 
 // packages/sdk/client-services/src/packlets/locks/browser.ts
-import { asyncTimeout as asyncTimeout3, Trigger as Trigger8 } from "@dxos/async";
+import { asyncTimeout as asyncTimeout3, Trigger as Trigger9 } from "@dxos/async";
 import { RESOURCE_LOCK_TIMEOUT } from "@dxos/client-protocol";
-import { log as log16, logInfo } from "@dxos/log";
+import { log as log19, logInfo } from "@dxos/log";
 function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -5616,7 +6083,7 @@ function _ts_decorate7(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file19 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/browser.ts";
+var __dxlog_file22 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/browser.ts";
 var Message;
 (function(Message2) {
   Message2["ACQUIRING"] = "acquiring";
@@ -5624,7 +6091,7 @@ var Message;
 var Lock = class {
   constructor({ lockKey, onAcquire, onRelease }) {
     this._broadcastChannel = new BroadcastChannel("vault-resource-lock");
-    this._releaseTrigger = new Trigger8();
+    this._releaseTrigger = new Trigger9();
     this._lockKey = lockKey;
     this._onAcquire = onAcquire;
     this._onRelease = onRelease;
@@ -5638,29 +6105,29 @@ var Lock = class {
       message: "acquiring"
     });
     try {
-      log16("aquiring lock...", void 0, {
-        F: __dxlog_file19,
+      log19("aquiring lock...", void 0, {
+        F: __dxlog_file22,
         L: 42,
         S: this,
         C: (f, a) => f(...a)
       });
       await asyncTimeout3(this._requestLock(), RESOURCE_LOCK_TIMEOUT);
-      log16("acquired lock", void 0, {
-        F: __dxlog_file19,
+      log19("acquired lock", void 0, {
+        F: __dxlog_file22,
         L: 44,
         S: this,
         C: (f, a) => f(...a)
       });
     } catch {
-      log16("stealing lock...", void 0, {
-        F: __dxlog_file19,
+      log19("stealing lock...", void 0, {
+        F: __dxlog_file22,
         L: 46,
         S: this,
         C: (f, a) => f(...a)
       });
       await this._requestLock(true);
-      log16("stolen lock", void 0, {
-        F: __dxlog_file19,
+      log19("stolen lock", void 0, {
+        F: __dxlog_file22,
         L: 48,
         S: this,
         C: (f, a) => f(...a)
@@ -5676,31 +6143,31 @@ var Lock = class {
     }
   }
   async _requestLock(steal = false) {
-    log16("requesting lock...", {
+    log19("requesting lock...", {
       steal
     }, {
-      F: __dxlog_file19,
+      F: __dxlog_file22,
       L: 63,
       S: this,
       C: (f, a) => f(...a)
     });
-    const acquired = new Trigger8();
+    const acquired = new Trigger9();
     void navigator.locks.request(this._lockKey, {
       steal
     }, async () => {
       await this._onAcquire?.();
       acquired.wake();
-      this._releaseTrigger = new Trigger8();
+      this._releaseTrigger = new Trigger9();
       await this._releaseTrigger.wait();
-      log16("releasing lock...", void 0, {
-        F: __dxlog_file19,
+      log19("releasing lock...", void 0, {
+        F: __dxlog_file22,
         L: 72,
         S: this,
         C: (f, a) => f(...a)
       });
       await this._onRelease?.();
-      log16("released lock", void 0, {
-        F: __dxlog_file19,
+      log19("released lock", void 0, {
+        F: __dxlog_file22,
         L: 74,
         S: this,
         C: (f, a) => f(...a)
@@ -5709,10 +6176,10 @@ var Lock = class {
       await this._onRelease?.();
     });
     await acquired.wait();
-    log16("recieved lock", {
+    log19("recieved lock", {
       steal
     }, {
-      F: __dxlog_file19,
+      F: __dxlog_file22,
       L: 81,
       S: this,
       C: (f, a) => f(...a)
@@ -5802,19 +6269,16 @@ var createLevel = async (config) => {
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
 import { Event as Event9, synchronized as synchronized3 } from "@dxos/async";
-import { clientServiceBundle, defaultKey, PropertiesType } from "@dxos/client-protocol";
+import { clientServiceBundle } from "@dxos/client-protocol";
 import { Context as Context11 } from "@dxos/context";
-import { encodeReference } from "@dxos/echo-protocol";
-import { getTypeReference } from "@dxos/echo-schema";
 import { invariant as invariant18 } from "@dxos/invariant";
-import { PublicKey as PublicKey16 } from "@dxos/keys";
-import { log as log18 } from "@dxos/log";
+import { PublicKey as PublicKey17 } from "@dxos/keys";
+import { log as log21 } from "@dxos/log";
 import { WebsocketSignalManager } from "@dxos/messaging";
 import { SwarmNetworkManager, createSimplePeerTransportFactory } from "@dxos/network-manager";
 import { trace as trace10 } from "@dxos/protocols";
 import { SystemStatus } from "@dxos/protocols/proto/dxos/client/services";
 import { TRACE_PROCESSOR as TRACE_PROCESSOR3, trace as Trace4 } from "@dxos/tracing";
-import { assignDeep as assignDeep2 } from "@dxos/util";
 import { WebsocketRpcClient } from "@dxos/websocket-rpc";
 
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
@@ -5822,7 +6286,7 @@ import { EventSubscriptions as EventSubscriptions3 } from "@dxos/async";
 import { Stream as Stream11 } from "@dxos/codec-protobuf";
 import { invariant as invariant17 } from "@dxos/invariant";
 import { Device as Device2, DeviceKind as DeviceKind2 } from "@dxos/protocols/proto/dxos/client/services";
-var __dxlog_file20 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
+var __dxlog_file23 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
     this._identityManager = _identityManager;
@@ -5840,7 +6304,7 @@ var DevicesServiceImpl = class {
           });
         } else {
           invariant17(this._identityManager.identity?.presence, "presence not present", {
-            F: __dxlog_file20,
+            F: __dxlog_file23,
             L: 32,
             S: this,
             A: [
@@ -5946,28 +6410,111 @@ var findConfigs = () => {
   return configs.map((r) => r.instance.deref()).filter(nonNullable);
 };
 
-// packages/sdk/client-services/src/packlets/logging/logging-service.ts
-import { Event as Event8 } from "@dxos/async";
+// packages/sdk/client-services/src/packlets/identity/contacts-service.ts
+import { EventSubscriptions as EventSubscriptions4, scheduleTask as scheduleTask7, UpdateScheduler as UpdateScheduler2 } from "@dxos/async";
 import { Stream as Stream12 } from "@dxos/codec-protobuf";
 import { PublicKey as PublicKey15 } from "@dxos/keys";
-import { getContextFromEntry, log as log17 } from "@dxos/log";
+import { ComplexMap as ComplexMap4, ComplexSet as ComplexSet6 } from "@dxos/util";
+var ContactsServiceImpl = class {
+  constructor(_identityManager, _spaceManager, _dataSpaceManagerProvider) {
+    this._identityManager = _identityManager;
+    this._spaceManager = _spaceManager;
+    this._dataSpaceManagerProvider = _dataSpaceManagerProvider;
+  }
+  async getContacts() {
+    const identity = this._identityManager.identity;
+    if (identity == null) {
+      return {
+        contacts: []
+      };
+    }
+    const contacts = [
+      ...this._spaceManager.spaces.values()
+    ].flatMap((s) => [
+      ...s.spaceState.members.values()
+    ].map((m) => [
+      s.key,
+      m
+    ])).reduce((acc, v) => {
+      const [spaceKey, memberInfo] = v;
+      if (memberInfo.key.equals(identity.identityKey)) {
+        return acc;
+      }
+      const existing = acc.get(memberInfo.key);
+      if (existing != null) {
+        existing.profile ??= memberInfo.profile;
+        existing.commonSpaces?.push(spaceKey);
+      } else {
+        acc.set(memberInfo.key, {
+          identityKey: memberInfo.key,
+          profile: memberInfo.profile,
+          commonSpaces: [
+            spaceKey
+          ]
+        });
+      }
+      return acc;
+    }, new ComplexMap4(PublicKey15.hash));
+    return {
+      contacts: [
+        ...contacts.values()
+      ]
+    };
+  }
+  queryContacts() {
+    const subscribedSpaceKeySet = new ComplexSet6(PublicKey15.hash);
+    return new Stream12(({ next, ctx }) => {
+      const pushUpdateTask = new UpdateScheduler2(ctx, async () => {
+        const contacts = await this.getContacts();
+        next(contacts);
+      }, {
+        maxFrequency: 2
+      });
+      scheduleTask7(ctx, async () => {
+        const subscriptions = new EventSubscriptions4();
+        ctx.onDispose(() => subscriptions.clear());
+        const subscribeToSpaceAndUpdate = () => {
+          const oldSetSize = subscribedSpaceKeySet.size;
+          for (const space of this._spaceManager.spaces.values()) {
+            if (!subscribedSpaceKeySet.has(space.key)) {
+              subscriptions.add(space.stateUpdate.on(ctx, () => pushUpdateTask.trigger()));
+              subscribedSpaceKeySet.add(space.key);
+            }
+          }
+          if (oldSetSize !== subscribedSpaceKeySet.size) {
+            pushUpdateTask.trigger();
+          }
+        };
+        const unsubscribe = (await this._dataSpaceManagerProvider()).updated.on(ctx, subscribeToSpaceAndUpdate);
+        ctx.onDispose(unsubscribe);
+        subscribeToSpaceAndUpdate();
+      });
+    });
+  }
+};
+
+// packages/sdk/client-services/src/packlets/logging/logging-service.ts
+import { Event as Event8 } from "@dxos/async";
+import { Stream as Stream13 } from "@dxos/codec-protobuf";
+import { PublicKey as PublicKey16 } from "@dxos/keys";
+import { getContextFromEntry, log as log20 } from "@dxos/log";
 import { QueryLogsRequest } from "@dxos/protocols/proto/dxos/client/services";
 import { getDebugName, jsonify, numericalValues, tracer } from "@dxos/util";
 var LoggingServiceImpl = class {
   constructor() {
     this._logs = new Event8();
     this._started = Date.now();
-    this._sessionId = PublicKey15.random().toHex();
+    this._sessionId = PublicKey16.random().toHex();
     this._logProcessor = (_config, entry2) => {
       this._logs.emit(entry2);
     };
   }
   async open() {
-    log17.runtimeConfig.processors.push(this._logProcessor);
+    log20.runtimeConfig.processors.push(this._logProcessor);
   }
   async close() {
-    const index = log17.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
-    log17.runtimeConfig.processors.splice(index, 1);
+    const index = log20.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
+    log20.runtimeConfig.processors.splice(index, 1);
   }
   async controlMetrics({ reset, record }) {
     if (reset) {
@@ -5993,7 +6540,7 @@ var LoggingServiceImpl = class {
         stats: numericalValues(events, "duration")
       };
     };
-    return new Stream12(({ next }) => {
+    return new Stream13(({ next }) => {
       const update = () => {
         const metrics = {
           timestamp: /* @__PURE__ */ new Date(),
@@ -6015,7 +6562,7 @@ var LoggingServiceImpl = class {
     });
   }
   queryLogs(request) {
-    return new Stream12(({ ctx, next }) => {
+    return new Stream13(({ ctx, next }) => {
       const handler = (entry2) => {
         if (LOG_PROCESSING > 0) {
           return;
@@ -6071,14 +6618,14 @@ var shouldLog = (entry2, request) => {
 var LOG_PROCESSING = 0;
 
 // packages/sdk/client-services/src/packlets/network/network-service.ts
-import { Stream as Stream13 } from "@dxos/codec-protobuf";
+import { Stream as Stream14 } from "@dxos/codec-protobuf";
 var NetworkServiceImpl = class {
   constructor(networkManager, signalManager) {
     this.networkManager = networkManager;
     this.signalManager = signalManager;
   }
   queryStatus() {
-    return new Stream13(({ next }) => {
+    return new Stream14(({ next }) => {
       const update = () => {
         next({
           swarm: this.networkManager.connectionState,
@@ -6104,7 +6651,7 @@ var NetworkServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/system/system-service.ts
-import { Stream as Stream14 } from "@dxos/codec-protobuf";
+import { Stream as Stream15 } from "@dxos/codec-protobuf";
 import { GetDiagnosticsRequest as GetDiagnosticsRequest2 } from "@dxos/protocols/proto/dxos/client/services";
 import { jsonKeyReplacer as jsonKeyReplacer2 } from "@dxos/util";
 var SystemServiceImpl = class {
@@ -6140,7 +6687,7 @@ var SystemServiceImpl = class {
   }
   // TODO(burdon): Standardize interval option in stream request?
   queryStatus({ interval = 3e3 } = {}) {
-    return new Stream14(({ next }) => {
+    return new Stream15(({ next }) => {
       const update = () => {
         next({
           status: this._getCurrentStatus()
@@ -6171,7 +6718,7 @@ function _ts_decorate8(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file21 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
+var __dxlog_file24 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
 var ClientServicesHost = class {
   constructor({
     config,
@@ -6191,7 +6738,7 @@ var ClientServicesHost = class {
     this._storage = storage;
     this._level = level;
     this._callbacks = callbacks;
-    this._runtimeParams = runtimeParams;
+    this._runtimeParams = runtimeParams ?? {};
     if (config) {
       this.initialize({
         config,
@@ -6204,7 +6751,10 @@ var ClientServicesHost = class {
         lockKey,
         onAcquire: () => {
           if (!this._opening) {
-            void this.open(new Context11());
+            void this.open(new Context11(void 0, {
+              F: __dxlog_file24,
+              L: 121
+            }));
           }
         },
         onRelease: () => this.close()
@@ -6260,24 +6810,24 @@ var ClientServicesHost = class {
   */
   initialize({ config, ...options }) {
     invariant18(!this._open, "service host is open", {
-      F: __dxlog_file21,
-      L: 189,
+      F: __dxlog_file24,
+      L: 187,
       S: this,
       A: [
         "!this._open",
         "'service host is open'"
       ]
     });
-    log18("initializing...", void 0, {
-      F: __dxlog_file21,
-      L: 190,
+    log21("initializing...", void 0, {
+      F: __dxlog_file24,
+      L: 188,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
       invariant18(!this._config, "config already set", {
-        F: __dxlog_file21,
-        L: 193,
+        F: __dxlog_file24,
+        L: 191,
         S: this,
         A: [
           "!this._config",
@@ -6290,9 +6840,9 @@ var ClientServicesHost = class {
       }
     }
     if (!options.signalManager) {
-      log18.warn("running signaling without telemetry metadata.", void 0, {
-        F: __dxlog_file21,
-        L: 201,
+      log21.warn("running signaling without telemetry metadata.", void 0, {
+        F: __dxlog_file24,
+        L: 199,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -6302,8 +6852,8 @@ var ClientServicesHost = class {
     }), signalManager = new WebsocketSignalManager(this._config?.get("runtime.services.signaling") ?? []) } = options;
     this._signalManager = signalManager;
     invariant18(!this._networkManager, "network manager already set", {
-      F: __dxlog_file21,
-      L: 212,
+      F: __dxlog_file24,
+      L: 210,
       S: this,
       A: [
         "!this._networkManager",
@@ -6315,9 +6865,9 @@ var ClientServicesHost = class {
       transportFactory,
       signalManager
     });
-    log18("initialized", void 0, {
-      F: __dxlog_file21,
-      L: 219,
+    log21("initialized", void 0, {
+      F: __dxlog_file24,
+      L: 217,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6326,18 +6876,18 @@ var ClientServicesHost = class {
     if (this._open) {
       return;
     }
-    const traceId = PublicKey16.random().toHex();
-    log18.trace("dxos.client-services.host.open", trace10.begin({
+    const traceId = PublicKey17.random().toHex();
+    log21.trace("dxos.client-services.host.open", trace10.begin({
       id: traceId
     }), {
-      F: __dxlog_file21,
-      L: 230,
+      F: __dxlog_file24,
+      L: 228,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant18(this._config, "config not set", {
-      F: __dxlog_file21,
-      L: 232,
+      F: __dxlog_file24,
+      L: 230,
       S: this,
       A: [
         "this._config",
@@ -6345,8 +6895,8 @@ var ClientServicesHost = class {
       ]
     });
     invariant18(this._storage, "storage not set", {
-      F: __dxlog_file21,
-      L: 233,
+      F: __dxlog_file24,
+      L: 231,
       S: this,
       A: [
         "this._storage",
@@ -6354,8 +6904,8 @@ var ClientServicesHost = class {
       ]
     });
     invariant18(this._signalManager, "signal manager not set", {
-      F: __dxlog_file21,
-      L: 234,
+      F: __dxlog_file24,
+      L: 232,
       S: this,
       A: [
         "this._signalManager",
@@ -6363,8 +6913,8 @@ var ClientServicesHost = class {
       ]
     });
     invariant18(this._networkManager, "network manager not set", {
-      F: __dxlog_file21,
-      L: 235,
+      F: __dxlog_file24,
+      L: 233,
       S: this,
       A: [
         "this._networkManager",
@@ -6372,11 +6922,11 @@ var ClientServicesHost = class {
       ]
     });
     this._opening = true;
-    log18("opening...", {
+    log21("opening...", {
       lockKey: this._resourceLock?.lockKey
     }, {
-      F: __dxlog_file21,
-      L: 238,
+      F: __dxlog_file24,
+      L: 236,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6387,15 +6937,18 @@ var ClientServicesHost = class {
     await this._level.open();
     await this._loggingService.open();
     this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._runtimeParams);
+    const dataSpaceManagerProvider = async () => {
+      await this._serviceContext.initialized.wait();
+      return this._serviceContext.dataSpaceManager;
+    };
+    const identityService = new IdentityServiceImpl(this._serviceContext.identityManager, this._serviceContext.keyring, () => this._serviceContext.dataSpaceManager, (params) => this._createIdentity(params), (profile) => this._serviceContext.broadcastProfileUpdate(profile));
     this._serviceRegistry.setServices({
       SystemService: this._systemService,
-      IdentityService: new IdentityServiceImpl((params) => this._createIdentity(params), this._serviceContext.identityManager, this._serviceContext.keyring, (profile) => this._serviceContext.broadcastProfileUpdate(profile)),
+      IdentityService: identityService,
+      ContactsService: new ContactsServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, dataSpaceManagerProvider),
       InvitationsService: new InvitationsServiceImpl(this._serviceContext.invitationsManager),
       DevicesService: new DevicesServiceImpl(this._serviceContext.identityManager),
-      SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, async () => {
-        await this._serviceContext.initialized.wait();
-        return this._serviceContext.dataSpaceManager;
-      }),
+      SpacesService: new SpacesServiceImpl(this._serviceContext.identityManager, this._serviceContext.spaceManager, dataSpaceManagerProvider),
       DataService: this._serviceContext.echoHost.dataService,
       QueryService: this._serviceContext.echoHost.queryService,
       NetworkService: new NetworkServiceImpl(this._serviceContext.networkManager, this._serviceContext.signalManager),
@@ -6409,6 +6962,7 @@ var ClientServicesHost = class {
       })
     });
     await this._serviceContext.open(ctx);
+    await identityService.open();
     const devtoolsProxy = this._config?.get("runtime.client.devtoolsProxy");
     if (devtoolsProxy) {
       this._devtoolsProxy = new WebsocketRpcClient({
@@ -6424,19 +6978,19 @@ var ClientServicesHost = class {
     this._open = true;
     this._statusUpdate.emit();
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    log18("opened", {
+    log21("opened", {
       deviceKey
     }, {
-      F: __dxlog_file21,
-      L: 314,
+      F: __dxlog_file24,
+      L: 322,
       S: this,
       C: (f, a) => f(...a)
     });
-    log18.trace("dxos.client-services.host.open", trace10.end({
+    log21.trace("dxos.client-services.host.open", trace10.end({
       id: traceId
     }), {
-      F: __dxlog_file21,
-      L: 315,
+      F: __dxlog_file24,
+      L: 323,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6446,11 +7000,11 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    log18("closing...", {
+    log21("closing...", {
       deviceKey
     }, {
-      F: __dxlog_file21,
-      L: 326,
+      F: __dxlog_file24,
+      L: 334,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6464,44 +7018,44 @@ var ClientServicesHost = class {
     await this._level?.close();
     this._open = false;
     this._statusUpdate.emit();
-    log18("closed", {
+    log21("closed", {
       deviceKey
     }, {
-      F: __dxlog_file21,
-      L: 335,
+      F: __dxlog_file24,
+      L: 343,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async reset() {
-    const traceId = PublicKey16.random().toHex();
-    log18.trace("dxos.sdk.client-services-host.reset", trace10.begin({
+    const traceId = PublicKey17.random().toHex();
+    log21.trace("dxos.sdk.client-services-host.reset", trace10.begin({
       id: traceId
     }), {
-      F: __dxlog_file21,
-      L: 340,
+      F: __dxlog_file24,
+      L: 348,
       S: this,
       C: (f, a) => f(...a)
     });
-    log18.info("resetting...", void 0, {
-      F: __dxlog_file21,
-      L: 342,
+    log21.info("resetting...", void 0, {
+      F: __dxlog_file24,
+      L: 350,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._serviceContext?.close();
     await this._storage.reset();
-    log18.info("reset", void 0, {
-      F: __dxlog_file21,
-      L: 345,
+    log21.info("reset", void 0, {
+      F: __dxlog_file24,
+      L: 353,
       S: this,
       C: (f, a) => f(...a)
     });
-    log18.trace("dxos.sdk.client-services-host.reset", trace10.end({
+    log21.trace("dxos.sdk.client-services-host.reset", trace10.end({
       id: traceId
     }), {
-      F: __dxlog_file21,
-      L: 346,
+      F: __dxlog_file24,
+      L: 354,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6510,38 +7064,6 @@ var ClientServicesHost = class {
   async _createIdentity(params) {
     const identity = await this._serviceContext.createIdentity(params);
     await this._serviceContext.initialized.wait();
-    const space = await this._serviceContext.dataSpaceManager.createSpace();
-    const automergeIndex = space.automergeSpaceState.rootUrl;
-    invariant18(automergeIndex, void 0, {
-      F: __dxlog_file21,
-      L: 358,
-      S: this,
-      A: [
-        "automergeIndex",
-        ""
-      ]
-    });
-    const document = this._serviceContext.echoHost.automergeRepo.find(automergeIndex);
-    await document.whenReady();
-    const properties = {
-      system: {
-        type: encodeReference(getTypeReference(PropertiesType))
-      },
-      data: {
-        [defaultKey]: identity.identityKey.toHex()
-      },
-      meta: {
-        keys: []
-      }
-    };
-    const propertiesId = PublicKey16.random().toHex();
-    document.change((doc) => {
-      assignDeep2(doc, [
-        "objects",
-        propertiesId
-      ], properties);
-    });
-    await this._serviceContext.echoHost.flush();
     return identity;
   }
 };
@@ -6591,7 +7113,6 @@ export {
   SpaceInvitationProtocol,
   InvitationsManager,
   DataSpace,
-  findPropertiesObject,
   DataSpaceManager,
   SpacesServiceImpl,
   ServiceContext,
@@ -6604,4 +7125,4 @@ export {
   ClientServicesProviderResource,
   DiagnosticsCollector
 };
-//# sourceMappingURL=chunk-QWL2M4EU.mjs.map
+//# sourceMappingURL=chunk-M35K3NOZ.mjs.map