@dxos/client-services 0.6.12-main.15a606f → 0.6.12-main.2d19bf1

package/dist/lib/browser/{chunk-BDGSOBZV.mjs → chunk-WU4ZS3F3.mjs}

@@ -404,7 +404,7 @@ import { SpaceMember } from "@dxos/protocols/proto/dxos/client/services";
 import { TRACE_PROCESSOR } from "@dxos/tracing";
 
 // packages/sdk/client-services/src/version.ts
-var DXOS_VERSION = "0.6.12-main.15a606f";
+var DXOS_VERSION = "0.6.12-main.2d19bf1";
 
 // packages/sdk/client-services/src/packlets/services/platform.ts
 import { Platform } from "@dxos/protocols/proto/dxos/client/services";
@@ -755,7 +755,7 @@ var TrustedKeySetAuthVerifier = class {
         return false;
       }
       if (this._isTrustedKey(credential.issuer)) {
-        log3("key is not currently in trusted set, waiting...", {
+        log3("key is trusted -- auth success", {
           key: credential.issuer
         }, {
           F: __dxlog_file5,
@@ -782,7 +782,10 @@ var TrustedKeySetAuthVerifier = class {
           trigger.wake(true);
         } else {
           log3("key is not currently in trusted set, waiting...", {
-            key: credential.issuer
+            key: credential.issuer,
+            trusted: [
+              ...this._params.trustedKeysProvider()
+            ]
           }, {
             F: __dxlog_file5,
             L: 84,
@@ -811,14 +814,21 @@ var TrustedKeySetAuthVerifier = class {
 // packages/sdk/client-services/src/packlets/spaces/edge-feed-replicator.ts
 import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
 import { Event, Mutex, scheduleMicroTask } from "@dxos/async";
-import { Resource } from "@dxos/context";
+import { Context as Context3, Resource } from "@dxos/context";
+import { EdgeConnectionClosedError, EdgeIdentityChangedError } from "@dxos/edge-client";
 import { invariant as invariant2 } from "@dxos/invariant";
 import { PublicKey as PublicKey3 } from "@dxos/keys";
-import { log as log4 } from "@dxos/log";
+import { log as log4, logInfo } from "@dxos/log";
 import { EdgeService } from "@dxos/protocols";
 import { buf } from "@dxos/protocols/buf";
 import { MessageSchema as RouterMessageSchema } from "@dxos/protocols/buf/dxos/edge/messenger_pb";
 import { ComplexMap as ComplexMap2, arrayToBuffer, bufferToArray, defaultMap, rangeFromTo } from "@dxos/util";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
 function _using_ctx() {
   var _disposeSuppressedError = typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed) {
     var err = new Error();
@@ -900,7 +910,13 @@ var EdgeFeedReplicator = class extends Resource {
     this._spaceId = spaceId;
   }
   async _open() {
-    this._ctx.onDispose(this._messenger.addListener(async (message) => {
+    log4("open", void 0, {
+      F: __dxlog_file6,
+      L: 56,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    this._ctx.onDispose(this._messenger.addListener((message) => {
       if (!message.serviceId) {
         return;
       }
@@ -915,33 +931,65 @@ var EdgeFeedReplicator = class extends Resource {
           _spaceId: this._spaceId
         }, {
           F: __dxlog_file6,
-          L: 62,
+          L: 70,
           S: this,
           C: (f, a) => f(...a)
         });
         return;
       }
       const payload = decodeCbor(message.payload.value);
-      log4.info("receive", {
+      log4("receive", {
         from: message.source,
         feedKey: payload.feedKey,
         type: payload.type
       }, {
         F: __dxlog_file6,
-        L: 67,
+        L: 75,
         S: this,
         C: (f, a) => f(...a)
       });
       this._onMessage(payload);
     }));
-    this._connected = true;
-    this._connectionCtx = this._ctx.derive();
-    for (const feed of this._feeds.values()) {
-      await this._replicateFeed(feed);
+    this._messenger.connected.on(this._ctx, async () => {
+      await this._resetConnection();
+      this._startReplication();
+    });
+    if (this._messenger.isConnected) {
+      this._startReplication();
     }
   }
   async _close() {
-    this._connected = false;
+    log4("close", void 0, {
+      F: __dxlog_file6,
+      L: 91,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    await this._resetConnection();
+  }
+  _startReplication() {
+    this._connected = true;
+    const connectionCtx = this._createConnectionContext();
+    this._connectionCtx = connectionCtx;
+    log4("connection context created", void 0, {
+      F: __dxlog_file6,
+      L: 99,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    scheduleMicroTask(connectionCtx, async () => {
+      for (const feed of this._feeds.values()) {
+        await this._replicateFeed(connectionCtx, feed);
+      }
+    });
+  }
+  async _resetConnection() {
+    log4("resetConnection", void 0, {
+      F: __dxlog_file6,
+      L: 108,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     this._connected = false;
     await this._connectionCtx?.dispose();
     this._connectionCtx = void 0;
@@ -949,40 +997,50 @@ var EdgeFeedReplicator = class extends Resource {
   }
   async addFeed(feed) {
     log4.info("addFeed", {
-      key: feed.key
+      key: feed.key,
+      connected: this._connected,
+      hasConnectionCtx: !!this._connectionCtx
     }, {
       F: __dxlog_file6,
-      L: 89,
+      L: 116,
       S: this,
       C: (f, a) => f(...a)
     });
     this._feeds.set(feed.key, feed);
-    if (this._connected) {
-      await this._replicateFeed(feed);
+    if (this._connected && this._connectionCtx) {
+      await this._replicateFeed(this._connectionCtx, feed);
     }
   }
   _getPushMutex(key) {
     return defaultMap(this._pushMutex, key, () => new Mutex());
   }
-  async _replicateFeed(feed) {
-    invariant2(this._connectionCtx, void 0, {
+  async _replicateFeed(ctx, feed) {
+    log4("replicateFeed", {
+      key: feed.key
+    }, {
       F: __dxlog_file6,
-      L: 102,
+      L: 129,
       S: this,
-      A: [
-        "this._connectionCtx",
-        ""
-      ]
+      C: (f, a) => f(...a)
     });
     await this._sendMessage({
       type: "get-metadata",
       feedKey: feed.key.toHex()
     });
-    Event.wrap(feed.core, "append").on(this._connectionCtx, async () => {
+    Event.wrap(feed.core, "append").on(ctx, async () => {
       await this._pushBlocksIfNeeded(feed);
     });
   }
   async _sendMessage(message) {
+    if (!this._connectionCtx) {
+      log4.info("message dropped because connection was disposed", void 0, {
+        F: __dxlog_file6,
+        L: 142,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return;
+    }
     const logPayload = message.type === "data" ? {
       feedKey: message.feedKey,
       blocks: message.blocks.map((b) => b.index)
@@ -991,13 +1049,13 @@ var EdgeFeedReplicator = class extends Resource {
     };
     log4.info("sending message", logPayload, {
       F: __dxlog_file6,
-      L: 117,
+      L: 148,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant2(message.feedKey, void 0, {
       F: __dxlog_file6,
-      L: 119,
+      L: 150,
       S: this,
       A: [
         "message.feedKey",
@@ -1005,6 +1063,14 @@ var EdgeFeedReplicator = class extends Resource {
       ]
     });
     const payloadValue = bufferToArray(encodeCbor(message));
+    log4("send", {
+      type: message.type
+    }, {
+      F: __dxlog_file6,
+      L: 153,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     await this._messenger.send(buf.create(RouterMessageSchema, {
       source: {
         identityKey: this._messenger.identityKey,
@@ -1017,7 +1083,16 @@ var EdgeFeedReplicator = class extends Resource {
     }));
   }
   _onMessage(message) {
-    scheduleMicroTask(this._ctx, async () => {
+    if (!this._connectionCtx) {
+      log4.warn("received message after connection context was disposed", void 0, {
+        F: __dxlog_file6,
+        L: 168,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return;
+    }
+    scheduleMicroTask(this._connectionCtx, async () => {
       switch (message.type) {
         case "metadata": {
           try {
@@ -1026,7 +1101,7 @@ var EdgeFeedReplicator = class extends Resource {
               message
             }, {
               F: __dxlog_file6,
-              L: 138,
+              L: 174,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1037,7 +1112,7 @@ var EdgeFeedReplicator = class extends Resource {
                 feedKey
               }, {
                 F: __dxlog_file6,
-                L: 143,
+                L: 179,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1070,7 +1145,7 @@ var EdgeFeedReplicator = class extends Resource {
             blocks: message.blocks.map((b) => b.index)
           }, {
             F: __dxlog_file6,
-            L: 165,
+            L: 201,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1081,7 +1156,7 @@ var EdgeFeedReplicator = class extends Resource {
               feedKey
             }, {
               F: __dxlog_file6,
-              L: 170,
+              L: 206,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1095,7 +1170,7 @@ var EdgeFeedReplicator = class extends Resource {
             ...message
           }, {
             F: __dxlog_file6,
-            L: 179,
+            L: 215,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1110,7 +1185,7 @@ var EdgeFeedReplicator = class extends Resource {
       to
     }, {
       F: __dxlog_file6,
-      L: 186,
+      L: 222,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1120,7 +1195,7 @@ var EdgeFeedReplicator = class extends Resource {
       });
       invariant2(data instanceof Uint8Array, void 0, {
         F: __dxlog_file6,
-        L: 191,
+        L: 227,
         S: this,
         A: [
           "data instanceof Uint8Array",
@@ -1148,7 +1223,7 @@ var EdgeFeedReplicator = class extends Resource {
       blocks: blocks.length
     }, {
       F: __dxlog_file6,
-      L: 212,
+      L: 248,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1166,11 +1241,11 @@ var EdgeFeedReplicator = class extends Resource {
   async _pushBlocksIfNeeded(feed) {
     try {
       var _usingCtx = _using_ctx();
-      const _guard = _usingCtx.u(await this._getPushMutex(feed.key).acquire());
+      const _ = _usingCtx.u(await this._getPushMutex(feed.key).acquire());
       if (!this._remoteLength.has(feed.key)) {
         log4("blocks not pushed because remote length is unknown", void 0, {
           F: __dxlog_file6,
-          L: 233,
+          L: 269,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1186,7 +1261,34 @@ var EdgeFeedReplicator = class extends Resource {
       _usingCtx.d();
     }
   }
+  _createConnectionContext() {
+    const connectionCtx = new Context3({
+      onError: async (err) => {
+        if (connectionCtx !== this._connectionCtx) {
+          return;
+        }
+        if (err instanceof EdgeIdentityChangedError || err instanceof EdgeConnectionClosedError) {
+          log4("resetting on reconnect", void 0, {
+            F: __dxlog_file6,
+            L: 286,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          await this._resetConnection();
+        } else {
+          this._ctx.raise(err);
+        }
+      }
+    }, {
+      F: __dxlog_file6,
+      L: 280
+    });
+    return connectionCtx;
+  }
 };
+_ts_decorate([
+  logInfo
+], EdgeFeedReplicator.prototype, "_spaceId", void 0);
 var bufferizeBlock = (block) => ({
   index: block.index,
   data: arrayToBuffer(block.data),
@@ -1436,53 +1538,67 @@ var runEpochMigration = async (ctx, context) => {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts
-import { DeferredTask, Event as Event3, scheduleTask as scheduleTask2, sleep, TimeoutError, Trigger as Trigger3 } from "@dxos/async";
-import { Context as Context3, rejectOnDispose } from "@dxos/context";
+import { DeferredTask, Event as Event3, scheduleTask as scheduleTask2, sleep, TimeoutError, Trigger as Trigger3, scheduleMicroTask as scheduleMicroTask2 } from "@dxos/async";
+import { rejectOnDispose, Resource as Resource3 } from "@dxos/context";
+import { verifyCredential as verifyCredential2 } from "@dxos/credentials";
 import { invariant as invariant4 } from "@dxos/invariant";
 import { PublicKey as PublicKey4 } from "@dxos/keys";
-import { log as log6 } from "@dxos/log";
+import { logInfo as logInfo2, log as log6 } from "@dxos/log";
+import { EdgeCallFailedError } from "@dxos/protocols";
 import { schema as schema2 } from "@dxos/protocols/proto";
 import { RpcExtension } from "@dxos/teleport";
 import { ComplexMap as ComplexMap3, ComplexSet, entry } from "@dxos/util";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
 var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
+var MAX_EDGE_RETRIES = 2;
 var WRITER_NOT_SET_ERROR_CODE = "WRITER_NOT_SET";
-var NotarizationPlugin = class {
-  constructor() {
-    this._ctx = new Context3(void 0, {
-      F: __dxlog_file8,
-      L: 62
-    });
+var credentialCodec = schema2.getCodecForType("dxos.halo.credentials.Credential");
+var NotarizationPlugin = class extends Resource3 {
+  constructor(params) {
+    super();
     this._extensionOpened = new Event3();
     this._extensions = /* @__PURE__ */ new Set();
     this._processedCredentials = new ComplexSet(PublicKey4.hash);
     this._processCredentialsTriggers = new ComplexMap3(PublicKey4.hash);
+    this._spaceId = params.spaceId;
+    if (params.edgeClient && params.edgeFeatures?.feedReplicator) {
+      this._edgeClient = params.edgeClient;
+    }
   }
   get hasWriter() {
     return !!this._writer;
   }
-  async open() {
+  async _open() {
+    if (this._edgeClient && this._writer) {
+      this._notarizePendingEdgeCredentials(this._edgeClient, this._writer);
+    }
   }
-  async close() {
+  async _close() {
     await this._ctx.dispose();
   }
   /**
   * Request credentials to be notarized.
   */
-  async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
+  async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY, edgeRetryJitter }) {
     log6("notarize", {
       credentials
     }, {
       F: __dxlog_file8,
-      L: 90,
+      L: 126,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant4(credentials.every((credential) => credential.id), "Credentials must have an id", {
       F: __dxlog_file8,
-      L: 91,
+      L: 127,
       S: this,
       A: [
         "credentials.every((credential) => credential.id)",
@@ -1496,7 +1612,7 @@ var NotarizationPlugin = class {
           err
         }, {
           F: __dxlog_file8,
-          L: 99,
+          L: 135,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1506,21 +1622,37 @@ var NotarizationPlugin = class {
     });
     opCtx?.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
-      scheduleTask2(ctx, () => {
-        log6.warn("Notarization timeout", {
-          timeout,
-          peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
-        }, {
-          F: __dxlog_file8,
-          L: 111,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        void ctx.dispose();
-        errors.throw(new TimeoutError(timeout, "Notarization timed out"));
-      }, timeout);
+      this._scheduleTimeout(ctx, errors, timeout);
     }
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
+    this._tryNotarizeCredentialsWithPeers(ctx, credentials, {
+      retryTimeout,
+      successDelay
+    });
+    if (this._edgeClient) {
+      this._tryNotarizeCredentialsWithEdge(ctx, this._edgeClient, credentials, {
+        retryTimeout,
+        successDelay,
+        jitter: edgeRetryJitter
+      });
+    }
+    try {
+      await Promise.race([
+        rejectOnDispose(ctx),
+        allNotarized,
+        errors.wait()
+      ]);
+      log6("done", void 0, {
+        F: __dxlog_file8,
+        L: 160,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    } finally {
+      await ctx.dispose();
+    }
+  }
+  _tryNotarizeCredentialsWithPeers(ctx, credentials, { retryTimeout, successDelay }) {
     const peersTried = /* @__PURE__ */ new Set();
     const notarizeTask = new DeferredTask(ctx, async () => {
       try {
@@ -1535,7 +1667,7 @@ var NotarizationPlugin = class {
             retryIn: retryTimeout
           }, {
             F: __dxlog_file8,
-            L: 136,
+            L: 183,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1549,7 +1681,7 @@ var NotarizationPlugin = class {
           credentialId: credentials.map((credential) => credential.id)
         }, {
           F: __dxlog_file8,
-          L: 143,
+          L: 190,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1558,7 +1690,7 @@ var NotarizationPlugin = class {
         });
         log6("success", void 0, {
           F: __dxlog_file8,
-          L: 147,
+          L: 194,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1567,7 +1699,7 @@ var NotarizationPlugin = class {
         if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
           log6.info("error notarizing (recoverable)", err, {
             F: __dxlog_file8,
-            L: 151,
+            L: 199,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1577,21 +1709,33 @@ var NotarizationPlugin = class {
     });
     notarizeTask.schedule();
     this._extensionOpened.on(ctx, () => notarizeTask.schedule());
-    try {
-      await Promise.race([
-        rejectOnDispose(ctx),
-        allNotarized,
-        errors.wait()
-      ]);
-      log6("done", void 0, {
-        F: __dxlog_file8,
-        L: 162,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    } finally {
-      await ctx.dispose();
-    }
+  }
+  _tryNotarizeCredentialsWithEdge(ctx, client, credentials, timeouts) {
+    const encodedCredentials = credentials.map((credential) => {
+      const binary = credentialCodec.encode(credential);
+      return Buffer.from(binary).toString("base64");
+    });
+    scheduleTask2(ctx, async () => {
+      try {
+        await client.notarizeCredentials(this._spaceId, {
+          credentials: encodedCredentials
+        }, {
+          retry: {
+            count: MAX_EDGE_RETRIES,
+            timeout: timeouts.retryTimeout,
+            jitter: timeouts.jitter
+          }
+        });
+        log6("edge notarization success", void 0, {
+          F: __dxlog_file8,
+          L: 227,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      } catch (error) {
+        handleEdgeError(error);
+      }
+    });
   }
   /**
   * Called with credentials arriving from the control pipeline.
@@ -1607,7 +1751,7 @@ var NotarizationPlugin = class {
   setWriter(writer) {
     invariant4(!this._writer, "Writer already set.", {
       F: __dxlog_file8,
-      L: 181,
+      L: 247,
       S: this,
       A: [
         "!this._writer",
@@ -1615,6 +1759,59 @@ var NotarizationPlugin = class {
       ]
     });
     this._writer = writer;
+    if (this._edgeClient) {
+      this._notarizePendingEdgeCredentials(this._edgeClient, writer);
+    }
+  }
+  /**
+  * The method is used only for adding agent feeds to spaces.
+  * When an agent is created we can admit them into all the existing spaces. In case the operation fails
+  * this method will fix it on the next space open.
+  * Given how rarely this happens there's no need to poll the endpoint.
+  */
+  _notarizePendingEdgeCredentials(client, writer) {
+    scheduleMicroTask2(this._ctx, async () => {
+      try {
+        const response = await client.getCredentialsForNotarization(this._spaceId, {
+          retry: {
+            count: MAX_EDGE_RETRIES
+          }
+        });
+        const credentials = response.awaitingNotarization.credentials;
+        if (!credentials.length) {
+          log6("edge did not return credentials for notarization", void 0, {
+            F: __dxlog_file8,
+            L: 269,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return;
+        }
+        log6("got edge credentials for notarization", {
+          count: credentials.length
+        }, {
+          F: __dxlog_file8,
+          L: 273,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        const decodedCredentials = credentials.map((credential) => {
+          const binary = Buffer.from(credential, "base64");
+          return credentialCodec.decode(binary);
+        });
+        await this._notarizeCredentials(writer, decodedCredentials);
+        log6.info("notarized edge credentials", {
+          count: decodedCredentials.length
+        }, {
+          F: __dxlog_file8,
+          L: 282,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      } catch (error) {
+        handleEdgeError(error);
+      }
+    });
   }
   async _waitUntilProcessed(id) {
     if (this._processedCredentials.has(id)) {
@@ -1629,10 +1826,13 @@ var NotarizationPlugin = class {
     if (!this._writer) {
       throw new Error(WRITER_NOT_SET_ERROR_CODE);
     }
-    for (const credential of request.credentials ?? []) {
+    await this._notarizeCredentials(this._writer, request.credentials ?? []);
+  }
+  async _notarizeCredentials(writer, credentials) {
+    for (const credential of credentials) {
       invariant4(credential.id, "Credential must have an id", {
         F: __dxlog_file8,
-        L: 200,
+        L: 308,
         S: this,
         A: [
           "credential.id",
@@ -1642,7 +1842,11 @@ var NotarizationPlugin = class {
       if (this._processedCredentials.has(credential.id)) {
         continue;
       }
-      await this._writer.write(credential);
+      const verificationResult = await verifyCredential2(credential);
+      if (verificationResult.kind === "fail") {
+        throw new Error(`Credential verification failed: ${verificationResult.errors.join("\n")}.`);
+      }
+      await writer.write(credential);
     }
   }
   createExtension() {
@@ -1652,7 +1856,7 @@ var NotarizationPlugin = class {
           peer: extension.localPeerId
         }, {
           F: __dxlog_file8,
-          L: 211,
+          L: 323,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1664,7 +1868,7 @@ var NotarizationPlugin = class {
           peer: extension.localPeerId
         }, {
           F: __dxlog_file8,
-          L: 216,
+          L: 328,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1674,6 +1878,43 @@ var NotarizationPlugin = class {
     });
     return extension;
   }
+  _scheduleTimeout(ctx, errors, timeout) {
+    scheduleTask2(ctx, () => {
+      log6.warn("Notarization timeout", {
+        timeout,
+        peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
+      }, {
+        F: __dxlog_file8,
+        L: 340,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      void ctx.dispose();
+      errors.throw(new TimeoutError(timeout, "Notarization timed out"));
+    }, timeout);
+  }
+};
+_ts_decorate2([
+  logInfo2
+], NotarizationPlugin.prototype, "_spaceId", void 0);
+var handleEdgeError = (error) => {
+  if (!(error instanceof EdgeCallFailedError) || error.errorData) {
+    log6.catch(error, void 0, {
+      F: __dxlog_file8,
+      L: 354,
+      S: void 0,
+      C: (f, a) => f(...a)
+    });
+  } else {
+    log6.info("Edge notarization failure", {
+      reason: error.reason
+    }, {
+      F: __dxlog_file8,
+      L: 356,
+      S: void 0,
+      C: (f, a) => f(...a)
+    });
+  }
 };
 var NotarizationTeleportExtension = class extends RpcExtension {
   constructor(_params) {
@@ -1768,7 +2009,7 @@ var DefaultSpaceStateMachine = class {
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
 import { Event as Event4, synchronized, trackLeaks } from "@dxos/async";
 import { PropertiesType } from "@dxos/client-protocol";
-import { LifecycleState, Resource as Resource3, cancelWithContext } from "@dxos/context";
+import { LifecycleState, Resource as Resource4, cancelWithContext } from "@dxos/context";
 import { createAdmissionCredentials, getCredentialAssertion as getCredentialAssertion2 } from "@dxos/credentials";
 import { convertLegacyReferences as convertLegacyReferences2, findInlineObjectOfType as findInlineObjectOfType2, AuthStatus, CredentialServerExtension } from "@dxos/echo-pipeline";
 import { LEGACY_TYPE_PROPERTIES, SpaceDocVersion as SpaceDocVersion2, encodeReference } from "@dxos/echo-protocol";
@@ -1779,6 +2020,7 @@ import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log as log8 } from "@dxos/log";
 import { AlreadyJoinedError, trace as Trace } from "@dxos/protocols";
 import { Invitation, SpaceState } from "@dxos/protocols/proto/dxos/client/services";
+import { EdgeReplicationSetting } from "@dxos/protocols/proto/dxos/echo/metadata";
 import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Gossip, Presence } from "@dxos/teleport-extension-gossip";
 import { trace } from "@dxos/tracing";
@@ -1855,7 +2097,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
-function _ts_decorate(decorators, target, key, desc) {
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -1865,13 +2107,14 @@ var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/s
 var PRESENCE_ANNOUNCE_INTERVAL = 1e4;
 var PRESENCE_OFFLINE_TIMEOUT = 2e4;
 var DEFAULT_SPACE_KEY = "__DEFAULT__";
-var DataSpaceManager = class extends Resource3 {
+var DataSpaceManager = class extends Resource4 {
   constructor(params) {
     super();
     this.updated = new Event4();
     this._spaces = new ComplexMap4(PublicKey5.hash);
     this._instanceId = PublicKey5.random().toHex();
     this._edgeConnection = void 0;
+    this._edgeHttpClient = void 0;
     this._edgeFeatures = void 0;
     this._meshReplicator = void 0;
     this._echoEdgeReplicator = void 0;
@@ -1887,6 +2130,7 @@ var DataSpaceManager = class extends Resource3 {
     this._edgeConnection = params.edgeConnection;
     this._edgeFeatures = params.edgeFeatures;
     this._echoEdgeReplicator = params.echoEdgeReplicator;
+    this._edgeHttpClient = params.edgeHttpClient;
     this._runtimeParams = params.runtimeParams;
     trace.diagnostic({
       id: "spaces",
@@ -1918,7 +2162,7 @@ var DataSpaceManager = class extends Resource3 {
   async _open() {
     log8("open", void 0, {
       F: __dxlog_file10,
-      L: 195,
+      L: 198,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1926,7 +2170,7 @@ var DataSpaceManager = class extends Resource3 {
       id: this._instanceId
     }), {
       F: __dxlog_file10,
-      L: 196,
+      L: 199,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1934,7 +2178,7 @@ var DataSpaceManager = class extends Resource3 {
       spaces: this._metadataStore.spaces.length
     }, {
       F: __dxlog_file10,
-      L: 197,
+      L: 200,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1944,7 +2188,7 @@ var DataSpaceManager = class extends Resource3 {
           spaceMetadata
         }, {
           F: __dxlog_file10,
-          L: 201,
+          L: 204,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1955,7 +2199,7 @@ var DataSpaceManager = class extends Resource3 {
           err
         }, {
           F: __dxlog_file10,
-          L: 204,
+          L: 207,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1966,7 +2210,7 @@ var DataSpaceManager = class extends Resource3 {
       id: this._instanceId
     }), {
       F: __dxlog_file10,
-      L: 210,
+      L: 213,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1974,7 +2218,7 @@ var DataSpaceManager = class extends Resource3 {
   async _close() {
     log8("close", void 0, {
       F: __dxlog_file10,
-      L: 215,
+      L: 218,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1989,7 +2233,7 @@ var DataSpaceManager = class extends Resource3 {
   async createSpace() {
     invariant5(this._lifecycleState === LifecycleState.OPEN, "Not open.", {
       F: __dxlog_file10,
-      L: 227,
+      L: 230,
       S: this,
       A: [
         "this._lifecycleState === LifecycleState.OPEN",
@@ -2010,7 +2254,7 @@ var DataSpaceManager = class extends Resource3 {
       spaceKey
     }, {
       F: __dxlog_file10,
-      L: 239,
+      L: 242,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2022,7 +2266,7 @@ var DataSpaceManager = class extends Resource3 {
     const memberCredential = credentials[1];
     invariant5(getCredentialAssertion2(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file10,
-      L: 249,
+      L: 252,
       S: this,
       A: [
         "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2054,7 +2298,7 @@ var DataSpaceManager = class extends Resource3 {
           spaceId: space.id
         }, {
           F: __dxlog_file10,
-          L: 274,
+          L: 277,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2089,7 +2333,7 @@ var DataSpaceManager = class extends Resource3 {
     const automergeIndex = space.automergeSpaceState.rootUrl;
     invariant5(automergeIndex, void 0, {
       F: __dxlog_file10,
-      L: 307,
+      L: 310,
       S: this,
       A: [
         "automergeIndex",
@@ -2106,13 +2350,13 @@ var DataSpaceManager = class extends Resource3 {
       opts
     }, {
       F: __dxlog_file10,
-      L: 316,
+      L: 319,
       S: this,
       C: (f, a) => f(...a)
     });
     invariant5(this._lifecycleState === LifecycleState.OPEN, "Not open.", {
       F: __dxlog_file10,
-      L: 317,
+      L: 320,
       S: this,
       A: [
         "this._lifecycleState === LifecycleState.OPEN",
@@ -2121,7 +2365,7 @@ var DataSpaceManager = class extends Resource3 {
     });
     invariant5(!this._spaces.has(opts.spaceKey), "Space already exists.", {
       F: __dxlog_file10,
-      L: 318,
+      L: 321,
       S: this,
       A: [
         "!this._spaces.has(opts.spaceKey)",
@@ -2145,7 +2389,7 @@ var DataSpaceManager = class extends Resource3 {
     const space = this._spaceManager.spaces.get(options.spaceKey);
     invariant5(space, void 0, {
       F: __dxlog_file10,
-      L: 338,
+      L: 341,
       S: this,
       A: [
         "space",
@@ -2158,7 +2402,7 @@ var DataSpaceManager = class extends Resource3 {
     const credentials = await createAdmissionCredentials(this._signingContext.credentialSigner, options.identityKey, space.key, space.genesisFeedKey, options.role, space.spaceState.membershipChainHeads, options.profile, options.delegationCredentialId);
     invariant5(credentials[0].credential, void 0, {
       F: __dxlog_file10,
-      L: 357,
+      L: 360,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2168,7 +2412,7 @@ var DataSpaceManager = class extends Resource3 {
     const spaceMemberCredential = credentials[0].credential.credential;
     invariant5(getCredentialAssertion2(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file10,
-      L: 359,
+      L: 362,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2202,12 +2446,36 @@ var DataSpaceManager = class extends Resource3 {
       }
     });
   }
+  async setSpaceEdgeReplicationSetting(spaceKey, setting) {
+    const space = this._spaces.get(spaceKey);
+    invariant5(space, "Space not found.", {
+      F: __dxlog_file10,
+      L: 399,
+      S: this,
+      A: [
+        "space",
+        "'Space not found.'"
+      ]
+    });
+    await this._metadataStore.setSpaceEdgeReplicationSetting(spaceKey, setting);
+    if (space.isOpen) {
+      switch (setting) {
+        case EdgeReplicationSetting.DISABLED:
+          await this._echoEdgeReplicator?.disconnectFromSpace(space.id);
+          break;
+        case EdgeReplicationSetting.ENABLED:
+          await this._echoEdgeReplicator?.connectToSpace(space.id);
+          break;
+      }
+    }
+    space.stateUpdate.emit();
+  }
   async _constructSpace(metadata) {
     log8("construct space", {
       metadata
     }, {
       F: __dxlog_file10,
-      L: 395,
+      L: 418,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2251,7 +2519,7 @@ var DataSpaceManager = class extends Resource3 {
             err
           }, {
             F: __dxlog_file10,
-            L: 437,
+            L: 460,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2261,7 +2529,7 @@ var DataSpaceManager = class extends Resource3 {
       onAuthFailure: () => {
         log8.warn("auth failure", void 0, {
           F: __dxlog_file10,
-          L: 442,
+          L: 465,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2294,7 +2562,7 @@ var DataSpaceManager = class extends Resource3 {
             space: space.key
           }, {
             F: __dxlog_file10,
-            L: 469,
+            L: 492,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2305,7 +2573,7 @@ var DataSpaceManager = class extends Resource3 {
             open: this._lifecycleState === LifecycleState.OPEN
           }, {
             F: __dxlog_file10,
-            L: 472,
+            L: 495,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2324,7 +2592,7 @@ var DataSpaceManager = class extends Resource3 {
             space: space.key
           }, {
             F: __dxlog_file10,
-            L: 480,
+            L: 503,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2332,13 +2600,29 @@ var DataSpaceManager = class extends Resource3 {
       },
       cache: metadata.cache,
       edgeConnection: this._edgeConnection,
+      edgeHttpClient: this._edgeHttpClient,
       edgeFeatures: this._edgeFeatures
     });
     dataSpace.postOpen.append(async () => {
-      await this._echoEdgeReplicator?.connectToSpace(dataSpace.id);
+      const setting = dataSpace.getEdgeReplicationSetting();
+      if (setting === EdgeReplicationSetting.ENABLED) {
+        await this._echoEdgeReplicator?.connectToSpace(dataSpace.id);
+      } else if (this._echoEdgeReplicator) {
+        log8("not connecting EchoEdgeReplicator because of EdgeReplicationSetting", {
+          spaceId: dataSpace.id
+        }, {
+          F: __dxlog_file10,
+          L: 516,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      }
     });
     dataSpace.preClose.append(async () => {
-      await this._echoEdgeReplicator?.disconnectFromSpace(dataSpace.id);
+      const setting = dataSpace.getEdgeReplicationSetting();
+      if (setting === EdgeReplicationSetting.ENABLED) {
+        await this._echoEdgeReplicator?.disconnectFromSpace(dataSpace.id);
+      }
     });
     presence.newPeer.on((peerState) => {
       if (dataSpace.state === SpaceState.SPACE_READY) {
@@ -2358,7 +2642,7 @@ var DataSpaceManager = class extends Resource3 {
         space: space.key
       }, {
         F: __dxlog_file10,
-        L: 511,
+        L: 543,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2391,7 +2675,7 @@ var DataSpaceManager = class extends Resource3 {
       closedSessions
     }, {
       F: __dxlog_file10,
-      L: 537,
+      L: 569,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2406,7 +2690,7 @@ var DataSpaceManager = class extends Resource3 {
           peerId: peerState.peerId
         }, {
           F: __dxlog_file10,
-          L: 551,
+          L: 583,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2450,19 +2734,19 @@ var DataSpaceManager = class extends Resource3 {
     await Promise.all(tasks);
   }
 };
-_ts_decorate([
+_ts_decorate3([
   synchronized
 ], DataSpaceManager.prototype, "_open", null);
-_ts_decorate([
+_ts_decorate3([
   synchronized
 ], DataSpaceManager.prototype, "_close", null);
-_ts_decorate([
+_ts_decorate3([
   synchronized
 ], DataSpaceManager.prototype, "createSpace", null);
-_ts_decorate([
+_ts_decorate3([
   synchronized
 ], DataSpaceManager.prototype, "acceptSpace", null);
-DataSpaceManager = _ts_decorate([
+DataSpaceManager = _ts_decorate3([
   trackLeaks("open", "close")
 ], DataSpaceManager);
 
@@ -2491,7 +2775,7 @@ var SpacesServiceImpl = class {
     await this._updateMetrics();
     return this._serializeSpace(space);
   }
-  async updateSpace({ spaceKey, state }) {
+  async updateSpace({ spaceKey, state, edgeReplication }) {
     const dataSpaceManager = await this._getDataSpaceManager();
     const space = dataSpaceManager.spaces.get(spaceKey) ?? raise(new SpaceNotFoundError(spaceKey));
     if (state) {
@@ -2506,6 +2790,9 @@ var SpacesServiceImpl = class {
           throw new ApiError("Invalid space state");
       }
     }
+    if (edgeReplication !== void 0) {
+      await dataSpaceManager.setSpaceEdgeReplicationSetting(spaceKey, edgeReplication);
+    }
   }
   async updateMemberRole(request) {
     const identity = this._requireIdentity();
@@ -2522,7 +2809,7 @@ var SpacesServiceImpl = class {
     const credentials = await createAdmissionCredentials2(identity.getIdentityCredentialSigner(), request.memberKey, space.key, space.genesisFeedKey, request.newRole, space.spaceState.membershipChainHeads);
     invariant6(credentials[0].credential, void 0, {
       F: __dxlog_file11,
-      L: 102,
+      L: 106,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2532,7 +2819,7 @@ var SpacesServiceImpl = class {
     const spaceMemberCredential = credentials[0].credential.credential;
     invariant6(getCredentialAssertion3(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file11,
-      L: 104,
+      L: 108,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2550,7 +2837,7 @@ var SpacesServiceImpl = class {
           ids: spaces.map((space) => space.id)
         }), {
           F: __dxlog_file11,
-          L: 115,
+          L: 119,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2642,7 +2929,7 @@ var SpacesServiceImpl = class {
       } else {
         invariant6(!credential.id, "Id on unsigned credentials is not allowed", {
           F: __dxlog_file11,
-          L: 213,
+          L: 217,
           S: this,
           A: [
             "!credential.id",
@@ -2651,7 +2938,7 @@ var SpacesServiceImpl = class {
         });
         invariant6(this._identityManager.identity, "Identity is not available", {
           F: __dxlog_file11,
-          L: 214,
+          L: 218,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -2661,7 +2948,7 @@ var SpacesServiceImpl = class {
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
         invariant6(credential.issuer.equals(signer.getIssuer()), void 0, {
           F: __dxlog_file11,
-          L: 216,
+          L: 220,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -2711,7 +2998,7 @@ var SpacesServiceImpl = class {
     const assertion = getCredentialAssertion3(credential);
     invariant6(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file11,
-      L: 250,
+      L: 254,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2721,7 +3008,7 @@ var SpacesServiceImpl = class {
     const myIdentity = this._identityManager.identity;
     invariant6(myIdentity && credential.subject.id.equals(myIdentity.identityKey), void 0, {
       F: __dxlog_file11,
-      L: 252,
+      L: 256,
       S: this,
       A: [
         "myIdentity && credential.subject.id.equals(myIdentity.identityKey)",
@@ -2783,7 +3070,8 @@ var SpacesServiceImpl = class {
       }),
       creator: space.inner.spaceState.creator?.key,
       cache: space.cache,
-      metrics: space.metrics
+      metrics: space.metrics,
+      edgeReplication: space.getEdgeReplicationSetting()
     };
   }
   _requireIdentity() {
@@ -2807,7 +3095,7 @@ var SpacesServiceImpl = class {
 var getChannelId = (channel) => `user-channel/${channel}`;
 
 // packages/sdk/client-services/src/packlets/identity/identity.ts
-function _ts_decorate2(decorators, target, key, desc) {
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -2916,6 +3204,9 @@ var Identity = class {
   get presence() {
     return this._presence;
   }
+  get signer() {
+    return this._signer;
+  }
   /**
   * Issues credentials as identity.
   * Requires identity to be ready.
@@ -2923,7 +3214,7 @@ var Identity = class {
   getIdentityCredentialSigner() {
     invariant7(this._deviceStateMachine.deviceCredentialChain, "Device credential chain is not ready.", {
       F: __dxlog_file12,
-      L: 185,
+      L: 189,
       S: this,
       A: [
         "this._deviceStateMachine.deviceCredentialChain",
@@ -2967,7 +3258,7 @@ var Identity = class {
       dataFeedKey
     }, {
       F: __dxlog_file12,
-      L: 210,
+      L: 214,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3008,13 +3299,13 @@ var Identity = class {
     })));
   }
 };
-_ts_decorate2([
+_ts_decorate4([
   trace3.span()
 ], Identity.prototype, "open", null);
-_ts_decorate2([
+_ts_decorate4([
   trace3.span()
 ], Identity.prototype, "close", null);
-Identity = _ts_decorate2([
+Identity = _ts_decorate4([
   trace3.resource()
 ], Identity);
 
@@ -3033,7 +3324,7 @@ import { Gossip as Gossip2, Presence as Presence2 } from "@dxos/teleport-extensi
 import { Timeframe as Timeframe3 } from "@dxos/timeframe";
 import { trace as Trace2 } from "@dxos/tracing";
 import { isNode, deferFunction as deferFunction2 } from "@dxos/util";
-function _ts_decorate3(decorators, target, key, desc) {
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -3484,19 +3775,19 @@ var IdentityManager = class {
     });
   }
 };
-_ts_decorate3([
+_ts_decorate5([
   Trace2.span({
     showInBrowserTimeline: true
   })
 ], IdentityManager.prototype, "open", null);
-IdentityManager = _ts_decorate3([
+IdentityManager = _ts_decorate5([
   Trace2.resource()
 ], IdentityManager);
 
 // packages/sdk/client-services/src/packlets/identity/identity-service.ts
 import { Trigger as Trigger4, sleep as sleep2 } from "@dxos/async";
 import { Stream as Stream8 } from "@dxos/codec-protobuf";
-import { Resource as Resource4 } from "@dxos/context";
+import { Resource as Resource5 } from "@dxos/context";
 import { signPresentation } from "@dxos/credentials";
 import { todo } from "@dxos/debug";
 import { invariant as invariant9 } from "@dxos/invariant";
@@ -3505,7 +3796,7 @@ import { SpaceState as SpaceState3 } from "@dxos/protocols/proto/dxos/client/ser
 import { safeAwaitAll } from "@dxos/util";
 var __dxlog_file14 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-service.ts";
 var DEFAULT_SPACE_SEARCH_TIMEOUT = 1e4;
-var IdentityServiceImpl = class extends Resource4 {
+var IdentityServiceImpl = class extends Resource5 {
   constructor(_identityManager, _keyring, _dataSpaceManagerProvider, _createIdentity, _onProfileUpdate) {
     super();
     this._identityManager = _identityManager;
@@ -3649,7 +3940,7 @@ var IdentityServiceImpl = class extends Resource4 {
 };
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -3722,9 +4013,8 @@ var DataSpace = class {
   constructor(params) {
     this._ctx = new Context5(void 0, {
       F: __dxlog_file15,
-      L: 94
+      L: 95
     });
-    this._notarizationPlugin = new NotarizationPlugin();
     this._cache = void 0;
     this._edgeFeedReplicator = void 0;
     // TODO(dmaretskyi): Move into Space?
@@ -3753,6 +4043,11 @@ var DataSpace = class {
     this._signingContext = params.signingContext;
     this._callbacks = params.callbacks ?? {};
     this._echoHost = params.echoHost;
+    this._notarizationPlugin = new NotarizationPlugin({
+      spaceId: this._inner.id,
+      edgeClient: params.edgeHttpClient,
+      edgeFeatures: params.edgeFeatures
+    });
     this.authVerifier = new TrustedKeySetAuthVerifier({
       trustedKeysProvider: () => new ComplexSet3(PublicKey8.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => member.role !== SpaceMember5.Role.REMOVED).map((member) => member.key)),
       update: this._inner.stateUpdate,
@@ -3770,7 +4065,7 @@ var DataSpace = class {
       state: SpaceState4[this._state]
     }, {
       F: __dxlog_file15,
-      L: 164,
+      L: 170,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3829,7 +4124,7 @@ var DataSpace = class {
     }
     await this._inner.open(new Context5(void 0, {
       F: __dxlog_file15,
-      L: 238
+      L: 244
     }));
     await this._edgeFeedReplicator?.open();
     this._state = SpaceState4.SPACE_CONTROL_ONLY;
@@ -3837,7 +4132,7 @@ var DataSpace = class {
       state: SpaceState4[this._state]
     }, {
       F: __dxlog_file15,
-      L: 243,
+      L: 249,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3857,14 +4152,14 @@ var DataSpace = class {
       state: SpaceState4[this._state]
     }, {
       F: __dxlog_file15,
-      L: 262,
+      L: 268,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._ctx.dispose();
     this._ctx = new Context5(void 0, {
       F: __dxlog_file15,
-      L: 264
+      L: 270
     });
     if (this._edgeFeedReplicator) {
       this.inner.protocol.feedAdded.remove(this._onFeedAdded);
@@ -3897,7 +4192,7 @@ var DataSpace = class {
         if (err instanceof CancelledError || err instanceof ContextDisposedError) {
           log13("data pipeline initialization cancelled", err, {
             F: __dxlog_file15,
-            L: 302,
+            L: 308,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3905,7 +4200,7 @@ var DataSpace = class {
         }
         log13.error("Error initializing data pipeline", err, {
           F: __dxlog_file15,
-          L: 306,
+          L: 312,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3914,7 +4209,7 @@ var DataSpace = class {
           state: SpaceState4[this._state]
         }, {
           F: __dxlog_file15,
-          L: 308,
+          L: 314,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -3934,15 +4229,39 @@ var DataSpace = class {
       state: SpaceState4[this._state]
     }, {
       F: __dxlog_file15,
-      L: 324,
+      L: 330,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    log13("initializing control pipeline", void 0, {
+      F: __dxlog_file15,
+      L: 332,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._initializeAndReadControlPipeline();
     await sleep3(1);
     const ready = this.stateUpdate.waitForCondition(() => this._state === SpaceState4.SPACE_READY);
+    log13("initializing automerge root", void 0, {
+      F: __dxlog_file15,
+      L: 340,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     this._automergeSpaceState.startProcessingRootDocs();
+    log13("waiting for space to be ready", void 0, {
+      F: __dxlog_file15,
+      L: 344,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     await ready;
+    log13("space is ready", void 0, {
+      F: __dxlog_file15,
+      L: 346,
+      S: this,
+      C: (f, a) => f(...a)
+    });
   }
   async _enterReadyState() {
     await this._callbacks.beforeReady?.();
@@ -3951,7 +4270,7 @@ var DataSpace = class {
       state: SpaceState4[this._state]
     }, {
       F: __dxlog_file15,
-      L: 343,
+      L: 353,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3961,13 +4280,14 @@ var DataSpace = class {
   async _initializeAndReadControlPipeline() {
     await this._inner.controlPipeline.state.waitUntilReachedTargetTimeframe({
       ctx: this._ctx,
+      timeout: 1e4,
       breakOnStall: false
     });
     this.metrics.controlPipelineReady = /* @__PURE__ */ new Date();
     await this._createWritableFeeds();
     log13("writable feeds created", void 0, {
       F: __dxlog_file15,
-      L: 359,
+      L: 370,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4016,11 +4336,35 @@ var DataSpace = class {
       }));
     }
     if (credentials.length > 0) {
-      await this.notarizationPlugin.notarize({
-        ctx: this._ctx,
-        credentials,
-        timeout: 0
-      });
+      try {
+        log13("will notarize credentials for feed admission", {
+          count: credentials.length
+        }, {
+          F: __dxlog_file15,
+          L: 428,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        await this.notarizationPlugin.notarize({
+          ctx: this._ctx,
+          credentials,
+          timeout: 0
+        });
+        log13("credentials notarized", void 0, {
+          F: __dxlog_file15,
+          L: 432,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      } catch (err) {
+        log13.error("error notarizing credentials for feed admission", err, {
+          F: __dxlog_file15,
+          L: 434,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        throw err;
+      }
       await this._metadataStore.setWritableFeedKeys(this.key, this.inner.controlFeedKey, this.inner.dataFeedKey);
     }
   }
@@ -4030,7 +4374,7 @@ var DataSpace = class {
       rootUrl
     }, {
       F: __dxlog_file15,
-      L: 425,
+      L: 444,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4082,7 +4426,7 @@ var DataSpace = class {
           err
         }, {
           F: __dxlog_file15,
-          L: 468,
+          L: 487,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4172,58 +4516,61 @@ var DataSpace = class {
       state: SpaceState4[this._state]
     }, {
       F: __dxlog_file15,
-      L: 550,
+      L: 569,
       S: this,
       C: (f, a) => f(...a)
     });
     this.stateUpdate.emit();
   }
+  getEdgeReplicationSetting() {
+    return this._metadataStore.getSpaceEdgeReplicationSetting(this.key);
+  }
 };
-_ts_decorate4([
+_ts_decorate6([
   trace5.info()
 ], DataSpace.prototype, "_inner", void 0);
-_ts_decorate4([
+_ts_decorate6([
   trace5.info()
 ], DataSpace.prototype, "id", null);
-_ts_decorate4([
+_ts_decorate6([
   trace5.info()
 ], DataSpace.prototype, "key", null);
-_ts_decorate4([
+_ts_decorate6([
   trace5.info({
     enum: SpaceState4
   })
 ], DataSpace.prototype, "state", null);
-_ts_decorate4([
+_ts_decorate6([
   trace5.info({
     depth: null
   })
 ], DataSpace.prototype, "_automergeInfo", null);
-_ts_decorate4([
+_ts_decorate6([
   synchronized2
 ], DataSpace.prototype, "open", null);
-_ts_decorate4([
+_ts_decorate6([
   synchronized2
 ], DataSpace.prototype, "close", null);
-_ts_decorate4([
+_ts_decorate6([
   trace5.span({
     showInBrowserTimeline: true
   })
 ], DataSpace.prototype, "initializeDataPipeline", null);
-_ts_decorate4([
+_ts_decorate6([
   trace5.span({
     showInBrowserTimeline: true
   })
 ], DataSpace.prototype, "_initializeAndReadControlPipeline", null);
-_ts_decorate4([
+_ts_decorate6([
   timed(1e4)
 ], DataSpace.prototype, "_createWritableFeeds", null);
-_ts_decorate4([
+_ts_decorate6([
   synchronized2
 ], DataSpace.prototype, "activate", null);
-_ts_decorate4([
+_ts_decorate6([
   synchronized2
 ], DataSpace.prototype, "deactivate", null);
-DataSpace = _ts_decorate4([
+DataSpace = _ts_decorate6([
   trackLeaks2("open", "close"),
   trace5.resource()
 ], DataSpace);
@@ -4340,30 +4687,30 @@ var DeviceInvitationProtocol = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-import { Mutex as Mutex3, scheduleTask as scheduleTask6, TimeoutError as TimeoutError2 } from "@dxos/async";
+import { scheduleTask as scheduleTask7, TimeoutError as TimeoutError2 } from "@dxos/async";
 import { INVITATION_TIMEOUT } from "@dxos/client-protocol";
 import { ContextDisposedError as ContextDisposedError3 } from "@dxos/context";
 import { createKeyPair, sign } from "@dxos/crypto";
-import { invariant as invariant14 } from "@dxos/invariant";
+import { invariant as invariant15 } from "@dxos/invariant";
 import { PublicKey as PublicKey11 } from "@dxos/keys";
-import { log as log17 } from "@dxos/log";
+import { log as log19 } from "@dxos/log";
 import { createTeleportProtocolFactory } from "@dxos/network-manager";
 import { InvalidInvitationExtensionRoleError as InvalidInvitationExtensionRoleError3, trace as trace7 } from "@dxos/protocols";
-import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
+import { Invitation as Invitation7 } from "@dxos/protocols/proto/dxos/client/services";
 import { AuthenticationResponse as AuthenticationResponse2 } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { InvitationOptions as InvitationOptions4 } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { trace as _trace } from "@dxos/tracing";
 import { ComplexSet as ComplexSet5 } from "@dxos/util";
 
-// packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts
-import { Trigger as Trigger5 } from "@dxos/async";
-import { cancelWithContext as cancelWithContext4, Context as Context6 } from "@dxos/context";
+// packages/sdk/client-services/src/packlets/invitations/edge-invitation-handler.ts
+import { scheduleMicroTask as scheduleMicroTask3, scheduleTask as scheduleTask5 } from "@dxos/async";
+import { ed25519Signature } from "@dxos/crypto";
 import { invariant as invariant11 } from "@dxos/invariant";
+import { SpaceId as SpaceId2 } from "@dxos/keys";
 import { log as log14 } from "@dxos/log";
-import { InvalidInvitationExtensionRoleError } from "@dxos/protocols";
+import { EdgeAuthChallengeError, EdgeCallFailedError as EdgeCallFailedError2 } from "@dxos/protocols";
 import { schema as schema3 } from "@dxos/protocols/proto";
-import { InvitationOptions } from "@dxos/protocols/proto/dxos/halo/invitations";
-import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
+import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
 
 // packages/sdk/client-services/src/packlets/invitations/utils.ts
 import { cancelWithContext as cancelWithContext3, ContextDisposedError as ContextDisposedError2 } from "@dxos/context";
@@ -4384,24 +4731,184 @@ var tryAcquireBeforeContextDisposed = async (ctx, mutex) => {
   })());
 };
 
+// packages/sdk/client-services/src/packlets/invitations/edge-invitation-handler.ts
+var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/edge-invitation-handler.ts";
+var DEFAULT_REQUEST_RETRY_INTERVAL_MS = 3e3;
+var DEFAULT_REQUEST_RETRY_JITTER_MS = 500;
+var EdgeInvitationHandler = class {
+  constructor(config, _client, _callbacks) {
+    this._client = _client;
+    this._callbacks = _callbacks;
+    this._retryInterval = config?.retryInterval ?? DEFAULT_REQUEST_RETRY_INTERVAL_MS;
+    this._retryJitter = config?.retryJitter ?? DEFAULT_REQUEST_RETRY_JITTER_MS;
+  }
+  handle(ctx, guardedState, protocol, deviceProfile) {
+    if (!this._client) {
+      log14("edge disabled", void 0, {
+        F: __dxlog_file17,
+        L: 65,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return;
+    }
+    const invitation = guardedState.current;
+    const spaceId = invitation.spaceId;
+    const canBeHandledByEdge = invitation.authMethod !== Invitation4.AuthMethod.SHARED_SECRET && invitation.type === Invitation4.Type.DELEGATED && invitation.kind === Invitation4.Kind.SPACE && spaceId != null && SpaceId2.isValid(spaceId);
+    if (!canBeHandledByEdge) {
+      log14("invitation could not be handled by edge", {
+        invitation
+      }, {
+        F: __dxlog_file17,
+        L: 79,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return;
+    }
+    ctx.onDispose(() => {
+      this._flowLock?.release();
+      this._flowLock = void 0;
+    });
+    const tryHandleInvitation = async () => {
+      const admissionRequest = await protocol.createAdmissionRequest(deviceProfile);
+      if (admissionRequest.space) {
+        try {
+          await this._handleSpaceInvitationFlow(ctx, guardedState, admissionRequest.space, spaceId);
+        } catch (error) {
+          if (error instanceof EdgeCallFailedError2) {
+            log14.info("join space with edge unsuccessful", {
+              reason: error.message,
+              retryable: error.isRetryable,
+              after: error.retryAfterMs ?? this._calculateNextRetryMs()
+            }, {
+              F: __dxlog_file17,
+              L: 95,
+              S: this,
+              C: (f, a) => f(...a)
+            });
+            if (error.isRetryable) {
+              scheduleTask5(ctx, tryHandleInvitation, error.retryAfterMs ?? this._calculateNextRetryMs());
+            }
+          } else {
+            log14.info("failed to handle invitation with edge", {
+              error
+            }, {
+              F: __dxlog_file17,
+              L: 104,
+              S: this,
+              C: (f, a) => f(...a)
+            });
+            scheduleTask5(ctx, tryHandleInvitation, this._calculateNextRetryMs());
+          }
+        }
+      }
+    };
+    scheduleMicroTask3(ctx, tryHandleInvitation);
+  }
+  async _handleSpaceInvitationFlow(ctx, guardedState, admissionRequest, spaceId) {
+    try {
+      log14("edge invitation flow", void 0, {
+        F: __dxlog_file17,
+        L: 120,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      this._flowLock = await tryAcquireBeforeContextDisposed(ctx, guardedState.mutex);
+      log14("edge invitation flow acquired the lock", void 0, {
+        F: __dxlog_file17,
+        L: 122,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      guardedState.set(this, Invitation4.State.CONNECTING);
+      const response = await this._joinSpaceByInvitation(guardedState, spaceId, {
+        identityKey: admissionRequest.identityKey.toHex(),
+        invitationId: guardedState.current.invitationId
+      });
+      const admissionResponse = await this._mapToAdmissionResponse(response);
+      await this._callbacks.onInvitationSuccess(admissionResponse, {
+        space: admissionRequest
+      });
+    } catch (error) {
+      guardedState.set(this, Invitation4.State.ERROR);
+      throw error;
+    } finally {
+      this._flowLock?.release();
+      this._flowLock = void 0;
+    }
+  }
+  async _mapToAdmissionResponse(edgeResponse) {
+    const credentialBytes = Buffer.from(edgeResponse.spaceMemberCredential, "base64");
+    const codec = schema3.getCodecForType("dxos.halo.credentials.Credential");
+    return {
+      space: {
+        credential: codec.decode(credentialBytes)
+      }
+    };
+  }
+  async _joinSpaceByInvitation(guardedState, spaceId, request) {
+    invariant11(this._client, void 0, {
+      F: __dxlog_file17,
+      L: 157,
+      S: this,
+      A: [
+        "this._client",
+        ""
+      ]
+    });
+    try {
+      return await this._client.joinSpaceByInvitation(spaceId, request);
+    } catch (error) {
+      if (error instanceof EdgeAuthChallengeError) {
+        guardedState.set(this, Invitation4.State.AUTHENTICATING);
+        const publicKey = guardedState.current.guestKeypair?.publicKey;
+        const privateKey = guardedState.current.guestKeypair?.privateKey;
+        if (!privateKey || !publicKey) {
+          throw error;
+        }
+        const signature = await ed25519Signature(privateKey, Buffer.from(error.challenge, "base64"));
+        request.signature = Buffer.from(signature).toString("base64");
+        return this._client.joinSpaceByInvitation(spaceId, request);
+      } else {
+        throw error;
+      }
+    }
+  }
+  hasFlowLock() {
+    return this._flowLock != null;
+  }
+  _calculateNextRetryMs() {
+    return this._retryInterval + Math.random() * this._retryJitter;
+  }
+};
+
 // packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts
-var __dxlog_file17 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts";
+import { Trigger as Trigger5 } from "@dxos/async";
+import { cancelWithContext as cancelWithContext4, Context as Context6 } from "@dxos/context";
+import { invariant as invariant12 } from "@dxos/invariant";
+import { log as log15 } from "@dxos/log";
+import { InvalidInvitationExtensionRoleError } from "@dxos/protocols";
+import { schema as schema4 } from "@dxos/protocols/proto";
+import { InvitationOptions } from "@dxos/protocols/proto/dxos/halo/invitations";
+import { RpcExtension as RpcExtension2 } from "@dxos/teleport";
+var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-guest-extenstion.ts";
 var OPTIONS_TIMEOUT = 1e4;
 var InvitationGuestExtension = class extends RpcExtension2 {
   constructor(_invitationFlowMutex, _callbacks) {
     super({
       requested: {
-        InvitationHostService: schema3.getService("dxos.halo.invitations.InvitationHostService")
+        InvitationHostService: schema4.getService("dxos.halo.invitations.InvitationHostService")
       },
       exposed: {
-        InvitationHostService: schema3.getService("dxos.halo.invitations.InvitationHostService")
+        InvitationHostService: schema4.getService("dxos.halo.invitations.InvitationHostService")
       }
     });
     this._invitationFlowMutex = _invitationFlowMutex;
     this._callbacks = _callbacks;
     this._ctx = new Context6(void 0, {
-      F: __dxlog_file17,
-      L: 34
+      F: __dxlog_file18,
+      L: 38
     });
     this._remoteOptionsTrigger = new Trigger5();
     this._invitationFlowLock = null;
@@ -4413,9 +4920,9 @@ var InvitationGuestExtension = class extends RpcExtension2 {
     return {
       InvitationHostService: {
         options: async (options) => {
-          invariant11(!this._remoteOptions, "Remote options already set.", {
-            F: __dxlog_file17,
-            L: 64,
+          invariant12(!this._remoteOptions, "Remote options already set.", {
+            F: __dxlog_file18,
+            L: 68,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -4440,34 +4947,34 @@ var InvitationGuestExtension = class extends RpcExtension2 {
   async onOpen(context) {
     await super.onOpen(context);
     try {
-      log14("guest acquire lock", void 0, {
-        F: __dxlog_file17,
-        L: 85,
+      log15("guest acquire lock", void 0, {
+        F: __dxlog_file18,
+        L: 89,
         S: this,
         C: (f, a) => f(...a)
       });
       this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
-      log14("guest lock acquired", void 0, {
-        F: __dxlog_file17,
-        L: 87,
+      log15("guest lock acquired", void 0, {
+        F: __dxlog_file18,
+        L: 91,
         S: this,
         C: (f, a) => f(...a)
       });
       await cancelWithContext4(this._ctx, this.rpc.InvitationHostService.options({
         role: InvitationOptions.Role.GUEST
       }));
-      log14("options sent", void 0, {
-        F: __dxlog_file17,
-        L: 92,
+      log15("options sent", void 0, {
+        F: __dxlog_file18,
+        L: 96,
         S: this,
         C: (f, a) => f(...a)
       });
       await cancelWithContext4(this._ctx, this._remoteOptionsTrigger.wait({
         timeout: OPTIONS_TIMEOUT
       }));
-      log14("options received", void 0, {
-        F: __dxlog_file17,
-        L: 94,
+      log15("options received", void 0, {
+        F: __dxlog_file18,
+        L: 98,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -4499,9 +5006,9 @@ var InvitationGuestExtension = class extends RpcExtension2 {
     if (this._invitationFlowLock != null) {
       this._invitationFlowLock.release();
       this._invitationFlowLock = null;
-      log14("invitation flow lock released", void 0, {
-        F: __dxlog_file17,
-        L: 127,
+      log15("invitation flow lock released", void 0, {
+        F: __dxlog_file18,
+        L: 131,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -4510,35 +5017,35 @@ var InvitationGuestExtension = class extends RpcExtension2 {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitation-host-extension.ts
-import { Trigger as Trigger6, scheduleTask as scheduleTask5 } from "@dxos/async";
+import { Trigger as Trigger6, scheduleTask as scheduleTask6 } from "@dxos/async";
 import { cancelWithContext as cancelWithContext5, Context as Context7 } from "@dxos/context";
 import { randomBytes, verify } from "@dxos/crypto";
-import { invariant as invariant12, InvariantViolation } from "@dxos/invariant";
+import { invariant as invariant13, InvariantViolation } from "@dxos/invariant";
 import { PublicKey as PublicKey9 } from "@dxos/keys";
-import { log as log15 } from "@dxos/log";
+import { log as log16 } from "@dxos/log";
 import { InvalidInvitationExtensionRoleError as InvalidInvitationExtensionRoleError2, trace as trace6 } from "@dxos/protocols";
-import { schema as schema4 } from "@dxos/protocols/proto";
-import { Invitation as Invitation4 } from "@dxos/protocols/proto/dxos/client/services";
+import { schema as schema5 } from "@dxos/protocols/proto";
+import { Invitation as Invitation5 } from "@dxos/protocols/proto/dxos/client/services";
 import { AuthenticationResponse, InvitationOptions as InvitationOptions2 } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { RpcExtension as RpcExtension3 } from "@dxos/teleport";
-var __dxlog_file18 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-host-extension.ts";
+var __dxlog_file19 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-host-extension.ts";
 var OPTIONS_TIMEOUT2 = 1e4;
 var MAX_OTP_ATTEMPTS = 3;
 var InvitationHostExtension = class extends RpcExtension3 {
   constructor(_invitationFlowMutex, _callbacks) {
     super({
       requested: {
-        InvitationHostService: schema4.getService("dxos.halo.invitations.InvitationHostService")
+        InvitationHostService: schema5.getService("dxos.halo.invitations.InvitationHostService")
       },
       exposed: {
-        InvitationHostService: schema4.getService("dxos.halo.invitations.InvitationHostService")
+        InvitationHostService: schema5.getService("dxos.halo.invitations.InvitationHostService")
       }
     });
     this._invitationFlowMutex = _invitationFlowMutex;
     this._callbacks = _callbacks;
     this._ctx = new Context7(void 0, {
-      F: __dxlog_file18,
-      L: 53
+      F: __dxlog_file19,
+      L: 57
     });
     this._remoteOptionsTrigger = new Trigger6();
     this._challenge = void 0;
@@ -4557,9 +5064,9 @@ var InvitationHostExtension = class extends RpcExtension3 {
       // Perhaps in the future we will have more complex logic here.
       InvitationHostService: {
         options: async (options) => {
-          invariant12(!this._remoteOptions, "Remote options already set.", {
-            F: __dxlog_file18,
-            L: 102,
+          invariant13(!this._remoteOptions, "Remote options already set.", {
+            F: __dxlog_file19,
+            L: 106,
             S: this,
             A: [
               "!this._remoteOptions",
@@ -4572,48 +5079,48 @@ var InvitationHostExtension = class extends RpcExtension3 {
         introduce: async (request) => {
           const { profile, invitationId } = request;
           const traceId = PublicKey9.random().toHex();
-          log15.trace("dxos.sdk.invitation-handler.host.introduce", trace6.begin({
+          log16.trace("dxos.sdk.invitation-handler.host.introduce", trace6.begin({
             id: traceId
           }), {
-            F: __dxlog_file18,
-            L: 110,
+            F: __dxlog_file19,
+            L: 114,
             S: this,
             C: (f, a) => f(...a)
           });
           const invitation = this._requireActiveInvitation();
-          this._assertInvitationState(Invitation4.State.CONNECTED);
+          this._assertInvitationState(Invitation5.State.CONNECTED);
           if (invitationId !== invitation?.invitationId) {
-            log15.warn("incorrect invitationId", {
+            log16.warn("incorrect invitationId", {
               expected: invitation.invitationId,
               actual: invitationId
             }, {
-              F: __dxlog_file18,
-              L: 115,
+              F: __dxlog_file19,
+              L: 119,
               S: this,
               C: (f, a) => f(...a)
             });
             this._callbacks.onError(new Error("Incorrect invitationId."));
-            scheduleTask5(this._ctx, () => this.close());
+            scheduleTask6(this._ctx, () => this.close());
             return {
-              authMethod: Invitation4.AuthMethod.NONE
+              authMethod: Invitation5.AuthMethod.NONE
             };
           }
-          log15("guest introduced themselves", {
+          log16("guest introduced themselves", {
             guestProfile: profile
           }, {
-            F: __dxlog_file18,
-            L: 124,
+            F: __dxlog_file19,
+            L: 128,
             S: this,
             C: (f, a) => f(...a)
           });
           this.guestProfile = profile;
-          this._callbacks.onStateUpdate(Invitation4.State.READY_FOR_AUTHENTICATION);
-          this._challenge = invitation.authMethod === Invitation4.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : void 0;
-          log15.trace("dxos.sdk.invitation-handler.host.introduce", trace6.end({
+          this._callbacks.onStateUpdate(Invitation5.State.READY_FOR_AUTHENTICATION);
+          this._challenge = invitation.authMethod === Invitation5.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : void 0;
+          log16.trace("dxos.sdk.invitation-handler.host.introduce", trace6.end({
             id: traceId
           }), {
-            F: __dxlog_file18,
-            L: 130,
+            F: __dxlog_file19,
+            L: 134,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4624,34 +5131,34 @@ var InvitationHostExtension = class extends RpcExtension3 {
         },
         authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = PublicKey9.random().toHex();
-          log15.trace("dxos.sdk.invitation-handler.host.authenticate", trace6.begin({
+          log16.trace("dxos.sdk.invitation-handler.host.authenticate", trace6.begin({
             id: traceId
           }), {
-            F: __dxlog_file18,
-            L: 139,
+            F: __dxlog_file19,
+            L: 143,
             S: this,
             C: (f, a) => f(...a)
           });
           const invitation = this._requireActiveInvitation();
-          log15("received authentication request", {
+          log16("received authentication request", {
             authCode: code
           }, {
-            F: __dxlog_file18,
-            L: 142,
+            F: __dxlog_file19,
+            L: 146,
             S: this,
             C: (f, a) => f(...a)
           });
           let status = AuthenticationResponse.Status.OK;
           this._assertInvitationState([
-            Invitation4.State.AUTHENTICATING,
-            Invitation4.State.READY_FOR_AUTHENTICATION
+            Invitation5.State.AUTHENTICATING,
+            Invitation5.State.READY_FOR_AUTHENTICATION
           ]);
-          this._callbacks.onStateUpdate(Invitation4.State.AUTHENTICATING);
+          this._callbacks.onStateUpdate(Invitation5.State.AUTHENTICATING);
           switch (invitation.authMethod) {
-            case Invitation4.AuthMethod.NONE: {
-              log15("authentication not required", void 0, {
-                F: __dxlog_file18,
-                L: 150,
+            case Invitation5.AuthMethod.NONE: {
+              log16("authentication not required", void 0, {
+                F: __dxlog_file19,
+                L: 154,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -4659,7 +5166,7 @@ var InvitationHostExtension = class extends RpcExtension3 {
                 status: AuthenticationResponse.Status.OK
               };
             }
-            case Invitation4.AuthMethod.SHARED_SECRET: {
+            case Invitation5.AuthMethod.SHARED_SECRET: {
               if (invitation.authCode) {
                 if (this.authenticationRetry++ > MAX_OTP_ATTEMPTS) {
                   status = AuthenticationResponse.Status.INVALID_OPT_ATTEMPTS;
@@ -4671,7 +5178,7 @@ var InvitationHostExtension = class extends RpcExtension3 {
               }
               break;
             }
-            case Invitation4.AuthMethod.KNOWN_PUBLIC_KEY: {
+            case Invitation5.AuthMethod.KNOWN_PUBLIC_KEY: {
               if (!invitation.guestKeypair) {
                 status = AuthenticationResponse.Status.INTERNAL_ERROR;
                 break;
@@ -4685,11 +5192,11 @@ var InvitationHostExtension = class extends RpcExtension3 {
               break;
             }
             default: {
-              log15.error("invalid authentication method", {
+              log16.error("invalid authentication method", {
                 authMethod: invitation.authMethod
               }, {
-                F: __dxlog_file18,
-                L: 188,
+                F: __dxlog_file19,
+                L: 192,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -4702,19 +5209,19 @@ var InvitationHostExtension = class extends RpcExtension3 {
             AuthenticationResponse.Status.INVALID_OTP
           ].includes(status)) {
             this._callbacks.onError(new Error(`Authentication failed, with status=${status}`));
-            scheduleTask5(this._ctx, () => this.close());
+            scheduleTask6(this._ctx, () => this.close());
             return {
               status
             };
           }
-          log15.trace("dxos.sdk.invitation-handler.host.authenticate", trace6.end({
+          log16.trace("dxos.sdk.invitation-handler.host.authenticate", trace6.end({
             id: traceId,
             data: {
               status
             }
           }), {
-            F: __dxlog_file18,
-            L: 200,
+            F: __dxlog_file19,
+            L: 204,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -4724,28 +5231,28 @@ var InvitationHostExtension = class extends RpcExtension3 {
         },
         admit: async (request) => {
           const traceId = PublicKey9.random().toHex();
-          log15.trace("dxos.sdk.invitation-handler.host.admit", trace6.begin({
+          log16.trace("dxos.sdk.invitation-handler.host.admit", trace6.begin({
             id: traceId
           }), {
-            F: __dxlog_file18,
-            L: 206,
+            F: __dxlog_file19,
+            L: 210,
             S: this,
             C: (f, a) => f(...a)
           });
           const invitation = this._requireActiveInvitation();
           try {
             if (isAuthenticationRequired(invitation)) {
-              this._assertInvitationState(Invitation4.State.AUTHENTICATING);
+              this._assertInvitationState(Invitation5.State.AUTHENTICATING);
               if (!this.authenticationPassed) {
                 throw new Error("Not authenticated");
               }
             }
             const response = await this._callbacks.admit(request);
-            log15.trace("dxos.sdk.invitation-handler.host.admit", trace6.end({
+            log16.trace("dxos.sdk.invitation-handler.host.admit", trace6.end({
               id: traceId
             }), {
-              F: __dxlog_file18,
-              L: 220,
+              F: __dxlog_file19,
+              L: 224,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -4761,36 +5268,36 @@ var InvitationHostExtension = class extends RpcExtension3 {
   async onOpen(context) {
     await super.onOpen(context);
     try {
-      log15("host acquire lock", void 0, {
-        F: __dxlog_file18,
-        L: 235,
+      log16("host acquire lock", void 0, {
+        F: __dxlog_file19,
+        L: 239,
         S: this,
         C: (f, a) => f(...a)
       });
       this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
-      log15("host lock acquired", void 0, {
-        F: __dxlog_file18,
-        L: 237,
+      log16("host lock acquired", void 0, {
+        F: __dxlog_file19,
+        L: 241,
         S: this,
         C: (f, a) => f(...a)
       });
       const lastState = this._requireActiveInvitation().state;
-      this._callbacks.onStateUpdate(Invitation4.State.CONNECTING);
+      this._callbacks.onStateUpdate(Invitation5.State.CONNECTING);
       await this.rpc.InvitationHostService.options({
         role: InvitationOptions2.Role.HOST
       });
-      log15("options sent", void 0, {
-        F: __dxlog_file18,
-        L: 241,
+      log16("options sent", void 0, {
+        F: __dxlog_file19,
+        L: 245,
         S: this,
         C: (f, a) => f(...a)
       });
       await cancelWithContext5(this._ctx, this._remoteOptionsTrigger.wait({
         timeout: OPTIONS_TIMEOUT2
       }));
-      log15("options received", void 0, {
-        F: __dxlog_file18,
-        L: 243,
+      log16("options received", void 0, {
+        F: __dxlog_file19,
+        L: 247,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -4802,7 +5309,7 @@ var InvitationHostExtension = class extends RpcExtension3 {
           remotePeerId: context.remotePeerId
         });
       }
-      this._callbacks.onStateUpdate(Invitation4.State.CONNECTED);
+      this._callbacks.onStateUpdate(Invitation5.State.CONNECTED);
       this._callbacks.onOpen(this._ctx, context);
     } catch (err) {
       if (this._invitationFlowLock != null) {
@@ -4816,7 +5323,7 @@ var InvitationHostExtension = class extends RpcExtension3 {
   _requireActiveInvitation() {
     const invitation = this._callbacks.activeInvitation;
     if (invitation == null) {
-      scheduleTask5(this._ctx, () => this.close());
+      scheduleTask6(this._ctx, () => this.close());
       throw new Error("Active invitation not found");
     }
     return invitation;
@@ -4827,7 +5334,7 @@ var InvitationHostExtension = class extends RpcExtension3 {
       stateOrMany
     ];
     if (!validStates.includes(invitation.state)) {
-      scheduleTask5(this._ctx, () => this.close());
+      scheduleTask6(this._ctx, () => this.close());
       throw new InvariantViolation(`Expected ${stateToString(invitation.state)} to be one of [${validStates.map(stateToString).join(", ")}]`);
     }
   }
@@ -4842,32 +5349,127 @@ var InvitationHostExtension = class extends RpcExtension3 {
     if (this._invitationFlowLock != null) {
       this._invitationFlowLock?.release();
       this._invitationFlowLock = null;
-      log15("invitation flow lock released", void 0, {
-        F: __dxlog_file18,
-        L: 298,
+      log16("invitation flow lock released", void 0, {
+        F: __dxlog_file19,
+        L: 302,
         S: this,
         C: (f, a) => f(...a)
       });
     }
   }
 };
-var isAuthenticationRequired = (invitation) => invitation.authMethod !== Invitation4.AuthMethod.NONE;
+var isAuthenticationRequired = (invitation) => invitation.authMethod !== Invitation5.AuthMethod.NONE;
+
+// packages/sdk/client-services/src/packlets/invitations/invitation-state.ts
+import { Mutex as Mutex3 } from "@dxos/async";
+import { log as log17 } from "@dxos/log";
+import { Invitation as Invitation6 } from "@dxos/protocols/proto/dxos/client/services";
+var __dxlog_file20 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-state.ts";
+var createGuardedInvitationState = (ctx, invitation, stream) => {
+  const mutex = new Mutex3();
+  let lastActiveLockHolder = null;
+  let currentInvitation = {
+    ...invitation
+  };
+  const isStateChangeAllowed = (lockHolder) => {
+    if (ctx.disposed || lockHolder !== null && mutex.isLocked() && !lockHolder.hasFlowLock()) {
+      return false;
+    }
+    return lockHolder == null || lastActiveLockHolder !== lockHolder || isNonTerminalState(currentInvitation.state);
+  };
+  return {
+    mutex,
+    get current() {
+      return currentInvitation;
+    },
+    // disposing context prevents any further state updates
+    complete: (newState) => {
+      currentInvitation = {
+        ...currentInvitation,
+        ...newState
+      };
+      stream.next(currentInvitation);
+      return ctx.dispose();
+    },
+    set: (lockHolder, newState) => {
+      if (isStateChangeAllowed(lockHolder)) {
+        logStateUpdate(currentInvitation, lockHolder, newState);
+        currentInvitation = {
+          ...currentInvitation,
+          state: newState
+        };
+        stream.next(currentInvitation);
+        lastActiveLockHolder = lockHolder;
+        return true;
+      }
+      return false;
+    },
+    error: (lockHolder, error) => {
+      if (isStateChangeAllowed(lockHolder)) {
+        logStateUpdate(currentInvitation, lockHolder, Invitation6.State.ERROR);
+        currentInvitation = {
+          ...currentInvitation,
+          state: Invitation6.State.ERROR
+        };
+        stream.next(currentInvitation);
+        stream.error(error);
+        lastActiveLockHolder = lockHolder;
+        return true;
+      }
+      return false;
+    }
+  };
+};
+var logStateUpdate = (invitation, actor, newState) => {
+  if (isNonTerminalState(newState)) {
+    log17("invitation state update", {
+      actor: actor?.constructor.name,
+      newState: stateToString(newState),
+      oldState: stateToString(invitation.state)
+    }, {
+      F: __dxlog_file20,
+      L: 89,
+      S: void 0,
+      C: (f, a) => f(...a)
+    });
+  } else {
+    log17.info("invitation state update", {
+      actor: actor?.constructor.name,
+      newState: stateToString(newState),
+      oldState: stateToString(invitation.state)
+    }, {
+      F: __dxlog_file20,
+      L: 95,
+      S: void 0,
+      C: (f, a) => f(...a)
+    });
+  }
+};
+var isNonTerminalState = (currentState) => {
+  return ![
+    Invitation6.State.SUCCESS,
+    Invitation6.State.ERROR,
+    Invitation6.State.CANCELLED,
+    Invitation6.State.TIMEOUT,
+    Invitation6.State.EXPIRED
+  ].includes(currentState);
+};
 
 // packages/sdk/client-services/src/packlets/invitations/invitation-topology.ts
-import { invariant as invariant13 } from "@dxos/invariant";
+import { invariant as invariant14 } from "@dxos/invariant";
 import { PublicKey as PublicKey10 } from "@dxos/keys";
-import { log as log16 } from "@dxos/log";
+import { log as log18 } from "@dxos/log";
 import { InvitationOptions as InvitationOptions3 } from "@dxos/protocols/proto/dxos/halo/invitations";
 import { ComplexSet as ComplexSet4 } from "@dxos/util";
-var __dxlog_file19 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-topology.ts";
+var __dxlog_file21 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitation-topology.ts";
 var InvitationTopology = class {
   constructor(_role) {
     this._role = _role;
     this._seenPeers = new ComplexSet4(PublicKey10.hash);
   }
   init(controller) {
-    invariant13(!this._controller, "Already initialized.", {
-      F: __dxlog_file19,
+    invariant14(!this._controller, "Already initialized.", {
+      F: __dxlog_file21,
       L: 42,
       S: this,
       A: [
@@ -4878,8 +5480,8 @@ var InvitationTopology = class {
     this._controller = controller;
   }
   update() {
-    invariant13(this._controller, "Not initialized.", {
-      F: __dxlog_file19,
+    invariant14(this._controller, "Not initialized.", {
+      F: __dxlog_file21,
       L: 47,
       S: this,
       A: [
@@ -4898,11 +5500,11 @@ var InvitationTopology = class {
     const firstUnknownPeer = candidates.find((peerId) => !this._seenPeers.has(peerId));
     this._seenPeers = new ComplexSet4(PublicKey10.hash, allPeers.filter((peerId) => this._seenPeers.has(peerId)));
     if (firstUnknownPeer != null) {
-      log16("invitation connect", {
+      log18("invitation connect", {
         ownPeerId,
         remotePeerId: firstUnknownPeer
       }, {
-        F: __dxlog_file19,
+        F: __dxlog_file21,
         L: 69,
         S: this,
         C: (f, a) => f(...a)
@@ -4912,8 +5514,8 @@ var InvitationTopology = class {
     }
   }
   async onOffer(peer) {
-    invariant13(this._controller, "Not initialized.", {
-      F: __dxlog_file19,
+    invariant14(this._controller, "Not initialized.", {
+      F: __dxlog_file21,
       L: 76,
       S: this,
       A: [
@@ -4932,20 +5534,21 @@ var InvitationTopology = class {
 };
 
 // packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts
-var __dxlog_file20 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts";
+var __dxlog_file22 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-handler.ts";
 var metrics = _trace.metrics;
 var MAX_DELEGATED_INVITATION_HOST_TRIES = 3;
 var InvitationsHandler = class {
   /**
   * @internal
   */
-  constructor(_networkManager, _defaultTeleportParams) {
+  constructor(_networkManager, _edgeClient, _connectionParams) {
     this._networkManager = _networkManager;
-    this._defaultTeleportParams = _defaultTeleportParams;
+    this._edgeClient = _edgeClient;
+    this._connectionParams = _connectionParams;
   }
   handleInvitationFlow(ctx, stream, protocol, invitation) {
     metrics.increment("dxos.invitation.created");
-    const guardedState = this._createGuardedState(ctx, invitation, stream);
+    const guardedState = createGuardedInvitationState(ctx, invitation, stream);
     const createExtension = () => {
       const extension = new InvitationHostExtension(guardedState.mutex, {
         get activeInvitation() {
@@ -4958,9 +5561,9 @@ var InvitationsHandler = class {
         admit: async (admissionRequest) => {
           try {
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
-            invariant14(deviceKey, void 0, {
-              F: __dxlog_file20,
-              L: 94,
+            invariant15(deviceKey, void 0, {
+              F: __dxlog_file22,
+              L: 100,
               S: this,
               A: [
                 "deviceKey",
@@ -4982,44 +5585,44 @@ var InvitationsHandler = class {
               guardedState.error(extension, new ContextDisposedError3());
             }
           });
-          scheduleTask6(connectionCtx, async () => {
+          scheduleTask7(connectionCtx, async () => {
             const traceId = PublicKey11.random().toHex();
             try {
-              log17.trace("dxos.sdk.invitations-handler.host.onOpen", trace7.begin({
+              log19.trace("dxos.sdk.invitations-handler.host.onOpen", trace7.begin({
                 id: traceId
               }), {
-                F: __dxlog_file20,
-                L: 119,
+                F: __dxlog_file22,
+                L: 125,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              log17("connected", {
+              log19("connected", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file20,
-                L: 120,
+                F: __dxlog_file22,
+                L: 126,
                 S: this,
                 C: (f, a) => f(...a)
               });
               const deviceKey = await extension.completedTrigger.wait({
                 timeout: invitation.timeout
               });
-              log17("admitted guest", {
+              log19("admitted guest", {
                 guest: deviceKey,
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file20,
-                L: 122,
+                F: __dxlog_file22,
+                L: 128,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              guardedState.set(extension, Invitation5.State.SUCCESS);
+              guardedState.set(extension, Invitation7.State.SUCCESS);
               metrics.increment("dxos.invitation.success");
-              log17.trace("dxos.sdk.invitations-handler.host.onOpen", trace7.end({
+              log19.trace("dxos.sdk.invitations-handler.host.onOpen", trace7.end({
                 id: traceId
               }), {
-                F: __dxlog_file20,
-                L: 125,
+                F: __dxlog_file22,
+                L: 131,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5029,13 +5632,13 @@ var InvitationsHandler = class {
               }
             } catch (err) {
               if (err instanceof TimeoutError2) {
-                if (guardedState.set(extension, Invitation5.State.TIMEOUT)) {
+                if (guardedState.set(extension, Invitation7.State.TIMEOUT)) {
                   metrics.increment("dxos.invitation.timeout");
-                  log17("timeout", {
+                  log19("timeout", {
                     ...protocol.toJSON()
                   }, {
-                    F: __dxlog_file20,
-                    L: 135,
+                    F: __dxlog_file22,
+                    L: 141,
                     S: this,
                     C: (f, a) => f(...a)
                   });
@@ -5043,20 +5646,20 @@ var InvitationsHandler = class {
               } else {
                 if (guardedState.error(extension, err)) {
                   metrics.increment("dxos.invitation.failed");
-                  log17.error("failed", err, {
-                    F: __dxlog_file20,
-                    L: 140,
+                  log19.error("failed", err, {
+                    F: __dxlog_file22,
+                    L: 146,
                     S: this,
                     C: (f, a) => f(...a)
                   });
                 }
               }
-              log17.trace("dxos.sdk.invitations-handler.host.onOpen", trace7.error({
+              log19.trace("dxos.sdk.invitations-handler.host.onOpen", trace7.error({
                 id: traceId,
                 error: err
               }), {
-                F: __dxlog_file20,
-                L: 143,
+                F: __dxlog_file22,
+                L: 149,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5066,24 +5669,24 @@ var InvitationsHandler = class {
         },
         onError: (err) => {
           if (err instanceof InvalidInvitationExtensionRoleError3) {
-            log17("invalid role", {
+            log19("invalid role", {
               ...err.context
             }, {
-              F: __dxlog_file20,
-              L: 151,
+              F: __dxlog_file22,
+              L: 157,
               S: this,
               C: (f, a) => f(...a)
             });
             return;
           }
           if (err instanceof TimeoutError2) {
-            if (guardedState.set(extension, Invitation5.State.TIMEOUT)) {
+            if (guardedState.set(extension, Invitation7.State.TIMEOUT)) {
               metrics.increment("dxos.invitation.timeout");
-              log17("timeout", {
+              log19("timeout", {
                 err
               }, {
-                F: __dxlog_file20,
-                L: 157,
+                F: __dxlog_file22,
+                L: 163,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5091,9 +5694,9 @@ var InvitationsHandler = class {
           } else {
             if (guardedState.error(extension, err)) {
               metrics.increment("dxos.invitation.failed");
-              log17.error("failed", err, {
-                F: __dxlog_file20,
-                L: 162,
+              log19.error("failed", err, {
+                F: __dxlog_file22,
+                L: 168,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5105,33 +5708,33 @@ var InvitationsHandler = class {
     };
     if (invitation.lifetime && invitation.created) {
       if (invitation.created.getTime() + invitation.lifetime * 1e3 < Date.now()) {
-        log17.warn("invitation has already expired", void 0, {
-          F: __dxlog_file20,
-          L: 173,
+        log19.warn("invitation has already expired", void 0, {
+          F: __dxlog_file22,
+          L: 179,
           S: this,
           C: (f, a) => f(...a)
         });
       } else {
-        scheduleTask6(ctx, async () => {
+        scheduleTask7(ctx, async () => {
           await swarmConnection.close();
-          guardedState.set(null, Invitation5.State.EXPIRED);
+          guardedState.set(null, Invitation7.State.EXPIRED);
           metrics.increment("dxos.invitation.expired");
           await ctx.dispose();
         }, invitation.created.getTime() + invitation.lifetime * 1e3 - Date.now());
       }
     }
     let swarmConnection;
-    scheduleTask6(ctx, async () => {
+    scheduleTask7(ctx, async () => {
       swarmConnection = await this._joinSwarm(ctx, invitation, InvitationOptions4.Role.HOST, createExtension);
-      guardedState.set(null, Invitation5.State.CONNECTING);
+      guardedState.set(null, Invitation7.State.CONNECTING);
     });
   }
   acceptInvitation(ctx, stream, protocol, invitation, otpEnteredTrigger, deviceProfile) {
     const { timeout = INVITATION_TIMEOUT } = invitation;
     if (deviceProfile) {
-      invariant14(invitation.kind === Invitation5.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
-        F: __dxlog_file20,
-        L: 207,
+      invariant15(invitation.kind === Invitation7.Kind.DEVICE, "deviceProfile provided for non-device invitation", {
+        F: __dxlog_file22,
+        L: 213,
         S: this,
         A: [
           "invitation.kind === Invitation.Kind.DEVICE",
@@ -5140,23 +5743,23 @@ var InvitationsHandler = class {
       });
     }
     const triedPeersIds = new ComplexSet5(PublicKey11.hash);
-    const guardedState = this._createGuardedState(ctx, invitation, stream);
+    const guardedState = createGuardedInvitationState(ctx, invitation, stream);
     const shouldCancelInvitationFlow = (extension) => {
       const isLockedByAnotherConnection = guardedState.mutex.isLocked() && !extension.hasFlowLock();
-      log17("should cancel invitation flow", {
+      log19("should cancel invitation flow", {
         isLockedByAnotherConnection,
-        invitationType: Invitation5.Type.DELEGATED,
+        invitationType: Invitation7.Type.DELEGATED,
         triedPeers: triedPeersIds.size
       }, {
-        F: __dxlog_file20,
-        L: 215,
+        F: __dxlog_file22,
+        L: 221,
         S: this,
         C: (f, a) => f(...a)
       });
       if (isLockedByAnotherConnection) {
         return false;
       }
-      return invitation.type !== Invitation5.Type.DELEGATED || triedPeersIds.size >= MAX_DELEGATED_INVITATION_HOST_TRIES;
+      return invitation.type !== Invitation7.Type.DELEGATED || triedPeersIds.size >= MAX_DELEGATED_INVITATION_HOST_TRIES;
     };
     let admitted = false;
     const createExtension = () => {
@@ -5171,12 +5774,12 @@ var InvitationsHandler = class {
             return;
           }
           connectionCtx.onDispose(async () => {
-            log17("extension disposed", {
+            log19("extension disposed", {
               admitted,
               currentState: guardedState.current.state
             }, {
-              F: __dxlog_file20,
-              L: 243,
+              F: __dxlog_file22,
+              L: 249,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -5187,35 +5790,35 @@ var InvitationsHandler = class {
               }
             }
           });
-          scheduleTask6(connectionCtx, async () => {
+          scheduleTask7(connectionCtx, async () => {
             const traceId = PublicKey11.random().toHex();
             try {
-              log17.trace("dxos.sdk.invitations-handler.guest.onOpen", trace7.begin({
+              log19.trace("dxos.sdk.invitations-handler.guest.onOpen", trace7.begin({
                 id: traceId
               }), {
-                F: __dxlog_file20,
-                L: 255,
+                F: __dxlog_file22,
+                L: 261,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              scheduleTask6(connectionCtx, () => {
-                guardedState.set(extension, Invitation5.State.TIMEOUT);
+              scheduleTask7(connectionCtx, () => {
+                guardedState.set(extension, Invitation7.State.TIMEOUT);
                 extensionCtx.close();
               }, timeout);
-              log17("connected", {
+              log19("connected", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file20,
-                L: 266,
+                F: __dxlog_file22,
+                L: 272,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              guardedState.set(extension, Invitation5.State.CONNECTED);
-              log17("introduce", {
+              guardedState.set(extension, Invitation7.State.CONNECTED);
+              log19("introduce", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file20,
-                L: 270,
+                F: __dxlog_file22,
+                L: 276,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5223,33 +5826,33 @@ var InvitationsHandler = class {
                 invitationId: invitation.invitationId,
                 ...protocol.createIntroduction()
               });
-              log17("introduce response", {
+              log19("introduce response", {
                 ...protocol.toJSON(),
                 response: introductionResponse
               }, {
-                F: __dxlog_file20,
-                L: 275,
+                F: __dxlog_file22,
+                L: 281,
                 S: this,
                 C: (f, a) => f(...a)
               });
               invitation.authMethod = introductionResponse.authMethod;
               if (isAuthenticationRequired(invitation)) {
                 switch (invitation.authMethod) {
-                  case Invitation5.AuthMethod.SHARED_SECRET:
+                  case Invitation7.AuthMethod.SHARED_SECRET:
                     await this._handleGuestOtpAuth(extension, (state) => guardedState.set(extension, state), otpEnteredTrigger, {
                       timeout
                     });
                     break;
-                  case Invitation5.AuthMethod.KNOWN_PUBLIC_KEY:
+                  case Invitation7.AuthMethod.KNOWN_PUBLIC_KEY:
                     await this._handleGuestKpkAuth(extension, (state) => guardedState.set(extension, state), invitation, introductionResponse);
                     break;
                 }
               }
-              log17("request admission", {
+              log19("request admission", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file20,
-                L: 301,
+                F: __dxlog_file22,
+                L: 307,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5257,54 +5860,54 @@ var InvitationsHandler = class {
               const admissionResponse = await extension.rpc.InvitationHostService.admit(admissionRequest);
               admitted = true;
               const result = await protocol.accept(admissionResponse, admissionRequest);
-              log17("admitted by host", {
+              log19("admitted by host", {
                 ...protocol.toJSON()
               }, {
-                F: __dxlog_file20,
-                L: 312,
+                F: __dxlog_file22,
+                L: 318,
                 S: this,
                 C: (f, a) => f(...a)
               });
-              await guardedState.complete({
+              guardedState.complete({
                 ...guardedState.current,
                 ...result,
-                state: Invitation5.State.SUCCESS
+                state: Invitation7.State.SUCCESS
               });
-              log17.trace("dxos.sdk.invitations-handler.guest.onOpen", trace7.end({
+              log19.trace("dxos.sdk.invitations-handler.guest.onOpen", trace7.end({
                 id: traceId
               }), {
-                F: __dxlog_file20,
-                L: 318,
+                F: __dxlog_file22,
+                L: 324,
                 S: this,
                 C: (f, a) => f(...a)
               });
             } catch (err) {
               if (err instanceof TimeoutError2) {
-                log17("timeout", {
+                log19("timeout", {
                   ...protocol.toJSON()
                 }, {
-                  F: __dxlog_file20,
-                  L: 321,
+                  F: __dxlog_file22,
+                  L: 327,
                   S: this,
                   C: (f, a) => f(...a)
                 });
-                guardedState.set(extension, Invitation5.State.TIMEOUT);
+                guardedState.set(extension, Invitation7.State.TIMEOUT);
               } else {
-                log17("auth failed", err, {
-                  F: __dxlog_file20,
-                  L: 324,
+                log19("auth failed", err, {
+                  F: __dxlog_file22,
+                  L: 330,
                   S: this,
                   C: (f, a) => f(...a)
                 });
                 guardedState.error(extension, err);
               }
               extensionCtx.close(err);
-              log17.trace("dxos.sdk.invitations-handler.guest.onOpen", trace7.error({
+              log19.trace("dxos.sdk.invitations-handler.guest.onOpen", trace7.error({
                 id: traceId,
                 error: err
               }), {
-                F: __dxlog_file20,
-                L: 328,
+                F: __dxlog_file22,
+                L: 334,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -5316,19 +5919,19 @@ var InvitationsHandler = class {
             return;
           }
           if (err instanceof TimeoutError2) {
-            log17("timeout", {
+            log19("timeout", {
               ...protocol.toJSON()
             }, {
-              F: __dxlog_file20,
-              L: 337,
+              F: __dxlog_file22,
+              L: 343,
               S: this,
               C: (f, a) => f(...a)
             });
-            guardedState.set(extension, Invitation5.State.TIMEOUT);
+            guardedState.set(extension, Invitation7.State.TIMEOUT);
           } else {
-            log17("auth failed", err, {
-              F: __dxlog_file20,
-              L: 340,
+            log19("auth failed", err, {
+              F: __dxlog_file22,
+              L: 346,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -5338,15 +5941,34 @@ var InvitationsHandler = class {
       });
       return extension;
     };
-    scheduleTask6(ctx, async () => {
+    const edgeInvitationHandler = new EdgeInvitationHandler(this._connectionParams?.edgeInvitations, this._edgeClient, {
+      onInvitationSuccess: async (admissionResponse, admissionRequest) => {
+        const result = await protocol.accept(admissionResponse, admissionRequest);
+        log19("admitted by edge", {
+          ...protocol.toJSON()
+        }, {
+          F: __dxlog_file22,
+          L: 358,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        guardedState.complete({
+          ...guardedState.current,
+          ...result,
+          state: Invitation7.State.SUCCESS
+        });
+      }
+    });
+    edgeInvitationHandler.handle(ctx, guardedState, protocol, deviceProfile);
+    scheduleTask7(ctx, async () => {
       const error = protocol.checkInvitation(invitation);
       if (error) {
         stream.error(error);
         await ctx.dispose();
       } else {
-        invariant14(invitation.swarmKey, void 0, {
-          F: __dxlog_file20,
-          L: 355,
+        invariant15(invitation.swarmKey, void 0, {
+          F: __dxlog_file22,
+          L: 370,
           S: this,
           A: [
             "invitation.swarmKey",
@@ -5355,14 +5977,14 @@ var InvitationsHandler = class {
         });
         const timeoutInactive = () => {
           if (guardedState.mutex.isLocked()) {
-            scheduleTask6(ctx, timeoutInactive, timeout);
+            scheduleTask7(ctx, timeoutInactive, timeout);
           } else {
-            guardedState.set(null, Invitation5.State.TIMEOUT);
+            guardedState.set(null, Invitation7.State.TIMEOUT);
           }
         };
-        scheduleTask6(ctx, timeoutInactive, timeout);
+        scheduleTask7(ctx, timeoutInactive, timeout);
         await this._joinSwarm(ctx, invitation, InvitationOptions4.Role.GUEST, createExtension);
-        guardedState.set(null, Invitation5.State.CONNECTING);
+        guardedState.set(null, Invitation7.State.CONNECTING);
       }
     });
   }
@@ -5370,7 +5992,7 @@ var InvitationsHandler = class {
     let label;
     if (role === InvitationOptions4.Role.GUEST) {
       label = "invitation guest";
-    } else if (invitation.kind === Invitation5.Kind.DEVICE) {
+    } else if (invitation.kind === Invitation7.Kind.DEVICE) {
       label = "invitation host for device";
     } else {
       label = `invitation host for space ${invitation.spaceKey?.truncate()}`;
@@ -5379,123 +6001,30 @@ var InvitationsHandler = class {
       topic: invitation.swarmKey,
       protocolProvider: createTeleportProtocolFactory(async (teleport) => {
         teleport.addExtension("dxos.halo.invitations", extensionFactory());
-      }, this._defaultTeleportParams),
+      }, this._connectionParams?.teleport),
       topology: new InvitationTopology(role),
       label
     });
     ctx.onDispose(() => swarmConnection.close());
     return swarmConnection;
   }
-  /**
-  * A utility object for serializing invitation state changes by multiple concurrent
-  * invitation flow connections.
-  */
-  _createGuardedState(ctx, invitation, stream) {
-    const mutex = new Mutex3();
-    let lastActiveExtension = null;
-    let currentInvitation = {
-      ...invitation
-    };
-    const isStateChangeAllowed = (extension) => {
-      if (ctx.disposed || extension !== null && mutex.isLocked() && !extension.hasFlowLock()) {
-        return false;
-      }
-      return extension == null || lastActiveExtension !== extension || this._isNotTerminal(currentInvitation.state);
-    };
-    return {
-      mutex,
-      get current() {
-        return currentInvitation;
-      },
-      // disposing context prevents any further state updates
-      complete: (newState) => {
-        currentInvitation = {
-          ...currentInvitation,
-          ...newState
-        };
-        stream.next(currentInvitation);
-        return ctx.dispose();
-      },
-      set: (extension, newState) => {
-        if (isStateChangeAllowed(extension)) {
-          this._logStateUpdate(currentInvitation, extension, newState);
-          currentInvitation = {
-            ...currentInvitation,
-            state: newState
-          };
-          stream.next(currentInvitation);
-          lastActiveExtension = extension;
-          return true;
-        }
-        return false;
-      },
-      error: (extension, error) => {
-        if (isStateChangeAllowed(extension)) {
-          this._logStateUpdate(currentInvitation, extension, Invitation5.State.ERROR);
-          currentInvitation = {
-            ...currentInvitation,
-            state: Invitation5.State.ERROR
-          };
-          stream.next(currentInvitation);
-          stream.error(error);
-          lastActiveExtension = extension;
-          return true;
-        }
-        return false;
-      }
-    };
-  }
-  _logStateUpdate(invitation, actor, newState) {
-    if (this._isNotTerminal(newState)) {
-      log17("invitation state update", {
-        actor: actor?.constructor.name,
-        newState: stateToString(newState),
-        oldState: stateToString(invitation.state)
-      }, {
-        F: __dxlog_file20,
-        L: 460,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    } else {
-      log17("invitation state update", {
-        actor: actor?.constructor.name,
-        newState: stateToString(newState),
-        oldState: stateToString(invitation.state)
-      }, {
-        F: __dxlog_file20,
-        L: 466,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    }
-  }
-  _isNotTerminal(currentState) {
-    return ![
-      Invitation5.State.SUCCESS,
-      Invitation5.State.ERROR,
-      Invitation5.State.CANCELLED,
-      Invitation5.State.TIMEOUT,
-      Invitation5.State.EXPIRED
-    ].includes(currentState);
-  }
   async _handleGuestOtpAuth(extension, setState, authenticated, options) {
     for (let attempt = 1; attempt <= MAX_OTP_ATTEMPTS; attempt++) {
-      log17("guest waiting for authentication code...", void 0, {
-        F: __dxlog_file20,
-        L: 491,
+      log19("guest waiting for authentication code...", void 0, {
+        F: __dxlog_file22,
+        L: 422,
         S: this,
         C: (f, a) => f(...a)
       });
-      setState(Invitation5.State.READY_FOR_AUTHENTICATION);
+      setState(Invitation7.State.READY_FOR_AUTHENTICATION);
       const authCode = await authenticated.wait(options);
-      log17("sending authentication request", void 0, {
-        F: __dxlog_file20,
-        L: 495,
+      log19("sending authentication request", void 0, {
+        F: __dxlog_file22,
+        L: 426,
         S: this,
         C: (f, a) => f(...a)
       });
-      setState(Invitation5.State.AUTHENTICATING);
+      setState(Invitation7.State.AUTHENTICATING);
       const response = await extension.rpc.InvitationHostService.authenticate({
         authCode
       });
@@ -5506,11 +6035,11 @@ var InvitationsHandler = class {
         if (attempt === MAX_OTP_ATTEMPTS) {
           throw new Error(`Maximum retry attempts: ${MAX_OTP_ATTEMPTS}`);
         } else {
-          log17("retrying invalid code", {
+          log19("retrying invalid code", {
             attempt
           }, {
-            F: __dxlog_file20,
-            L: 506,
+            F: __dxlog_file22,
+            L: 437,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -5526,13 +6055,13 @@ var InvitationsHandler = class {
     if (introductionResponse.challenge == null) {
       throw new Error("challenge missing in the introduction");
     }
-    log17("sending authentication request", void 0, {
-      F: __dxlog_file20,
-      L: 525,
+    log19("sending authentication request", void 0, {
+      F: __dxlog_file22,
+      L: 456,
       S: this,
       C: (f, a) => f(...a)
     });
-    setState(Invitation5.State.AUTHENTICATING);
+    setState(Invitation7.State.AUTHENTICATING);
     const signature = sign(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
     const response = await extension.rpc.InvitationHostService.authenticate({
       signedChallenge: signature
@@ -5650,12 +6179,12 @@ var InvitationsServiceImpl = class {
 // packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts
 import { createCancelDelegatedSpaceInvitationCredential, createDelegatedSpaceInvitationCredential, getCredentialAssertion as getCredentialAssertion4 } from "@dxos/credentials";
 import { writeMessages as writeMessages4 } from "@dxos/feed-store";
-import { invariant as invariant15 } from "@dxos/invariant";
-import { log as log18 } from "@dxos/log";
+import { invariant as invariant16 } from "@dxos/invariant";
+import { log as log20 } from "@dxos/log";
 import { AlreadyJoinedError as AlreadyJoinedError3, AuthorizationError as AuthorizationError2, InvalidInvitationError, SpaceNotFoundError as SpaceNotFoundError2 } from "@dxos/protocols";
-import { Invitation as Invitation6 } from "@dxos/protocols/proto/dxos/client/services";
+import { Invitation as Invitation8 } from "@dxos/protocols/proto/dxos/client/services";
 import { SpaceMember as SpaceMember6 } from "@dxos/protocols/proto/dxos/halo/credentials";
-var __dxlog_file21 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
+var __dxlog_file23 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/space-invitation-protocol.ts";
 var SpaceInvitationProtocol = class {
   constructor(_spaceManager, _signingContext, _keyring, _spaceKey) {
     this._spaceManager = _spaceManager;
@@ -5683,27 +6212,47 @@ var SpaceInvitationProtocol = class {
     return void 0;
   }
   getInvitationContext() {
+    invariant16(this._spaceKey, void 0, {
+      F: __dxlog_file23,
+      L: 63,
+      S: this,
+      A: [
+        "this._spaceKey",
+        ""
+      ]
+    });
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    invariant16(space, void 0, {
+      F: __dxlog_file23,
+      L: 65,
+      S: this,
+      A: [
+        "space",
+        ""
+      ]
+    });
     return {
-      kind: Invitation6.Kind.SPACE,
-      spaceKey: this._spaceKey
+      kind: Invitation8.Kind.SPACE,
+      spaceKey: this._spaceKey,
+      spaceId: space.id
     };
   }
   async admit(invitation, request, guestProfile) {
-    invariant15(this._spaceKey && request.space, void 0, {
-      F: __dxlog_file21,
-      L: 74,
+    invariant16(this._spaceKey && request.space, void 0, {
+      F: __dxlog_file23,
+      L: 78,
       S: this,
       A: [
         "this._spaceKey && request.space",
         ""
       ]
     });
-    log18("writing guest credentials", {
+    log20("writing guest credentials", {
       host: this._signingContext.deviceKey,
       guest: request.space.deviceKey
     }, {
-      F: __dxlog_file21,
-      L: 75,
+      F: __dxlog_file23,
+      L: 79,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5723,29 +6272,29 @@ var SpaceInvitationProtocol = class {
     };
   }
   async delegate(invitation) {
-    invariant15(this._spaceKey, void 0, {
-      F: __dxlog_file21,
-      L: 95,
+    invariant16(this._spaceKey, void 0, {
+      F: __dxlog_file23,
+      L: 99,
       S: this,
       A: [
         "this._spaceKey",
         ""
       ]
     });
-    const space = this._spaceManager.spaces.get(this._spaceKey);
-    invariant15(space, void 0, {
-      F: __dxlog_file21,
-      L: 97,
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    invariant16(space, void 0, {
+      F: __dxlog_file23,
+      L: 101,
       S: this,
       A: [
         "space",
         ""
       ]
     });
-    if (invitation.authMethod === Invitation6.AuthMethod.KNOWN_PUBLIC_KEY) {
-      invariant15(invitation.guestKeypair?.publicKey, void 0, {
-        F: __dxlog_file21,
-        L: 99,
+    if (invitation.authMethod === Invitation8.AuthMethod.KNOWN_PUBLIC_KEY) {
+      invariant16(invitation.guestKeypair?.publicKey, void 0, {
+        F: __dxlog_file23,
+        L: 103,
         S: this,
         A: [
           "invitation.guestKeypair?.publicKey",
@@ -5753,12 +6302,12 @@ var SpaceInvitationProtocol = class {
         ]
       });
     }
-    log18("writing delegate space invitation", {
+    log20("writing delegate space invitation", {
       host: this._signingContext.deviceKey,
       id: invitation.invitationId
     }, {
-      F: __dxlog_file21,
-      L: 102,
+      F: __dxlog_file23,
+      L: 106,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -5769,11 +6318,11 @@ var SpaceInvitationProtocol = class {
       role: invitation.role ?? SpaceMember6.Role.ADMIN,
       expiresOn: invitation.lifetime ? new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime) : void 0,
       multiUse: invitation.multiUse ?? false,
-      guestKey: invitation.authMethod === Invitation6.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
+      guestKey: invitation.authMethod === Invitation8.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
     });
-    invariant15(credential.credential, void 0, {
-      F: __dxlog_file21,
-      L: 122,
+    invariant16(credential.credential, void 0, {
+      F: __dxlog_file23,
+      L: 126,
       S: this,
       A: [
         "credential.credential",
@@ -5786,18 +6335,18 @@ var SpaceInvitationProtocol = class {
     return credential.credential.credential.id;
   }
   async cancelDelegation(invitation) {
-    invariant15(this._spaceKey, void 0, {
-      F: __dxlog_file21,
-      L: 128,
+    invariant16(this._spaceKey, void 0, {
+      F: __dxlog_file23,
+      L: 132,
       S: this,
       A: [
         "this._spaceKey",
         ""
       ]
     });
-    invariant15(invitation.type === Invitation6.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
-      F: __dxlog_file21,
-      L: 129,
+    invariant16(invitation.type === Invitation8.Type.DELEGATED && invitation.delegationCredentialId, void 0, {
+      F: __dxlog_file23,
+      L: 133,
       S: this,
       A: [
         "invitation.type === Invitation.Type.DELEGATED && invitation.delegationCredentialId",
@@ -5805,28 +6354,28 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const space = this._spaceManager.spaces.get(this._spaceKey);
-    invariant15(space, void 0, {
-      F: __dxlog_file21,
-      L: 131,
+    invariant16(space, void 0, {
+      F: __dxlog_file23,
+      L: 135,
       S: this,
       A: [
         "space",
         ""
       ]
     });
-    log18("cancelling delegated space invitation", {
+    log20("cancelling delegated space invitation", {
       host: this._signingContext.deviceKey,
       id: invitation.invitationId
     }, {
-      F: __dxlog_file21,
-      L: 133,
+      F: __dxlog_file23,
+      L: 137,
       S: this,
       C: (f, a) => f(...a)
     });
     const credential = await createCancelDelegatedSpaceInvitationCredential(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
-    invariant15(credential.credential, void 0, {
-      F: __dxlog_file21,
-      L: 140,
+    invariant16(credential.credential, void 0, {
+      F: __dxlog_file23,
+      L: 144,
       S: this,
       A: [
         "credential.credential",
@@ -5863,9 +6412,9 @@ var SpaceInvitationProtocol = class {
     };
   }
   async accept(response) {
-    invariant15(response.space, void 0, {
-      F: __dxlog_file21,
-      L: 175,
+    invariant16(response.space, void 0, {
+      F: __dxlog_file23,
+      L: 179,
       S: this,
       A: [
         "response.space",
@@ -5874,18 +6423,18 @@ var SpaceInvitationProtocol = class {
     });
     const { credential, controlTimeframe, dataTimeframe } = response.space;
     const assertion = getCredentialAssertion4(credential);
-    invariant15(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
-      F: __dxlog_file21,
-      L: 178,
+    invariant16(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
+      F: __dxlog_file23,
+      L: 182,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
         "'Invalid credential'"
       ]
     });
-    invariant15(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
-      F: __dxlog_file21,
-      L: 179,
+    invariant16(credential.subject.id.equals(this._signingContext.identityKey), void 0, {
+      F: __dxlog_file23,
+      L: 183,
       S: this,
       A: [
         "credential.subject.id.equals(this._signingContext.identityKey)",
@@ -5914,12 +6463,12 @@ import { AuthenticatingInvitation, AUTHENTICATION_CODE_LENGTH, CancellableInvita
 import { Context as Context8 } from "@dxos/context";
 import { generatePasscode } from "@dxos/credentials";
 import { hasInvitationExpired } from "@dxos/echo-pipeline";
-import { invariant as invariant16 } from "@dxos/invariant";
+import { invariant as invariant17 } from "@dxos/invariant";
 import { PublicKey as PublicKey12 } from "@dxos/keys";
-import { log as log19 } from "@dxos/log";
-import { Invitation as Invitation7 } from "@dxos/protocols/proto/dxos/client/services";
+import { log as log21 } from "@dxos/log";
+import { Invitation as Invitation9 } from "@dxos/protocols/proto/dxos/client/services";
 import { SpaceMember as SpaceMember7 } from "@dxos/protocols/proto/dxos/halo/credentials";
-var __dxlog_file22 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
+var __dxlog_file24 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/invitations/invitations-manager.ts";
 var InvitationsManager = class {
   constructor(_invitationsHandler, _getHandler, _metadataStore) {
     this._invitationsHandler = _invitationsHandler;
@@ -5961,8 +6510,8 @@ var InvitationsManager = class {
     try {
       await this._persistIfRequired(handler, stream, invitation);
     } catch (err) {
-      log19.catch(err, void 0, {
-        F: __dxlog_file22,
+      log21.catch(err, void 0, {
+        F: __dxlog_file24,
         L: 82,
         S: this,
         C: (f, a) => f(...a)
@@ -5984,8 +6533,8 @@ var InvitationsManager = class {
       const persistentInvitations = this._metadataStore.getInvitations();
       const freshInvitations = persistentInvitations.filter((invitation) => !hasInvitationExpired(invitation));
       const loadTasks = freshInvitations.map((persistentInvitation) => {
-        invariant16(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
-          F: __dxlog_file22,
+        invariant17(!this._createInvitations.get(persistentInvitation.invitationId), "invitation already exists", {
+          F: __dxlog_file24,
           L: 103,
           S: this,
           A: [
@@ -6003,8 +6552,8 @@ var InvitationsManager = class {
         invitations: cInvitations.map((invitation) => invitation.get())
       };
     } catch (err) {
-      log19.catch(err, void 0, {
-        F: __dxlog_file22,
+      log21.catch(err, void 0, {
+        F: __dxlog_file24,
         L: 110,
         S: this,
         C: (f, a) => f(...a)
@@ -6035,14 +6584,14 @@ var InvitationsManager = class {
     return invitation;
   }
   async authenticate({ invitationId, authCode }) {
-    log19("authenticating...", void 0, {
-      F: __dxlog_file22,
+    log21("authenticating...", void 0, {
+      F: __dxlog_file24,
       L: 140,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant16(invitationId, void 0, {
-      F: __dxlog_file22,
+    invariant17(invitationId, void 0, {
+      F: __dxlog_file24,
       L: 141,
       S: this,
       A: [
@@ -6052,10 +6601,10 @@ var InvitationsManager = class {
     });
     const observable = this._acceptInvitations.get(invitationId);
     if (!observable) {
-      log19.warn("invalid invitation", {
+      log21.warn("invalid invitation", {
         invitationId
       }, {
-        F: __dxlog_file22,
+        F: __dxlog_file24,
         L: 144,
         S: this,
         C: (f, a) => f(...a)
@@ -6065,16 +6614,16 @@ var InvitationsManager = class {
     }
   }
   async cancelInvitation({ invitationId }) {
-    log19("cancelInvitation...", {
+    log21("cancelInvitation...", {
       invitationId
     }, {
-      F: __dxlog_file22,
+      F: __dxlog_file24,
       L: 151,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant16(invitationId, void 0, {
-      F: __dxlog_file22,
+    invariant17(invitationId, void 0, {
+      F: __dxlog_file24,
       L: 152,
       S: this,
       A: [
@@ -6087,7 +6636,7 @@ var InvitationsManager = class {
       if (created.get().persistent) {
         await this._metadataStore.removeInvitation(invitationId);
       }
-      if (created.get().type === Invitation7.Type.DELEGATED) {
+      if (created.get().type === Invitation9.Type.DELEGATED) {
         const handler = this._getHandler(created.get());
         await handler.cancelDelegation(created.get());
       }
@@ -6121,8 +6670,8 @@ var InvitationsManager = class {
     }
   }
   _createInvitation(protocol, options) {
-    const { invitationId = PublicKey12.random().toHex(), type = Invitation7.Type.INTERACTIVE, authMethod = Invitation7.AuthMethod.SHARED_SECRET, state = Invitation7.State.INIT, timeout = INVITATION_TIMEOUT2, swarmKey = PublicKey12.random(), persistent = options?.authMethod !== Invitation7.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, role = SpaceMember7.Role.ADMIN, lifetime = 86400, multiUse = false } = options ?? {};
-    const authCode = options?.authCode ?? (authMethod === Invitation7.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0);
+    const { invitationId = PublicKey12.random().toHex(), type = Invitation9.Type.INTERACTIVE, authMethod = Invitation9.AuthMethod.SHARED_SECRET, state = Invitation9.State.INIT, timeout = INVITATION_TIMEOUT2, swarmKey = PublicKey12.random(), persistent = options?.authMethod !== Invitation9.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, role = SpaceMember7.Role.ADMIN, lifetime = 86400, multiUse = false } = options ?? {};
+    const authCode = options?.authCode ?? (authMethod === Invitation9.AuthMethod.SHARED_SECRET ? generatePasscode(AUTHENTICATION_CODE_LENGTH) : void 0);
     return {
       invitationId,
       type,
@@ -6131,8 +6680,8 @@ var InvitationsManager = class {
       swarmKey,
       authCode,
       timeout,
-      persistent: persistent && type !== Invitation7.Type.DELEGATED,
-      guestKeypair: guestKeypair ?? (authMethod === Invitation7.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
+      persistent: persistent && type !== Invitation9.Type.DELEGATED,
+      guestKeypair: guestKeypair ?? (authMethod === Invitation9.AuthMethod.KNOWN_PUBLIC_KEY ? createAdmissionKeypair() : void 0),
       created,
       lifetime,
       role,
@@ -6149,14 +6698,14 @@ var InvitationsManager = class {
         void ctx.dispose();
       }
     }, {
-      F: __dxlog_file22,
+      F: __dxlog_file24,
       L: 234
     });
     ctx.onDispose(() => {
-      log19("complete", {
+      log21("complete", {
         ...handler.toJSON()
       }, {
-        F: __dxlog_file22,
+        F: __dxlog_file24,
         L: 241,
         S: this,
         C: (f, a) => f(...a)
@@ -6169,7 +6718,7 @@ var InvitationsManager = class {
       onCancel: async () => {
         stream.next({
           ...invitation,
-          state: Invitation7.State.CANCELLED
+          state: Invitation9.State.CANCELLED
         });
         await ctx.dispose();
       }
@@ -6186,41 +6735,41 @@ var InvitationsManager = class {
     const ctx = new Context8({
       onError: (err) => {
         if (err instanceof TimeoutError3) {
-          log19("timeout", {
+          log21("timeout", {
             ...handler.toJSON()
           }, {
-            F: __dxlog_file22,
+            F: __dxlog_file24,
             L: 261,
             S: this,
             C: (f, a) => f(...a)
           });
           stream.next({
             ...initialState,
-            state: Invitation7.State.TIMEOUT
+            state: Invitation9.State.TIMEOUT
           });
         } else {
-          log19.warn("auth failed", err, {
-            F: __dxlog_file22,
+          log21.warn("auth failed", err, {
+            F: __dxlog_file24,
             L: 264,
             S: this,
             C: (f, a) => f(...a)
           });
           stream.next({
             ...initialState,
-            state: Invitation7.State.ERROR
+            state: Invitation9.State.ERROR
           });
         }
         void ctx.dispose();
       }
     }, {
-      F: __dxlog_file22,
+      F: __dxlog_file24,
       L: 258
     });
     ctx.onDispose(() => {
-      log19("complete", {
+      log21("complete", {
         ...handler.toJSON()
       }, {
-        F: __dxlog_file22,
+        F: __dxlog_file24,
         L: 271,
         S: this,
         C: (f, a) => f(...a)
@@ -6233,7 +6782,7 @@ var InvitationsManager = class {
       onCancel: async () => {
         stream.next({
           ...initialState,
-          state: Invitation7.State.CANCELLED
+          state: Invitation9.State.CANCELLED
         });
         await ctx.dispose();
       },
@@ -6249,7 +6798,7 @@ var InvitationsManager = class {
     };
   }
   async _persistIfRequired(handler, changeStream, invitation) {
-    if (invitation.type === Invitation7.Type.DELEGATED && invitation.delegationCredentialId == null) {
+    if (invitation.type === Invitation9.Type.DELEGATED && invitation.delegationCredentialId == null) {
       const delegationCredentialId = await handler.delegate(invitation);
       changeStream.next({
         ...invitation,
@@ -6264,8 +6813,8 @@ var InvitationsManager = class {
     try {
       await this._metadataStore.removeInvitation(invitation.invitationId);
     } catch (err) {
-      log19.catch(err, void 0, {
-        F: __dxlog_file22,
+      log21.catch(err, void 0, {
+        F: __dxlog_file24,
         L: 307,
         S: this,
         C: (f, a) => f(...a)
@@ -6282,14 +6831,14 @@ var InvitationsManager = class {
 // packages/sdk/client-services/src/packlets/locks/browser.ts
 import { asyncTimeout as asyncTimeout2, Trigger as Trigger8 } from "@dxos/async";
 import { RESOURCE_LOCK_TIMEOUT } from "@dxos/client-protocol";
-import { log as log20, logInfo } from "@dxos/log";
-function _ts_decorate5(decorators, target, key, desc) {
+import { log as log22, logInfo as logInfo3 } from "@dxos/log";
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file23 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/browser.ts";
+var __dxlog_file25 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/locks/browser.ts";
 var Message;
 (function(Message2) {
   Message2["ACQUIRING"] = "acquiring";
@@ -6311,29 +6860,29 @@ var Lock = class {
       message: "acquiring"
     });
     try {
-      log20("aquiring lock...", void 0, {
-        F: __dxlog_file23,
+      log22("aquiring lock...", void 0, {
+        F: __dxlog_file25,
         L: 42,
         S: this,
         C: (f, a) => f(...a)
       });
       await asyncTimeout2(this._requestLock(), RESOURCE_LOCK_TIMEOUT);
-      log20("acquired lock", void 0, {
-        F: __dxlog_file23,
+      log22("acquired lock", void 0, {
+        F: __dxlog_file25,
         L: 44,
         S: this,
         C: (f, a) => f(...a)
       });
     } catch {
-      log20("stealing lock...", void 0, {
-        F: __dxlog_file23,
+      log22("stealing lock...", void 0, {
+        F: __dxlog_file25,
         L: 46,
         S: this,
         C: (f, a) => f(...a)
       });
       await this._requestLock(true);
-      log20("stolen lock", void 0, {
-        F: __dxlog_file23,
+      log22("stolen lock", void 0, {
+        F: __dxlog_file25,
         L: 48,
         S: this,
         C: (f, a) => f(...a)
@@ -6349,10 +6898,10 @@ var Lock = class {
     }
   }
   async _requestLock(steal = false) {
-    log20("requesting lock...", {
+    log22("requesting lock...", {
       steal
     }, {
-      F: __dxlog_file23,
+      F: __dxlog_file25,
       L: 63,
       S: this,
       C: (f, a) => f(...a)
@@ -6365,15 +6914,15 @@ var Lock = class {
       acquired.wake();
       this._releaseTrigger = new Trigger8();
       await this._releaseTrigger.wait();
-      log20("releasing lock...", void 0, {
-        F: __dxlog_file23,
+      log22("releasing lock...", void 0, {
+        F: __dxlog_file25,
         L: 72,
         S: this,
         C: (f, a) => f(...a)
       });
       await this._onRelease?.();
-      log20("released lock", void 0, {
-        F: __dxlog_file23,
+      log22("released lock", void 0, {
+        F: __dxlog_file25,
         L: 74,
         S: this,
         C: (f, a) => f(...a)
@@ -6382,18 +6931,18 @@ var Lock = class {
       await this._onRelease?.();
     });
     await acquired.wait();
-    log20("recieved lock", {
+    log22("recieved lock", {
       steal
     }, {
-      F: __dxlog_file23,
+      F: __dxlog_file25,
       L: 81,
       S: this,
       C: (f, a) => f(...a)
     });
   }
 };
-_ts_decorate5([
-  logInfo
+_ts_decorate7([
+  logInfo3
 ], Lock.prototype, "lockKey", null);
 var isLocked = (lockPath) => {
   throw new Error("Not implemented");
@@ -6404,7 +6953,7 @@ import { Stream as Stream10 } from "@dxos/codec-protobuf";
 import { raise as raise2 } from "@dxos/debug";
 import { parseMethodName, RpcPeer } from "@dxos/rpc";
 import { MapCounter, trace as trace8 } from "@dxos/tracing";
-function _ts_decorate6(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -6466,49 +7015,114 @@ var ClientRpcServer = class {
     return this._handlerCache.get(serviceName);
   }
 };
-_ts_decorate6([
+_ts_decorate8([
   trace8.metricsCounter()
 ], ClientRpcServer.prototype, "_callMetrics", void 0);
-_ts_decorate6([
+_ts_decorate8([
   trace8.info()
 ], ClientRpcServer.prototype, "_services", null);
-ClientRpcServer = _ts_decorate6([
+ClientRpcServer = _ts_decorate8([
   trace8.resource()
 ], ClientRpcServer);
 
 // packages/sdk/client-services/src/packlets/services/service-context.ts
-import { Trigger as Trigger9 } from "@dxos/async";
-import { Context as Context9, Resource as Resource5 } from "@dxos/context";
+import { Mutex as Mutex4, scheduleMicroTask as scheduleMicroTask4, Trigger as Trigger9 } from "@dxos/async";
+import { Context as Context9, Resource as Resource6 } from "@dxos/context";
 import { getCredentialAssertion as getCredentialAssertion5 } from "@dxos/credentials";
-import { failUndefined as failUndefined2 } from "@dxos/debug";
+import { failUndefined as failUndefined2, warnAfterTimeout as warnAfterTimeout2 } from "@dxos/debug";
 import { EchoEdgeReplicator, EchoHost, MeshEchoReplicator, MetadataStore, SpaceManager, valueEncoding } from "@dxos/echo-pipeline";
+import { createChainEdgeIdentity, createEphemeralEdgeIdentity } from "@dxos/edge-client";
 import { FeedFactory, FeedStore } from "@dxos/feed-store";
-import { invariant as invariant17 } from "@dxos/invariant";
+import { invariant as invariant18 } from "@dxos/invariant";
 import { Keyring } from "@dxos/keyring";
 import { PublicKey as PublicKey13 } from "@dxos/keys";
-import { log as log21 } from "@dxos/log";
+import { log as log23 } from "@dxos/log";
 import { InvalidStorageVersionError, STORAGE_VERSION as STORAGE_VERSION2, trace as trace9 } from "@dxos/protocols";
-import { Invitation as Invitation8 } from "@dxos/protocols/proto/dxos/client/services";
+import { Invitation as Invitation10 } from "@dxos/protocols/proto/dxos/client/services";
 import { BlobStore } from "@dxos/teleport-extension-object-sync";
 import { trace as Trace3 } from "@dxos/tracing";
 import { safeInstanceof } from "@dxos/util";
-function _ts_decorate7(decorators, target, key, desc) {
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file24 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
-var ServiceContext = class extends Resource5 {
-  constructor(storage, level, networkManager, signalManager, _edgeConnection, _runtimeParams, _edgeFeatures) {
+function _using_ctx3() {
+  var _disposeSuppressedError = typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed) {
+    var err = new Error();
+    err.name = "SuppressedError";
+    err.suppressed = suppressed;
+    err.error = error;
+    return err;
+  }, empty = {}, stack = [];
+  function using(isAwait, value) {
+    if (value != null) {
+      if (Object(value) !== value) {
+        throw new TypeError("using declarations can only be used with objects, functions, null, or undefined.");
+      }
+      if (isAwait) {
+        var dispose = value[Symbol.asyncDispose || Symbol.for("Symbol.asyncDispose")];
+      }
+      if (dispose == null) {
+        dispose = value[Symbol.dispose || Symbol.for("Symbol.dispose")];
+      }
+      if (typeof dispose !== "function") {
+        throw new TypeError(`Property [Symbol.dispose] is not a function.`);
+      }
+      stack.push({
+        v: value,
+        d: dispose,
+        a: isAwait
+      });
+    } else if (isAwait) {
+      stack.push({
+        d: value,
+        a: isAwait
+      });
+    }
+    return value;
+  }
+  return {
+    e: empty,
+    u: using.bind(null, false),
+    a: using.bind(null, true),
+    d: function() {
+      var error = this.e;
+      function next() {
+        while (resource = stack.pop()) {
+          try {
+            var resource, disposalResult = resource.d && resource.d.call(resource.v);
+            if (resource.a) {
+              return Promise.resolve(disposalResult).then(next, err);
+            }
+          } catch (e) {
+            return err(e);
+          }
+        }
+        if (error !== empty) throw error;
+      }
+      function err(e) {
+        error = error !== empty ? new _disposeSuppressedError(error, e) : e;
+        return next();
+      }
+      return next();
+    }
+  };
+}
+var __dxlog_file26 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
+var ServiceContext = class extends Resource6 {
+  constructor(storage, level, networkManager, signalManager, _edgeConnection, _edgeHttpClient, _runtimeParams, _edgeFeatures) {
     super();
     this.storage = storage;
     this.level = level;
     this.networkManager = networkManager;
     this.signalManager = signalManager;
     this._edgeConnection = _edgeConnection;
+    this._edgeHttpClient = _edgeHttpClient;
     this._runtimeParams = _runtimeParams;
     this._edgeFeatures = _edgeFeatures;
+    this._edgeIdentityUpdateMutex = new Mutex4();
     this.initialized = new Trigger9();
     this._meshReplicator = void 0;
     this._echoEdgeReplicator = void 0;
@@ -6546,23 +7160,42 @@ var ServiceContext = class extends Resource5 {
       callbacks: {
         onIdentityConstruction: (identity) => {
           if (this._edgeConnection) {
-            log21.info("Setting identity on edge connection", {
-              identity: identity.identityKey.toHex(),
-              oldIdentity: this._edgeConnection.identityKey,
-              swarms: this.networkManager.topics
-            }, {
-              F: __dxlog_file24,
-              L: 140,
-              S: this,
-              C: (f, a) => f(...a)
-            });
-            this._edgeConnection.setIdentity({
-              peerKey: identity.deviceKey.toHex(),
-              identityKey: identity.identityKey.toHex()
-            });
-            this.networkManager.setPeerInfo({
-              identityKey: identity.identityKey.toHex(),
-              peerKey: identity.deviceKey.toHex()
+            scheduleMicroTask4(this._ctx, async () => {
+              try {
+                var _usingCtx = _using_ctx3();
+                const _ = _usingCtx.u(await this._edgeIdentityUpdateMutex.acquire());
+                log23.info("Setting identity on edge connection", {
+                  identity: identity.identityKey.toHex(),
+                  oldIdentity: this._edgeConnection.identityKey,
+                  swarms: this.networkManager.topics
+                }, {
+                  F: __dxlog_file26,
+                  L: 147,
+                  S: this,
+                  C: (f, a) => f(...a)
+                });
+                await warnAfterTimeout2(1e4, "Waiting for identity to be ready for edge connection", async () => {
+                  await identity.ready();
+                });
+                invariant18(identity.deviceCredentialChain, void 0, {
+                  F: __dxlog_file26,
+                  L: 157,
+                  S: this,
+                  A: [
+                    "identity.deviceCredentialChain",
+                    ""
+                  ]
+                });
+                this._edgeConnection.setIdentity(await createChainEdgeIdentity(identity.signer, identity.identityKey, identity.deviceKey, identity.deviceCredentialChain, []));
+                this.networkManager.setPeerInfo({
+                  identityKey: identity.identityKey.toHex(),
+                  peerKey: identity.deviceKey.toHex()
+                });
+              } catch (_) {
+                _usingCtx.e = _;
+              } finally {
+                _usingCtx.d();
+              }
             });
           }
         }
@@ -6572,9 +7205,9 @@ var ServiceContext = class extends Resource5 {
       kv: this.level
     });
     this._meshReplicator = new MeshEchoReplicator();
-    this.invitations = new InvitationsHandler(this.networkManager, _runtimeParams?.invitationConnectionDefaultParams);
+    this.invitations = new InvitationsHandler(this.networkManager, this._edgeHttpClient, _runtimeParams?.invitationConnectionDefaultParams);
     this.invitationsManager = new InvitationsManager(this.invitations, (invitation) => this.getInvitationHandler(invitation), this.metadataStore);
-    this._handlerFactories.set(Invitation8.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? failUndefined2(), this._acceptIdentity.bind(this)));
+    this._handlerFactories.set(Invitation10.Kind.DEVICE, () => new DeviceInvitationProtocol(this.keyring, () => this.identityManager.identity ?? failUndefined2(), this._acceptIdentity.bind(this)));
     if (!this._runtimeParams?.disableP2pReplication) {
       this._meshReplicator = new MeshEchoReplicator();
     }
@@ -6586,21 +7219,24 @@ var ServiceContext = class extends Resource5 {
   }
   async _open(ctx) {
     await this._checkStorageVersion();
-    log21("opening...", void 0, {
-      F: __dxlog_file24,
-      L: 198,
+    log23("opening...", void 0, {
+      F: __dxlog_file26,
+      L: 218,
       S: this,
       C: (f, a) => f(...a)
     });
-    log21.trace("dxos.sdk.service-context.open", trace9.begin({
+    log23.trace("dxos.sdk.service-context.open", trace9.begin({
       id: this._instanceId
     }), {
-      F: __dxlog_file24,
-      L: 199,
+      F: __dxlog_file26,
+      L: 219,
       S: this,
       C: (f, a) => f(...a)
     });
-    await this._edgeConnection?.open();
+    if (this._edgeConnection) {
+      this._edgeConnection.setIdentity(await createEphemeralEdgeIdentity());
+      await this._edgeConnection.open();
+    }
     await this.signalManager.open();
     await this.networkManager.open();
     await this.echoHost.open(ctx);
@@ -6617,33 +7253,33 @@ var ServiceContext = class extends Resource5 {
       await this._initialize(ctx);
     }
     const loadedInvitations = await this.invitationsManager.loadPersistentInvitations();
-    log21("loaded persistent invitations", {
+    log23("loaded persistent invitations", {
       count: loadedInvitations.invitations?.length
     }, {
-      F: __dxlog_file24,
-      L: 222,
+      F: __dxlog_file26,
+      L: 246,
       S: this,
       C: (f, a) => f(...a)
     });
-    log21.trace("dxos.sdk.service-context.open", trace9.end({
+    log23.trace("dxos.sdk.service-context.open", trace9.end({
       id: this._instanceId
     }), {
-      F: __dxlog_file24,
-      L: 224,
+      F: __dxlog_file26,
+      L: 248,
       S: this,
       C: (f, a) => f(...a)
     });
-    log21("opened", void 0, {
-      F: __dxlog_file24,
-      L: 225,
+    log23("opened", void 0, {
+      F: __dxlog_file26,
+      L: 249,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async _close(ctx) {
-    log21("closing...", void 0, {
-      F: __dxlog_file24,
-      L: 229,
+    log23("closing...", void 0, {
+      F: __dxlog_file26,
+      L: 253,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6659,9 +7295,9 @@ var ServiceContext = class extends Resource5 {
     await this.networkManager.close();
     await this.signalManager.close();
     await this._edgeConnection?.close();
-    log21("closed", void 0, {
-      F: __dxlog_file24,
-      L: 244,
+    log23("closed", void 0, {
+      F: __dxlog_file26,
+      L: 268,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6669,16 +7305,16 @@ var ServiceContext = class extends Resource5 {
   async createIdentity(params = {}) {
     const identity = await this.identityManager.createIdentity(params);
     await this._initialize(new Context9(void 0, {
-      F: __dxlog_file24,
-      L: 249
+      F: __dxlog_file26,
+      L: 273
     }));
     return identity;
   }
   getInvitationHandler(invitation) {
     const factory = this._handlerFactories.get(invitation.kind);
-    invariant17(factory, `Unknown invitation kind: ${invitation.kind}`, {
-      F: __dxlog_file24,
-      L: 255,
+    invariant18(factory, `Unknown invitation kind: ${invitation.kind}`, {
+      F: __dxlog_file26,
+      L: 279,
       S: this,
       A: [
         "factory",
@@ -6698,8 +7334,8 @@ var ServiceContext = class extends Resource5 {
   async _acceptIdentity(params) {
     const identity = await this.identityManager.acceptIdentity(params);
     await this._initialize(new Context9(void 0, {
-      F: __dxlog_file24,
-      L: 271
+      F: __dxlog_file26,
+      L: 295
     }));
     return identity;
   }
@@ -6711,9 +7347,9 @@ var ServiceContext = class extends Resource5 {
   }
   // Called when identity is created.
   async _initialize(ctx) {
-    log21("initializing spaces...", void 0, {
-      F: __dxlog_file24,
-      L: 286,
+    log23("initializing spaces...", void 0, {
+      F: __dxlog_file26,
+      L: 310,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6740,16 +7376,17 @@ var ServiceContext = class extends Resource5 {
       echoHost: this.echoHost,
       invitationsManager: this.invitationsManager,
       edgeConnection: this._edgeConnection,
+      edgeHttpClient: this._edgeHttpClient,
       echoEdgeReplicator: this._echoEdgeReplicator,
       meshReplicator: this._meshReplicator,
       runtimeParams: this._runtimeParams,
       edgeFeatures: this._edgeFeatures
     });
     await this.dataSpaceManager.open();
-    this._handlerFactories.set(Invitation8.Kind.SPACE, (invitation) => {
-      invariant17(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
-        F: __dxlog_file24,
-        L: 315,
+    this._handlerFactories.set(Invitation10.Kind.SPACE, (invitation) => {
+      invariant18(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
+        F: __dxlog_file26,
+        L: 340,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -6769,33 +7406,33 @@ var ServiceContext = class extends Resource5 {
           return;
         }
         if (!this.dataSpaceManager) {
-          log21("dataSpaceManager not initialized yet, ignoring space admission", {
+          log23("dataSpaceManager not initialized yet, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file24,
-            L: 331,
+            F: __dxlog_file26,
+            L: 356,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
         if (this.dataSpaceManager.spaces.has(assertion.spaceKey)) {
-          log21("space already exists, ignoring space admission", {
+          log23("space already exists, ignoring space admission", {
             details: assertion
           }, {
-            F: __dxlog_file24,
-            L: 335,
+            F: __dxlog_file26,
+            L: 360,
             S: this,
             C: (f, a) => f(...a)
           });
           return;
         }
         try {
-          log21("accepting space recorded in halo", {
+          log23("accepting space recorded in halo", {
             details: assertion
           }, {
-            F: __dxlog_file24,
-            L: 340,
+            F: __dxlog_file26,
+            L: 365,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -6804,9 +7441,9 @@ var ServiceContext = class extends Resource5 {
             genesisFeedKey: assertion.genesisFeedKey
           });
         } catch (err) {
-          log21.catch(err, void 0, {
-            F: __dxlog_file24,
-            L: 346,
+          log23.catch(err, void 0, {
+            F: __dxlog_file26,
+            L: 371,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -6816,13 +7453,13 @@ var ServiceContext = class extends Resource5 {
     await identity.space.spaceState.addCredentialProcessor(this._deviceSpaceSync);
   }
 };
-_ts_decorate7([
+_ts_decorate9([
   Trace3.span()
 ], ServiceContext.prototype, "_open", null);
-_ts_decorate7([
+_ts_decorate9([
   Trace3.span()
 ], ServiceContext.prototype, "_initialize", null);
-ServiceContext = _ts_decorate7([
+ServiceContext = _ts_decorate9([
   safeInstanceof("dxos.client-services.ServiceContext"),
   Trace3.resource()
 ], ServiceContext);
@@ -6927,11 +7564,11 @@ var createLevel = async (config) => {
 
 // packages/sdk/client-services/src/packlets/storage/profile-archive.ts
 import { cbor } from "@dxos/automerge/automerge-repo";
-import { invariant as invariant18 } from "@dxos/invariant";
-import { log as log22 } from "@dxos/log";
+import { invariant as invariant19 } from "@dxos/invariant";
+import { log as log24 } from "@dxos/log";
 import { ProfileArchiveEntryType } from "@dxos/protocols";
 import { arrayToBuffer as arrayToBuffer2 } from "@dxos/util";
-var __dxlog_file25 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/storage/profile-archive.ts";
+var __dxlog_file27 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/storage/profile-archive.ts";
 var encodeProfileArchive = (profile) => cbor.encode(profile);
 var decodeProfileArchive = (data) => cbor.decode(data);
 var exportProfileData = async ({ storage, level }) => {
@@ -6944,10 +7581,10 @@ var exportProfileData = async ({ storage, level }) => {
   {
     const directory = await storage.createDirectory();
     const files = await directory.list();
-    log22.info("begin exporting files", {
+    log24.info("begin exporting files", {
       count: files.length
     }, {
-      F: __dxlog_file25,
+      F: __dxlog_file27,
       L: 30,
       S: void 0,
       C: (f, a) => f(...a)
@@ -6962,18 +7599,18 @@ var exportProfileData = async ({ storage, level }) => {
         value: data
       });
     }
-    log22.info("done exporting files", {
+    log24.info("done exporting files", {
       count: files.length
     }, {
-      F: __dxlog_file25,
+      F: __dxlog_file27,
       L: 41,
       S: void 0,
       C: (f, a) => f(...a)
     });
   }
   {
-    log22.info("begin exporting kv pairs", void 0, {
-      F: __dxlog_file25,
+    log24.info("begin exporting kv pairs", void 0, {
+      F: __dxlog_file27,
       L: 45,
       S: void 0,
       C: (f, a) => f(...a)
@@ -6991,10 +7628,10 @@ var exportProfileData = async ({ storage, level }) => {
       });
       count++;
     }
-    log22.info("done exporting kv pairs", {
+    log24.info("done exporting kv pairs", {
       count
     }, {
-      F: __dxlog_file25,
+      F: __dxlog_file27,
       L: 56,
       S: void 0,
       C: (f, a) => f(...a)
@@ -7009,8 +7646,8 @@ var importProfileData = async ({ storage, level }, archive) => {
     switch (entry2.type) {
       case ProfileArchiveEntryType.FILE: {
         const directory = await storage.createDirectory();
-        invariant18(typeof entry2.key === "string", "Invalid key type", {
-          F: __dxlog_file25,
+        invariant19(typeof entry2.key === "string", "Invalid key type", {
+          F: __dxlog_file27,
           L: 79,
           S: void 0,
           A: [
@@ -7019,8 +7656,8 @@ var importProfileData = async ({ storage, level }, archive) => {
           ]
         });
         const file = await directory.getOrCreateFile(entry2.key);
-        invariant18(entry2.value instanceof Uint8Array, "Invalid value type", {
-          F: __dxlog_file25,
+        invariant19(entry2.value instanceof Uint8Array, "Invalid value type", {
+          F: __dxlog_file27,
           L: 81,
           S: void 0,
           A: [
@@ -7033,8 +7670,8 @@ var importProfileData = async ({ storage, level }, archive) => {
         break;
       }
       case ProfileArchiveEntryType.KEY_VALUE: {
-        invariant18(entry2.key instanceof Uint8Array, "Invalid key type", {
-          F: __dxlog_file25,
+        invariant19(entry2.key instanceof Uint8Array, "Invalid key type", {
+          F: __dxlog_file27,
           L: 87,
           S: void 0,
           A: [
@@ -7042,8 +7679,8 @@ var importProfileData = async ({ storage, level }, archive) => {
             "'Invalid key type'"
           ]
         });
-        invariant18(entry2.value instanceof Uint8Array, "Invalid value type", {
-          F: __dxlog_file25,
+        invariant19(entry2.value instanceof Uint8Array, "Invalid value type", {
+          F: __dxlog_file27,
           L: 88,
           S: void 0,
           A: [
@@ -7063,20 +7700,20 @@ var importProfileData = async ({ storage, level }, archive) => {
     if (++count % 1e3 === 0) {
       await batch.write();
       batch = level.batch();
-      log22.info("importing", {
+      log24.info("importing", {
         count,
         total: archive.storage.length,
         progress: `${(count / archive.storage.length * 100).toFixed()}%`
       }, {
-        F: __dxlog_file25,
+        F: __dxlog_file27,
         L: 101,
         S: void 0,
         C: (f, a) => f(...a)
       });
     }
   }
-  log22.info("committing changes..", void 0, {
-    F: __dxlog_file25,
+  log24.info("committing changes..", void 0, {
+    F: __dxlog_file27,
     L: 109,
     S: void 0,
     C: (f, a) => f(...a)
@@ -7088,10 +7725,10 @@ var importProfileData = async ({ storage, level }, archive) => {
 import { Event as Event10, synchronized as synchronized3 } from "@dxos/async";
 import { clientServiceBundle } from "@dxos/client-protocol";
 import { Context as Context10 } from "@dxos/context";
-import { EdgeClient } from "@dxos/edge-client";
-import { invariant as invariant20 } from "@dxos/invariant";
+import { EdgeClient, EdgeHttpClient, createStubEdgeIdentity } from "@dxos/edge-client";
+import { invariant as invariant21 } from "@dxos/invariant";
 import { PublicKey as PublicKey17 } from "@dxos/keys";
-import { log as log24 } from "@dxos/log";
+import { log as log26 } from "@dxos/log";
 import { EdgeSignalManager, WebsocketSignalManager } from "@dxos/messaging";
 import { SwarmNetworkManager, createIceProvider, createRtcTransportFactory } from "@dxos/network-manager";
 import { trace as trace10 } from "@dxos/protocols";
@@ -7102,9 +7739,9 @@ import { WebsocketRpcClient } from "@dxos/websocket-rpc";
 // packages/sdk/client-services/src/packlets/devices/devices-service.ts
 import { EventSubscriptions as EventSubscriptions3 } from "@dxos/async";
 import { Stream as Stream11 } from "@dxos/codec-protobuf";
-import { invariant as invariant19 } from "@dxos/invariant";
+import { invariant as invariant20 } from "@dxos/invariant";
 import { Device as Device2, DeviceKind as DeviceKind2 } from "@dxos/protocols/proto/dxos/client/services";
-var __dxlog_file26 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
+var __dxlog_file28 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/devices/devices-service.ts";
 var DevicesServiceImpl = class {
   constructor(_identityManager) {
     this._identityManager = _identityManager;
@@ -7121,8 +7758,8 @@ var DevicesServiceImpl = class {
             devices: []
           });
         } else {
-          invariant19(this._identityManager.identity?.presence, "presence not present", {
-            F: __dxlog_file26,
+          invariant20(this._identityManager.identity?.presence, "presence not present", {
+            F: __dxlog_file28,
             L: 32,
             S: this,
             A: [
@@ -7182,7 +7819,7 @@ var DevicesServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/identity/contacts-service.ts
-import { EventSubscriptions as EventSubscriptions4, scheduleTask as scheduleTask7, UpdateScheduler as UpdateScheduler2 } from "@dxos/async";
+import { EventSubscriptions as EventSubscriptions4, scheduleTask as scheduleTask8, UpdateScheduler as UpdateScheduler2 } from "@dxos/async";
 import { Stream as Stream12 } from "@dxos/codec-protobuf";
 import { PublicKey as PublicKey15 } from "@dxos/keys";
 import { ComplexMap as ComplexMap5, ComplexSet as ComplexSet6 } from "@dxos/util";
@@ -7241,7 +7878,7 @@ var ContactsServiceImpl = class {
       }, {
         maxFrequency: 2
       });
-      scheduleTask7(ctx, async () => {
+      scheduleTask8(ctx, async () => {
         const subscriptions = new EventSubscriptions4();
         ctx.onDispose(() => subscriptions.clear());
         const subscribeToSpaceAndUpdate = () => {
@@ -7268,7 +7905,7 @@ var ContactsServiceImpl = class {
 import { Event as Event9 } from "@dxos/async";
 import { Stream as Stream13 } from "@dxos/codec-protobuf";
 import { PublicKey as PublicKey16 } from "@dxos/keys";
-import { getContextFromEntry, log as log23 } from "@dxos/log";
+import { getContextFromEntry, log as log25 } from "@dxos/log";
 import { QueryLogsRequest } from "@dxos/protocols/proto/dxos/client/services";
 import { getDebugName, jsonify, numericalValues, tracer } from "@dxos/util";
 var LoggingServiceImpl = class {
@@ -7281,11 +7918,11 @@ var LoggingServiceImpl = class {
     };
   }
   async open() {
-    log23.runtimeConfig.processors.push(this._logProcessor);
+    log25.runtimeConfig.processors.push(this._logProcessor);
   }
   async close() {
-    const index = log23.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
-    log23.runtimeConfig.processors.splice(index, 1);
+    const index = log25.runtimeConfig.processors.findIndex((processor) => processor === this._logProcessor);
+    log25.runtimeConfig.processors.splice(index, 1);
   }
   async controlMetrics({ reset, record }) {
     if (reset) {
@@ -7479,13 +8116,13 @@ var SystemServiceImpl = class {
 };
 
 // packages/sdk/client-services/src/packlets/services/service-host.ts
-function _ts_decorate8(decorators, target, key, desc) {
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file27 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
+var __dxlog_file29 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-host.ts";
 var ClientServicesHost = class {
   constructor({
     config,
@@ -7501,6 +8138,7 @@ var ClientServicesHost = class {
     this._tracingService = TRACE_PROCESSOR3.createTraceSender();
     this._statusUpdate = new Event10();
     this._edgeConnection = void 0;
+    this._edgeHttpClient = void 0;
     this._opening = false;
     this._open = false;
     this._storage = storage;
@@ -7523,8 +8161,8 @@ var ClientServicesHost = class {
         onAcquire: () => {
           if (!this._opening) {
             void this.open(new Context10(void 0, {
-              F: __dxlog_file27,
-              L: 132
+              F: __dxlog_file29,
+              L: 133
             }));
           }
         },
@@ -7580,25 +8218,25 @@ var ClientServicesHost = class {
   * Can only be called once.
   */
   initialize({ config, ...options }) {
-    invariant20(!this._open, "service host is open", {
-      F: __dxlog_file27,
-      L: 198,
+    invariant21(!this._open, "service host is open", {
+      F: __dxlog_file29,
+      L: 199,
       S: this,
       A: [
         "!this._open",
         "'service host is open'"
       ]
     });
-    log24("initializing...", void 0, {
-      F: __dxlog_file27,
-      L: 199,
+    log26("initializing...", void 0, {
+      F: __dxlog_file29,
+      L: 200,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
-      invariant20(!this._config, "config already set", {
-        F: __dxlog_file27,
-        L: 202,
+      invariant21(!this._config, "config already set", {
+        F: __dxlog_file29,
+        L: 203,
         S: this,
         A: [
           "!this._config",
@@ -7611,19 +8249,19 @@ var ClientServicesHost = class {
       }
     }
     if (!options.signalManager) {
-      log24.warn("running signaling without telemetry metadata.", void 0, {
-        F: __dxlog_file27,
-        L: 210,
+      log26.warn("running signaling without telemetry metadata.", void 0, {
+        F: __dxlog_file29,
+        L: 211,
         S: this,
         C: (f, a) => f(...a)
       });
     }
     const edgeEndpoint = config?.get("runtime.services.edge.url");
     if (edgeEndpoint) {
-      const randomKey = PublicKey17.random().toHex();
-      this._edgeConnection = new EdgeClient(randomKey, randomKey, {
+      this._edgeConnection = new EdgeClient(createStubEdgeIdentity(), {
         socketEndpoint: edgeEndpoint
       });
+      this._edgeHttpClient = new EdgeHttpClient(edgeEndpoint);
     }
     const { connectionLog = true, transportFactory = createRtcTransportFactory({
       iceServers: this._config?.get("runtime.services.ice")
@@ -7631,9 +8269,9 @@ var ClientServicesHost = class {
       edgeConnection: this._edgeConnection
     }) : new WebsocketSignalManager(this._config?.get("runtime.services.signaling") ?? []) } = options;
     this._signalManager = signalManager;
-    invariant20(!this._networkManager, "network manager already set", {
-      F: __dxlog_file27,
-      L: 232,
+    invariant21(!this._networkManager, "network manager already set", {
+      F: __dxlog_file29,
+      L: 233,
       S: this,
       A: [
         "!this._networkManager",
@@ -7649,9 +8287,9 @@ var ClientServicesHost = class {
         peerKey: this._edgeConnection.peerKey
       } : void 0
     });
-    log24("initialized", void 0, {
-      F: __dxlog_file27,
-      L: 245,
+    log26("initialized", void 0, {
+      F: __dxlog_file29,
+      L: 246,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7661,44 +8299,44 @@ var ClientServicesHost = class {
       return;
     }
     const traceId = PublicKey17.random().toHex();
-    log24.trace("dxos.client-services.host.open", trace10.begin({
+    log26.trace("dxos.client-services.host.open", trace10.begin({
       id: traceId
     }), {
-      F: __dxlog_file27,
-      L: 256,
+      F: __dxlog_file29,
+      L: 257,
       S: this,
       C: (f, a) => f(...a)
     });
-    invariant20(this._config, "config not set", {
-      F: __dxlog_file27,
-      L: 258,
+    invariant21(this._config, "config not set", {
+      F: __dxlog_file29,
+      L: 259,
       S: this,
       A: [
         "this._config",
         "'config not set'"
       ]
     });
-    invariant20(this._storage, "storage not set", {
-      F: __dxlog_file27,
-      L: 259,
+    invariant21(this._storage, "storage not set", {
+      F: __dxlog_file29,
+      L: 260,
       S: this,
       A: [
         "this._storage",
         "'storage not set'"
       ]
     });
-    invariant20(this._signalManager, "signal manager not set", {
-      F: __dxlog_file27,
-      L: 260,
+    invariant21(this._signalManager, "signal manager not set", {
+      F: __dxlog_file29,
+      L: 261,
       S: this,
       A: [
         "this._signalManager",
         "'signal manager not set'"
       ]
     });
-    invariant20(this._networkManager, "network manager not set", {
-      F: __dxlog_file27,
-      L: 261,
+    invariant21(this._networkManager, "network manager not set", {
+      F: __dxlog_file29,
+      L: 262,
       S: this,
       A: [
         "this._networkManager",
@@ -7706,11 +8344,11 @@ var ClientServicesHost = class {
       ]
     });
     this._opening = true;
-    log24("opening...", {
+    log26("opening...", {
       lockKey: this._resourceLock?.lockKey
     }, {
-      F: __dxlog_file27,
-      L: 264,
+      F: __dxlog_file29,
+      L: 265,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7720,7 +8358,7 @@ var ClientServicesHost = class {
     }
     await this._level.open();
     await this._loggingService.open();
-    this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._edgeConnection, this._runtimeParams, this._config.get("runtime.client.edgeFeatures"));
+    this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._edgeConnection, this._edgeHttpClient, this._runtimeParams, this._config.get("runtime.client.edgeFeatures"));
     const dataSpaceManagerProvider = async () => {
       await this._serviceContext.initialized.wait();
       return this._serviceContext.dataSpaceManager;
@@ -7762,19 +8400,19 @@ var ClientServicesHost = class {
     this._open = true;
     this._statusUpdate.emit();
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    log24("opened", {
+    log26("opened", {
       deviceKey
     }, {
-      F: __dxlog_file27,
-      L: 352,
+      F: __dxlog_file29,
+      L: 354,
       S: this,
       C: (f, a) => f(...a)
     });
-    log24.trace("dxos.client-services.host.open", trace10.end({
+    log26.trace("dxos.client-services.host.open", trace10.end({
       id: traceId
     }), {
-      F: __dxlog_file27,
-      L: 353,
+      F: __dxlog_file29,
+      L: 355,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7784,11 +8422,11 @@ var ClientServicesHost = class {
       return;
     }
     const deviceKey = this._serviceContext.identityManager.identity?.deviceKey;
-    log24("closing...", {
+    log26("closing...", {
       deviceKey
     }, {
-      F: __dxlog_file27,
-      L: 364,
+      F: __dxlog_file29,
+      L: 366,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7802,44 +8440,44 @@ var ClientServicesHost = class {
     await this._level?.close();
     this._open = false;
     this._statusUpdate.emit();
-    log24("closed", {
+    log26("closed", {
       deviceKey
     }, {
-      F: __dxlog_file27,
-      L: 373,
+      F: __dxlog_file29,
+      L: 375,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async reset() {
     const traceId = PublicKey17.random().toHex();
-    log24.trace("dxos.sdk.client-services-host.reset", trace10.begin({
+    log26.trace("dxos.sdk.client-services-host.reset", trace10.begin({
       id: traceId
     }), {
-      F: __dxlog_file27,
-      L: 378,
+      F: __dxlog_file29,
+      L: 380,
       S: this,
       C: (f, a) => f(...a)
     });
-    log24.info("resetting...", void 0, {
-      F: __dxlog_file27,
-      L: 380,
+    log26.info("resetting...", void 0, {
+      F: __dxlog_file29,
+      L: 382,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._serviceContext?.close();
     await this._storage.reset();
-    log24.info("reset", void 0, {
-      F: __dxlog_file27,
-      L: 383,
+    log26.info("reset", void 0, {
+      F: __dxlog_file29,
+      L: 385,
       S: this,
       C: (f, a) => f(...a)
     });
-    log24.trace("dxos.sdk.client-services-host.reset", trace10.end({
+    log26.trace("dxos.sdk.client-services-host.reset", trace10.end({
       id: traceId
     }), {
-      F: __dxlog_file27,
-      L: 384,
+      F: __dxlog_file29,
+      L: 386,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7851,21 +8489,21 @@ var ClientServicesHost = class {
     return identity;
   }
 };
-_ts_decorate8([
+_ts_decorate10([
   Trace4.info()
 ], ClientServicesHost.prototype, "_opening", void 0);
-_ts_decorate8([
+_ts_decorate10([
   Trace4.info()
 ], ClientServicesHost.prototype, "_open", void 0);
-_ts_decorate8([
+_ts_decorate10([
   synchronized3,
   Trace4.span()
 ], ClientServicesHost.prototype, "open", null);
-_ts_decorate8([
+_ts_decorate10([
   synchronized3,
   Trace4.span()
 ], ClientServicesHost.prototype, "close", null);
-ClientServicesHost = _ts_decorate8([
+ClientServicesHost = _ts_decorate10([
   Trace4.resource()
 ], ClientServicesHost);
 
@@ -7913,4 +8551,4 @@ export {
   importProfileData,
   ClientServicesHost
 };
-//# sourceMappingURL=chunk-BDGSOBZV.mjs.map
+//# sourceMappingURL=chunk-WU4ZS3F3.mjs.map