@dxos/client-services 0.6.12-main.78ddbdf → 0.6.12-main.7907542

package/dist/lib/node/{chunk-F3WGFGEN.cjs → chunk-2UUETFZ2.cjs}

@@ -26,8 +26,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var chunk_F3WGFGEN_exports = {};
-__export(chunk_F3WGFGEN_exports, {
+var chunk_2UUETFZ2_exports = {};
+__export(chunk_2UUETFZ2_exports, {
   ClientRpcServer: () => ClientRpcServer,
   ClientServicesHost: () => ClientServicesHost,
   DataSpace: () => DataSpace,
@@ -70,7 +70,7 @@ __export(chunk_F3WGFGEN_exports, {
   subscribeToSpaces: () => subscribeToSpaces,
   subscribeToSwarmInfo: () => subscribeToSwarmInfo
 });
-module.exports = __toCommonJS(chunk_F3WGFGEN_exports);
+module.exports = __toCommonJS(chunk_2UUETFZ2_exports);
 var import_async = require("@dxos/async");
 var import_codec_protobuf = require("@dxos/codec-protobuf");
 var import_feed_store = require("@dxos/feed-store");
@@ -142,30 +142,32 @@ var import_log5 = require("@dxos/log");
 var import_services5 = require("@dxos/protocols/proto/dxos/client/services");
 var import_async9 = require("@dxos/async");
 var import_context6 = require("@dxos/context");
+var import_credentials5 = require("@dxos/credentials");
 var import_invariant5 = require("@dxos/invariant");
 var import_keys5 = require("@dxos/keys");
 var import_log6 = require("@dxos/log");
+var import_protocols4 = require("@dxos/protocols");
 var import_proto2 = require("@dxos/protocols/proto");
 var import_teleport = require("@dxos/teleport");
 var import_util5 = require("@dxos/util");
 var import_async10 = require("@dxos/async");
 var import_client_protocol3 = require("@dxos/client-protocol");
-var import_credentials5 = require("@dxos/credentials");
+var import_credentials6 = require("@dxos/credentials");
 var import_feed_store2 = require("@dxos/feed-store");
 var import_invariant6 = require("@dxos/invariant");
 var import_keys6 = require("@dxos/keys");
 var import_log7 = require("@dxos/log");
-var import_credentials6 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials7 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe2 = require("@dxos/timeframe");
 var import_tracing4 = require("@dxos/tracing");
 var import_util6 = require("@dxos/util");
-var import_credentials7 = require("@dxos/credentials");
+var import_credentials8 = require("@dxos/credentials");
 var import_keys7 = require("@dxos/keys");
 var import_log8 = require("@dxos/log");
 var import_async11 = require("@dxos/async");
 var import_client_protocol4 = require("@dxos/client-protocol");
 var import_context7 = require("@dxos/context");
-var import_credentials8 = require("@dxos/credentials");
+var import_credentials9 = require("@dxos/credentials");
 var import_echo_pipeline3 = require("@dxos/echo-pipeline");
 var import_echo_protocol3 = require("@dxos/echo-protocol");
 var import_echo_schema2 = require("@dxos/echo-schema");
@@ -173,36 +175,37 @@ var import_feed_store3 = require("@dxos/feed-store");
 var import_invariant7 = require("@dxos/invariant");
 var import_keys8 = require("@dxos/keys");
 var import_log9 = require("@dxos/log");
-var import_protocols4 = require("@dxos/protocols");
+var import_protocols5 = require("@dxos/protocols");
 var import_services6 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials9 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_metadata = require("@dxos/protocols/proto/dxos/echo/metadata");
+var import_credentials10 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_teleport_extension_gossip = require("@dxos/teleport-extension-gossip");
 var import_tracing5 = require("@dxos/tracing");
 var import_util7 = require("@dxos/util");
-var import_credentials10 = require("@dxos/credentials");
+var import_credentials11 = require("@dxos/credentials");
 var import_debug2 = require("@dxos/debug");
-var import_credentials11 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials12 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_timeframe3 = require("@dxos/timeframe");
 var import_async12 = require("@dxos/async");
 var import_codec_protobuf8 = require("@dxos/codec-protobuf");
-var import_credentials12 = require("@dxos/credentials");
+var import_credentials13 = require("@dxos/credentials");
 var import_debug3 = require("@dxos/debug");
 var import_feed_store4 = require("@dxos/feed-store");
 var import_invariant8 = require("@dxos/invariant");
 var import_log10 = require("@dxos/log");
-var import_protocols5 = require("@dxos/protocols");
+var import_protocols6 = require("@dxos/protocols");
 var import_services7 = require("@dxos/protocols/proto/dxos/client/services");
 var import_tracing6 = require("@dxos/tracing");
 var import_platform = __toESM(require("platform"));
 var import_async13 = require("@dxos/async");
 var import_context8 = require("@dxos/context");
-var import_credentials13 = require("@dxos/credentials");
+var import_credentials14 = require("@dxos/credentials");
 var import_invariant9 = require("@dxos/invariant");
 var import_keys9 = require("@dxos/keys");
 var import_log11 = require("@dxos/log");
-var import_protocols6 = require("@dxos/protocols");
+var import_protocols7 = require("@dxos/protocols");
 var import_services8 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials14 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials15 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_teleport_extension_gossip2 = require("@dxos/teleport-extension-gossip");
 var import_timeframe4 = require("@dxos/timeframe");
 var import_tracing7 = require("@dxos/tracing");
@@ -210,14 +213,14 @@ var import_util8 = require("@dxos/util");
 var import_async14 = require("@dxos/async");
 var import_codec_protobuf9 = require("@dxos/codec-protobuf");
 var import_context9 = require("@dxos/context");
-var import_credentials15 = require("@dxos/credentials");
+var import_credentials16 = require("@dxos/credentials");
 var import_debug4 = require("@dxos/debug");
 var import_invariant10 = require("@dxos/invariant");
 var import_log12 = require("@dxos/log");
 var import_services9 = require("@dxos/protocols/proto/dxos/client/services");
 var import_util9 = require("@dxos/util");
 var import_invariant11 = require("@dxos/invariant");
-var import_protocols7 = require("@dxos/protocols");
+var import_protocols8 = require("@dxos/protocols");
 var import_services10 = require("@dxos/protocols/proto/dxos/client/services");
 var import_async15 = require("@dxos/async");
 var import_client_protocol5 = require("@dxos/client-protocol");
@@ -227,7 +230,7 @@ var import_invariant12 = require("@dxos/invariant");
 var import_keys10 = require("@dxos/keys");
 var import_log13 = require("@dxos/log");
 var import_network_manager = require("@dxos/network-manager");
-var import_protocols8 = require("@dxos/protocols");
+var import_protocols9 = require("@dxos/protocols");
 var import_services11 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_invitations2 = require("@dxos/protocols/proto/dxos/halo/invitations");
@@ -237,7 +240,7 @@ var import_async16 = require("@dxos/async");
 var import_context11 = require("@dxos/context");
 var import_invariant13 = require("@dxos/invariant");
 var import_log14 = require("@dxos/log");
-var import_protocols9 = require("@dxos/protocols");
+var import_protocols10 = require("@dxos/protocols");
 var import_proto3 = require("@dxos/protocols/proto");
 var import_invitations3 = require("@dxos/protocols/proto/dxos/halo/invitations");
 var import_teleport2 = require("@dxos/teleport");
@@ -249,7 +252,7 @@ var import_crypto2 = require("@dxos/crypto");
 var import_invariant14 = require("@dxos/invariant");
 var import_keys11 = require("@dxos/keys");
 var import_log15 = require("@dxos/log");
-var import_protocols10 = require("@dxos/protocols");
+var import_protocols11 = require("@dxos/protocols");
 var import_proto4 = require("@dxos/protocols/proto");
 var import_services13 = require("@dxos/protocols/proto/dxos/client/services");
 var import_invitations4 = require("@dxos/protocols/proto/dxos/halo/invitations");
@@ -261,23 +264,23 @@ var import_invitations5 = require("@dxos/protocols/proto/dxos/halo/invitations")
 var import_util11 = require("@dxos/util");
 var import_codec_protobuf10 = require("@dxos/codec-protobuf");
 var import_services14 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials16 = require("@dxos/credentials");
+var import_credentials17 = require("@dxos/credentials");
 var import_feed_store5 = require("@dxos/feed-store");
 var import_invariant16 = require("@dxos/invariant");
 var import_log17 = require("@dxos/log");
-var import_protocols11 = require("@dxos/protocols");
+var import_protocols12 = require("@dxos/protocols");
 var import_services15 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials17 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials18 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_async18 = require("@dxos/async");
 var import_client_protocol6 = require("@dxos/client-protocol");
 var import_context14 = require("@dxos/context");
-var import_credentials18 = require("@dxos/credentials");
+var import_credentials19 = require("@dxos/credentials");
 var import_echo_pipeline4 = require("@dxos/echo-pipeline");
 var import_invariant17 = require("@dxos/invariant");
 var import_keys13 = require("@dxos/keys");
 var import_log18 = require("@dxos/log");
 var import_services16 = require("@dxos/protocols/proto/dxos/client/services");
-var import_credentials19 = require("@dxos/protocols/proto/dxos/halo/credentials");
+var import_credentials20 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_invariant18 = require("@dxos/invariant");
 var import_lock_file = require("@dxos/lock-file");
 var import_log19 = require("@dxos/log");
@@ -287,20 +290,21 @@ var import_rpc = require("@dxos/rpc");
 var import_tracing9 = require("@dxos/tracing");
 var import_async19 = require("@dxos/async");
 var import_context15 = require("@dxos/context");
-var import_credentials20 = require("@dxos/credentials");
+var import_credentials21 = require("@dxos/credentials");
 var import_debug6 = require("@dxos/debug");
 var import_echo_pipeline5 = require("@dxos/echo-pipeline");
+var import_edge_client2 = require("@dxos/edge-client");
 var import_feed_store6 = require("@dxos/feed-store");
 var import_invariant19 = require("@dxos/invariant");
 var import_keyring = require("@dxos/keyring");
 var import_keys14 = require("@dxos/keys");
 var import_log20 = require("@dxos/log");
-var import_protocols12 = require("@dxos/protocols");
+var import_protocols13 = require("@dxos/protocols");
 var import_services17 = require("@dxos/protocols/proto/dxos/client/services");
 var import_teleport_extension_object_sync = require("@dxos/teleport-extension-object-sync");
 var import_tracing10 = require("@dxos/tracing");
 var import_util12 = require("@dxos/util");
-var import_protocols13 = require("@dxos/protocols");
+var import_protocols14 = require("@dxos/protocols");
 var import_config2 = require("@dxos/protocols/proto/dxos/config");
 var import_random_access_storage = require("@dxos/random-access-storage");
 var import_client_protocol7 = require("@dxos/client-protocol");
@@ -312,18 +316,18 @@ var import_kv_store = require("@dxos/kv-store");
 var import_automerge_repo = require("@dxos/automerge/automerge-repo");
 var import_invariant20 = require("@dxos/invariant");
 var import_log21 = require("@dxos/log");
-var import_protocols14 = require("@dxos/protocols");
+var import_protocols15 = require("@dxos/protocols");
 var import_util14 = require("@dxos/util");
 var import_async20 = require("@dxos/async");
 var import_client_protocol8 = require("@dxos/client-protocol");
 var import_context16 = require("@dxos/context");
-var import_edge_client2 = require("@dxos/edge-client");
+var import_edge_client3 = require("@dxos/edge-client");
 var import_invariant21 = require("@dxos/invariant");
 var import_keys16 = require("@dxos/keys");
 var import_log22 = require("@dxos/log");
 var import_messaging = require("@dxos/messaging");
 var import_network_manager2 = require("@dxos/network-manager");
-var import_protocols15 = require("@dxos/protocols");
+var import_protocols16 = require("@dxos/protocols");
 var import_services18 = require("@dxos/protocols/proto/dxos/client/services");
 var import_tracing11 = require("@dxos/tracing");
 var import_websocket_rpc = require("@dxos/websocket-rpc");
@@ -703,7 +707,7 @@ var DevtoolsServiceImpl = class {
     });
   }
 };
-var DXOS_VERSION = "0.6.12-main.78ddbdf";
+var DXOS_VERSION = "0.6.12-main.7907542";
 var getPlatform = () => {
   if (process.browser) {
     if (typeof window !== "undefined") {
@@ -955,7 +959,7 @@ var TrustedKeySetAuthVerifier = class {
         return false;
       }
       if (this._isTrustedKey(credential.issuer)) {
-        (0, import_log2.log)("key is not currently in trusted set, waiting...", {
+        (0, import_log2.log)("key is trusted -- auth success", {
           key: credential.issuer
         }, {
           F: __dxlog_file4,
@@ -982,7 +986,10 @@ var TrustedKeySetAuthVerifier = class {
           trigger.wake(true);
         } else {
           (0, import_log2.log)("key is not currently in trusted set, waiting...", {
-            key: credential.issuer
+            key: credential.issuer,
+            trusted: [
+              ...this._params.trustedKeysProvider()
+            ]
           }, {
             F: __dxlog_file4,
             L: 84,
@@ -1007,6 +1014,12 @@ var TrustedKeySetAuthVerifier = class {
     return deviceSet.has(deviceKey);
   }
 };
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
 function _using_ctx() {
   var _disposeSuppressedError = typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed) {
     var err = new Error();
@@ -1082,6 +1095,12 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
     this._spaceId = spaceId;
   }
   async _open() {
+    (0, import_log3.log)("open", void 0, {
+      F: __dxlog_file5,
+      L: 56,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     this._ctx.onDispose(this._messenger.addListener((message) => {
       if (!message.serviceId) {
         return;
@@ -1097,20 +1116,20 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
           _spaceId: this._spaceId
         }, {
           F: __dxlog_file5,
-          L: 66,
+          L: 70,
           S: this,
           C: (f, a) => f(...a)
         });
         return;
       }
       const payload = (0, import_cbor_x.decode)(message.payload.value);
-      import_log3.log.info("receive", {
+      (0, import_log3.log)("receive", {
         from: message.source,
         feedKey: payload.feedKey,
         type: payload.type
       }, {
         F: __dxlog_file5,
-        L: 71,
+        L: 75,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1118,46 +1137,44 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
     }));
     this._messenger.connected.on(this._ctx, async () => {
       await this._resetConnection();
-      this._connected = true;
-      const connectionCtx = new import_context3.Context({
-        onError: async (err) => {
-          if (connectionCtx !== this._connectionCtx) {
-            return;
-          }
-          if (err instanceof import_edge_client.EdgeIdentityChangedError || err instanceof import_edge_client.EdgeConnectionClosedError) {
-            (0, import_log3.log)("resetting on reconnect", void 0, {
-              F: __dxlog_file5,
-              L: 86,
-              S: this,
-              C: (f, a) => f(...a)
-            });
-            await this._resetConnection();
-          } else {
-            this._ctx.raise(err);
-          }
-        }
-      }, {
-        F: __dxlog_file5,
-        L: 80
-      });
-      this._connectionCtx = connectionCtx;
-      (0, import_log3.log)("connection context created", void 0, {
-        F: __dxlog_file5,
-        L: 94,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      (0, import_async6.scheduleMicroTask)(connectionCtx, async () => {
-        for (const feed of this._feeds.values()) {
-          await this._replicateFeed(connectionCtx, feed);
-        }
-      });
+      this._startReplication();
     });
+    if (this._messenger.isConnected) {
+      this._startReplication();
+    }
   }
   async _close() {
+    (0, import_log3.log)("close", void 0, {
+      F: __dxlog_file5,
+      L: 91,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     await this._resetConnection();
   }
+  _startReplication() {
+    this._connected = true;
+    const connectionCtx = this._createConnectionContext();
+    this._connectionCtx = connectionCtx;
+    (0, import_log3.log)("connection context created", void 0, {
+      F: __dxlog_file5,
+      L: 99,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    (0, import_async6.scheduleMicroTask)(connectionCtx, async () => {
+      for (const feed of this._feeds.values()) {
+        await this._replicateFeed(connectionCtx, feed);
+      }
+    });
+  }
   async _resetConnection() {
+    (0, import_log3.log)("resetConnection", void 0, {
+      F: __dxlog_file5,
+      L: 108,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     this._connected = false;
     await this._connectionCtx?.dispose();
     this._connectionCtx = void 0;
@@ -1165,10 +1182,12 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
   }
   async addFeed(feed) {
     import_log3.log.info("addFeed", {
-      key: feed.key
+      key: feed.key,
+      connected: this._connected,
+      hasConnectionCtx: !!this._connectionCtx
     }, {
       F: __dxlog_file5,
-      L: 115,
+      L: 116,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1181,6 +1200,14 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
     return (0, import_util3.defaultMap)(this._pushMutex, key, () => new import_async6.Mutex());
   }
   async _replicateFeed(ctx, feed) {
+    (0, import_log3.log)("replicateFeed", {
+      key: feed.key
+    }, {
+      F: __dxlog_file5,
+      L: 129,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     await this._sendMessage({
       type: "get-metadata",
       feedKey: feed.key.toHex()
@@ -1193,7 +1220,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
     if (!this._connectionCtx) {
       import_log3.log.info("message dropped because connection was disposed", void 0, {
         F: __dxlog_file5,
-        L: 140,
+        L: 142,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1207,13 +1234,13 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
     };
     import_log3.log.info("sending message", logPayload, {
       F: __dxlog_file5,
-      L: 146,
+      L: 148,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant2.invariant)(message.feedKey, void 0, {
       F: __dxlog_file5,
-      L: 148,
+      L: 150,
       S: this,
       A: [
         "message.feedKey",
@@ -1221,6 +1248,14 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
       ]
     });
     const payloadValue = (0, import_util3.bufferToArray)((0, import_cbor_x.encode)(message));
+    (0, import_log3.log)("send", {
+      type: message.type
+    }, {
+      F: __dxlog_file5,
+      L: 153,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     await this._messenger.send(import_buf.buf.create(import_messenger_pb.MessageSchema, {
       source: {
         identityKey: this._messenger.identityKey,
@@ -1236,7 +1271,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
     if (!this._connectionCtx) {
       import_log3.log.warn("received message after connection context was disposed", void 0, {
         F: __dxlog_file5,
-        L: 165,
+        L: 168,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -1251,7 +1286,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
               message
             }, {
               F: __dxlog_file5,
-              L: 171,
+              L: 174,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1262,7 +1297,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
                 feedKey
               }, {
                 F: __dxlog_file5,
-                L: 176,
+                L: 179,
                 S: this,
                 C: (f, a) => f(...a)
               });
@@ -1295,7 +1330,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
             blocks: message.blocks.map((b) => b.index)
           }, {
             F: __dxlog_file5,
-            L: 198,
+            L: 201,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1306,7 +1341,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
               feedKey
             }, {
               F: __dxlog_file5,
-              L: 203,
+              L: 206,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -1320,7 +1355,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
             ...message
           }, {
             F: __dxlog_file5,
-            L: 212,
+            L: 215,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1335,7 +1370,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
       to
     }, {
       F: __dxlog_file5,
-      L: 219,
+      L: 222,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1345,7 +1380,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
       });
       (0, import_invariant2.invariant)(data instanceof Uint8Array, void 0, {
         F: __dxlog_file5,
-        L: 224,
+        L: 227,
         S: this,
         A: [
           "data instanceof Uint8Array",
@@ -1373,7 +1408,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
       blocks: blocks.length
     }, {
       F: __dxlog_file5,
-      L: 245,
+      L: 248,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1395,7 +1430,7 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
       if (!this._remoteLength.has(feed.key)) {
         (0, import_log3.log)("blocks not pushed because remote length is unknown", void 0, {
           F: __dxlog_file5,
-          L: 266,
+          L: 269,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1411,7 +1446,34 @@ var EdgeFeedReplicator = class extends import_context3.Resource {
       _usingCtx.d();
     }
   }
+  _createConnectionContext() {
+    const connectionCtx = new import_context3.Context({
+      onError: async (err) => {
+        if (connectionCtx !== this._connectionCtx) {
+          return;
+        }
+        if (err instanceof import_edge_client.EdgeIdentityChangedError || err instanceof import_edge_client.EdgeConnectionClosedError) {
+          (0, import_log3.log)("resetting on reconnect", void 0, {
+            F: __dxlog_file5,
+            L: 286,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          await this._resetConnection();
+        } else {
+          this._ctx.raise(err);
+        }
+      }
+    }, {
+      F: __dxlog_file5,
+      L: 280
+    });
+    return connectionCtx;
+  }
 };
+_ts_decorate([
+  import_log3.logInfo
+], EdgeFeedReplicator.prototype, "_spaceId", void 0);
 var bufferizeBlock = (block) => ({
   index: block.index,
   data: (0, import_util3.arrayToBuffer)(block.data),
@@ -1628,45 +1690,57 @@ var runEpochMigration = async (ctx, context) => {
   }
   return {};
 };
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
 var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/notarization-plugin.ts";
 var DEFAULT_RETRY_TIMEOUT = 1e3;
 var DEFAULT_SUCCESS_DELAY = 1e3;
 var DEFAULT_NOTARIZE_TIMEOUT = 1e4;
+var MAX_EDGE_RETRIES = 2;
 var WRITER_NOT_SET_ERROR_CODE = "WRITER_NOT_SET";
-var NotarizationPlugin = class {
-  constructor() {
-    this._ctx = new import_context6.Context(void 0, {
-      F: __dxlog_file7,
-      L: 62
-    });
+var credentialCodec = import_proto2.schema.getCodecForType("dxos.halo.credentials.Credential");
+var NotarizationPlugin = class extends import_context6.Resource {
+  constructor(params) {
+    super();
     this._extensionOpened = new import_async9.Event();
     this._extensions = /* @__PURE__ */ new Set();
     this._processedCredentials = new import_util5.ComplexSet(import_keys5.PublicKey.hash);
     this._processCredentialsTriggers = new import_util5.ComplexMap(import_keys5.PublicKey.hash);
+    this._spaceId = params.spaceId;
+    if (params.edgeClient && params.edgeFeatures?.feedReplicator) {
+      this._edgeClient = params.edgeClient;
+    }
   }
   get hasWriter() {
     return !!this._writer;
   }
-  async open() {
+  async _open() {
+    if (this._edgeClient && this._writer) {
+      this._notarizePendingEdgeCredentials(this._edgeClient, this._writer);
+    }
   }
-  async close() {
+  async _close() {
     await this._ctx.dispose();
   }
   /**
   * Request credentials to be notarized.
   */
-  async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY }) {
+  async notarize({ ctx: opCtx, credentials, timeout = DEFAULT_NOTARIZE_TIMEOUT, retryTimeout = DEFAULT_RETRY_TIMEOUT, successDelay = DEFAULT_SUCCESS_DELAY, edgeRetryJitter }) {
     (0, import_log6.log)("notarize", {
       credentials
     }, {
       F: __dxlog_file7,
-      L: 90,
+      L: 126,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant5.invariant)(credentials.every((credential) => credential.id), "Credentials must have an id", {
       F: __dxlog_file7,
-      L: 91,
+      L: 127,
       S: this,
       A: [
         "credentials.every((credential) => credential.id)",
@@ -1680,7 +1754,7 @@ var NotarizationPlugin = class {
           err
         }, {
           F: __dxlog_file7,
-          L: 99,
+          L: 135,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1690,21 +1764,37 @@ var NotarizationPlugin = class {
     });
     opCtx?.onDispose(() => ctx.dispose());
     if (timeout !== 0) {
-      (0, import_async9.scheduleTask)(ctx, () => {
-        import_log6.log.warn("Notarization timeout", {
-          timeout,
-          peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
-        }, {
-          F: __dxlog_file7,
-          L: 111,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        void ctx.dispose();
-        errors.throw(new import_async9.TimeoutError(timeout, "Notarization timed out"));
-      }, timeout);
+      this._scheduleTimeout(ctx, errors, timeout);
     }
     const allNotarized = Promise.all(credentials.map((credential) => this._waitUntilProcessed(credential.id)));
+    this._tryNotarizeCredentialsWithPeers(ctx, credentials, {
+      retryTimeout,
+      successDelay
+    });
+    if (this._edgeClient) {
+      this._tryNotarizeCredentialsWithEdge(ctx, this._edgeClient, credentials, {
+        retryTimeout,
+        successDelay,
+        jitter: edgeRetryJitter
+      });
+    }
+    try {
+      await Promise.race([
+        (0, import_context6.rejectOnDispose)(ctx),
+        allNotarized,
+        errors.wait()
+      ]);
+      (0, import_log6.log)("done", void 0, {
+        F: __dxlog_file7,
+        L: 160,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    } finally {
+      await ctx.dispose();
+    }
+  }
+  _tryNotarizeCredentialsWithPeers(ctx, credentials, { retryTimeout, successDelay }) {
     const peersTried = /* @__PURE__ */ new Set();
     const notarizeTask = new import_async9.DeferredTask(ctx, async () => {
       try {
@@ -1719,7 +1809,7 @@ var NotarizationPlugin = class {
             retryIn: retryTimeout
           }, {
             F: __dxlog_file7,
-            L: 136,
+            L: 183,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1733,7 +1823,7 @@ var NotarizationPlugin = class {
           credentialId: credentials.map((credential) => credential.id)
         }, {
           F: __dxlog_file7,
-          L: 143,
+          L: 190,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1742,7 +1832,7 @@ var NotarizationPlugin = class {
         });
         (0, import_log6.log)("success", void 0, {
           F: __dxlog_file7,
-          L: 147,
+          L: 194,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1751,7 +1841,7 @@ var NotarizationPlugin = class {
         if (!ctx.disposed && !err.message.includes(WRITER_NOT_SET_ERROR_CODE)) {
           import_log6.log.info("error notarizing (recoverable)", err, {
             F: __dxlog_file7,
-            L: 151,
+            L: 199,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1761,21 +1851,33 @@ var NotarizationPlugin = class {
     });
     notarizeTask.schedule();
     this._extensionOpened.on(ctx, () => notarizeTask.schedule());
-    try {
-      await Promise.race([
-        (0, import_context6.rejectOnDispose)(ctx),
-        allNotarized,
-        errors.wait()
-      ]);
-      (0, import_log6.log)("done", void 0, {
-        F: __dxlog_file7,
-        L: 162,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    } finally {
-      await ctx.dispose();
-    }
+  }
+  _tryNotarizeCredentialsWithEdge(ctx, client, credentials, timeouts) {
+    const encodedCredentials = credentials.map((credential) => {
+      const binary = credentialCodec.encode(credential);
+      return Buffer.from(binary).toString("base64");
+    });
+    (0, import_async9.scheduleTask)(ctx, async () => {
+      try {
+        await client.notarizeCredentials(this._spaceId, {
+          credentials: encodedCredentials
+        }, {
+          retry: {
+            count: MAX_EDGE_RETRIES,
+            timeout: timeouts.retryTimeout,
+            jitter: timeouts.jitter
+          }
+        });
+        (0, import_log6.log)("edge notarization success", void 0, {
+          F: __dxlog_file7,
+          L: 227,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      } catch (error) {
+        handleEdgeError(error);
+      }
+    });
   }
   /**
   * Called with credentials arriving from the control pipeline.
@@ -1791,7 +1893,7 @@ var NotarizationPlugin = class {
   setWriter(writer) {
     (0, import_invariant5.invariant)(!this._writer, "Writer already set.", {
       F: __dxlog_file7,
-      L: 181,
+      L: 247,
       S: this,
       A: [
         "!this._writer",
@@ -1799,6 +1901,59 @@ var NotarizationPlugin = class {
       ]
     });
     this._writer = writer;
+    if (this._edgeClient) {
+      this._notarizePendingEdgeCredentials(this._edgeClient, writer);
+    }
+  }
+  /**
+  * The method is used only for adding agent feeds to spaces.
+  * When an agent is created we can admit them into all the existing spaces. In case the operation fails
+  * this method will fix it on the next space open.
+  * Given how rarely this happens there's no need to poll the endpoint.
+  */
+  _notarizePendingEdgeCredentials(client, writer) {
+    (0, import_async9.scheduleMicroTask)(this._ctx, async () => {
+      try {
+        const response = await client.getCredentialsForNotarization(this._spaceId, {
+          retry: {
+            count: MAX_EDGE_RETRIES
+          }
+        });
+        const credentials = response.awaitingNotarization.credentials;
+        if (!credentials.length) {
+          (0, import_log6.log)("edge did not return credentials for notarization", void 0, {
+            F: __dxlog_file7,
+            L: 269,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return;
+        }
+        (0, import_log6.log)("got edge credentials for notarization", {
+          count: credentials.length
+        }, {
+          F: __dxlog_file7,
+          L: 273,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        const decodedCredentials = credentials.map((credential) => {
+          const binary = Buffer.from(credential, "base64");
+          return credentialCodec.decode(binary);
+        });
+        await this._notarizeCredentials(writer, decodedCredentials);
+        import_log6.log.info("notarized edge credentials", {
+          count: decodedCredentials.length
+        }, {
+          F: __dxlog_file7,
+          L: 282,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      } catch (error) {
+        handleEdgeError(error);
+      }
+    });
   }
   async _waitUntilProcessed(id) {
     if (this._processedCredentials.has(id)) {
@@ -1813,10 +1968,13 @@ var NotarizationPlugin = class {
     if (!this._writer) {
       throw new Error(WRITER_NOT_SET_ERROR_CODE);
     }
-    for (const credential of request.credentials ?? []) {
+    await this._notarizeCredentials(this._writer, request.credentials ?? []);
+  }
+  async _notarizeCredentials(writer, credentials) {
+    for (const credential of credentials) {
       (0, import_invariant5.invariant)(credential.id, "Credential must have an id", {
         F: __dxlog_file7,
-        L: 200,
+        L: 308,
         S: this,
         A: [
           "credential.id",
@@ -1826,7 +1984,11 @@ var NotarizationPlugin = class {
       if (this._processedCredentials.has(credential.id)) {
         continue;
       }
-      await this._writer.write(credential);
+      const verificationResult = await (0, import_credentials5.verifyCredential)(credential);
+      if (verificationResult.kind === "fail") {
+        throw new Error(`Credential verification failed: ${verificationResult.errors.join("\n")}.`);
+      }
+      await writer.write(credential);
     }
   }
   createExtension() {
@@ -1836,7 +1998,7 @@ var NotarizationPlugin = class {
           peer: extension.localPeerId
         }, {
           F: __dxlog_file7,
-          L: 211,
+          L: 323,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1848,7 +2010,7 @@ var NotarizationPlugin = class {
           peer: extension.localPeerId
         }, {
           F: __dxlog_file7,
-          L: 216,
+          L: 328,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1858,6 +2020,43 @@ var NotarizationPlugin = class {
     });
     return extension;
   }
+  _scheduleTimeout(ctx, errors, timeout) {
+    (0, import_async9.scheduleTask)(ctx, () => {
+      import_log6.log.warn("Notarization timeout", {
+        timeout,
+        peers: Array.from(this._extensions).map((extension) => extension.remotePeerId)
+      }, {
+        F: __dxlog_file7,
+        L: 340,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      void ctx.dispose();
+      errors.throw(new import_async9.TimeoutError(timeout, "Notarization timed out"));
+    }, timeout);
+  }
+};
+_ts_decorate2([
+  import_log6.logInfo
+], NotarizationPlugin.prototype, "_spaceId", void 0);
+var handleEdgeError = (error) => {
+  if (!(error instanceof import_protocols4.EdgeCallFailedError) || error.errorData) {
+    import_log6.log.catch(error, void 0, {
+      F: __dxlog_file7,
+      L: 354,
+      S: void 0,
+      C: (f, a) => f(...a)
+    });
+  } else {
+    import_log6.log.info("Edge notarization failure", {
+      reason: error.reason
+    }, {
+      F: __dxlog_file7,
+      L: 356,
+      S: void 0,
+      C: (f, a) => f(...a)
+    });
+  }
 };
 var NotarizationTeleportExtension = class extends import_teleport.RpcExtension {
   constructor(_params) {
@@ -1898,7 +2097,7 @@ var DefaultSpaceStateMachine = class {
     return this._spaceId;
   }
   async processCredential(credential) {
-    const assertion = (0, import_credentials7.getCredentialAssertion)(credential);
+    const assertion = (0, import_credentials8.getCredentialAssertion)(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.DefaultSpace": {
         if (!credential.subject.id.equals(this._params.identityKey)) {
@@ -1932,7 +2131,7 @@ var DefaultSpaceStateMachine = class {
 };
 var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   const credentials = [
-    await (0, import_credentials10.createCredential)({
+    await (0, import_credentials11.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: space.key,
@@ -1941,14 +2140,14 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key
       }
     }),
-    await (0, import_credentials10.createCredential)({
+    await (0, import_credentials11.createCredential)({
       signer: keyring,
       issuer: space.key,
       subject: signingContext.identityKey,
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey: space.key,
-        role: import_credentials11.SpaceMember.Role.OWNER,
+        role: import_credentials12.SpaceMember.Role.OWNER,
         profile: signingContext.getProfile(),
         genesisFeedKey: space.controlFeedKey ?? (0, import_debug2.failUndefined)()
       }
@@ -1960,7 +2159,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials11.AdmittedFeed.Designation.CONTROL
+        designation: import_credentials12.AdmittedFeed.Designation.CONTROL
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -1970,7 +2169,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
         spaceKey: space.key,
         identityKey: signingContext.identityKey,
         deviceKey: signingContext.deviceKey,
-        designation: import_credentials11.AdmittedFeed.Designation.DATA
+        designation: import_credentials12.AdmittedFeed.Designation.DATA
       }
     }),
     await signingContext.credentialSigner.createCredential({
@@ -1994,7 +2193,7 @@ var spaceGenesis = async (keyring, signingContext, space, automergeRoot) => {
   }
   return credentials;
 };
-function _ts_decorate(decorators, target, key, desc) {
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -2011,6 +2210,7 @@ var DataSpaceManager = class extends import_context7.Resource {
     this._spaces = new import_util7.ComplexMap(import_keys8.PublicKey.hash);
     this._instanceId = import_keys8.PublicKey.random().toHex();
     this._edgeConnection = void 0;
+    this._edgeHttpClient = void 0;
     this._edgeFeatures = void 0;
     this._meshReplicator = void 0;
     this._echoEdgeReplicator = void 0;
@@ -2026,6 +2226,7 @@ var DataSpaceManager = class extends import_context7.Resource {
     this._edgeConnection = params.edgeConnection;
     this._edgeFeatures = params.edgeFeatures;
     this._echoEdgeReplicator = params.echoEdgeReplicator;
+    this._edgeHttpClient = params.edgeHttpClient;
     this._runtimeParams = params.runtimeParams;
     import_tracing5.trace.diagnostic({
       id: "spaces",
@@ -2057,15 +2258,15 @@ var DataSpaceManager = class extends import_context7.Resource {
   async _open() {
     (0, import_log9.log)("open", void 0, {
       F: __dxlog_file9,
-      L: 195,
+      L: 198,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log9.log.trace("dxos.echo.data-space-manager.open", import_protocols4.trace.begin({
+    import_log9.log.trace("dxos.echo.data-space-manager.open", import_protocols5.trace.begin({
       id: this._instanceId
     }), {
       F: __dxlog_file9,
-      L: 196,
+      L: 199,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2073,7 +2274,7 @@ var DataSpaceManager = class extends import_context7.Resource {
       spaces: this._metadataStore.spaces.length
     }, {
       F: __dxlog_file9,
-      L: 197,
+      L: 200,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2083,7 +2284,7 @@ var DataSpaceManager = class extends import_context7.Resource {
           spaceMetadata
         }, {
           F: __dxlog_file9,
-          L: 201,
+          L: 204,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2094,18 +2295,18 @@ var DataSpaceManager = class extends import_context7.Resource {
           err
         }, {
           F: __dxlog_file9,
-          L: 204,
+          L: 207,
           S: this,
           C: (f, a) => f(...a)
         });
       }
     });
     this.updated.emit();
-    import_log9.log.trace("dxos.echo.data-space-manager.open", import_protocols4.trace.end({
+    import_log9.log.trace("dxos.echo.data-space-manager.open", import_protocols5.trace.end({
       id: this._instanceId
     }), {
       F: __dxlog_file9,
-      L: 210,
+      L: 213,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2113,7 +2314,7 @@ var DataSpaceManager = class extends import_context7.Resource {
   async _close() {
     (0, import_log9.log)("close", void 0, {
       F: __dxlog_file9,
-      L: 215,
+      L: 218,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2128,7 +2329,7 @@ var DataSpaceManager = class extends import_context7.Resource {
   async createSpace() {
     (0, import_invariant7.invariant)(this._lifecycleState === import_context7.LifecycleState.OPEN, "Not open.", {
       F: __dxlog_file9,
-      L: 227,
+      L: 230,
       S: this,
       A: [
         "this._lifecycleState === LifecycleState.OPEN",
@@ -2149,7 +2350,7 @@ var DataSpaceManager = class extends import_context7.Resource {
       spaceKey
     }, {
       F: __dxlog_file9,
-      L: 239,
+      L: 242,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2159,9 +2360,9 @@ var DataSpaceManager = class extends import_context7.Resource {
     const credentials = await spaceGenesis(this._keyring, this._signingContext, space.inner, root.url);
     await this._metadataStore.addSpace(metadata);
     const memberCredential = credentials[1];
-    (0, import_invariant7.invariant)((0, import_credentials8.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+    (0, import_invariant7.invariant)((0, import_credentials9.getCredentialAssertion)(memberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file9,
-      L: 249,
+      L: 252,
       S: this,
       A: [
         "getCredentialAssertion(memberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2193,7 +2394,7 @@ var DataSpaceManager = class extends import_context7.Resource {
           spaceId: space.id
         }, {
           F: __dxlog_file9,
-          L: 274,
+          L: 277,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2228,7 +2429,7 @@ var DataSpaceManager = class extends import_context7.Resource {
     const automergeIndex = space.automergeSpaceState.rootUrl;
     (0, import_invariant7.invariant)(automergeIndex, void 0, {
       F: __dxlog_file9,
-      L: 307,
+      L: 310,
       S: this,
       A: [
         "automergeIndex",
@@ -2245,13 +2446,13 @@ var DataSpaceManager = class extends import_context7.Resource {
       opts
     }, {
       F: __dxlog_file9,
-      L: 316,
+      L: 319,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant7.invariant)(this._lifecycleState === import_context7.LifecycleState.OPEN, "Not open.", {
       F: __dxlog_file9,
-      L: 317,
+      L: 320,
       S: this,
       A: [
         "this._lifecycleState === LifecycleState.OPEN",
@@ -2260,7 +2461,7 @@ var DataSpaceManager = class extends import_context7.Resource {
     });
     (0, import_invariant7.invariant)(!this._spaces.has(opts.spaceKey), "Space already exists.", {
       F: __dxlog_file9,
-      L: 318,
+      L: 321,
       S: this,
       A: [
         "!this._spaces.has(opts.spaceKey)",
@@ -2284,20 +2485,20 @@ var DataSpaceManager = class extends import_context7.Resource {
     const space = this._spaceManager.spaces.get(options.spaceKey);
     (0, import_invariant7.invariant)(space, void 0, {
       F: __dxlog_file9,
-      L: 338,
+      L: 341,
       S: this,
       A: [
         "space",
         ""
       ]
     });
-    if (space.spaceState.getMemberRole(options.identityKey) !== import_credentials9.SpaceMember.Role.REMOVED) {
-      throw new import_protocols4.AlreadyJoinedError();
+    if (space.spaceState.getMemberRole(options.identityKey) !== import_credentials10.SpaceMember.Role.REMOVED) {
+      throw new import_protocols5.AlreadyJoinedError();
     }
-    const credentials = await (0, import_credentials8.createAdmissionCredentials)(this._signingContext.credentialSigner, options.identityKey, space.key, space.genesisFeedKey, options.role, space.spaceState.membershipChainHeads, options.profile, options.delegationCredentialId);
+    const credentials = await (0, import_credentials9.createAdmissionCredentials)(this._signingContext.credentialSigner, options.identityKey, space.key, space.genesisFeedKey, options.role, space.spaceState.membershipChainHeads, options.profile, options.delegationCredentialId);
     (0, import_invariant7.invariant)(credentials[0].credential, void 0, {
       F: __dxlog_file9,
-      L: 357,
+      L: 360,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2305,9 +2506,9 @@ var DataSpaceManager = class extends import_context7.Resource {
       ]
     });
     const spaceMemberCredential = credentials[0].credential.credential;
-    (0, import_invariant7.invariant)((0, import_credentials8.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+    (0, import_invariant7.invariant)((0, import_credentials9.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file9,
-      L: 359,
+      L: 362,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2341,12 +2542,35 @@ var DataSpaceManager = class extends import_context7.Resource {
       }
     });
   }
+  async setSpaceEdgeReplicationSetting(spaceKey, setting) {
+    const space = this._spaces.get(spaceKey);
+    (0, import_invariant7.invariant)(space, "Space not found.", {
+      F: __dxlog_file9,
+      L: 399,
+      S: this,
+      A: [
+        "space",
+        "'Space not found.'"
+      ]
+    });
+    await this._metadataStore.setSpaceEdgeReplicationSetting(spaceKey, setting);
+    if (space.isOpen) {
+      switch (setting) {
+        case import_metadata.EdgeReplicationSetting.DISABLED:
+          await this._echoEdgeReplicator?.disconnectFromSpace(space.id);
+          break;
+        case import_metadata.EdgeReplicationSetting.ENABLED:
+          await this._echoEdgeReplicator?.connectToSpace(space.id);
+          break;
+      }
+    }
+  }
   async _constructSpace(metadata) {
     (0, import_log9.log)("construct space", {
       metadata
     }, {
       F: __dxlog_file9,
-      L: 395,
+      L: 416,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2390,7 +2614,7 @@ var DataSpaceManager = class extends import_context7.Resource {
             err
           }, {
             F: __dxlog_file9,
-            L: 437,
+            L: 458,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2400,7 +2624,7 @@ var DataSpaceManager = class extends import_context7.Resource {
       onAuthFailure: () => {
         import_log9.log.warn("auth failure", void 0, {
           F: __dxlog_file9,
-          L: 442,
+          L: 463,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2433,7 +2657,7 @@ var DataSpaceManager = class extends import_context7.Resource {
             space: space.key
           }, {
             F: __dxlog_file9,
-            L: 469,
+            L: 490,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2444,7 +2668,7 @@ var DataSpaceManager = class extends import_context7.Resource {
             open: this._lifecycleState === import_context7.LifecycleState.OPEN
           }, {
             F: __dxlog_file9,
-            L: 472,
+            L: 493,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2463,7 +2687,7 @@ var DataSpaceManager = class extends import_context7.Resource {
             space: space.key
           }, {
             F: __dxlog_file9,
-            L: 480,
+            L: 501,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -2471,13 +2695,20 @@ var DataSpaceManager = class extends import_context7.Resource {
       },
       cache: metadata.cache,
       edgeConnection: this._edgeConnection,
+      edgeHttpClient: this._edgeHttpClient,
       edgeFeatures: this._edgeFeatures
     });
     dataSpace.postOpen.append(async () => {
-      await this._echoEdgeReplicator?.connectToSpace(dataSpace.id);
+      const setting = dataSpace.getEdgeReplicationSetting();
+      if (setting === import_metadata.EdgeReplicationSetting.ENABLED) {
+        await this._echoEdgeReplicator?.connectToSpace(dataSpace.id);
+      }
     });
     dataSpace.preClose.append(async () => {
-      await this._echoEdgeReplicator?.disconnectFromSpace(dataSpace.id);
+      const setting = dataSpace.getEdgeReplicationSetting();
+      if (setting === import_metadata.EdgeReplicationSetting.ENABLED) {
+        await this._echoEdgeReplicator?.disconnectFromSpace(dataSpace.id);
+      }
     });
     presence.newPeer.on((peerState) => {
       if (dataSpace.state === import_services6.SpaceState.SPACE_READY) {
@@ -2497,7 +2728,7 @@ var DataSpaceManager = class extends import_context7.Resource {
         space: space.key
       }, {
         F: __dxlog_file9,
-        L: 511,
+        L: 539,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -2517,7 +2748,7 @@ var DataSpaceManager = class extends import_context7.Resource {
       const peers = presence.getPeersByIdentityKey(member.key);
       const sessions = peers.map((p) => p.peerId && spaceProtocol.sessions.get(p.peerId));
       const sessionsToClose = sessions.filter((s) => {
-        return (s && member.role === import_credentials9.SpaceMember.Role.REMOVED !== (s.authStatus === import_echo_pipeline3.AuthStatus.FAILURE)) ?? false;
+        return (s && member.role === import_credentials10.SpaceMember.Role.REMOVED !== (s.authStatus === import_echo_pipeline3.AuthStatus.FAILURE)) ?? false;
       });
       sessionsToClose.forEach((session) => {
         void session.close().catch(import_log9.log.error);
@@ -2530,7 +2761,7 @@ var DataSpaceManager = class extends import_context7.Resource {
       closedSessions
     }, {
       F: __dxlog_file9,
-      L: 537,
+      L: 565,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -2538,14 +2769,14 @@ var DataSpaceManager = class extends import_context7.Resource {
   }
   _handleNewPeerConnected(space, peerState) {
     const role = space.spaceState.getMemberRole(peerState.identityKey);
-    if (role === import_credentials9.SpaceMember.Role.REMOVED) {
+    if (role === import_credentials10.SpaceMember.Role.REMOVED) {
       const session = peerState.peerId && space.protocol.sessions.get(peerState.peerId);
       if (session != null) {
         (0, import_log9.log)("closing a session with a removed peer", {
           peerId: peerState.peerId
         }, {
           F: __dxlog_file9,
-          L: 551,
+          L: 579,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2589,19 +2820,19 @@ var DataSpaceManager = class extends import_context7.Resource {
     await Promise.all(tasks);
   }
 };
-_ts_decorate([
+_ts_decorate3([
   import_async11.synchronized
 ], DataSpaceManager.prototype, "_open", null);
-_ts_decorate([
+_ts_decorate3([
   import_async11.synchronized
 ], DataSpaceManager.prototype, "_close", null);
-_ts_decorate([
+_ts_decorate3([
   import_async11.synchronized
 ], DataSpaceManager.prototype, "createSpace", null);
-_ts_decorate([
+_ts_decorate3([
   import_async11.synchronized
 ], DataSpaceManager.prototype, "acceptSpace", null);
-DataSpaceManager = _ts_decorate([
+DataSpaceManager = _ts_decorate3([
   (0, import_async11.trackLeaks)("open", "close")
 ], DataSpaceManager);
 var __dxlog_file10 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/spaces/spaces-service.ts";
@@ -2618,9 +2849,9 @@ var SpacesServiceImpl = class {
     await this._updateMetrics();
     return this._serializeSpace(space);
   }
-  async updateSpace({ spaceKey, state }) {
+  async updateSpace({ spaceKey, state, edgeReplication }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols5.SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols6.SpaceNotFoundError(spaceKey));
     if (state) {
       switch (state) {
         case import_services7.SpaceState.SPACE_ACTIVE:
@@ -2630,26 +2861,29 @@ var SpacesServiceImpl = class {
           await space.deactivate();
           break;
         default:
-          throw new import_protocols5.ApiError("Invalid space state");
+          throw new import_protocols6.ApiError("Invalid space state");
       }
     }
+    if (edgeReplication !== void 0) {
+      await dataSpaceManager.setSpaceEdgeReplicationSetting(spaceKey, edgeReplication);
+    }
   }
   async updateMemberRole(request) {
     const identity = this._requireIdentity();
     const space = this._spaceManager.spaces.get(request.spaceKey);
     if (space == null) {
-      throw new import_protocols5.SpaceNotFoundError(request.spaceKey);
+      throw new import_protocols6.SpaceNotFoundError(request.spaceKey);
     }
     if (!space.spaceState.hasMembershipManagementPermission(identity.identityKey)) {
-      throw new import_protocols5.AuthorizationError("No member management permission.", {
+      throw new import_protocols6.AuthorizationError("No member management permission.", {
         spaceKey: space.key,
         role: space.spaceState.getMemberRole(identity.identityKey)
       });
     }
-    const credentials = await (0, import_credentials12.createAdmissionCredentials)(identity.getIdentityCredentialSigner(), request.memberKey, space.key, space.genesisFeedKey, request.newRole, space.spaceState.membershipChainHeads);
+    const credentials = await (0, import_credentials13.createAdmissionCredentials)(identity.getIdentityCredentialSigner(), request.memberKey, space.key, space.genesisFeedKey, request.newRole, space.spaceState.membershipChainHeads);
     (0, import_invariant8.invariant)(credentials[0].credential, void 0, {
       F: __dxlog_file10,
-      L: 102,
+      L: 106,
       S: this,
       A: [
         "credentials[0].credential",
@@ -2657,9 +2891,9 @@ var SpacesServiceImpl = class {
       ]
     });
     const spaceMemberCredential = credentials[0].credential.credential;
-    (0, import_invariant8.invariant)((0, import_credentials12.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
+    (0, import_invariant8.invariant)((0, import_credentials13.getCredentialAssertion)(spaceMemberCredential)["@type"] === "dxos.halo.credentials.SpaceMember", void 0, {
       F: __dxlog_file10,
-      L: 104,
+      L: 108,
       S: this,
       A: [
         "getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2677,7 +2911,7 @@ var SpacesServiceImpl = class {
           ids: spaces.map((space) => space.id)
         }), {
           F: __dxlog_file10,
-          L: 115,
+          L: 119,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -2725,14 +2959,14 @@ var SpacesServiceImpl = class {
   }
   async postMessage({ spaceKey, channel, message }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols5.SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols6.SpaceNotFoundError(spaceKey));
     await space.postMessage(getChannelId(channel), message);
   }
   subscribeMessages({ spaceKey, channel }) {
     return new import_codec_protobuf8.Stream(({ ctx, next }) => {
       (0, import_async12.scheduleTask)(ctx, async () => {
         const dataSpaceManager = await this._getDataSpaceManager();
-        const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols5.SpaceNotFoundError(spaceKey));
+        const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols6.SpaceNotFoundError(spaceKey));
         const handle = space.listen(getChannelId(channel), (message) => {
           next(message);
         });
@@ -2742,7 +2976,7 @@ var SpacesServiceImpl = class {
   }
   queryCredentials({ spaceKey, noTail }) {
     return new import_codec_protobuf8.Stream(({ ctx, next, close }) => {
-      const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols5.SpaceNotFoundError(spaceKey));
+      const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols6.SpaceNotFoundError(spaceKey));
       const processor = {
         processCredential: async (credential) => {
           next(credential);
@@ -2758,7 +2992,7 @@ var SpacesServiceImpl = class {
     });
   }
   async writeCredentials({ spaceKey, credentials }) {
-    const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols5.SpaceNotFoundError(spaceKey));
+    const space = this._spaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols6.SpaceNotFoundError(spaceKey));
     for (const credential of credentials ?? []) {
       if (credential.proof) {
         await space.controlPipeline.writer.write({
@@ -2769,7 +3003,7 @@ var SpacesServiceImpl = class {
       } else {
         (0, import_invariant8.invariant)(!credential.id, "Id on unsigned credentials is not allowed", {
           F: __dxlog_file10,
-          L: 213,
+          L: 217,
           S: this,
           A: [
             "!credential.id",
@@ -2778,7 +3012,7 @@ var SpacesServiceImpl = class {
         });
         (0, import_invariant8.invariant)(this._identityManager.identity, "Identity is not available", {
           F: __dxlog_file10,
-          L: 214,
+          L: 218,
           S: this,
           A: [
             "this._identityManager.identity",
@@ -2788,7 +3022,7 @@ var SpacesServiceImpl = class {
         const signer = this._identityManager.identity.getIdentityCredentialSigner();
         (0, import_invariant8.invariant)(credential.issuer.equals(signer.getIssuer()), void 0, {
           F: __dxlog_file10,
-          L: 216,
+          L: 220,
           S: this,
           A: [
             "credential.issuer.equals(signer.getIssuer())",
@@ -2809,7 +3043,7 @@ var SpacesServiceImpl = class {
   }
   async createEpoch({ spaceKey, migration, automergeRootUrl }) {
     const dataSpaceManager = await this._getDataSpaceManager();
-    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols5.SpaceNotFoundError(spaceKey));
+    const space = dataSpaceManager.spaces.get(spaceKey) ?? (0, import_debug3.raise)(new import_protocols6.SpaceNotFoundError(spaceKey));
     const result = await space.createEpoch({
       migration,
       newAutomergeRoot: automergeRootUrl
@@ -2835,10 +3069,10 @@ var SpacesServiceImpl = class {
     });
   }
   async _joinByAdmission({ credential }) {
-    const assertion = (0, import_credentials12.getCredentialAssertion)(credential);
+    const assertion = (0, import_credentials13.getCredentialAssertion)(credential);
     (0, import_invariant8.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file10,
-      L: 250,
+      L: 254,
       S: this,
       A: [
         "assertion['@type'] === 'dxos.halo.credentials.SpaceMember'",
@@ -2848,7 +3082,7 @@ var SpacesServiceImpl = class {
     const myIdentity = this._identityManager.identity;
     (0, import_invariant8.invariant)(myIdentity && credential.subject.id.equals(myIdentity.identityKey), void 0, {
       F: __dxlog_file10,
-      L: 252,
+      L: 256,
       S: this,
       A: [
         "myIdentity && credential.subject.id.equals(myIdentity.identityKey)",
@@ -2877,7 +3111,7 @@ var SpacesServiceImpl = class {
       id: space.id,
       spaceKey: space.key,
       state: space.state,
-      error: space.error ? (0, import_protocols5.encodeError)(space.error) : void 0,
+      error: space.error ? (0, import_protocols6.encodeError)(space.error) : void 0,
       pipeline: {
         currentEpoch: space.automergeSpaceState.lastEpoch,
         appliedEpoch: space.automergeSpaceState.lastEpoch,
@@ -2910,12 +3144,13 @@ var SpacesServiceImpl = class {
       }),
       creator: space.inner.spaceState.creator?.key,
       cache: space.cache,
-      metrics: space.metrics
+      metrics: space.metrics,
+      edgeReplication: space.getEdgeReplicationSetting()
     };
   }
   _requireIdentity() {
     if (!this._identityManager.identity) {
-      throw new import_protocols5.IdentityNotInitializedError("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
+      throw new import_protocols6.IdentityNotInitializedError("This device has no HALO identity available. See https://docs.dxos.org/guide/platform/halo");
     }
     return this._identityManager.identity;
   }
@@ -2932,7 +3167,7 @@ var SpacesServiceImpl = class {
   }
 };
 var getChannelId = (channel) => `user-channel/${channel}`;
-function _ts_decorate2(decorators, target, key, desc) {
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -2959,12 +3194,12 @@ var Identity = class {
       S: this,
       C: (f, a) => f(...a)
     });
-    this._deviceStateMachine = new import_credentials5.DeviceStateMachine({
+    this._deviceStateMachine = new import_credentials6.DeviceStateMachine({
       identityKey: this.identityKey,
       deviceKey: this.deviceKey,
       onUpdate: () => this.stateUpdate.emit()
     });
-    this._profileStateMachine = new import_credentials5.ProfileStateMachine({
+    this._profileStateMachine = new import_credentials6.ProfileStateMachine({
       identityKey: this.identityKey,
       onUpdate: () => this.stateUpdate.emit()
     });
@@ -3041,6 +3276,9 @@ var Identity = class {
   get presence() {
     return this._presence;
   }
+  get signer() {
+    return this._signer;
+  }
   /**
   * Issues credentials as identity.
   * Requires identity to be ready.
@@ -3048,20 +3286,20 @@ var Identity = class {
   getIdentityCredentialSigner() {
     (0, import_invariant6.invariant)(this._deviceStateMachine.deviceCredentialChain, "Device credential chain is not ready.", {
       F: __dxlog_file11,
-      L: 185,
+      L: 189,
       S: this,
       A: [
         "this._deviceStateMachine.deviceCredentialChain",
         "'Device credential chain is not ready.'"
       ]
     });
-    return (0, import_credentials5.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.deviceCredentialChain, this.deviceKey);
+    return (0, import_credentials6.createCredentialSignerWithChain)(this._signer, this._deviceStateMachine.deviceCredentialChain, this.deviceKey);
   }
   /**
   * Issues credentials as device.
   */
   getDeviceCredentialSigner() {
-    return (0, import_credentials5.createCredentialSignerWithKey)(this._signer, this.deviceKey);
+    return (0, import_credentials6.createCredentialSignerWithKey)(this._signer, this.deviceKey);
   }
   async updateDefaultSpace(spaceId) {
     const credential = await this.getDeviceCredentialSigner().createCredential({
@@ -3092,7 +3330,7 @@ var Identity = class {
       dataFeedKey
     }, {
       F: __dxlog_file11,
-      L: 210,
+      L: 214,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3113,7 +3351,7 @@ var Identity = class {
           spaceKey: this.haloSpaceKey,
           deviceKey,
           identityKey: this.identityKey,
-          designation: import_credentials6.AdmittedFeed.Designation.CONTROL
+          designation: import_credentials7.AdmittedFeed.Designation.CONTROL
         }
       }),
       await signer.createCredential({
@@ -3123,7 +3361,7 @@ var Identity = class {
           spaceKey: this.haloSpaceKey,
           deviceKey,
           identityKey: this.identityKey,
-          designation: import_credentials6.AdmittedFeed.Designation.DATA
+          designation: import_credentials7.AdmittedFeed.Designation.DATA
         }
       })
     ].map((credential) => ({
@@ -3133,16 +3371,16 @@ var Identity = class {
     })));
   }
 };
-_ts_decorate2([
+_ts_decorate4([
   import_tracing4.trace.span()
 ], Identity.prototype, "open", null);
-_ts_decorate2([
+_ts_decorate4([
   import_tracing4.trace.span()
 ], Identity.prototype, "close", null);
-Identity = _ts_decorate2([
+Identity = _ts_decorate4([
   import_tracing4.trace.resource()
 ], Identity);
-function _ts_decorate3(decorators, target, key, desc) {
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -3170,7 +3408,7 @@ var IdentityManager = class {
   }
   async open(ctx) {
     const traceId = import_keys9.PublicKey.random().toHex();
-    import_log11.log.trace("dxos.halo.identity-manager.open", import_protocols6.trace.begin({
+    import_log11.log.trace("dxos.halo.identity-manager.open", import_protocols7.trace.begin({
       id: traceId
     }), {
       F: __dxlog_file12,
@@ -3202,7 +3440,7 @@ var IdentityManager = class {
       });
       this.stateUpdate.emit();
     }
-    import_log11.log.trace("dxos.halo.identity-manager.open", import_protocols6.trace.end({
+    import_log11.log.trace("dxos.halo.identity-manager.open", import_protocols7.trace.end({
       id: traceId
     }), {
       F: __dxlog_file12,
@@ -3250,7 +3488,7 @@ var IdentityManager = class {
       L: 161
     }));
     {
-      const generator = new import_credentials13.CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
+      const generator = new import_credentials14.CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
       (0, import_invariant9.invariant)(identityRecord.haloSpace.genesisFeedKey, "Genesis feed key is required.", {
         F: __dxlog_file12,
         L: 165,
@@ -3273,7 +3511,7 @@ var IdentityManager = class {
         // Space genesis.
         ...await generator.createSpaceGenesis(identityRecord.haloSpace.key, identityRecord.haloSpace.genesisFeedKey),
         // Feed admission.
-        await generator.createFeedAdmission(identityRecord.haloSpace.key, identityRecord.haloSpace.dataFeedKey, import_credentials14.AdmittedFeed.Designation.DATA)
+        await generator.createFeedAdmission(identityRecord.haloSpace.key, identityRecord.haloSpace.dataFeedKey, import_credentials15.AdmittedFeed.Designation.DATA)
       ];
       if (displayName) {
         credentials.push(await generator.createProfileCredential({
@@ -3322,14 +3560,14 @@ var IdentityManager = class {
   createDefaultDeviceProfile() {
     let type;
     if ((0, import_util8.isNode)()) {
-      type = import_credentials14.DeviceType.AGENT;
+      type = import_credentials15.DeviceType.AGENT;
     } else {
       if (import_platform.default.name?.startsWith("iOS") || import_platform.default.name?.startsWith("Android")) {
-        type = import_credentials14.DeviceType.MOBILE;
+        type = import_credentials15.DeviceType.MOBILE;
       } else if (globalThis.__args) {
-        type = import_credentials14.DeviceType.NATIVE;
+        type = import_credentials15.DeviceType.NATIVE;
       } else {
-        type = import_credentials14.DeviceType.BROWSER;
+        type = import_credentials15.DeviceType.BROWSER;
       }
     }
     return {
@@ -3533,7 +3771,7 @@ var IdentityManager = class {
       swarmIdentity: {
         identityKey: identityRecord.identityKey,
         peerKey: identityRecord.deviceKey,
-        credentialProvider: createAuthProvider((0, import_credentials13.createCredentialSignerWithKey)(this._keyring, identityRecord.deviceKey)),
+        credentialProvider: createAuthProvider((0, import_credentials14.createCredentialSignerWithKey)(this._keyring, identityRecord.deviceKey)),
         credentialAuthenticator: (0, import_util8.deferFunction)(() => identity.authVerifier.verifier)
       },
       gossip,
@@ -3593,12 +3831,12 @@ var IdentityManager = class {
     });
   }
 };
-_ts_decorate3([
+_ts_decorate5([
   import_tracing7.trace.span({
     showInBrowserTimeline: true
   })
 ], IdentityManager.prototype, "open", null);
-IdentityManager = _ts_decorate3([
+IdentityManager = _ts_decorate5([
   import_tracing7.trace.resource()
 ], IdentityManager);
 var __dxlog_file13 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/identity/identity-service.ts";
@@ -3688,7 +3926,7 @@ var IdentityServiceImpl = class extends import_context9.Resource {
         "'Identity not initialized.'"
       ]
     });
-    return await (0, import_credentials15.signPresentation)({
+    return await (0, import_credentials16.signPresentation)({
       presentation,
       signer: this._keyring,
       signerKey: this._identityManager.identity.deviceKey,
@@ -3745,7 +3983,7 @@ var IdentityServiceImpl = class extends import_context9.Resource {
     }
   }
 };
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -3818,9 +4056,8 @@ var DataSpace = class {
   constructor(params) {
     this._ctx = new import_context4.Context(void 0, {
       F: __dxlog_file14,
-      L: 94
+      L: 95
     });
-    this._notarizationPlugin = new NotarizationPlugin();
     this._cache = void 0;
     this._edgeFeedReplicator = void 0;
     this._automergeSpaceState = new AutomergeSpaceState((rootUrl) => this._onNewAutomergeRoot(rootUrl));
@@ -3845,6 +4082,11 @@ var DataSpace = class {
     this._signingContext = params.signingContext;
     this._callbacks = params.callbacks ?? {};
     this._echoHost = params.echoHost;
+    this._notarizationPlugin = new NotarizationPlugin({
+      spaceId: this._inner.id,
+      edgeClient: params.edgeHttpClient,
+      edgeFeatures: params.edgeFeatures
+    });
     this.authVerifier = new TrustedKeySetAuthVerifier({
       trustedKeysProvider: () => new import_util4.ComplexSet(import_keys4.PublicKey.hash, Array.from(this._inner.spaceState.members.values()).filter((member) => member.role !== import_credentials3.SpaceMember.Role.REMOVED).map((member) => member.key)),
       update: this._inner.stateUpdate,
@@ -3862,7 +4104,7 @@ var DataSpace = class {
       state: import_services4.SpaceState[this._state]
     }, {
       F: __dxlog_file14,
-      L: 164,
+      L: 170,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3921,7 +4163,7 @@ var DataSpace = class {
     }
     await this._inner.open(new import_context4.Context(void 0, {
       F: __dxlog_file14,
-      L: 238
+      L: 244
     }));
     await this._edgeFeedReplicator?.open();
     this._state = import_services4.SpaceState.SPACE_CONTROL_ONLY;
@@ -3929,7 +4171,7 @@ var DataSpace = class {
       state: import_services4.SpaceState[this._state]
     }, {
       F: __dxlog_file14,
-      L: 243,
+      L: 249,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -3949,14 +4191,14 @@ var DataSpace = class {
       state: import_services4.SpaceState[this._state]
     }, {
       F: __dxlog_file14,
-      L: 262,
+      L: 268,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._ctx.dispose();
     this._ctx = new import_context4.Context(void 0, {
       F: __dxlog_file14,
-      L: 264
+      L: 270
     });
     if (this._edgeFeedReplicator) {
       this.inner.protocol.feedAdded.remove(this._onFeedAdded);
@@ -3989,7 +4231,7 @@ var DataSpace = class {
         if (err instanceof import_protocols3.CancelledError || err instanceof import_context4.ContextDisposedError) {
           (0, import_log4.log)("data pipeline initialization cancelled", err, {
             F: __dxlog_file14,
-            L: 302,
+            L: 308,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -3997,7 +4239,7 @@ var DataSpace = class {
         }
         import_log4.log.error("Error initializing data pipeline", err, {
           F: __dxlog_file14,
-          L: 306,
+          L: 312,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4006,7 +4248,7 @@ var DataSpace = class {
           state: import_services4.SpaceState[this._state]
         }, {
           F: __dxlog_file14,
-          L: 308,
+          L: 314,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4026,15 +4268,39 @@ var DataSpace = class {
       state: import_services4.SpaceState[this._state]
     }, {
       F: __dxlog_file14,
-      L: 324,
+      L: 330,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    (0, import_log4.log)("initializing control pipeline", void 0, {
+      F: __dxlog_file14,
+      L: 332,
       S: this,
       C: (f, a) => f(...a)
     });
     await this._initializeAndReadControlPipeline();
     await (0, import_async7.sleep)(1);
     const ready = this.stateUpdate.waitForCondition(() => this._state === import_services4.SpaceState.SPACE_READY);
+    (0, import_log4.log)("initializing automerge root", void 0, {
+      F: __dxlog_file14,
+      L: 340,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     this._automergeSpaceState.startProcessingRootDocs();
+    (0, import_log4.log)("waiting for space to be ready", void 0, {
+      F: __dxlog_file14,
+      L: 344,
+      S: this,
+      C: (f, a) => f(...a)
+    });
     await ready;
+    (0, import_log4.log)("space is ready", void 0, {
+      F: __dxlog_file14,
+      L: 346,
+      S: this,
+      C: (f, a) => f(...a)
+    });
   }
   async _enterReadyState() {
     await this._callbacks.beforeReady?.();
@@ -4043,7 +4309,7 @@ var DataSpace = class {
       state: import_services4.SpaceState[this._state]
     }, {
       F: __dxlog_file14,
-      L: 343,
+      L: 353,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4053,13 +4319,14 @@ var DataSpace = class {
   async _initializeAndReadControlPipeline() {
     await this._inner.controlPipeline.state.waitUntilReachedTargetTimeframe({
       ctx: this._ctx,
+      timeout: 1e4,
       breakOnStall: false
     });
     this.metrics.controlPipelineReady = /* @__PURE__ */ new Date();
     await this._createWritableFeeds();
     (0, import_log4.log)("writable feeds created", void 0, {
       F: __dxlog_file14,
-      L: 359,
+      L: 370,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4108,11 +4375,35 @@ var DataSpace = class {
       }));
     }
     if (credentials.length > 0) {
-      await this.notarizationPlugin.notarize({
-        ctx: this._ctx,
-        credentials,
-        timeout: 0
-      });
+      try {
+        (0, import_log4.log)("will notarize credentials for feed admission", {
+          count: credentials.length
+        }, {
+          F: __dxlog_file14,
+          L: 428,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        await this.notarizationPlugin.notarize({
+          ctx: this._ctx,
+          credentials,
+          timeout: 0
+        });
+        (0, import_log4.log)("credentials notarized", void 0, {
+          F: __dxlog_file14,
+          L: 432,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      } catch (err) {
+        import_log4.log.error("error notarizing credentials for feed admission", err, {
+          F: __dxlog_file14,
+          L: 434,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        throw err;
+      }
       await this._metadataStore.setWritableFeedKeys(this.key, this.inner.controlFeedKey, this.inner.dataFeedKey);
     }
   }
@@ -4122,7 +4413,7 @@ var DataSpace = class {
       rootUrl
     }, {
       F: __dxlog_file14,
-      L: 425,
+      L: 444,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -4174,7 +4465,7 @@ var DataSpace = class {
           err
         }, {
           F: __dxlog_file14,
-          L: 468,
+          L: 487,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -4264,58 +4555,61 @@ var DataSpace = class {
       state: import_services4.SpaceState[this._state]
     }, {
       F: __dxlog_file14,
-      L: 550,
+      L: 569,
       S: this,
       C: (f, a) => f(...a)
     });
     this.stateUpdate.emit();
   }
+  getEdgeReplicationSetting() {
+    return this._metadataStore.getSpaceEdgeReplicationSetting(this.key);
+  }
 };
-_ts_decorate4([
+_ts_decorate6([
   import_tracing3.trace.info()
 ], DataSpace.prototype, "_inner", void 0);
-_ts_decorate4([
+_ts_decorate6([
   import_tracing3.trace.info()
 ], DataSpace.prototype, "id", null);
-_ts_decorate4([
+_ts_decorate6([
   import_tracing3.trace.info()
 ], DataSpace.prototype, "key", null);
-_ts_decorate4([
+_ts_decorate6([
   import_tracing3.trace.info({
     enum: import_services4.SpaceState
   })
 ], DataSpace.prototype, "state", null);
-_ts_decorate4([
+_ts_decorate6([
   import_tracing3.trace.info({
     depth: null
   })
 ], DataSpace.prototype, "_automergeInfo", null);
-_ts_decorate4([
+_ts_decorate6([
   import_async7.synchronized
 ], DataSpace.prototype, "open", null);
-_ts_decorate4([
+_ts_decorate6([
   import_async7.synchronized
 ], DataSpace.prototype, "close", null);
-_ts_decorate4([
+_ts_decorate6([
   import_tracing3.trace.span({
     showInBrowserTimeline: true
   })
 ], DataSpace.prototype, "initializeDataPipeline", null);
-_ts_decorate4([
+_ts_decorate6([
   import_tracing3.trace.span({
     showInBrowserTimeline: true
   })
 ], DataSpace.prototype, "_initializeAndReadControlPipeline", null);
-_ts_decorate4([
+_ts_decorate6([
   (0, import_debug.timed)(1e4)
 ], DataSpace.prototype, "_createWritableFeeds", null);
-_ts_decorate4([
+_ts_decorate6([
   import_async7.synchronized
 ], DataSpace.prototype, "activate", null);
-_ts_decorate4([
+_ts_decorate6([
   import_async7.synchronized
 ], DataSpace.prototype, "deactivate", null);
-DataSpace = _ts_decorate4([
+DataSpace = _ts_decorate6([
   (0, import_async7.trackLeaks)("open", "close"),
   import_tracing3.trace.resource()
 ], DataSpace);
@@ -4368,7 +4662,7 @@ var DeviceInvitationProtocol = class {
     try {
       const identity = this._getIdentity();
       if (identity) {
-        return new import_protocols7.AlreadyJoinedError("Currently only one identity per client is supported.");
+        return new import_protocols8.AlreadyJoinedError("Currently only one identity per client is supported.");
       }
     } catch {
     }
@@ -4527,7 +4821,7 @@ var InvitationGuestExtension = class extends import_teleport2.RpcExtension {
         C: (f, a) => f(...a)
       });
       if (this._remoteOptions?.role !== import_invitations3.InvitationOptions.Role.HOST) {
-        throw new import_protocols9.InvalidInvitationExtensionRoleError(void 0, {
+        throw new import_protocols10.InvalidInvitationExtensionRoleError(void 0, {
           expected: import_invitations3.InvitationOptions.Role.HOST,
           remoteOptions: this._remoteOptions,
           remotePeerId: context.remotePeerId
@@ -4614,7 +4908,7 @@ var InvitationHostExtension = class extends import_teleport3.RpcExtension {
         introduce: async (request) => {
           const { profile, invitationId } = request;
           const traceId = import_keys11.PublicKey.random().toHex();
-          import_log15.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols10.trace.begin({
+          import_log15.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols11.trace.begin({
             id: traceId
           }), {
             F: __dxlog_file17,
@@ -4651,7 +4945,7 @@ var InvitationHostExtension = class extends import_teleport3.RpcExtension {
           this.guestProfile = profile;
           this._callbacks.onStateUpdate(import_services13.Invitation.State.READY_FOR_AUTHENTICATION);
           this._challenge = invitation.authMethod === import_services13.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? (0, import_crypto2.randomBytes)(32) : void 0;
-          import_log15.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols10.trace.end({
+          import_log15.log.trace("dxos.sdk.invitation-handler.host.introduce", import_protocols11.trace.end({
             id: traceId
           }), {
             F: __dxlog_file17,
@@ -4666,7 +4960,7 @@ var InvitationHostExtension = class extends import_teleport3.RpcExtension {
         },
         authenticate: async ({ authCode: code, signedChallenge }) => {
           const traceId = import_keys11.PublicKey.random().toHex();
-          import_log15.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols10.trace.begin({
+          import_log15.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols11.trace.begin({
             id: traceId
           }), {
             F: __dxlog_file17,
@@ -4749,7 +5043,7 @@ var InvitationHostExtension = class extends import_teleport3.RpcExtension {
               status
             };
           }
-          import_log15.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols10.trace.end({
+          import_log15.log.trace("dxos.sdk.invitation-handler.host.authenticate", import_protocols11.trace.end({
             id: traceId,
             data: {
               status
@@ -4766,7 +5060,7 @@ var InvitationHostExtension = class extends import_teleport3.RpcExtension {
         },
         admit: async (request) => {
           const traceId = import_keys11.PublicKey.random().toHex();
-          import_log15.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols10.trace.begin({
+          import_log15.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols11.trace.begin({
             id: traceId
           }), {
             F: __dxlog_file17,
@@ -4783,7 +5077,7 @@ var InvitationHostExtension = class extends import_teleport3.RpcExtension {
               }
             }
             const response = await this._callbacks.admit(request);
-            import_log15.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols10.trace.end({
+            import_log15.log.trace("dxos.sdk.invitation-handler.host.admit", import_protocols11.trace.end({
               id: traceId
             }), {
               F: __dxlog_file17,
@@ -4838,7 +5132,7 @@ var InvitationHostExtension = class extends import_teleport3.RpcExtension {
       });
       if (this._remoteOptions?.role !== import_invitations4.InvitationOptions.Role.GUEST) {
         this._callbacks.onStateUpdate(lastState);
-        throw new import_protocols10.InvalidInvitationExtensionRoleError(void 0, {
+        throw new import_protocols11.InvalidInvitationExtensionRoleError(void 0, {
           expected: import_invitations4.InvitationOptions.Role.GUEST,
           remoteOptions: this._remoteOptions,
           remotePeerId: context.remotePeerId
@@ -5018,7 +5312,7 @@ var InvitationsHandler = class {
           (0, import_async15.scheduleTask)(connectionCtx, async () => {
             const traceId = import_keys10.PublicKey.random().toHex();
             try {
-              import_log13.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols8.trace.begin({
+              import_log13.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols9.trace.begin({
                 id: traceId
               }), {
                 F: __dxlog_file19,
@@ -5048,7 +5342,7 @@ var InvitationsHandler = class {
               });
               guardedState.set(extension, import_services11.Invitation.State.SUCCESS);
               metrics.increment("dxos.invitation.success");
-              import_log13.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols8.trace.end({
+              import_log13.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols9.trace.end({
                 id: traceId
               }), {
                 F: __dxlog_file19,
@@ -5084,7 +5378,7 @@ var InvitationsHandler = class {
                   });
                 }
               }
-              import_log13.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols8.trace.error({
+              import_log13.log.trace("dxos.sdk.invitations-handler.host.onOpen", import_protocols9.trace.error({
                 id: traceId,
                 error: err
               }), {
@@ -5098,7 +5392,7 @@ var InvitationsHandler = class {
           });
         },
         onError: (err) => {
-          if (err instanceof import_protocols8.InvalidInvitationExtensionRoleError) {
+          if (err instanceof import_protocols9.InvalidInvitationExtensionRoleError) {
             (0, import_log13.log)("invalid role", {
               ...err.context
             }, {
@@ -5223,7 +5517,7 @@ var InvitationsHandler = class {
           (0, import_async15.scheduleTask)(connectionCtx, async () => {
             const traceId = import_keys10.PublicKey.random().toHex();
             try {
-              import_log13.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols8.trace.begin({
+              import_log13.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols9.trace.begin({
                 id: traceId
               }), {
                 F: __dxlog_file19,
@@ -5303,7 +5597,7 @@ var InvitationsHandler = class {
                 ...result,
                 state: import_services11.Invitation.State.SUCCESS
               });
-              import_log13.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols8.trace.end({
+              import_log13.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols9.trace.end({
                 id: traceId
               }), {
                 F: __dxlog_file19,
@@ -5332,7 +5626,7 @@ var InvitationsHandler = class {
                 guardedState.error(extension, err);
               }
               extensionCtx.close(err);
-              import_log13.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols8.trace.error({
+              import_log13.log.trace("dxos.sdk.invitations-handler.guest.onOpen", import_protocols9.trace.error({
                 id: traceId,
                 error: err
               }), {
@@ -5345,7 +5639,7 @@ var InvitationsHandler = class {
           });
         },
         onError: (err) => {
-          if (err instanceof import_protocols8.InvalidInvitationExtensionRoleError) {
+          if (err instanceof import_protocols9.InvalidInvitationExtensionRoleError) {
             return;
           }
           if (err instanceof import_async15.TimeoutError) {
@@ -5691,14 +5985,14 @@ var SpaceInvitationProtocol = class {
   }
   checkCanInviteNewMembers() {
     if (this._spaceKey == null) {
-      return new import_protocols11.InvalidInvitationError("No spaceKey was provided for a space invitation.");
+      return new import_protocols12.InvalidInvitationError("No spaceKey was provided for a space invitation.");
     }
     const space = this._spaceManager.spaces.get(this._spaceKey);
     if (space == null) {
-      return new import_protocols11.SpaceNotFoundError(this._spaceKey);
+      return new import_protocols12.SpaceNotFoundError(this._spaceKey);
     }
     if (!space?.inner.spaceState.hasMembershipManagementPermission(this._signingContext.identityKey)) {
-      return new import_protocols11.AuthorizationError("No member management permission.");
+      return new import_protocols12.AuthorizationError("No member management permission.");
     }
     return void 0;
   }
@@ -5730,7 +6024,7 @@ var SpaceInvitationProtocol = class {
     const spaceMemberCredential = await this._spaceManager.admitMember({
       spaceKey: this._spaceKey,
       identityKey: request.space.identityKey,
-      role: invitation.role ?? import_credentials17.SpaceMember.Role.ADMIN,
+      role: invitation.role ?? import_credentials18.SpaceMember.Role.ADMIN,
       profile: guestProfile,
       delegationCredentialId: invitation.delegationCredentialId
     });
@@ -5782,11 +6076,11 @@ var SpaceInvitationProtocol = class {
       S: this,
       C: (f, a) => f(...a)
     });
-    const credential = await (0, import_credentials16.createDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, {
+    const credential = await (0, import_credentials17.createDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, {
       invitationId: invitation.invitationId,
       authMethod: invitation.authMethod,
       swarmKey: invitation.swarmKey,
-      role: invitation.role ?? import_credentials17.SpaceMember.Role.ADMIN,
+      role: invitation.role ?? import_credentials18.SpaceMember.Role.ADMIN,
       expiresOn: invitation.lifetime ? new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime) : void 0,
       multiUse: invitation.multiUse ?? false,
       guestKey: invitation.authMethod === import_services15.Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? invitation.guestKeypair.publicKey : void 0
@@ -5843,7 +6137,7 @@ var SpaceInvitationProtocol = class {
       S: this,
       C: (f, a) => f(...a)
     });
-    const credential = await (0, import_credentials16.createCancelDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
+    const credential = await (0, import_credentials17.createCancelDelegatedSpaceInvitationCredential)(this._signingContext.credentialSigner, space.key, invitation.delegationCredentialId);
     (0, import_invariant16.invariant)(credential.credential, void 0, {
       F: __dxlog_file20,
       L: 140,
@@ -5859,10 +6153,10 @@ var SpaceInvitationProtocol = class {
   }
   checkInvitation(invitation) {
     if (invitation.spaceKey == null) {
-      return new import_protocols11.InvalidInvitationError("No spaceKey was provided for a space invitation.");
+      return new import_protocols12.InvalidInvitationError("No spaceKey was provided for a space invitation.");
     }
     if (this._spaceManager.spaces.has(invitation.spaceKey)) {
-      return new import_protocols11.AlreadyJoinedError("Already joined space.");
+      return new import_protocols12.AlreadyJoinedError("Already joined space.");
     }
   }
   createIntroduction() {
@@ -5893,7 +6187,7 @@ var SpaceInvitationProtocol = class {
       ]
     });
     const { credential, controlTimeframe, dataTimeframe } = response.space;
-    const assertion = (0, import_credentials16.getCredentialAssertion)(credential);
+    const assertion = (0, import_credentials17.getCredentialAssertion)(credential);
     (0, import_invariant16.invariant)(assertion["@type"] === "dxos.halo.credentials.SpaceMember", "Invalid credential", {
       F: __dxlog_file20,
       L: 178,
@@ -5913,7 +6207,7 @@ var SpaceInvitationProtocol = class {
       ]
     });
     if (this._spaceManager.spaces.has(assertion.spaceKey)) {
-      throw new import_protocols11.AlreadyJoinedError("Already joined space.");
+      throw new import_protocols12.AlreadyJoinedError("Already joined space.");
     }
     await this._spaceManager.acceptSpace({
       spaceKey: assertion.spaceKey,
@@ -6129,8 +6423,8 @@ var InvitationsManager = class {
     }
   }
   _createInvitation(protocol, options) {
-    const { invitationId = import_keys13.PublicKey.random().toHex(), type = import_services16.Invitation.Type.INTERACTIVE, authMethod = import_services16.Invitation.AuthMethod.SHARED_SECRET, state = import_services16.Invitation.State.INIT, timeout = import_client_protocol6.INVITATION_TIMEOUT, swarmKey = import_keys13.PublicKey.random(), persistent = options?.authMethod !== import_services16.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, role = import_credentials19.SpaceMember.Role.ADMIN, lifetime = 86400, multiUse = false } = options ?? {};
-    const authCode = options?.authCode ?? (authMethod === import_services16.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials18.generatePasscode)(import_client_protocol6.AUTHENTICATION_CODE_LENGTH) : void 0);
+    const { invitationId = import_keys13.PublicKey.random().toHex(), type = import_services16.Invitation.Type.INTERACTIVE, authMethod = import_services16.Invitation.AuthMethod.SHARED_SECRET, state = import_services16.Invitation.State.INIT, timeout = import_client_protocol6.INVITATION_TIMEOUT, swarmKey = import_keys13.PublicKey.random(), persistent = options?.authMethod !== import_services16.Invitation.AuthMethod.KNOWN_PUBLIC_KEY, created = /* @__PURE__ */ new Date(), guestKeypair = void 0, role = import_credentials20.SpaceMember.Role.ADMIN, lifetime = 86400, multiUse = false } = options ?? {};
+    const authCode = options?.authCode ?? (authMethod === import_services16.Invitation.AuthMethod.SHARED_SECRET ? (0, import_credentials19.generatePasscode)(import_client_protocol6.AUTHENTICATION_CODE_LENGTH) : void 0);
     return {
       invitationId,
       type,
@@ -6286,7 +6580,7 @@ var InvitationsManager = class {
     }, callback);
   }
 };
-function _ts_decorate5(decorators, target, key, desc) {
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -6332,11 +6626,11 @@ var Lock = class {
     await import_lock_file.LockFile.release(this._fileHandle);
   }
 };
-_ts_decorate5([
+_ts_decorate7([
   import_log19.logInfo
 ], Lock.prototype, "lockKey", null);
 var isLocked = (lockPath) => import_lock_file.LockFile.isLocked(lockPath);
-function _ts_decorate6(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -6398,32 +6692,96 @@ var ClientRpcServer = class {
     return this._handlerCache.get(serviceName);
   }
 };
-_ts_decorate6([
+_ts_decorate8([
   import_tracing9.trace.metricsCounter()
 ], ClientRpcServer.prototype, "_callMetrics", void 0);
-_ts_decorate6([
+_ts_decorate8([
   import_tracing9.trace.info()
 ], ClientRpcServer.prototype, "_services", null);
-ClientRpcServer = _ts_decorate6([
+ClientRpcServer = _ts_decorate8([
   import_tracing9.trace.resource()
 ], ClientRpcServer);
-function _ts_decorate7(decorators, target, key, desc) {
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
+function _using_ctx3() {
+  var _disposeSuppressedError = typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed) {
+    var err = new Error();
+    err.name = "SuppressedError";
+    err.suppressed = suppressed;
+    err.error = error;
+    return err;
+  }, empty = {}, stack = [];
+  function using(isAwait, value) {
+    if (value != null) {
+      if (Object(value) !== value) {
+        throw new TypeError("using declarations can only be used with objects, functions, null, or undefined.");
+      }
+      if (isAwait) {
+        var dispose = value[Symbol.asyncDispose || Symbol.for("Symbol.asyncDispose")];
+      }
+      if (dispose == null) {
+        dispose = value[Symbol.dispose || Symbol.for("Symbol.dispose")];
+      }
+      if (typeof dispose !== "function") {
+        throw new TypeError(`Property [Symbol.dispose] is not a function.`);
+      }
+      stack.push({
+        v: value,
+        d: dispose,
+        a: isAwait
+      });
+    } else if (isAwait) {
+      stack.push({
+        d: value,
+        a: isAwait
+      });
+    }
+    return value;
+  }
+  return {
+    e: empty,
+    u: using.bind(null, false),
+    a: using.bind(null, true),
+    d: function() {
+      var error = this.e;
+      function next() {
+        while (resource = stack.pop()) {
+          try {
+            var resource, disposalResult = resource.d && resource.d.call(resource.v);
+            if (resource.a) {
+              return Promise.resolve(disposalResult).then(next, err);
+            }
+          } catch (e) {
+            return err(e);
+          }
+        }
+        if (error !== empty) throw error;
+      }
+      function err(e) {
+        error = error !== empty ? new _disposeSuppressedError(error, e) : e;
+        return next();
+      }
+      return next();
+    }
+  };
+}
 var __dxlog_file23 = "/home/runner/work/dxos/dxos/packages/sdk/client-services/src/packlets/services/service-context.ts";
 var ServiceContext = class extends import_context15.Resource {
-  constructor(storage, level, networkManager, signalManager, _edgeConnection, _runtimeParams, _edgeFeatures) {
+  constructor(storage, level, networkManager, signalManager, _edgeConnection, _edgeHttpClient, _runtimeParams, _edgeFeatures) {
     super();
     this.storage = storage;
     this.level = level;
     this.networkManager = networkManager;
     this.signalManager = signalManager;
     this._edgeConnection = _edgeConnection;
+    this._edgeHttpClient = _edgeHttpClient;
     this._runtimeParams = _runtimeParams;
     this._edgeFeatures = _edgeFeatures;
+    this._edgeIdentityUpdateMutex = new import_async19.Mutex();
     this.initialized = new import_async19.Trigger();
     this._meshReplicator = void 0;
     this._echoEdgeReplicator = void 0;
@@ -6461,23 +6819,42 @@ var ServiceContext = class extends import_context15.Resource {
       callbacks: {
         onIdentityConstruction: (identity) => {
           if (this._edgeConnection) {
-            import_log20.log.info("Setting identity on edge connection", {
-              identity: identity.identityKey.toHex(),
-              oldIdentity: this._edgeConnection.identityKey,
-              swarms: this.networkManager.topics
-            }, {
-              F: __dxlog_file23,
-              L: 140,
-              S: this,
-              C: (f, a) => f(...a)
-            });
-            this._edgeConnection.setIdentity({
-              peerKey: identity.deviceKey.toHex(),
-              identityKey: identity.identityKey.toHex()
-            });
-            this.networkManager.setPeerInfo({
-              identityKey: identity.identityKey.toHex(),
-              peerKey: identity.deviceKey.toHex()
+            (0, import_async19.scheduleMicroTask)(this._ctx, async () => {
+              try {
+                var _usingCtx = _using_ctx3();
+                const _ = _usingCtx.u(await this._edgeIdentityUpdateMutex.acquire());
+                import_log20.log.info("Setting identity on edge connection", {
+                  identity: identity.identityKey.toHex(),
+                  oldIdentity: this._edgeConnection.identityKey,
+                  swarms: this.networkManager.topics
+                }, {
+                  F: __dxlog_file23,
+                  L: 147,
+                  S: this,
+                  C: (f, a) => f(...a)
+                });
+                await (0, import_debug6.warnAfterTimeout)(1e4, "Waiting for identity to be ready for edge connection", async () => {
+                  await identity.ready();
+                });
+                (0, import_invariant19.invariant)(identity.deviceCredentialChain, void 0, {
+                  F: __dxlog_file23,
+                  L: 157,
+                  S: this,
+                  A: [
+                    "identity.deviceCredentialChain",
+                    ""
+                  ]
+                });
+                this._edgeConnection.setIdentity(await (0, import_edge_client2.createChainEdgeIdentity)(identity.signer, identity.identityKey, identity.deviceKey, identity.deviceCredentialChain, []));
+                this.networkManager.setPeerInfo({
+                  identityKey: identity.identityKey.toHex(),
+                  peerKey: identity.deviceKey.toHex()
+                });
+              } catch (_) {
+                _usingCtx.e = _;
+              } finally {
+                _usingCtx.d();
+              }
             });
           }
         }
@@ -6503,19 +6880,22 @@ var ServiceContext = class extends import_context15.Resource {
     await this._checkStorageVersion();
     (0, import_log20.log)("opening...", void 0, {
       F: __dxlog_file23,
-      L: 198,
+      L: 217,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log20.log.trace("dxos.sdk.service-context.open", import_protocols12.trace.begin({
+    import_log20.log.trace("dxos.sdk.service-context.open", import_protocols13.trace.begin({
       id: this._instanceId
     }), {
       F: __dxlog_file23,
-      L: 199,
+      L: 218,
       S: this,
       C: (f, a) => f(...a)
     });
-    await this._edgeConnection?.open();
+    if (this._edgeConnection) {
+      this._edgeConnection.setIdentity(await (0, import_edge_client2.createEphemeralEdgeIdentity)());
+      await this._edgeConnection.open();
+    }
     await this.signalManager.open();
     await this.networkManager.open();
     await this.echoHost.open(ctx);
@@ -6536,21 +6916,21 @@ var ServiceContext = class extends import_context15.Resource {
       count: loadedInvitations.invitations?.length
     }, {
       F: __dxlog_file23,
-      L: 222,
+      L: 245,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log20.log.trace("dxos.sdk.service-context.open", import_protocols12.trace.end({
+    import_log20.log.trace("dxos.sdk.service-context.open", import_protocols13.trace.end({
       id: this._instanceId
     }), {
       F: __dxlog_file23,
-      L: 224,
+      L: 247,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_log20.log)("opened", void 0, {
       F: __dxlog_file23,
-      L: 225,
+      L: 248,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6558,7 +6938,7 @@ var ServiceContext = class extends import_context15.Resource {
   async _close(ctx) {
     (0, import_log20.log)("closing...", void 0, {
       F: __dxlog_file23,
-      L: 229,
+      L: 252,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6576,7 +6956,7 @@ var ServiceContext = class extends import_context15.Resource {
     await this._edgeConnection?.close();
     (0, import_log20.log)("closed", void 0, {
       F: __dxlog_file23,
-      L: 244,
+      L: 267,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6585,7 +6965,7 @@ var ServiceContext = class extends import_context15.Resource {
     const identity = await this.identityManager.createIdentity(params);
     await this._initialize(new import_context15.Context(void 0, {
       F: __dxlog_file23,
-      L: 249
+      L: 272
     }));
     return identity;
   }
@@ -6593,7 +6973,7 @@ var ServiceContext = class extends import_context15.Resource {
     const factory = this._handlerFactories.get(invitation.kind);
     (0, import_invariant19.invariant)(factory, `Unknown invitation kind: ${invitation.kind}`, {
       F: __dxlog_file23,
-      L: 255,
+      L: 278,
       S: this,
       A: [
         "factory",
@@ -6614,21 +6994,21 @@ var ServiceContext = class extends import_context15.Resource {
     const identity = await this.identityManager.acceptIdentity(params);
     await this._initialize(new import_context15.Context(void 0, {
       F: __dxlog_file23,
-      L: 271
+      L: 294
     }));
     return identity;
   }
   async _checkStorageVersion() {
     await this.metadataStore.load();
-    if (this.metadataStore.version !== import_protocols12.STORAGE_VERSION) {
-      throw new import_protocols12.InvalidStorageVersionError(import_protocols12.STORAGE_VERSION, this.metadataStore.version);
+    if (this.metadataStore.version !== import_protocols13.STORAGE_VERSION) {
+      throw new import_protocols13.InvalidStorageVersionError(import_protocols13.STORAGE_VERSION, this.metadataStore.version);
     }
   }
   // Called when identity is created.
   async _initialize(ctx) {
     (0, import_log20.log)("initializing spaces...", void 0, {
       F: __dxlog_file23,
-      L: 286,
+      L: 309,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -6655,6 +7035,7 @@ var ServiceContext = class extends import_context15.Resource {
       echoHost: this.echoHost,
       invitationsManager: this.invitationsManager,
       edgeConnection: this._edgeConnection,
+      edgeHttpClient: this._edgeHttpClient,
       echoEdgeReplicator: this._echoEdgeReplicator,
       meshReplicator: this._meshReplicator,
       runtimeParams: this._runtimeParams,
@@ -6664,7 +7045,7 @@ var ServiceContext = class extends import_context15.Resource {
     this._handlerFactories.set(import_services17.Invitation.Kind.SPACE, (invitation) => {
       (0, import_invariant19.invariant)(this.dataSpaceManager, "dataSpaceManager not initialized yet", {
         F: __dxlog_file23,
-        L: 315,
+        L: 339,
         S: this,
         A: [
           "this.dataSpaceManager",
@@ -6676,7 +7057,7 @@ var ServiceContext = class extends import_context15.Resource {
     this.initialized.wake();
     this._deviceSpaceSync = {
       processCredential: async (credential) => {
-        const assertion = (0, import_credentials20.getCredentialAssertion)(credential);
+        const assertion = (0, import_credentials21.getCredentialAssertion)(credential);
         if (assertion["@type"] !== "dxos.halo.credentials.SpaceMember") {
           return;
         }
@@ -6688,7 +7069,7 @@ var ServiceContext = class extends import_context15.Resource {
             details: assertion
           }, {
             F: __dxlog_file23,
-            L: 331,
+            L: 355,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -6699,7 +7080,7 @@ var ServiceContext = class extends import_context15.Resource {
             details: assertion
           }, {
             F: __dxlog_file23,
-            L: 335,
+            L: 359,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -6710,7 +7091,7 @@ var ServiceContext = class extends import_context15.Resource {
             details: assertion
           }, {
             F: __dxlog_file23,
-            L: 340,
+            L: 364,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -6721,7 +7102,7 @@ var ServiceContext = class extends import_context15.Resource {
         } catch (err) {
           import_log20.log.catch(err, void 0, {
             F: __dxlog_file23,
-            L: 346,
+            L: 370,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -6731,13 +7112,13 @@ var ServiceContext = class extends import_context15.Resource {
     await identity.space.spaceState.addCredentialProcessor(this._deviceSpaceSync);
   }
 };
-_ts_decorate7([
+_ts_decorate9([
   import_tracing10.trace.span()
 ], ServiceContext.prototype, "_open", null);
-_ts_decorate7([
+_ts_decorate9([
   import_tracing10.trace.span()
 ], ServiceContext.prototype, "_initialize", null);
-ServiceContext = _ts_decorate7([
+ServiceContext = _ts_decorate9([
   (0, import_util12.safeInstanceof)("dxos.client-services.ServiceContext"),
   import_tracing10.trace.resource()
 ], ServiceContext);
@@ -6775,16 +7156,16 @@ var StorageDriver = import_config2.Runtime.Client.Storage.StorageDriver;
 var createStorageObjects = (config) => {
   const { persistent = false, keyStore, dataStore } = config ?? {};
   if (persistent && dataStore === StorageDriver.RAM) {
-    throw new import_protocols13.InvalidConfigError("RAM storage cannot be used in persistent mode.");
+    throw new import_protocols14.InvalidConfigError("RAM storage cannot be used in persistent mode.");
   }
   if (!persistent && dataStore !== void 0 && dataStore !== StorageDriver.RAM) {
-    throw new import_protocols13.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
+    throw new import_protocols14.InvalidConfigError("Cannot use a persistent storage in not persistent mode.");
   }
   if (persistent && keyStore === StorageDriver.RAM) {
-    throw new import_protocols13.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
+    throw new import_protocols14.InvalidConfigError("RAM key storage cannot be used in persistent mode.");
   }
   if (!persistent && keyStore !== StorageDriver.RAM && keyStore !== void 0) {
-    throw new import_protocols13.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
+    throw new import_protocols14.InvalidConfigError("Cannot use a persistent key storage in not persistent mode.");
   }
   return {
     storage: (0, import_random_access_storage.createStorage)({
@@ -6846,7 +7227,7 @@ var exportProfileData = async ({ storage, level }) => {
       const { size } = await file.stat();
       const data = await file.read(0, size);
       archive.storage.push({
-        type: import_protocols14.ProfileArchiveEntryType.FILE,
+        type: import_protocols15.ProfileArchiveEntryType.FILE,
         key: filename,
         value: data
       });
@@ -6874,7 +7255,7 @@ var exportProfileData = async ({ storage, level }) => {
     let count = 0;
     for await (const [key, value] of iter) {
       archive.storage.push({
-        type: import_protocols14.ProfileArchiveEntryType.KEY_VALUE,
+        type: import_protocols15.ProfileArchiveEntryType.KEY_VALUE,
         key,
         value
       });
@@ -6896,7 +7277,7 @@ var importProfileData = async ({ storage, level }, archive) => {
   let count = 0;
   for (const entry2 of archive.storage) {
     switch (entry2.type) {
-      case import_protocols14.ProfileArchiveEntryType.FILE: {
+      case import_protocols15.ProfileArchiveEntryType.FILE: {
         const directory = await storage.createDirectory();
         (0, import_invariant20.invariant)(typeof entry2.key === "string", "Invalid key type", {
           F: __dxlog_file24,
@@ -6921,7 +7302,7 @@ var importProfileData = async ({ storage, level }, archive) => {
         await file.close();
         break;
       }
-      case import_protocols14.ProfileArchiveEntryType.KEY_VALUE: {
+      case import_protocols15.ProfileArchiveEntryType.KEY_VALUE: {
         (0, import_invariant20.invariant)(entry2.key instanceof Uint8Array, "Invalid key type", {
           F: __dxlog_file24,
           L: 87,
@@ -7323,7 +7704,7 @@ var SystemServiceImpl = class {
     await this._onReset();
   }
 };
-function _ts_decorate8(decorators, target, key, desc) {
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
@@ -7345,6 +7726,7 @@ var ClientServicesHost = class {
     this._tracingService = import_tracing11.TRACE_PROCESSOR.createTraceSender();
     this._statusUpdate = new import_async20.Event();
     this._edgeConnection = void 0;
+    this._edgeHttpClient = void 0;
     this._opening = false;
     this._open = false;
     this._storage = storage;
@@ -7368,7 +7750,7 @@ var ClientServicesHost = class {
           if (!this._opening) {
             void this.open(new import_context16.Context(void 0, {
               F: __dxlog_file26,
-              L: 132
+              L: 133
             }));
           }
         },
@@ -7426,7 +7808,7 @@ var ClientServicesHost = class {
   initialize({ config, ...options }) {
     (0, import_invariant21.invariant)(!this._open, "service host is open", {
       F: __dxlog_file26,
-      L: 198,
+      L: 199,
       S: this,
       A: [
         "!this._open",
@@ -7435,14 +7817,14 @@ var ClientServicesHost = class {
     });
     (0, import_log22.log)("initializing...", void 0, {
       F: __dxlog_file26,
-      L: 199,
+      L: 200,
       S: this,
       C: (f, a) => f(...a)
     });
     if (config) {
       (0, import_invariant21.invariant)(!this._config, "config already set", {
         F: __dxlog_file26,
-        L: 202,
+        L: 203,
         S: this,
         A: [
           "!this._config",
@@ -7457,17 +7839,17 @@ var ClientServicesHost = class {
     if (!options.signalManager) {
       import_log22.log.warn("running signaling without telemetry metadata.", void 0, {
         F: __dxlog_file26,
-        L: 210,
+        L: 211,
         S: this,
         C: (f, a) => f(...a)
       });
     }
     const edgeEndpoint = config?.get("runtime.services.edge.url");
     if (edgeEndpoint) {
-      const randomKey = import_keys16.PublicKey.random().toHex();
-      this._edgeConnection = new import_edge_client2.EdgeClient(randomKey, randomKey, {
+      this._edgeConnection = new import_edge_client3.EdgeClient((0, import_edge_client3.createStubEdgeIdentity)(), {
         socketEndpoint: edgeEndpoint
       });
+      this._edgeHttpClient = new import_edge_client3.EdgeHttpClient(edgeEndpoint);
     }
     const { connectionLog = true, transportFactory = (0, import_network_manager2.createRtcTransportFactory)({
       iceServers: this._config?.get("runtime.services.ice")
@@ -7477,7 +7859,7 @@ var ClientServicesHost = class {
     this._signalManager = signalManager;
     (0, import_invariant21.invariant)(!this._networkManager, "network manager already set", {
       F: __dxlog_file26,
-      L: 232,
+      L: 233,
       S: this,
       A: [
         "!this._networkManager",
@@ -7495,7 +7877,7 @@ var ClientServicesHost = class {
     });
     (0, import_log22.log)("initialized", void 0, {
       F: __dxlog_file26,
-      L: 245,
+      L: 246,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7505,17 +7887,17 @@ var ClientServicesHost = class {
       return;
     }
     const traceId = import_keys16.PublicKey.random().toHex();
-    import_log22.log.trace("dxos.client-services.host.open", import_protocols15.trace.begin({
+    import_log22.log.trace("dxos.client-services.host.open", import_protocols16.trace.begin({
       id: traceId
     }), {
       F: __dxlog_file26,
-      L: 256,
+      L: 257,
       S: this,
       C: (f, a) => f(...a)
     });
     (0, import_invariant21.invariant)(this._config, "config not set", {
       F: __dxlog_file26,
-      L: 258,
+      L: 259,
       S: this,
       A: [
         "this._config",
@@ -7524,7 +7906,7 @@ var ClientServicesHost = class {
     });
     (0, import_invariant21.invariant)(this._storage, "storage not set", {
       F: __dxlog_file26,
-      L: 259,
+      L: 260,
       S: this,
       A: [
         "this._storage",
@@ -7533,7 +7915,7 @@ var ClientServicesHost = class {
     });
     (0, import_invariant21.invariant)(this._signalManager, "signal manager not set", {
       F: __dxlog_file26,
-      L: 260,
+      L: 261,
       S: this,
       A: [
         "this._signalManager",
@@ -7542,7 +7924,7 @@ var ClientServicesHost = class {
     });
     (0, import_invariant21.invariant)(this._networkManager, "network manager not set", {
       F: __dxlog_file26,
-      L: 261,
+      L: 262,
       S: this,
       A: [
         "this._networkManager",
@@ -7554,7 +7936,7 @@ var ClientServicesHost = class {
       lockKey: this._resourceLock?.lockKey
     }, {
       F: __dxlog_file26,
-      L: 264,
+      L: 265,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7564,7 +7946,7 @@ var ClientServicesHost = class {
     }
     await this._level.open();
     await this._loggingService.open();
-    this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._edgeConnection, this._runtimeParams, this._config.get("runtime.client.edgeFeatures"));
+    this._serviceContext = new ServiceContext(this._storage, this._level, this._networkManager, this._signalManager, this._edgeConnection, this._edgeHttpClient, this._runtimeParams, this._config.get("runtime.client.edgeFeatures"));
     const dataSpaceManagerProvider = async () => {
       await this._serviceContext.initialized.wait();
       return this._serviceContext.dataSpaceManager;
@@ -7610,15 +7992,15 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file26,
-      L: 352,
+      L: 354,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log22.log.trace("dxos.client-services.host.open", import_protocols15.trace.end({
+    import_log22.log.trace("dxos.client-services.host.open", import_protocols16.trace.end({
       id: traceId
     }), {
       F: __dxlog_file26,
-      L: 353,
+      L: 355,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7632,7 +8014,7 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file26,
-      L: 364,
+      L: 366,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7650,24 +8032,24 @@ var ClientServicesHost = class {
       deviceKey
     }, {
       F: __dxlog_file26,
-      L: 373,
+      L: 375,
       S: this,
       C: (f, a) => f(...a)
     });
   }
   async reset() {
     const traceId = import_keys16.PublicKey.random().toHex();
-    import_log22.log.trace("dxos.sdk.client-services-host.reset", import_protocols15.trace.begin({
+    import_log22.log.trace("dxos.sdk.client-services-host.reset", import_protocols16.trace.begin({
       id: traceId
     }), {
       F: __dxlog_file26,
-      L: 378,
+      L: 380,
       S: this,
       C: (f, a) => f(...a)
     });
     import_log22.log.info("resetting...", void 0, {
       F: __dxlog_file26,
-      L: 380,
+      L: 382,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7675,15 +8057,15 @@ var ClientServicesHost = class {
     await this._storage.reset();
     import_log22.log.info("reset", void 0, {
       F: __dxlog_file26,
-      L: 383,
+      L: 385,
       S: this,
       C: (f, a) => f(...a)
     });
-    import_log22.log.trace("dxos.sdk.client-services-host.reset", import_protocols15.trace.end({
+    import_log22.log.trace("dxos.sdk.client-services-host.reset", import_protocols16.trace.end({
       id: traceId
     }), {
       F: __dxlog_file26,
-      L: 384,
+      L: 386,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -7695,21 +8077,21 @@ var ClientServicesHost = class {
     return identity;
   }
 };
-_ts_decorate8([
+_ts_decorate10([
   import_tracing11.trace.info()
 ], ClientServicesHost.prototype, "_opening", void 0);
-_ts_decorate8([
+_ts_decorate10([
   import_tracing11.trace.info()
 ], ClientServicesHost.prototype, "_open", void 0);
-_ts_decorate8([
+_ts_decorate10([
   import_async20.synchronized,
   import_tracing11.trace.span()
 ], ClientServicesHost.prototype, "open", null);
-_ts_decorate8([
+_ts_decorate10([
   import_async20.synchronized,
   import_tracing11.trace.span()
 ], ClientServicesHost.prototype, "close", null);
-ClientServicesHost = _ts_decorate8([
+ClientServicesHost = _ts_decorate10([
   import_tracing11.trace.resource()
 ], ClientServicesHost);
 // Annotate the CommonJS export names for ESM import in node:
@@ -7756,4 +8138,4 @@ ClientServicesHost = _ts_decorate8([
   subscribeToSpaces,
   subscribeToSwarmInfo
 });
-//# sourceMappingURL=chunk-F3WGFGEN.cjs.map
+//# sourceMappingURL=chunk-2UUETFZ2.cjs.map