@dxos/client-services 0.6.13 → 0.6.14-main.69511f5

package/src/packlets/invitations/invitations-handler.ts

@@ -2,10 +2,11 @@
 // Copyright 2022 DXOS.org
 //
 
-import { Mutex, type PushStream, scheduleTask, TimeoutError, type Trigger } from '@dxos/async';
+import { type PushStream, scheduleTask, TimeoutError, type Trigger } from '@dxos/async';
 import { INVITATION_TIMEOUT } from '@dxos/client-protocol';
 import { type Context, ContextDisposedError } from '@dxos/context';
 import { createKeyPair, sign } from '@dxos/crypto';
+import { type EdgeHttpClient } from '@dxos/edge-client';
 import { invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
@@ -19,17 +20,21 @@ import { type ExtensionContext, type TeleportExtension, type TeleportParams } fr
 import { trace as _trace } from '@dxos/tracing';
 import { ComplexSet } from '@dxos/util';
 
+import { type EdgeInvitationConfig, EdgeInvitationHandler } from './edge-invitation-handler';
 import { InvitationGuestExtension } from './invitation-guest-extenstion';
 import { InvitationHostExtension, isAuthenticationRequired, MAX_OTP_ATTEMPTS } from './invitation-host-extension';
 import { type InvitationProtocol } from './invitation-protocol';
+import { createGuardedInvitationState } from './invitation-state';
 import { InvitationTopology } from './invitation-topology';
-import { stateToString } from './utils';
 
 const metrics = _trace.metrics;
 
 const MAX_DELEGATED_INVITATION_HOST_TRIES = 3;
 
-type InvitationExtension = InvitationHostExtension | InvitationGuestExtension;
+export type InvitationConnectionParams = {
+  teleport: Partial<TeleportParams>;
+  edgeInvitations?: EdgeInvitationConfig;
+};
 
 /**
  * Generic handler for Halo and Space invitations.
@@ -65,7 +70,8 @@ export class InvitationsHandler {
    */
   constructor(
     private readonly _networkManager: SwarmNetworkManager,
-    private readonly _defaultTeleportParams?: Partial<TeleportParams>,
+    private readonly _edgeClient?: EdgeHttpClient,
+    private readonly _connectionParams?: InvitationConnectionParams,
   ) {}
 
   handleInvitationFlow(
@@ -74,8 +80,14 @@ export class InvitationsHandler {
     protocol: InvitationProtocol,
     invitation: Invitation,
   ): void {
+    log.verbose('dxos.sdk.invitations-handler.handleInvitationFlow', {
+      state: invitation.state,
+      invitationId: invitation.invitationId,
+      kind: invitation.kind,
+      type: invitation.type,
+    });
     metrics.increment('dxos.invitation.created');
-    const guardedState = this._createGuardedState(ctx, invitation, stream);
+    const guardedState = createGuardedInvitationState(ctx, invitation, stream);
     // Called for every connecting peer.
     const createExtension = (): InvitationHostExtension => {
       const extension = new InvitationHostExtension(guardedState.mutex, {
@@ -90,6 +102,10 @@ export class InvitationsHandler {
 
         admit: async (admissionRequest) => {
           try {
+            log.verbose('dxos.sdk.invitations-handler.host.admit', {
+              invitationId: invitation.invitationId,
+              ...protocol.toJSON(),
+            });
             const deviceKey = admissionRequest.device?.deviceKey ?? admissionRequest.space?.deviceKey;
             invariant(deviceKey);
             const admissionResponse = await protocol.admit(invitation, admissionRequest, extension.guestProfile);
@@ -201,6 +217,12 @@ export class InvitationsHandler {
     otpEnteredTrigger: Trigger<string>,
     deviceProfile?: DeviceProfileDocument,
   ): void {
+    log.verbose('dxos.sdk.invitations-handler.acceptInvitation', {
+      state: invitation.state,
+      invitationId: invitation.invitationId,
+      kind: invitation.kind,
+      type: invitation.type,
+    });
     const { timeout = INVITATION_TIMEOUT } = invitation;
 
     if (deviceProfile) {
@@ -208,7 +230,7 @@ export class InvitationsHandler {
     }
 
     const triedPeersIds = new ComplexSet(PublicKey.hash);
-    const guardedState = this._createGuardedState(ctx, invitation, stream);
+    const guardedState = createGuardedInvitationState(ctx, invitation, stream);
 
     const shouldCancelInvitationFlow = (extension: InvitationGuestExtension) => {
       const isLockedByAnotherConnection = guardedState.mutex.isLocked() && !extension.hasFlowLock();
@@ -263,16 +285,23 @@ export class InvitationsHandler {
                 timeout,
               );
 
-              log('connected', { ...protocol.toJSON() });
+              log.verbose('dxos.sdk.invitations-handler.guest.connected', { ...protocol.toJSON() });
               guardedState.set(extension, Invitation.State.CONNECTED);
 
               // 1. Introduce guest to host.
-              log('introduce', { ...protocol.toJSON() });
+              log.verbose('dxos.sdk.invitations-handler.guest.introduce', {
+                invitationId: invitation.invitationId,
+                ...protocol.toJSON(),
+              });
               const introductionResponse = await extension.rpc.InvitationHostService.introduce({
                 invitationId: invitation.invitationId,
                 ...protocol.createIntroduction(),
               });
-              log('introduce response', { ...protocol.toJSON(), response: introductionResponse });
+              log.verbose('dxos.sdk.invitations-handler.guest.introduce-response', {
+                invitationId: invitation.invitationId,
+                ...protocol.toJSON(),
+                authMethod: introductionResponse.authMethod,
+              });
               invitation.authMethod = introductionResponse.authMethod;
 
               // 2. Get authentication code.
@@ -298,7 +327,10 @@ export class InvitationsHandler {
               }
 
               // 3. Send admission credentials to host (with local space keys).
-              log('request admission', { ...protocol.toJSON() });
+              log.verbose('dxos.sdk.invitations-handler.guest.request-admission', {
+                invitationId: invitation.invitationId,
+                ...protocol.toJSON(),
+              });
               const admissionRequest = await protocol.createAdmissionRequest(deviceProfile);
               const admissionResponse = await extension.rpc.InvitationHostService.admit(admissionRequest);
 
@@ -309,8 +341,11 @@ export class InvitationsHandler {
               const result = await protocol.accept(admissionResponse, admissionRequest);
 
               // 5. Success.
-              log('admitted by host', { ...protocol.toJSON() });
-              await guardedState.complete({
+              log.verbose('dxos.sdk.invitations-handler.guest.admitted-by-host', {
+                invitationId: invitation.invitationId,
+                ...protocol.toJSON(),
+              });
+              guardedState.complete({
                 ...guardedState.current,
                 ...result,
                 state: Invitation.State.SUCCESS,
@@ -346,6 +381,15 @@ export class InvitationsHandler {
       return extension;
     };
 
+    const edgeInvitationHandler = new EdgeInvitationHandler(this._connectionParams?.edgeInvitations, this._edgeClient, {
+      onInvitationSuccess: async (admissionResponse, admissionRequest) => {
+        const result = await protocol.accept(admissionResponse, admissionRequest);
+        log.info('admitted by edge', { ...protocol.toJSON() });
+        guardedState.complete({ ...guardedState.current, ...result, state: Invitation.State.SUCCESS });
+      },
+    });
+    edgeInvitationHandler.handle(ctx, guardedState, protocol, deviceProfile);
+
     scheduleTask(ctx, async () => {
       const error = protocol.checkInvitation(invitation);
       if (error) {
@@ -389,7 +433,7 @@ export class InvitationsHandler {
       topic: invitation.swarmKey,
       protocolProvider: createTeleportProtocolFactory(async (teleport) => {
         teleport.addExtension('dxos.halo.invitations', extensionFactory());
-      }, this._defaultTeleportParams),
+      }, this._connectionParams?.teleport),
       topology: new InvitationTopology(role),
       label,
     });
@@ -397,90 +441,6 @@ export class InvitationsHandler {
     return swarmConnection;
   }
 
-  /**
-   * A utility object for serializing invitation state changes by multiple concurrent
-   * invitation flow connections.
-   */
-  private _createGuardedState(ctx: Context, invitation: Invitation, stream: PushStream<Invitation>) {
-    // the mutex guards invitation flow on host and guest side, making sure only one flow is currently active
-    // deadlocks seem very unlikely because hosts don't initiate multiple connections
-    // even if this somehow happens that there are 2 guests (A, B) and 2 hosts (1, 2) and:
-    //  A has lock for flow with 1, B has lock for flow with 2
-    //  1 has lock for flow with B, 2 has lock for flow with A
-    // there'll be a 10-second introduction timeout after which connection will be closed and deadlock broken
-    const mutex = new Mutex();
-    let lastActiveExtension: any = null;
-    let currentInvitation = { ...invitation };
-    const isStateChangeAllowed = (extension: InvitationExtension | null) => {
-      if (ctx.disposed || (extension !== null && mutex.isLocked() && !extension.hasFlowLock())) {
-        return false;
-      }
-      // don't allow transitions from a terminal state unless a new extension acquired mutex
-      // handles a case when error occurs (e.g. connection is closed) after we completed the flow
-      // successfully or already reported another error
-      return extension == null || lastActiveExtension !== extension || this._isNotTerminal(currentInvitation.state);
-    };
-    return {
-      mutex,
-      get current() {
-        return currentInvitation;
-      },
-      // disposing context prevents any further state updates
-      complete: (newState: Partial<Invitation>) => {
-        currentInvitation = { ...currentInvitation, ...newState };
-        stream.next(currentInvitation);
-        return ctx.dispose();
-      },
-      set: (extension: InvitationExtension | null, newState: Invitation.State): boolean => {
-        if (isStateChangeAllowed(extension)) {
-          this._logStateUpdate(currentInvitation, extension, newState);
-          currentInvitation = { ...currentInvitation, state: newState };
-          stream.next(currentInvitation);
-          lastActiveExtension = extension;
-          return true;
-        }
-        return false;
-      },
-      error: (extension: InvitationExtension | null, error: any): boolean => {
-        if (isStateChangeAllowed(extension)) {
-          this._logStateUpdate(currentInvitation, extension, Invitation.State.ERROR);
-          currentInvitation = { ...currentInvitation, state: Invitation.State.ERROR };
-          stream.next(currentInvitation);
-          stream.error(error);
-          lastActiveExtension = extension;
-          return true;
-        }
-        return false;
-      },
-    };
-  }
-
-  private _logStateUpdate(invitation: Invitation, actor: any, newState: Invitation.State) {
-    if (this._isNotTerminal(newState)) {
-      log('invitation state update', {
-        actor: actor?.constructor.name,
-        newState: stateToString(newState),
-        oldState: stateToString(invitation.state),
-      });
-    } else {
-      log.info('invitation state update', {
-        actor: actor?.constructor.name,
-        newState: stateToString(newState),
-        oldState: stateToString(invitation.state),
-      });
-    }
-  }
-
-  private _isNotTerminal(currentState: Invitation.State): boolean {
-    return ![
-      Invitation.State.SUCCESS,
-      Invitation.State.ERROR,
-      Invitation.State.CANCELLED,
-      Invitation.State.TIMEOUT,
-      Invitation.State.EXPIRED,
-    ].includes(currentState);
-  }
-
   private async _handleGuestOtpAuth(
     extension: InvitationGuestExtension,
     setState: (newState: Invitation.State) => void,
@@ -523,7 +483,6 @@ export class InvitationsHandler {
       throw new Error('challenge missing in the introduction');
     }
     log('sending authentication request');
-    setState(Invitation.State.AUTHENTICATING);
     const signature = sign(Buffer.from(introductionResponse.challenge), invitation.guestKeypair.privateKey);
     const response = await extension.rpc.InvitationHostService.authenticate({
       signedChallenge: signature,

package/src/packlets/invitations/space-invitation-protocol.test.ts

@@ -2,20 +2,21 @@
 // Copyright 2022 DXOS.org
 //
 
-import { expect } from 'chai';
+import { onTestFinished, describe, expect, test } from 'vitest';
 
 import { asyncChain, Trigger } from '@dxos/async';
 import { raise } from '@dxos/debug';
 import { AlreadyJoinedError } from '@dxos/protocols';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
-import { afterTest, describe, test } from '@dxos/test';
 
 import { type ServiceContext } from '../services';
 import { createIdentity, createPeers } from '../testing';
 import { acceptInvitation, createInvitation, performInvitation } from '../testing/invitation-utils';
 
 const closeAfterTest = async (peer: ServiceContext) => {
-  afterTest(() => peer.close());
+  onTestFinished(async () => {
+    await peer.close();
+  });
   return peer;
 };
 

package/src/packlets/invitations/space-invitation-protocol.ts

@@ -40,6 +40,7 @@ export class SpaceInvitationProtocol implements InvitationProtocol {
 
   toJSON(): object {
     return {
+      kind: 'space',
       deviceKey: this._signingContext.deviceKey,
       spaceKey: this._spaceKey,
     };
@@ -60,9 +61,13 @@ export class SpaceInvitationProtocol implements InvitationProtocol {
   }
 
   getInvitationContext(): Partial<Invitation> & Pick<Invitation, 'kind'> {
+    invariant(this._spaceKey);
+    const space = this._spaceManager.spaces.get(this._spaceKey);
+    invariant(space);
     return {
       kind: Invitation.Kind.SPACE,
       spaceKey: this._spaceKey,
+      spaceId: space.id,
     };
   }
 

package/src/packlets/logging/logging.test.ts

@@ -2,12 +2,11 @@
 // Copyright 2023 DXOS.org
 //
 
-import { expect } from 'chai';
+import { afterEach, beforeEach, describe, expect, test } from 'vitest';
 
 import { Trigger } from '@dxos/async';
 import { log, LogLevel } from '@dxos/log';
 import { type LogEntry } from '@dxos/protocols/proto/dxos/client/services';
-import { beforeEach, describe, test } from '@dxos/test';
 
 import { LoggingServiceImpl } from './logging-service';
 

package/src/packlets/network/network-service.test.ts

@@ -2,12 +2,11 @@
 // Copyright 2023 DXOS.org
 //
 
-import { expect } from 'chai';
+import { afterEach, onTestFinished, beforeEach, describe, expect, test } from 'vitest';
 
 import { Trigger } from '@dxos/async';
 import { Context } from '@dxos/context';
 import { type NetworkService, ConnectionState } from '@dxos/protocols/proto/dxos/client/services';
-import { afterEach, afterTest, beforeEach, describe, test } from '@dxos/test';
 
 import { NetworkServiceImpl } from './network-service';
 import { type ServiceContext } from '../services';
@@ -41,7 +40,7 @@ describe('NetworkService', () => {
     query.subscribe(({ swarm }) => {
       result.wake(swarm);
     });
-    afterTest(() => query.close());
+    onTestFinished(() => query.close());
     expect(await result.wait()).to.equal(ConnectionState.ONLINE);
 
     result = new Trigger<ConnectionState | undefined>();

package/src/packlets/services/service-context.test.ts

@@ -2,9 +2,11 @@
 // Copyright 2023 DXOS.org
 //
 
+import { describe, test } from 'vitest';
+
 import { MemorySignalManagerContext, MemorySignalManager } from '@dxos/messaging';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
-import { describe, openAndClose, test } from '@dxos/test';
+import { openAndClose } from '@dxos/test-utils';
 
 import { createServiceContext, performInvitation } from '../testing';
 

package/src/packlets/services/service-context.ts

@@ -2,13 +2,20 @@
 // Copyright 2022 DXOS.org
 //
 
-import { Trigger } from '@dxos/async';
+import { Mutex, Trigger } from '@dxos/async';
 import { Context, Resource } from '@dxos/context';
 import { getCredentialAssertion, type CredentialProcessor } from '@dxos/credentials';
-import { failUndefined } from '@dxos/debug';
-import { EchoEdgeReplicator, EchoHost } from '@dxos/echo-db';
-import { MeshEchoReplicator, MetadataStore, SpaceManager, valueEncoding } from '@dxos/echo-pipeline';
-import type { EdgeConnection } from '@dxos/edge-client';
+import { failUndefined, warnAfterTimeout } from '@dxos/debug';
+import {
+  EchoEdgeReplicator,
+  EchoHost,
+  MeshEchoReplicator,
+  MetadataStore,
+  SpaceManager,
+  valueEncoding,
+} from '@dxos/echo-pipeline';
+import { createChainEdgeIdentity, createEphemeralEdgeIdentity } from '@dxos/edge-client';
+import type { EdgeHttpClient, EdgeConnection, EdgeIdentity } from '@dxos/edge-client';
 import { FeedFactory, FeedStore } from '@dxos/feed-store';
 import { invariant } from '@dxos/invariant';
 import { Keyring } from '@dxos/keyring';
@@ -23,19 +30,21 @@ import { type Runtime } from '@dxos/protocols/proto/dxos/config';
 import type { FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
 import { type Credential, type ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type Storage } from '@dxos/random-access-storage';
-import type { TeleportParams } from '@dxos/teleport';
 import { BlobStore } from '@dxos/teleport-extension-object-sync';
 import { trace as Trace } from '@dxos/tracing';
 import { safeInstanceof } from '@dxos/util';
 
+import { EdgeAgentManager } from '../agents';
 import {
   IdentityManager,
   type CreateIdentityOptions,
-  type IdentityManagerRuntimeParams,
+  type IdentityManagerParams,
   type JoinIdentityParams,
 } from '../identity';
+import { EdgeIdentityRecoveryManager } from '../identity/identity-recovery-manager';
 import {
   DeviceInvitationProtocol,
+  type InvitationConnectionParams,
   InvitationsHandler,
   InvitationsManager,
   SpaceInvitationProtocol,
@@ -43,9 +52,12 @@ import {
 } from '../invitations';
 import { DataSpaceManager, type DataSpaceManagerRuntimeParams, type SigningContext } from '../spaces';
 
-export type ServiceContextRuntimeParams = IdentityManagerRuntimeParams &
+export type ServiceContextRuntimeParams = Pick<
+  IdentityManagerParams,
+  'devicePresenceOfflineTimeout' | 'devicePresenceAnnounceInterval'
+> &
   DataSpaceManagerRuntimeParams & {
-    invitationConnectionDefaultParams?: Partial<TeleportParams>;
+    invitationConnectionDefaultParams?: InvitationConnectionParams;
     disableP2pReplication?: boolean;
   };
 /**
@@ -56,6 +68,8 @@ export type ServiceContextRuntimeParams = IdentityManagerRuntimeParams &
 @safeInstanceof('dxos.client-services.ServiceContext')
 @Trace.resource()
 export class ServiceContext extends Resource {
+  private readonly _edgeIdentityUpdateMutex = new Mutex();
+
   public readonly initialized = new Trigger();
   public readonly metadataStore: MetadataStore;
   public readonly blobStore: BlobStore;
@@ -63,6 +77,7 @@ export class ServiceContext extends Resource {
   public readonly keyring: Keyring;
   public readonly spaceManager: SpaceManager;
   public readonly identityManager: IdentityManager;
+  public readonly recoveryManager: EdgeIdentityRecoveryManager;
   public readonly invitations: InvitationsHandler;
   public readonly invitationsManager: InvitationsManager;
   public readonly echoHost: EchoHost;
@@ -71,6 +86,7 @@ export class ServiceContext extends Resource {
 
   // Initialized after identity is initialized.
   public dataSpaceManager?: DataSpaceManager;
+  public edgeAgentManager?: EdgeAgentManager;
 
   private readonly _handlerFactories = new Map<
     Invitation.Kind,
@@ -87,6 +103,7 @@ export class ServiceContext extends Resource {
     public readonly networkManager: SwarmNetworkManager,
     public readonly signalManager: SignalManager,
     private readonly _edgeConnection: EdgeConnection | undefined,
+    private readonly _edgeHttpClient: EdgeHttpClient | undefined,
     public readonly _runtimeParams?: ServiceContextRuntimeParams,
     private readonly _edgeFeatures?: Runtime.Client.EdgeFeatures,
   ) {
@@ -116,31 +133,22 @@ export class ServiceContext extends Resource {
       disableP2pReplication: this._runtimeParams?.disableP2pReplication,
     });
 
-    this.identityManager = new IdentityManager(
-      this.metadataStore,
+    this.identityManager = new IdentityManager({
+      metadataStore: this.metadataStore,
+      keyring: this.keyring,
+      feedStore: this.feedStore,
+      spaceManager: this.spaceManager,
+      devicePresenceOfflineTimeout: this._runtimeParams?.devicePresenceOfflineTimeout,
+      devicePresenceAnnounceInterval: this._runtimeParams?.devicePresenceAnnounceInterval,
+      edgeConnection: this._edgeConnection,
+      edgeFeatures: this._edgeFeatures,
+    });
+
+    this.recoveryManager = new EdgeIdentityRecoveryManager(
       this.keyring,
-      this.feedStore,
-      this.spaceManager,
-      this._runtimeParams as IdentityManagerRuntimeParams,
-      {
-        onIdentityConstruction: (identity) => {
-          if (this._edgeConnection) {
-            log.info('Setting identity on edge connection', {
-              identity: identity.identityKey.toHex(),
-              oldIdentity: this._edgeConnection.identityKey,
-              swarms: this.networkManager.topics,
-            });
-            this._edgeConnection.setIdentity({
-              peerKey: identity.deviceKey.toHex(),
-              identityKey: identity.identityKey.toHex(),
-            });
-            this.networkManager.setPeerInfo({
-              identityKey: identity.identityKey.toHex(),
-              peerKey: identity.deviceKey.toHex(),
-            });
-          }
-        },
-      },
+      this._edgeHttpClient,
+      () => this.identityManager.identity,
+      this._acceptIdentity.bind(this),
     );
 
     this.echoHost = new EchoHost({ kv: this.level });
@@ -149,6 +157,7 @@ export class ServiceContext extends Resource {
 
     this.invitations = new InvitationsHandler(
       this.networkManager, //
+      this._edgeHttpClient,
       _runtimeParams?.invitationConnectionDefaultParams,
     );
     this.invitationsManager = new InvitationsManager(
@@ -185,6 +194,11 @@ export class ServiceContext extends Resource {
 
     log('opening...');
     log.trace('dxos.sdk.service-context.open', trace.begin({ id: this._instanceId }));
+
+    await this.identityManager.open(ctx);
+
+    await this._setNetworkIdentity();
+
     await this._edgeConnection?.open();
     await this.signalManager.open();
     await this.networkManager.open();
@@ -200,9 +214,9 @@ export class ServiceContext extends Resource {
 
     await this.metadataStore.load();
     await this.spaceManager.open();
-    await this.identityManager.open(ctx);
 
     if (this.identityManager.identity) {
+      await this.identityManager.identity.joinNetwork();
       await this._initialize(ctx);
     }
 
@@ -219,6 +233,7 @@ export class ServiceContext extends Resource {
       await this.identityManager.identity.space.spaceState.removeCredentialProcessor(this._deviceSpaceSync);
     }
     await this.dataSpaceManager?.close();
+    await this.edgeAgentManager?.close();
     await this.identityManager.close();
     await this.spaceManager.close();
     await this.feedStore.close();
@@ -234,11 +249,16 @@ export class ServiceContext extends Resource {
 
   async createIdentity(params: CreateIdentityOptions = {}) {
     const identity = await this.identityManager.createIdentity(params);
+    await this._setNetworkIdentity();
+    await identity.joinNetwork();
     await this._initialize(new Context());
     return identity;
   }
 
   getInvitationHandler(invitation: Partial<Invitation> & Pick<Invitation, 'kind'>): InvitationProtocol {
+    if (this.identityManager.identity == null && invitation.kind === Invitation.Kind.SPACE) {
+      throw new Error('Identity must be created before joining a space.');
+    }
     const factory = this._handlerFactories.get(invitation.kind);
     invariant(factory, `Unknown invitation kind: ${invitation.kind}`);
     return factory(invitation);
@@ -255,7 +275,10 @@ export class ServiceContext extends Resource {
   }
 
   private async _acceptIdentity(params: JoinIdentityParams) {
-    const identity = await this.identityManager.acceptIdentity(params);
+    const { identity, identityRecord } = await this.identityManager.prepareIdentity(params);
+    await this._setNetworkIdentity({ deviceCredential: params.authorizedDeviceCredential! });
+    await identity.joinNetwork();
+    await this.identityManager.acceptIdentity(identity, identityRecord, params.deviceProfile);
     await this._initialize(new Context());
     return identity;
   }
@@ -292,6 +315,7 @@ export class ServiceContext extends Resource {
       echoHost: this.echoHost,
       invitationsManager: this.invitationsManager,
       edgeConnection: this._edgeConnection,
+      edgeHttpClient: this._edgeHttpClient,
       echoEdgeReplicator: this._echoEdgeReplicator,
       meshReplicator: this._meshReplicator,
       runtimeParams: this._runtimeParams as DataSpaceManagerRuntimeParams,
@@ -299,6 +323,14 @@ export class ServiceContext extends Resource {
     });
     await this.dataSpaceManager.open();
 
+    this.edgeAgentManager = new EdgeAgentManager(
+      this._edgeFeatures,
+      this._edgeHttpClient,
+      this.dataSpaceManager,
+      identity,
+    );
+    await this.edgeAgentManager.open();
+
     this._handlerFactories.set(Invitation.Kind.SPACE, (invitation) => {
       invariant(this.dataSpaceManager, 'dataSpaceManager not initialized yet');
       return new SpaceInvitationProtocol(this.dataSpaceManager, signingContext, this.keyring, invitation.spaceKey);
@@ -338,4 +370,50 @@ export class ServiceContext extends Resource {
 
     await identity.space.spaceState.addCredentialProcessor(this._deviceSpaceSync);
   }
+
+  private async _setNetworkIdentity(params?: { deviceCredential: Credential }) {
+    using _ = await this._edgeIdentityUpdateMutex.acquire();
+
+    let edgeIdentity: EdgeIdentity;
+    const identity = this.identityManager.identity;
+    if (identity) {
+      log.info('Setting identity on edge connection', {
+        identity: identity.identityKey.toHex(),
+        swarms: this.networkManager.topics,
+      });
+      if (params?.deviceCredential) {
+        edgeIdentity = await createChainEdgeIdentity(
+          identity.signer,
+          identity.identityKey,
+          identity.deviceKey,
+          { credential: params.deviceCredential },
+          [], // TODO(dmaretskyi): Service access credentials.
+        );
+      } else {
+        // TODO: throw here or from identity if device chain can't be loaded, to avoid indefinite hangup
+        await warnAfterTimeout(10_000, 'Waiting for identity to be ready for edge connection', async () => {
+          await identity.ready();
+        });
+
+        invariant(identity.deviceCredentialChain);
+
+        edgeIdentity = await createChainEdgeIdentity(
+          identity.signer,
+          identity.identityKey,
+          identity.deviceKey,
+          identity.deviceCredentialChain,
+          [], // TODO(dmaretskyi): Service access credentials.
+        );
+      }
+    } else {
+      edgeIdentity = await createEphemeralEdgeIdentity();
+    }
+
+    this._edgeConnection?.setIdentity(edgeIdentity);
+    this._edgeHttpClient?.setIdentity(edgeIdentity);
+    this.networkManager.setPeerInfo({
+      identityKey: edgeIdentity.identityKey,
+      peerKey: edgeIdentity.peerKey,
+    });
+  }
 }