@dxos/edge-client 0.10.0 → 0.11.0

package/dist/lib/index.mjs

@@ -0,0 +1,1769 @@
+import { proxyFetchLegacy } from "./cors-proxy.mjs";
+import { a as Protocol, i as protocol, n as CLOUDFLARE_RPC_MAX_BYTES, o as getTypename, r as WebSocketMuxer, s as toUint8Array, t as CLOUDFLARE_MESSAGE_MAX_BYTES } from "./chunk-edge-ws-muxer.mjs";
+import { Event, Mutex, PersistentLifecycle, Trigger, TriggerState, scheduleMicroTask, scheduleTask, scheduleTaskInterval, sleep } from "@dxos/async";
+import { log, logInfo } from "@dxos/log";
+import { buf } from "@dxos/protocols/buf";
+import { MessageSchema } from "@dxos/protocols/buf/dxos/edge/messenger_pb";
+import { invariant } from "@dxos/invariant";
+import { createUrl } from "@dxos/util";
+import { createCredential, createDidFromIdentityKey, signPresentation } from "@dxos/credentials";
+import { Keyring } from "@dxos/keyring";
+import { IdentityDid, PublicKey } from "@dxos/keys";
+import * as EffectContext from "effect/Context";
+import { Context, Resource, TRACE_SPAN_ATTRIBUTE } from "@dxos/context";
+import { EdgeStatus } from "@dxos/protocols/proto/dxos/client/services";
+import { schema } from "@dxos/protocols/proto";
+import WebSocket from "isomorphic-ws";
+import { BYOK_HEADER, EDGE_CLIENT_TAG_HEADER, EdgeAuthChallengeError, EdgeCallFailedError, EdgeWebsocketProtocol } from "@dxos/protocols";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schedule from "effect/Schedule";
+import * as Headers$1 from "@effect/platform/Headers";
+import * as HttpClient from "@effect/platform/HttpClient";
+import * as HttpClientError from "@effect/platform/HttpClientError";
+import * as HttpClientResponse from "@effect/platform/HttpClientResponse";
+import * as FiberRef from "effect/FiberRef";
+import * as Stream from "effect/Stream";
+import { BaseError } from "@dxos/errors";
+import * as FetchHttpClient from "@effect/platform/FetchHttpClient";
+import * as HttpClientRequest from "@effect/platform/HttpClientRequest";
+import * as Function from "effect/Function";
+import { EffectEx } from "@dxos/effect";
+import * as Schema from "effect/Schema";
+export * from "@dxos/protocols/buf/dxos/edge/messenger_pb";
+//#region src/auth.ts
+var __dxlog_file$7 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/auth.ts";
+/**
+* Edge identity backed by a device key without a credential chain.
+*/
+var createDeviceEdgeIdentity = async (signer, key) => {
+	return {
+		identityDid: await createDidFromIdentityKey(key),
+		peerKey: key.toHex(),
+		presentCredentials: async ({ challenge }) => {
+			return signPresentation({
+				presentation: { credentials: [await createCredential({
+					assertion: { "@type": "dxos.halo.credentials.Auth" },
+					issuer: key,
+					subject: key,
+					signer
+				})] },
+				signer,
+				signerKey: key,
+				nonce: challenge
+			});
+		}
+	};
+};
+/**
+* Edge identity backed by a chain of credentials.
+*/
+var createChainEdgeIdentity = async (signer, identityKey, peerKey, chain, credentials) => {
+	const credentialsToSign = credentials.length > 0 ? credentials : [await createCredential({
+		assertion: { "@type": "dxos.halo.credentials.Auth" },
+		issuer: identityKey,
+		subject: identityKey,
+		signer,
+		chain,
+		signingKey: peerKey
+	})];
+	return {
+		identityDid: await createDidFromIdentityKey(identityKey),
+		peerKey: peerKey.toHex(),
+		presentCredentials: async ({ challenge }) => {
+			invariant(chain, void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$7,
+				L: 75,
+				S: void 0,
+				A: ["chain", ""]
+			});
+			return signPresentation({
+				presentation: { credentials: credentialsToSign },
+				signer,
+				nonce: challenge,
+				signerKey: peerKey,
+				chain
+			});
+		}
+	};
+};
+/**
+* Edge identity backed by a random ephemeral key without HALO.
+*/
+var createEphemeralEdgeIdentity = async () => {
+	const keyring = new Keyring();
+	return createDeviceEdgeIdentity(keyring, await keyring.createKey());
+};
+/**
+* Creates a HALO chain of credentials to act as an edge identity.
+*/
+var createTestHaloEdgeIdentity = async (signer, identityKey, deviceKey) => {
+	return createChainEdgeIdentity(signer, identityKey, deviceKey, { credential: await createCredential({
+		assertion: {
+			"@type": "dxos.halo.credentials.AuthorizedDevice",
+			deviceKey,
+			identityKey
+		},
+		issuer: identityKey,
+		subject: deviceKey,
+		signer
+	}) }, [await createCredential({
+		assertion: { "@type": "dxos.halo.credentials.Auth" },
+		issuer: identityKey,
+		subject: identityKey,
+		signer
+	})]);
+};
+var createStubEdgeIdentity = () => {
+	const deviceKey = PublicKey.random();
+	return {
+		identityDid: IdentityDid.random(),
+		peerKey: deviceKey.toHex(),
+		presentCredentials: async () => {
+			throw new Error("Stub identity does not support authentication.");
+		}
+	};
+};
+//#endregion
+//#region src/edge-identity.ts
+var __dxlog_file$6 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-identity.ts";
+var handleAuthChallenge = async (failedResponse, identity) => {
+	invariant(failedResponse.status === 401, void 0, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$6,
+		L: 25,
+		S: void 0,
+		A: ["failedResponse.status === 401", ""]
+	});
+	const headerValue = failedResponse.headers.get("Www-Authenticate");
+	invariant(headerValue?.startsWith("VerifiablePresentation challenge="), void 0, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$6,
+		L: 28,
+		S: void 0,
+		A: ["headerValue?.startsWith('VerifiablePresentation challenge=')", ""]
+	});
+	const challenge = headerValue?.slice(33);
+	invariant(challenge, void 0, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$6,
+		L: 31,
+		S: void 0,
+		A: ["challenge", ""]
+	});
+	const presentation = await identity.presentCredentials({ challenge: Buffer.from(challenge, "base64") });
+	return schema.getCodecForType("dxos.halo.credentials.Presentation").encode(presentation);
+};
+//#endregion
+//#region \0@oxc-project+runtime@0.139.0/helpers/esm/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.139.0/helpers/esm/usingCtx.js
+function _usingCtx() {
+	var r = "function" == typeof SuppressedError ? SuppressedError : function(r, e) {
+		var n = Error();
+		return n.name = "SuppressedError", n.error = r, n.suppressed = e, n;
+	}, e = {}, n = [];
+	function using(r, e) {
+		if (null != e) {
+			if (Object(e) !== e) throw new TypeError("using declarations can only be used with objects, functions, null, or undefined.");
+			if (r) var o = e[Symbol.asyncDispose || Symbol["for"]("Symbol.asyncDispose")];
+			if (void 0 === o && (o = e[Symbol.dispose || Symbol["for"]("Symbol.dispose")], r)) var t = o;
+			if ("function" != typeof o) throw new TypeError("Object is not disposable.");
+			t && (o = function o() {
+				try {
+					t.call(e);
+				} catch (r) {
+					return Promise.reject(r);
+				}
+			}), n.push({
+				v: e,
+				d: o,
+				a: r
+			});
+		} else r && n.push({
+			d: e,
+			a: r
+		});
+		return e;
+	}
+	return {
+		e,
+		u: using.bind(null, !1),
+		a: using.bind(null, !0),
+		d: function d() {
+			var o, t = this.e, s = 0;
+			function next() {
+				for (; o = n.pop();) try {
+					if (!o.a && 1 === s) return s = 0, n.push(o), Promise.resolve().then(next);
+					if (o.d) {
+						var r = o.d.call(o.v);
+						if (o.a) return s |= 2, Promise.resolve(r).then(next, err);
+					} else s |= 1;
+				} catch (r) {
+					return err(r);
+				}
+				if (1 === s) return t !== e ? Promise.reject(t) : Promise.resolve();
+				if (t !== e) throw t;
+			}
+			function err(n) {
+				return t = t !== e ? new r(n, t) : n, next();
+			}
+			return next();
+		}
+	};
+}
+//#endregion
+//#region src/edge-ws-connection.ts
+var __dxlog_file$5 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-ws-connection.ts";
+var SIGNAL_KEEPALIVE_INTERVAL = 4e3;
+var SIGNAL_KEEPALIVE_TIMEOUT = 12e3;
+/**
+* Watchdog self-check: if the inactivity timer fires later than its schedule by more than this,
+* the local event loop was starved (heavy WASM sync compute pins it for seconds at a time) —
+* our pings were not being sent and inbound pongs were not being processed, so the silence says
+* nothing about the connection. Probe and re-arm instead of restarting.
+*/
+var KEEPALIVE_WATCHDOG_LATE_TOLERANCE = 3e3;
+var EdgeWsConnection = class extends Resource {
+	_identity;
+	_connectionInfo;
+	_callbacks;
+	_inactivityTimeoutCtx;
+	_ws;
+	_wsMuxer;
+	_lastReceivedMessageTimestamp = Date.now();
+	_openTimestamp;
+	_pingTimestamp;
+	_lastPingSentTimestamp = 0;
+	_rtt = 0;
+	_uploadRate = 0;
+	_downloadRate = 0;
+	_rateWindow = 1e4;
+	_rateUpdateInterval = 1e3;
+	_bytesSamples = [];
+	_messagesSent = 0;
+	_messagesReceived = 0;
+	/**
+	* WebSocket frames arrive in order, but converting frame data to bytes is async
+	* (the `Blob` fallback path awaits `blob.arrayBuffer()`), and concurrent conversions
+	* are not guaranteed to complete in arrival order. Segmented-message reassembly in
+	* `WebSocketMuxer` requires chunks to reach `receiveData` in arrival order, so message
+	* processing is serialized through this lock.
+	*/
+	_receiveMutex = new Mutex();
+	constructor(_identity, _connectionInfo, _callbacks) {
+		super();
+		this._identity = _identity;
+		this._connectionInfo = _connectionInfo;
+		this._callbacks = _callbacks;
+	}
+	get info() {
+		return {
+			open: this.isOpen,
+			identity: this._identity.identityDid,
+			device: this._identity.peerKey
+		};
+	}
+	get rtt() {
+		return this._rtt;
+	}
+	get uptime() {
+		return this._openTimestamp ? (Date.now() - this._openTimestamp) / 1e3 : 0;
+	}
+	get uploadRate() {
+		return this._uploadRate;
+	}
+	get downloadRate() {
+		return this._downloadRate;
+	}
+	get messagesSent() {
+		return this._messagesSent;
+	}
+	get messagesReceived() {
+		return this._messagesReceived;
+	}
+	send(message) {
+		invariant(this._ws, void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$5,
+			L: 110,
+			S: this,
+			A: ["this._ws", ""]
+		});
+		invariant(this._wsMuxer, void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$5,
+			L: 111,
+			S: this,
+			A: ["this._wsMuxer", ""]
+		});
+		log("sending...", {
+			peerKey: this._identity.peerKey,
+			payload: protocol.getPayloadType(message)
+		}, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$5,
+			L: 112,
+			S: this
+		});
+		this._messagesSent++;
+		if (this._ws?.protocol.includes(EdgeWebsocketProtocol.V0)) {
+			const binary = buf.toBinary(MessageSchema, message);
+			if (binary.length > 1e6) {
+				log.error("Message dropped because it was too large (>1MB).", {
+					byteLength: binary.byteLength,
+					serviceId: message.serviceId,
+					payload: protocol.getPayloadType(message)
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$5,
+					L: 117,
+					S: this
+				});
+				return;
+			}
+			this._recordBytes(binary.byteLength, 0);
+			this._ws.send(binary);
+		} else {
+			const binary = buf.toBinary(MessageSchema, message);
+			this._recordBytes(binary.byteLength, 0);
+			this._wsMuxer.send(message).catch((e) => log.catch(e, void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$5,
+				L: 130,
+				S: this
+			}));
+		}
+	}
+	async _open() {
+		const baseProtocols = [...Object.values(EdgeWebsocketProtocol)];
+		this._ws = new WebSocket(this._connectionInfo.url.toString(), this._connectionInfo.protocolHeader ? [...baseProtocols, this._connectionInfo.protocolHeader] : [...baseProtocols], this._connectionInfo.headers ? { headers: this._connectionInfo.headers } : void 0);
+		this._ws.binaryType = "arraybuffer";
+		const muxer = new WebSocketMuxer(this._ws);
+		this._wsMuxer = muxer;
+		this._ws.onopen = () => {
+			if (this.isOpen) {
+				log("connected", void 0, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$5,
+					L: 152,
+					S: this
+				});
+				this._openTimestamp = Date.now();
+				this._callbacks.onConnected();
+				this._scheduleHeartbeats();
+				this._scheduleRateCalculation();
+			} else log.verbose("connected after becoming inactive", { currentIdentity: this._identity }, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$5,
+				L: 158,
+				S: this
+			});
+		};
+		this._ws.onclose = (event) => {
+			if (this.isOpen) {
+				log.warn("server disconnected", {
+					code: event.code,
+					reason: event.reason
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$5,
+					L: 163,
+					S: this
+				});
+				this._callbacks.onRestartRequired();
+				muxer.destroy();
+			}
+		};
+		this._ws.onerror = (event) => {
+			if (this.isOpen) {
+				log.warn("edge connection socket error", {
+					error: event.error,
+					info: event.message
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$5,
+					L: 170,
+					S: this
+				});
+				this._callbacks.onRestartRequired();
+			} else log.verbose("error ignored on closed connection", { error: event.error }, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$5,
+				L: 173,
+				S: this
+			});
+		};
+		/**
+		* https://developer.mozilla.org/en-US/docs/Web/API/MessageEvent/data
+		*/
+		this._ws.onmessage = (event) => {
+			if (!this.isOpen) {
+				log.verbose("message ignored on closed connection", { event: event.type }, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$5,
+					L: 181,
+					S: this
+				});
+				return;
+			}
+			this._lastReceivedMessageTimestamp = Date.now();
+			if (event.data === "__pong__") {
+				if (this._pingTimestamp) {
+					this._rtt = Date.now() - this._pingTimestamp;
+					this._pingTimestamp = void 0;
+				}
+				this._rescheduleHeartbeatTimeout();
+				return;
+			}
+			this._receiveMessage(event.data, muxer).catch((err) => log.catch(err, void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$5,
+				L: 197,
+				S: this
+			}));
+		};
+	}
+	async _receiveMessage(data, muxer) {
+		try {
+			var _usingCtx$1 = _usingCtx();
+			_usingCtx$1.u(await this._receiveMutex.acquire());
+			const bytes = await toUint8Array(data);
+			this._recordBytes(0, bytes.byteLength);
+			if (!this.isOpen) return;
+			this._messagesReceived++;
+			const message = this._ws?.protocol?.includes(EdgeWebsocketProtocol.V0) ? buf.fromBinary(MessageSchema, bytes) : muxer.receiveData(bytes);
+			if (message) {
+				log("received", {
+					from: message.source,
+					payload: protocol.getPayloadType(message)
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$5,
+					L: 219,
+					S: this
+				});
+				this._callbacks.onMessage(message);
+			}
+		} catch (_) {
+			_usingCtx$1.e = _;
+		} finally {
+			_usingCtx$1.d();
+		}
+	}
+	async _close() {
+		this._inactivityTimeoutCtx?.dispose().catch(() => {});
+		try {
+			this._ws?.close();
+			this._ws = void 0;
+			this._wsMuxer?.destroy();
+			this._wsMuxer = void 0;
+		} catch (err) {
+			if (err instanceof Error && err.message.includes("WebSocket is closed before the connection is established.")) return;
+			log.warn("error closing websocket", { err }, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$5,
+				L: 236,
+				S: this
+			});
+		}
+	}
+	_scheduleHeartbeats() {
+		invariant(this._ws, void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$5,
+			L: 241,
+			S: this,
+			A: ["this._ws", ""]
+		});
+		scheduleTaskInterval(this._ctx, async () => {
+			this._sendPing();
+		}, SIGNAL_KEEPALIVE_INTERVAL);
+		this._sendPing();
+		this._rescheduleHeartbeatTimeout();
+	}
+	_sendPing() {
+		if (!this._ws) return;
+		this._pingTimestamp = Date.now();
+		this._lastPingSentTimestamp = Date.now();
+		this._ws.send("__ping__");
+	}
+	/**
+	* Inactivity watchdog. Restarts the connection only after a fair trial: pings were actually
+	* flowing (a recent send), the timer fired on schedule (the local event loop was alive to
+	* process an answer), and still nothing was received for the full window. Wall-clock silence
+	* alone is not evidence — sync compute can pin the event loop for seconds, during which the
+	* ping sender does not run and arrived pongs are not processed; restarting a healthy
+	* connection on that basis costs a re-handshake and fails in-flight sync rounds.
+	*/
+	_rescheduleHeartbeatTimeout() {
+		if (!this.isOpen) return;
+		this._inactivityTimeoutCtx?.dispose();
+		this._inactivityTimeoutCtx = new Context(void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$5,
+			L: 277
+		});
+		const armedAt = Date.now();
+		scheduleTask(this._inactivityTimeoutCtx, () => {
+			if (!this.isOpen) return;
+			const now = Date.now();
+			const silenceMs = now - this._lastReceivedMessageTimestamp;
+			if (silenceMs <= SIGNAL_KEEPALIVE_TIMEOUT) {
+				this._rescheduleHeartbeatTimeout();
+				return;
+			}
+			const pingAgeMs = this._lastPingSentTimestamp ? now - this._lastPingSentTimestamp : Number.POSITIVE_INFINITY;
+			const firedLateByMs = now - armedAt - SIGNAL_KEEPALIVE_TIMEOUT;
+			if (pingAgeMs <= SIGNAL_KEEPALIVE_INTERVAL * 2 && firedLateByMs < KEEPALIVE_WATCHDOG_LATE_TOLERANCE) {
+				log.warn("restart due to inactivity timeout", {
+					silenceMs,
+					pingAgeMs,
+					lastReceivedMessageTimestamp: this._lastReceivedMessageTimestamp
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$5,
+					L: 296,
+					S: this
+				});
+				this._callbacks.onRestartRequired();
+				return;
+			}
+			log.verbose("keepalive starved by event loop; probing instead of restarting", {
+				silenceMs,
+				pingAgeMs,
+				firedLateByMs
+			}, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$5,
+				L: 306,
+				S: this
+			});
+			this._sendPing();
+			this._rescheduleHeartbeatTimeout();
+		}, SIGNAL_KEEPALIVE_TIMEOUT);
+	}
+	_recordBytes(sent, received) {
+		const now = Date.now();
+		const currentSecond = Math.floor(now / 1e3) * 1e3;
+		const existingSample = this._bytesSamples.find((s) => Math.floor(s.timestamp / 1e3) * 1e3 === currentSecond);
+		if (existingSample) {
+			existingSample.sent += sent;
+			existingSample.received += received;
+		} else this._bytesSamples.push({
+			timestamp: now,
+			sent,
+			received
+		});
+	}
+	_scheduleRateCalculation() {
+		scheduleTaskInterval(this._ctx, async () => {
+			this._calculateRates();
+		}, this._rateUpdateInterval);
+		this._calculateRates();
+	}
+	_calculateRates() {
+		const now = Date.now();
+		const cutoff = now - this._rateWindow;
+		this._bytesSamples = this._bytesSamples.filter((s) => s.timestamp > cutoff);
+		if (this._bytesSamples.length === 0) {
+			this._uploadRate = 0;
+			this._downloadRate = 0;
+			return;
+		}
+		let totalSent = 0;
+		let totalReceived = 0;
+		const timeSpan = (now - Math.min(...this._bytesSamples.map((s) => s.timestamp))) / 1e3;
+		for (const sample of this._bytesSamples) {
+			totalSent += sample.sent;
+			totalReceived += sample.received;
+		}
+		this._uploadRate = timeSpan > 0 ? Math.round(totalSent / timeSpan) : 0;
+		this._downloadRate = timeSpan > 0 ? Math.round(totalReceived / timeSpan) : 0;
+	}
+};
+__decorate([logInfo], EdgeWsConnection.prototype, "info", null);
+//#endregion
+//#region src/errors.ts
+var EdgeConnectionClosedError = class extends Error {
+	constructor() {
+		super("Edge connection closed.");
+	}
+};
+var EdgeIdentityChangedError = class extends Error {
+	constructor() {
+		super("Edge identity changed.");
+	}
+};
+//#endregion
+//#region src/utils.ts
+var getEdgeUrlWithProtocol = (baseUrl, protocol) => {
+	const isSecure = baseUrl.startsWith("https") || baseUrl.startsWith("wss");
+	const url = new URL(baseUrl);
+	url.protocol = protocol + (isSecure ? "s" : "");
+	return url.toString();
+};
+//#endregion
+//#region src/edge-client.ts
+var __dxlog_file$4 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-client.ts";
+var DEFAULT_TIMEOUT = 1e4;
+var STATUS_REFRESH_INTERVAL = 1e3;
+/**
+* Effect service tag for {@link EdgeConnection}.
+*/
+var EdgeConnectionService = class extends EffectContext.Tag("@dxos/edge-client/EdgeConnection")() {};
+/**
+* Messenger client for EDGE:
+*  - While open, uses PersistentLifecycle to keep an open EdgeWsConnection, reconnecting on failures.
+*  - Manages identity and re-create EdgeWsConnection when identity changes.
+*  - Dispatches connection state and message notifications.
+*/
+var EdgeClient = class extends Resource {
+	_identity;
+	_config;
+	statusChanged = new Event();
+	_persistentLifecycle = new PersistentLifecycle({
+		start: async () => this._connect(),
+		stop: async (state) => this._disconnect(state)
+	});
+	_messageListeners = /* @__PURE__ */ new Set();
+	_reconnectListeners = /* @__PURE__ */ new Set();
+	_baseWsUrl;
+	_baseHttpUrl;
+	_currentConnection = void 0;
+	_ready = new Trigger();
+	constructor(_identity, _config) {
+		super();
+		this._identity = _identity;
+		this._config = _config;
+		this._baseWsUrl = getEdgeUrlWithProtocol(_config.socketEndpoint, "ws");
+		this._baseHttpUrl = getEdgeUrlWithProtocol(_config.socketEndpoint, "http");
+	}
+	get info() {
+		return {
+			open: this.isOpen,
+			status: this.status,
+			identity: this._identity.identityDid,
+			device: this._identity.peerKey
+		};
+	}
+	get status() {
+		return {
+			state: Boolean(this._currentConnection) && this._ready.state === TriggerState.RESOLVED ? EdgeStatus.ConnectionState.CONNECTED : EdgeStatus.ConnectionState.NOT_CONNECTED,
+			uptime: this._currentConnection?.uptime ?? 0,
+			rtt: this._currentConnection?.rtt ?? 0,
+			rateBytesUp: this._currentConnection?.uploadRate ?? 0,
+			rateBytesDown: this._currentConnection?.downloadRate ?? 0,
+			messagesSent: this._currentConnection?.messagesSent ?? 0,
+			messagesReceived: this._currentConnection?.messagesReceived ?? 0
+		};
+	}
+	get identityDid() {
+		return this._identity.identityDid;
+	}
+	get peerKey() {
+		return this._identity.peerKey;
+	}
+	setIdentity(identity) {
+		if (identity.identityDid !== this._identity.identityDid || identity.peerKey !== this._identity.peerKey) {
+			log("Edge identity changed", {
+				identity,
+				oldIdentity: this._identity
+			}, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 140,
+				S: this
+			});
+			this._identity = identity;
+			this._closeCurrentConnection(new EdgeIdentityChangedError());
+			this._persistentLifecycle.scheduleRestart();
+		}
+	}
+	/**
+	* Send message.
+	* NOTE: The message is guaranteed to be delivered but the service must respond with a message to confirm processing.
+	*/
+	async send(ctx, message) {
+		if (this._ready.state !== TriggerState.RESOLVED) {
+			log("waiting for websocket", void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 153,
+				S: this
+			});
+			await this._ready.wait({ timeout: this._config.timeout ?? DEFAULT_TIMEOUT });
+		}
+		if (!this._currentConnection) throw new EdgeConnectionClosedError();
+		if (message.source && (message.source.peerKey !== this._identity.peerKey || message.source.identityDid !== this.identityDid)) throw new EdgeIdentityChangedError();
+		const traceCtx = ctx.getAttribute(TRACE_SPAN_ATTRIBUTE);
+		if (traceCtx) message.traceContext = {
+			$typeName: "dxos.edge.messenger.TraceContext",
+			traceparent: traceCtx.traceparent,
+			tracestate: traceCtx.tracestate
+		};
+		this._currentConnection.send(message);
+	}
+	onMessage(listener) {
+		this._messageListeners.add(listener);
+		return () => this._messageListeners.delete(listener);
+	}
+	onReconnected(listener, opts) {
+		this._reconnectListeners.add(listener);
+		if ((opts?.emitCurrentState ?? true) && this._ready.state === TriggerState.RESOLVED) scheduleMicroTask(this._ctx, () => {
+			if (this._reconnectListeners.has(listener)) try {
+				listener();
+			} catch (error) {
+				log.catch(error, void 0, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$4,
+					L: 196,
+					S: this
+				});
+			}
+		});
+		return () => this._reconnectListeners.delete(listener);
+	}
+	/**
+	* Open connection to messaging service.
+	*/
+	async _open() {
+		log("opening...", { info: this.info }, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 209,
+			S: this
+		});
+		this._persistentLifecycle.open().catch((err) => {
+			log.warn("Error while opening connection", { err }, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 211,
+				S: this
+			});
+		});
+		scheduleTaskInterval(this._ctx, async () => {
+			if (!this._currentConnection) return;
+			this.statusChanged.emit(this.status);
+		}, STATUS_REFRESH_INTERVAL);
+	}
+	/**
+	* Close connection and free resources.
+	*/
+	async _close() {
+		log("closing...", { peerKey: this._identity.peerKey }, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 231,
+			S: this
+		});
+		this._closeCurrentConnection();
+		await this._persistentLifecycle.close();
+	}
+	async _connect() {
+		if (this._ctx.disposed) return;
+		const identity = this._identity;
+		const path = `/ws/${identity.identityDid}/${identity.peerKey}`;
+		const protocolHeader = this._config.disableAuth ? void 0 : await this._createAuthHeader(path);
+		if (this._identity !== identity) {
+			log("identity changed during auth header request", void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 245,
+				S: this
+			});
+			return;
+		}
+		const restartRequired = new Trigger();
+		const url = new URL(path, this._baseWsUrl);
+		log("Opening websocket", {
+			url: url.toString(),
+			protocolHeader
+		}, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 251,
+			S: this
+		});
+		const connection = new EdgeWsConnection(identity, {
+			url,
+			protocolHeader,
+			headers: this._config.clientTag ? { "X-DXOS-Client-Tag": this._config.clientTag } : void 0
+		}, {
+			onConnected: () => {
+				if (this._isActive(connection)) {
+					this._ready.wake();
+					this._notifyReconnected();
+				} else log.verbose("connected callback ignored, because connection is not active", void 0, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$4,
+					L: 265,
+					S: this
+				});
+			},
+			onRestartRequired: () => {
+				if (this._isActive(connection)) {
+					this._closeCurrentConnection();
+					this._persistentLifecycle.scheduleRestart();
+				} else log.verbose("restart requested by inactive connection", void 0, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$4,
+					L: 273,
+					S: this
+				});
+				restartRequired.wake();
+			},
+			onMessage: (message) => {
+				if (this._isActive(connection)) this._notifyMessageReceived(message);
+				else log.verbose("ignored a message on inactive connection", {
+					from: message.source,
+					type: message.payload?.typeUrl
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$4,
+					L: 281,
+					S: this
+				});
+			}
+		});
+		this._currentConnection = connection;
+		await connection.open();
+		if (!await Promise.race([this._ready.wait({ timeout: this._config.timeout ?? DEFAULT_TIMEOUT }).then(() => true, () => false), restartRequired.wait().then(() => false)])) throw new EdgeConnectionClosedError();
+		return connection;
+	}
+	async _disconnect(state) {
+		await state.close();
+		this.statusChanged.emit(this.status);
+	}
+	_closeCurrentConnection(error = new EdgeConnectionClosedError()) {
+		this._currentConnection = void 0;
+		this._ready.throw(error);
+		this._ready.reset();
+		this.statusChanged.emit(this.status);
+	}
+	_notifyReconnected() {
+		this.statusChanged.emit(this.status);
+		for (const listener of this._reconnectListeners) try {
+			listener();
+		} catch (err) {
+			log.error("ws reconnect listener failed", { err }, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 330,
+				S: this
+			});
+		}
+	}
+	_notifyMessageReceived(message) {
+		for (const listener of this._messageListeners) try {
+			listener(message);
+		} catch (err) {
+			log.error("ws incoming message processing failed", {
+				err,
+				payload: protocol.getPayloadType(message)
+			}, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 340,
+				S: this
+			});
+		}
+	}
+	async _createAuthHeader(path) {
+		const httpUrl = new URL(path, this._baseHttpUrl);
+		httpUrl.protocol = getEdgeUrlWithProtocol(this._baseWsUrl.toString(), "http");
+		const response = await fetch(httpUrl, { method: "GET" });
+		if (response.status === 401) return encodePresentationWsAuthHeader(await handleAuthChallenge(response, this._identity));
+		else {
+			log.warn("no auth challenge from edge", {
+				status: response.status,
+				statusText: response.statusText
+			}, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 352,
+				S: this
+			});
+			return;
+		}
+	}
+	_isActive = (connection) => connection === this._currentConnection;
+};
+__decorate([logInfo], EdgeClient.prototype, "info", null);
+var encodePresentationWsAuthHeader = (encodedPresentation) => {
+	return `base64url.bearer.authorization.dxos.org.${Buffer.from(encodedPresentation).toString("base64").replace(/=*$/, "").replaceAll("/", "|")}`;
+};
+//#endregion
+//#region src/http-client.ts
+var __dxlog_file$3 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/http-client.ts";
+var HttpConfig = class HttpConfig extends EffectContext.Tag("HttpConfig")() {
+	static default = Layer.succeed(HttpConfig, {
+		timeout: Duration.millis(1e3),
+		retryTimes: 3,
+		retryBaseDelay: Duration.millis(1e3)
+	});
+};
+var withRetry = (effect, { timeout = Duration.millis(1e3), retryBaseDelay = Duration.millis(1e3), retryTimes = 3 } = {}) => {
+	return effect.pipe(Effect.flatMap((res) => res.status === 500 ? Effect.fail(new Error(res.status.toString())) : res.json), Effect.timeout(timeout), Effect.retry({
+		schedule: Schedule.exponential(retryBaseDelay).pipe(Schedule.jittered),
+		times: retryTimes
+	}));
+};
+var withRetryConfig = (effect) => Effect.gen(function* () {
+	return yield* withRetry(effect, yield* HttpConfig);
+});
+var withLogging = (effect) => effect.pipe(Effect.tap((res) => {
+	log.info("response", { status: res.status }, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$3,
+		L: 66,
+		S: void 0
+	});
+}));
+/**
+*
+*/
+var encodeAuthHeader = (challenge) => {
+	return `VerifiablePresentation pb;base64,${Buffer.from(challenge).toString("base64")}`;
+};
+//#endregion
+//#region src/base-http-client.ts
+var __dxlog_file$2 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/base-http-client.ts";
+var DEFAULT_RETRY_TIMEOUT = 1500;
+var DEFAULT_RETRY_JITTER = 500;
+var DEFAULT_MAX_RETRIES_COUNT = 3;
+var WARNING_BODY_SIZE = 10 * 1024 * 1024;
+var BaseHttpClient = class {
+	_baseUrl;
+	_clientTag;
+	_edgeIdentity;
+	/** Auth header cached until next 401. */
+	_authHeader;
+	constructor(baseUrl, options) {
+		this._baseUrl = getEdgeUrlWithProtocol(baseUrl, "http");
+		this._clientTag = options?.clientTag;
+		log("created", { url: this._baseUrl }, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$2,
+			L: 74,
+			S: this
+		});
+	}
+	get baseUrl() {
+		return this._baseUrl;
+	}
+	setIdentity(identity) {
+		if (this._edgeIdentity?.identityDid !== identity.identityDid || this._edgeIdentity?.peerKey !== identity.peerKey) {
+			this._edgeIdentity = identity;
+			this._authHeader = void 0;
+		}
+	}
+	async _call(ctx, url, args) {
+		const shouldRetry = createRetryHandler(args);
+		log("fetch", {
+			url,
+			hasBody: args.body !== void 0,
+			bodySize: typeof args.body === "string" ? args.body.length : void 0
+		}, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$2,
+			L: 91,
+			S: this
+		});
+		const traceHeaders = getTraceHeaders(ctx);
+		let handledAuth = false;
+		const tryCount = 1;
+		while (true) {
+			let processingError = void 0;
+			try {
+				if (!this._authHeader && args.auth) {
+					const response = await fetch(new URL("/auth", this._baseUrl));
+					if (response.status === 401) this._authHeader = await this._handleUnauthorized(response);
+				}
+				const request = createRequest(args, this._authHeader, traceHeaders, this._clientTag);
+				log("call", {
+					url,
+					tryCount,
+					authHeader: !!this._authHeader
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$2,
+					L: 112,
+					S: this
+				});
+				const response = await fetch(url, request);
+				if (response.ok) {
+					const contentType = response.headers.get("Content-Type") ?? "";
+					if (response.status === 204 || response.headers.get("Content-Length") === "0" || !contentType.includes("application/json")) return;
+					const body = await response.clone().json();
+					if (typeof body !== "object" || body === null) return body;
+					if (!("success" in body)) return body;
+					if (body.success) return body.data;
+				} else if (response.status === 401 && response.headers.get("WWW-Authenticate") !== null && !handledAuth) {
+					this._authHeader = await this._handleUnauthorized(response);
+					handledAuth = true;
+					continue;
+				}
+				const body = (response.headers.get("Content-Type") ?? "").startsWith("application/json") ? await response.clone().json() : void 0;
+				invariant(!body?.success, "Expected body to not be a failure response or undefined.", {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$2,
+					L: 148,
+					S: this,
+					A: ["!body?.success", "'Expected body to not be a failure response or undefined.'"]
+				});
+				if (body?.data?.type === "auth_challenge" && typeof body?.data?.challenge === "string") processingError = new EdgeAuthChallengeError(body.data.challenge, body.data);
+				else if (body?.success === false) processingError = EdgeCallFailedError.fromUnsuccessfulResponse(response, body);
+				else {
+					invariant(!response.ok, "Expected response to not be ok.", {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file$2,
+						L: 155,
+						S: this,
+						A: ["!response.ok", "'Expected response to not be ok.'"]
+					});
+					processingError = await EdgeCallFailedError.fromHttpFailure(response);
+				}
+			} catch (error) {
+				processingError = EdgeCallFailedError.fromProcessingFailureCause(error);
+			}
+			if (processingError?.isRetryable && await shouldRetry(ctx, processingError.retryAfterMs)) log.verbose("retrying request", {
+				url,
+				processingError
+			}, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$2,
+				L: 163,
+				S: this
+			});
+			else throw processingError;
+		}
+	}
+	/**
+	* Like {@link _call} but returns the raw `Response` instead of parsing a JSON envelope — for
+	* endpoints with binary or absent response bodies (e.g. blob storage). A 404 is returned to the
+	* caller rather than thrown, since "not found" is an expected outcome for lookups; all other
+	* non-ok, non-retryable statuses throw `EdgeCallFailedError`, mirroring `_call`.
+	*
+	* NOTE: Duplicates `_call`'s auth/retry loop rather than sharing it, to avoid touching `_call`'s
+	* broadly-depended-on JSON-envelope behavior. `EdgeHttpClient.anthropicAiRequest`'s separate
+	* duplicate loop is a follow-up candidate for consolidating onto this method.
+	*/
+	async _callRaw(ctx, url, args) {
+		const shouldRetry = createRetryHandler(args);
+		log("fetch", {
+			url,
+			hasBody: args.body !== void 0
+		}, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$2,
+			L: 182,
+			S: this
+		});
+		const traceHeaders = getTraceHeaders(ctx);
+		let handledAuth = false;
+		while (true) {
+			let processingError;
+			try {
+				if (!this._authHeader && args.auth) {
+					const response = await fetch(new URL("/auth", this._baseUrl));
+					if (response.status === 401) this._authHeader = await this._handleUnauthorized(response);
+				}
+				const headers = { ...args.headers };
+				if (this._authHeader) headers["Authorization"] = this._authHeader;
+				if (traceHeaders) Object.assign(headers, traceHeaders);
+				if (this._clientTag) headers[EDGE_CLIENT_TAG_HEADER] = this._clientTag;
+				const response = await fetch(url, {
+					method: args.method,
+					body: args.body,
+					headers
+				});
+				if (response.ok || response.status === 404) return response;
+				if (response.status === 401 && response.headers.get("WWW-Authenticate") !== null && !handledAuth) {
+					this._authHeader = await this._handleUnauthorized(response);
+					handledAuth = true;
+					continue;
+				}
+				processingError = await EdgeCallFailedError.fromHttpFailure(response);
+			} catch (error) {
+				processingError = EdgeCallFailedError.fromProcessingFailureCause(error);
+			}
+			if (processingError?.isRetryable && await shouldRetry(ctx, processingError.retryAfterMs)) log.verbose("retrying raw request", {
+				url,
+				processingError
+			}, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$2,
+				L: 226,
+				S: this
+			});
+			else throw processingError;
+		}
+	}
+	async _handleUnauthorized(response) {
+		if (!this._edgeIdentity) {
+			log.warn("unauthorized response received before identity was set", void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$2,
+				L: 235,
+				S: this
+			});
+			throw await EdgeCallFailedError.fromHttpFailure(response);
+		}
+		return encodeAuthHeader(await handleAuthChallenge(response, this._edgeIdentity));
+	}
+};
+var createRequest = ({ method, body, json = true }, authHeader, traceHeaders, clientTag) => {
+	let requestBody;
+	const headers = {};
+	if (json) {
+		requestBody = body === void 0 ? void 0 : JSON.stringify(body);
+		headers["Content-Type"] = "application/json";
+	} else requestBody = body;
+	if (typeof requestBody === "string" && requestBody.length > WARNING_BODY_SIZE) log.warn("Request with large body", { bodySize: requestBody.length }, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$2,
+		L: 260,
+		S: void 0
+	});
+	if (authHeader) headers["Authorization"] = authHeader;
+	if (traceHeaders) Object.assign(headers, traceHeaders);
+	if (clientTag) headers[EDGE_CLIENT_TAG_HEADER] = clientTag;
+	return {
+		method,
+		body: requestBody,
+		headers
+	};
+};
+var getTraceHeaders = (ctx) => {
+	const traceCtx = ctx.getAttribute(TRACE_SPAN_ATTRIBUTE);
+	if (!traceCtx) return;
+	const headers = { traceparent: traceCtx.traceparent };
+	if (traceCtx.tracestate) headers.tracestate = traceCtx.tracestate;
+	return headers;
+};
+/** @deprecated */
+var createRetryHandler = ({ retry }) => {
+	if (!retry || retry.count < 1) return async () => false;
+	let retries = 0;
+	const maxRetries = retry.count ?? DEFAULT_MAX_RETRIES_COUNT;
+	const baseTimeout = retry.timeout ?? DEFAULT_RETRY_TIMEOUT;
+	const jitter = retry.jitter ?? DEFAULT_RETRY_JITTER;
+	return async (ctx, retryAfter) => {
+		if (++retries > maxRetries || ctx.disposed) return false;
+		if (retryAfter) await sleep(retryAfter);
+		else await sleep(baseTimeout + Math.random() * jitter);
+		return true;
+	};
+};
+//#endregion
+//#region src/edge-ai-http-client.ts
+var __dxlog_file$1 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-ai-http-client.ts";
+/**
+* Thrown by {@link EdgeAiHttpClient} when an AI request carrying {@link BYOK_HEADER} is rejected
+* with 401/403 by the upstream provider — i.e. the user-supplied API key is invalid. Wrapped as
+* the `cause` of an `HttpClientError.ResponseError` so it flows through `@effect/ai`'s error
+* mapping; callers walk the cause chain (via {@link ByokError.is}) to render a useful message.
+*/
+var ByokError = class extends BaseError.extend("ByokError", "BYOK authentication failed") {
+	constructor(options) {
+		super({
+			context: {
+				status: options.status,
+				provider: options.provider
+			},
+			...options
+		});
+	}
+};
+/**
+* Thrown by {@link EdgeAiHttpClient} when EDGE rejects an AI request with 429 because the
+* authenticated profile exceeded a metering limit. Wrapped as the `cause` of an
+* {@link HttpClientError.ResponseError} so it survives `@effect/ai`'s error mapping.
+*/
+var UsageQuotaExceededError = class extends BaseError.extend("UsageQuotaExceededError", "Usage quota exceeded") {};
+/**
+* Copy pasted from https://github.com/Effect-TS/effect/blob/main/packages/platform/src/internal/fetchHttpClient.ts
+*/
+var requestInitTagKey = "@effect/platform/FetchHttpClient/FetchOptions";
+var isUserDefinedAnthropicTool = (tool) => tool.input_schema != null && typeof tool.input_schema === "object";
+/**
+* Enables Anthropic fine-grained tool input streaming for client-defined tools.
+* Provider tools (bash, web_search, etc.) are left unchanged.
+*/
+var patchAnthropicMessagesRequestBody = (body) => {
+	if (body == null) return body;
+	const decodeBody = () => {
+		if (typeof body === "string") return body;
+		if (body instanceof Uint8Array) return new TextDecoder().decode(body);
+	};
+	const text = decodeBody();
+	if (text == null) return body;
+	try {
+		const payload = JSON.parse(text);
+		if (!Array.isArray(payload.tools)) return body;
+		payload.tools = payload.tools.map((tool) => isUserDefinedAnthropicTool(tool) ? {
+			...tool,
+			eager_input_streaming: true
+		} : tool);
+		const patched = JSON.stringify(payload);
+		return typeof body === "string" ? patched : new TextEncoder().encode(patched);
+	} catch {
+		return body;
+	}
+};
+var readStreamBody = (stream) => Effect.promise(async () => {
+	return await new Response(stream).text();
+});
+/**
+* An `@effect/platform` {@link HttpClient.HttpClient} that routes requests through the
+* authenticated EDGE AI endpoint via {@link EdgeHttpClient.anthropicAiRequest}, instead of
+* fetching the AI service directly.
+*
+* Provide this layer in place of `FetchHttpClient.layer` when constructing an Anthropic client,
+* e.g. `AnthropicClient.layer({ apiUrl: 'http://edge' }).pipe(Layer.provide(EdgeAiHttpClient.layer(() => edgeClient)))`.
+* The `apiUrl` host is a sentinel; only the request path is forwarded (see `anthropicAiRequest`).
+*
+* Modeled on `FunctionsAiHttpClient` in `@dxos/functions`.
+*/
+var EdgeAiHttpClient = class EdgeAiHttpClient {
+	static make = (getClient) => HttpClient.make((request, url, signal, fiber) => {
+		const edgeClient = getClient();
+		const options = fiber.getFiberRef(FiberRef.currentContext).unsafeMap.get("@effect/platform/FetchHttpClient/FetchOptions") ?? {};
+		const headers = options.headers ? Headers$1.merge(Headers$1.fromInput(options.headers), request.headers) : request.headers;
+		const carriedByok = !!headers[BYOK_HEADER.toLowerCase()];
+		const send = (body) => Effect.tryPromise({
+			try: () => edgeClient.anthropicAiRequest(new Request(url, {
+				...options,
+				method: request.method,
+				headers,
+				body: patchAnthropicMessagesRequestBody(body),
+				signal
+			})),
+			catch: (cause) => {
+				log.error("Failed to fetch", { cause }, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$1,
+					L: 136,
+					S: this
+				});
+				return new HttpClientError.RequestError({
+					request,
+					reason: "Transport",
+					cause
+				});
+			}
+		}).pipe(Effect.flatMap((response) => {
+			const httpResponse = HttpClientResponse.fromWeb(request, response);
+			if (carriedByok && (response.status === 401 || response.status === 403)) return Effect.tryPromise({
+				try: () => response.clone().json(),
+				catch: () => void 0
+			}).pipe(Effect.orElseSucceed(() => void 0), Effect.flatMap((body) => Effect.fail(new HttpClientError.ResponseError({
+				request,
+				response: httpResponse,
+				reason: "StatusCode",
+				cause: new ByokError({
+					status: response.status,
+					provider: "anthropic.com",
+					message: body?.error?.message ?? "Authentication failed"
+				})
+			}))));
+			if (!carriedByok && response.status === 429) return Effect.tryPromise({
+				try: () => response.clone().json(),
+				catch: () => void 0
+			}).pipe(Effect.orElseSucceed(() => void 0), Effect.flatMap((body) => Effect.fail(new HttpClientError.ResponseError({
+				request,
+				response: httpResponse,
+				reason: "StatusCode",
+				cause: new UsageQuotaExceededError({ message: body?.error?.message })
+			}))));
+			return Effect.succeed(httpResponse);
+		}));
+		switch (request.body._tag) {
+			case "Raw":
+			case "Uint8Array": return send(request.body.body);
+			case "FormData": return send(request.body.formData);
+			case "Stream": return Stream.toReadableStreamEffect(request.body.stream).pipe(Effect.flatMap((readable) => readStreamBody(readable)), Effect.flatMap((text) => send(text)));
+		}
+		return send(void 0);
+	});
+	static layer = (getClient) => Layer.succeed(HttpClient.HttpClient, EdgeAiHttpClient.make(getClient));
+};
+//#endregion
+//#region src/edge-http-client.ts
+var __dxlog_file = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-http-client.ts";
+var EdgeHttpClientService = class extends EffectContext.Tag("@dxos/edge-client/EdgeHttpClient")() {};
+/**
+* HTTP client for the edge worker API (spaces, queues, functions, agents, etc.).
+*
+* Hub-service API (accounts, invitations) lives in {@link HubHttpClient} — the two
+* services run at different URLs and are never both available from the same base URL.
+*/
+var EdgeHttpClient = class extends BaseHttpClient {
+	constructor(baseUrl, options) {
+		super(baseUrl, options);
+		log("created", { url: this.baseUrl }, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file,
+			L: 143,
+			S: this
+		});
+	}
+	async getStatus(ctx, args) {
+		return this._call(ctx, new URL("/status", this.baseUrl), {
+			...args,
+			method: "GET",
+			auth: true
+		});
+	}
+	createAgent(ctx, body, args) {
+		return this._call(ctx, new URL("/agents/create", this.baseUrl), {
+			...args,
+			method: "POST",
+			body
+		});
+	}
+	getAgentStatus(ctx, request, args) {
+		return this._call(ctx, new URL(`/users/${request.ownerIdentityDid}/agent/status`, this.baseUrl), {
+			...args,
+			method: "GET"
+		});
+	}
+	getCredentialsForNotarization(ctx, spaceId, args) {
+		return this._call(ctx, new URL(`/spaces/${spaceId}/notarization`, this.baseUrl), {
+			...args,
+			method: "GET"
+		});
+	}
+	async notarizeCredentials(ctx, spaceId, body, args) {
+		await this._call(ctx, new URL(`/spaces/${spaceId}/notarization`, this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async recoverIdentity(ctx, body, args) {
+		return this._call(ctx, new URL("/identity/recover", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async joinSpaceByInvitation(ctx, spaceId, body, args) {
+		return this._call(ctx, new URL(`/spaces/${spaceId}/join`, this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async initiateOAuthFlow(ctx, body, args) {
+		return this._call(ctx, new URL("/oauth/initiate", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async completeOAuthRegistration(ctx, body, args) {
+		return this._call(ctx, new URL("/oauth/registration/complete", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	/**
+	* Resolves the live access token behind a `MANAGED_ACCESS_TOKEN` placeholder. Authorized by the
+	* caller's presentation: EDGE serves it only to members of the owning space.
+	*/
+	async getAccessToken(ctx, body, args) {
+		return this._call(ctx, new URL("/oauth/token", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async createSpace(ctx, body, args) {
+		return this._call(ctx, new URL("/spaces/create", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async queryQueue(ctx, subspaceTag, spaceId, query, args) {
+		const queueId = query.feedIds?.[0];
+		invariant(queueId, "queueId required", {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file,
+			L: 275,
+			S: this,
+			A: ["queueId", "'queueId required'"]
+		});
+		return this._call(ctx, createUrl(new URL(`/spaces/${subspaceTag}/${spaceId}/queue/${queueId}/query`, this.baseUrl), {
+			after: query.after,
+			before: query.before,
+			limit: query.limit,
+			reverse: query.reverse,
+			objectIds: query.objectIds?.join(",")
+		}), {
+			...args,
+			method: "GET"
+		});
+	}
+	async insertIntoQueue(ctx, subspaceTag, spaceId, queueId, objects, args) {
+		return this._call(ctx, new URL(`/spaces/${subspaceTag}/${spaceId}/queue/${queueId}`, this.baseUrl), {
+			...args,
+			body: { objects },
+			method: "POST"
+		});
+	}
+	async deleteFromQueue(ctx, subspaceTag, spaceId, queueId, objectIds, args) {
+		return this._call(ctx, createUrl(new URL(`/spaces/${subspaceTag}/${spaceId}/queue/${queueId}`, this.baseUrl), { ids: objectIds.join(",") }), {
+			...args,
+			method: "DELETE"
+		});
+	}
+	/**
+	* Builds the URL for the blob stored under `key`. `key` is URL-encoded for defense in depth —
+	* callers pass a lowercase hex SHA-256 digest (extracted from an `ni:` URI by the edge backend).
+	*/
+	getBlobUrl(key) {
+		return new URL(`/api/file/${encodeURIComponent(key)}`, this.baseUrl);
+	}
+	/**
+	* Uploads bytes to the edge blob service, keyed by content hash. Pre-fetches `/auth` (`auth:
+	* true`) so large bodies aren't sent twice on an auth challenge.
+	*/
+	async putBlob(ctx, key, data, args) {
+		const headers = {};
+		if (args?.contentType) headers["Content-Type"] = args.contentType;
+		await this._callRaw(ctx, this.getBlobUrl(key), {
+			retry: args?.retry,
+			auth: args?.auth ?? true,
+			method: "POST",
+			body: data,
+			headers
+		});
+	}
+	/**
+	* Downloads bytes previously stored with {@link putBlob}. Returns `undefined` if `key` is not
+	* found.
+	*/
+	async getBlob(ctx, key, args) {
+		const response = await this._callRaw(ctx, this.getBlobUrl(key), {
+			...args,
+			method: "GET"
+		});
+		if (response.status === 404) return;
+		return new Uint8Array(await response.arrayBuffer());
+	}
+	/**
+	* Checks whether bytes are stored under `key`, without downloading them.
+	*/
+	async hasBlob(ctx, key, args) {
+		return (await this._callRaw(ctx, this.getBlobUrl(key), {
+			...args,
+			method: "HEAD"
+		})).status !== 404;
+	}
+	/**
+	* Deletes bytes stored under `key`. Not called by any core `Blob.remove` path in v1 (deletion is
+	* deferred), provided for completeness.
+	*/
+	async deleteBlob(ctx, key, args) {
+		await this._callRaw(ctx, this.getBlobUrl(key), {
+			...args,
+			method: "DELETE"
+		});
+	}
+	async uploadFunction(ctx, pathParts, body, args) {
+		const formData = new FormData();
+		formData.append("name", body.name ?? "");
+		formData.append("version", body.version);
+		const ownerUri = this._edgeIdentity?.identityDid ?? body.ownerUri;
+		formData.append("ownerUri", ownerUri);
+		formData.append("entryPoint", body.entryPoint);
+		body.runtime && formData.append("runtime", body.runtime);
+		for (const [filename, content] of Object.entries(body.assets)) formData.append("assets", new Blob([content], { type: getFileMimeType(filename) }), filename);
+		const path = ["functions", ...pathParts.functionId ? [pathParts.functionId] : []].join("/");
+		return this._call(ctx, new URL(path, this.baseUrl), {
+			...args,
+			body: formData,
+			method: "PUT",
+			json: false
+		});
+	}
+	async listFunctions(ctx, args) {
+		return this._call(ctx, new URL("/functions", this.baseUrl), {
+			...args,
+			method: "GET"
+		});
+	}
+	async invokeFunction(ctx, params, input, args) {
+		const url = new URL(`/functions/${params.functionId}`, this.baseUrl);
+		if (params.version) url.searchParams.set("version", params.version);
+		if (params.spaceId) url.searchParams.set("spaceId", params.spaceId.toString());
+		if (params.cpuTimeLimit) url.searchParams.set("cpuTimeLimit", params.cpuTimeLimit.toString());
+		if (params.subrequestsLimit) url.searchParams.set("subrequestsLimit", params.subrequestsLimit.toString());
+		return this._call(ctx, url, {
+			...args,
+			body: input,
+			method: "POST"
+		});
+	}
+	async executeWorkflow(ctx, spaceId, graphId, input, args) {
+		return this._call(ctx, new URL(`/workflows/${spaceId}/${graphId}`, this.baseUrl), {
+			...args,
+			body: input,
+			method: "POST"
+		});
+	}
+	async getCronTriggers(ctx, spaceId) {
+		return this._call(ctx, new URL(`/functions/${spaceId}/triggers/crons`, this.baseUrl), { method: "GET" });
+	}
+	async getTriggersDispatcherStatus(ctx, spaceId, args) {
+		return this._call(ctx, new URL(`/triggers/${spaceId}/status`, this.baseUrl), {
+			...args,
+			method: "GET",
+			auth: true
+		});
+	}
+	async forceRunCronTrigger(ctx, spaceId, triggerId) {
+		return this._call(ctx, new URL(`/functions/${spaceId}/triggers/crons/${triggerId}/run`, this.baseUrl), { method: "POST" });
+	}
+	/**
+	* Cancels the current run of a cron trigger on the EDGE dispatcher — its in-flight execution and
+	* `runAgain` continuation chain. The trigger stays enabled, so its schedule keeps firing.
+	*/
+	async cancelTriggerRun(ctx, spaceId, triggerId) {
+		return this._call(ctx, new URL(`/functions/${spaceId}/triggers/crons/${triggerId}/cancel`, this.baseUrl), { method: "POST" });
+	}
+	/**
+	* Returns the full list of triggers registered on a space's EDGE dispatcher, with per-trigger
+	* runtime status. Polled by the remote trigger monitor to surface edge trigger state.
+	*
+	* TODO(edge): Proposed endpoint; not yet implemented server-side.
+	*/
+	async getSpaceTriggers(ctx, spaceId, args) {
+		return this._call(ctx, new URL(`/triggers/${spaceId}`, this.baseUrl), {
+			...args,
+			method: "GET",
+			auth: true
+		});
+	}
+	async execQuery(ctx, spaceId, body, args) {
+		return this._call(ctx, new URL(`/spaces/${spaceId}/exec-query`, this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async getRegistryPlugins(ctx, args) {
+		return this._call(ctx, new URL("/registry/plugins", this.baseUrl), {
+			...args,
+			method: "GET"
+		});
+	}
+	/**
+	* Uploads a built plugin bundle to the registry's R2-backed hosting. Authenticated
+	* with the caller's hub identity (verifiable presentation) — `setIdentity` must
+	* have been called. Returns the canonical `moduleUrl` (the hosted `manifest.json`).
+	*/
+	async uploadPluginBundle(ctx, request, args) {
+		return this._call(ctx, new URL("/registry/upload", this.baseUrl), {
+			body: request,
+			method: "POST",
+			auth: true,
+			...args
+		});
+	}
+	async importBundle(ctx, spaceId, body, args) {
+		return this._call(ctx, new URL(`/spaces/${spaceId}/import`, this.baseUrl), {
+			...args,
+			body,
+			method: "PUT"
+		});
+	}
+	async exportBundle(ctx, spaceId, body, args) {
+		return this._call(ctx, new URL(`/spaces/${spaceId}/export`, this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	/**
+	* Fetch through the edge proxy for third-party REST APIs.
+	* TEMPORARY: currently routes through legacy open proxy. See https://github.com/dxos/edge/pull/576.
+	*/
+	async proxyFetch(target, init = {}) {
+		return proxyFetchLegacy(target, init, this._clientTag);
+	}
+	/**
+	* Issue an authenticated request to the EDGE AI route (`/ai/generate/anthropic/*`), which
+	* proxies to the AI service. Used as the backend HTTP client for the Anthropic AI provider
+	* (see {@link EdgeAiHttpClient}).
+	*
+	* Returns the raw `Response` so streaming bodies are forwarded unchanged to `@effect/ai`.
+	* Requires an identity to have been set via {@link setIdentity}.
+	*/
+	async anthropicAiRequest(request) {
+		const incoming = new URL(request.url);
+		const base = this.baseUrl.replace(/\/$/, "");
+		const target = new URL(`${base}/ai/generate/anthropic${incoming.pathname}${incoming.search}`);
+		const method = request.method;
+		const body = method === "GET" || method === "HEAD" ? void 0 : await request.arrayBuffer();
+		let handledAuth = false;
+		while (true) {
+			if (!this._authHeader) {
+				const authResponse = await fetch(new URL("/auth", this.baseUrl));
+				if (authResponse.status === 401) this._authHeader = await this._handleUnauthorized(authResponse);
+			}
+			const headers = new Headers(request.headers);
+			if (this._authHeader) headers.set("Authorization", this._authHeader);
+			if (this._clientTag) headers.set(EDGE_CLIENT_TAG_HEADER, this._clientTag);
+			const response = await fetch(target, {
+				method,
+				headers,
+				body,
+				signal: request.signal
+			});
+			if (response.status === 401 && response.headers.get("WWW-Authenticate") !== null && !handledAuth) {
+				this._authHeader = await this._handleUnauthorized(response);
+				handledAuth = true;
+				continue;
+			}
+			return response;
+		}
+	}
+	async _fetch(url, _args) {
+		return Function.pipe(HttpClient.execute(HttpClientRequest.make(_args.method)(url.toString())), withLogging, withRetryConfig, Effect.provide(FetchHttpClient.layer), Effect.provide(HttpConfig.default), Effect.withSpan("EdgeHttpClient"), EffectEx.runAndForwardErrors);
+	}
+};
+var getFileMimeType = (filename) => [".js", ".mjs"].some((ext) => filename.endsWith(ext)) ? "application/javascript+module" : filename.endsWith(".wasm") ? "application/wasm" : "application/octet-stream";
+//#endregion
+//#region src/hub-http-client.ts
+/**
+* HTTP client for the hub-service API (accounts, invitations, email verification).
+*
+* Hub-service and the edge worker are separate Cloudflare Workers deployed at different
+* URLs (`DX_HUB_URL` vs `DX_EDGE_URL`). This client is never used to talk to the edge
+* worker, and vice versa — keep them separate.
+*
+* NOTE: Do NOT set `auth: true` on any call here. Hub-service has no `/auth` VP-challenge
+* endpoint (it has an admin login page that 302s and is not CORS-enabled). Auth is handled
+* via the regular request → 401 → WWW-Authenticate challenge → retry path.
+*/
+var HubHttpClient = class extends BaseHttpClient {
+	constructor(hubUrl, options) {
+		super(hubUrl, options);
+	}
+	async checkEmailExists(ctx, body, args) {
+		return this._call(ctx, new URL("/account/email/exists", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async validateInvitationCode(ctx, body, args) {
+		return this._call(ctx, new URL("/account/invitation-code/validate", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async redeemInvitationCode(ctx, body, args) {
+		return this._call(ctx, new URL("/account/invitation-code/redeem", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	/**
+	* Existing-account email login. Server inlines `token` for test emails; regular
+	* emails are delivered out-of-band. Response is identical for unknown emails
+	* (enumeration-safe).
+	*/
+	async login(ctx, body, args) {
+		return this._call(ctx, new URL("/account/login", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async requestAccess(ctx, body, args) {
+		return this._call(ctx, new URL("/account/request-access", this.baseUrl), {
+			...args,
+			body,
+			method: "POST"
+		});
+	}
+	async getAccount(ctx, args) {
+		return this._call(ctx, new URL("/account/me", this.baseUrl), {
+			...args,
+			method: "GET"
+		});
+	}
+	async deleteAccount(ctx, args) {
+		return this._call(ctx, new URL("/account/me", this.baseUrl), {
+			...args,
+			method: "DELETE"
+		});
+	}
+	async listAccountInvitations(ctx, args) {
+		return this._call(ctx, new URL("/account/invitation", this.baseUrl), {
+			...args,
+			method: "GET"
+		});
+	}
+	async issueAccountInvitation(ctx, args) {
+		return this._call(ctx, new URL("/account/invitation/issue", this.baseUrl), {
+			...args,
+			method: "POST"
+		});
+	}
+	async resendVerificationEmail(ctx, args) {
+		return this._call(ctx, new URL("/account/email/resend-verification", this.baseUrl), {
+			...args,
+			method: "POST"
+		});
+	}
+	/**
+	* Rolling-window usage and effective limits for the authenticated identity.
+	* Served from the per-user metering DO; optional `windowSeconds` defaults to the largest limit window.
+	*/
+	async getProfileUsage(ctx, query, args) {
+		return this._call(ctx, createUrl(new URL("/api/metering/profile/usage", this.baseUrl), { windowSeconds: query?.windowSeconds }), {
+			...args,
+			method: "GET"
+		});
+	}
+};
+//#endregion
+//#region src/browser-rendering.ts
+/** Request body for EDGE `/ai/browser-rendering/markdown` (ai-service Browser Run markdown quick action). */
+var MarkdownRequest = Schema.Struct({
+	url: Schema.optional(Schema.String),
+	html: Schema.optional(Schema.String),
+	gotoOptions: Schema.optional(Schema.Struct({
+		waitUntil: Schema.optional(Schema.Literal("load", "domcontentloaded", "networkidle0", "networkidle2")),
+		timeout: Schema.optional(Schema.Number)
+	})),
+	rejectRequestPattern: Schema.optional(Schema.Array(Schema.String)),
+	userAgent: Schema.optional(Schema.String),
+	waitForSelector: Schema.optional(Schema.String)
+});
+/** JSON body returned by Cloudflare Browser Run markdown quick action. */
+var MarkdownResponse = Schema.Struct({
+	success: Schema.Boolean,
+	result: Schema.String
+});
+//#endregion
+export { BaseHttpClient, ByokError, CLOUDFLARE_MESSAGE_MAX_BYTES, CLOUDFLARE_RPC_MAX_BYTES, EdgeAiHttpClient, EdgeClient, EdgeConnectionClosedError, EdgeConnectionService, EdgeHttpClient, EdgeHttpClientService, EdgeIdentityChangedError, HttpConfig, HubHttpClient, MarkdownRequest, MarkdownResponse, Protocol, UsageQuotaExceededError, WebSocketMuxer, createChainEdgeIdentity, createDeviceEdgeIdentity, createEphemeralEdgeIdentity, createStubEdgeIdentity, createTestHaloEdgeIdentity, encodeAuthHeader, getTypename, handleAuthChallenge, patchAnthropicMessagesRequestBody, protocol, proxyFetchLegacy, requestInitTagKey, toUint8Array, withLogging, withRetry, withRetryConfig };
+
+//# sourceMappingURL=index.mjs.map