@dxos/edge-client 0.6.12-main.78ddbdf → 0.6.12-main.89e9959

package/dist/lib/node-esm/meta.json

@@ -1 +1 @@
-{"inputs":{"packages/core/mesh/edge-client/src/protocol.ts":{"bytes":10334,"imports":[{"path":"@dxos/invariant","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"@dxos/util","kind":"import-statement","external":true}],"format":"esm"},"packages/core/mesh/edge-client/src/defs.ts":{"bytes":1607,"imports":[{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"packages/core/mesh/edge-client/src/protocol.ts","kind":"import-statement","original":"./protocol"}],"format":"esm"},"packages/core/mesh/edge-client/src/errors.ts":{"bytes":1265,"imports":[],"format":"esm"},"packages/core/mesh/edge-client/src/persistent-lifecycle.ts":{"bytes":10868,"imports":[{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/debug","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true}],"format":"esm"},"packages/core/mesh/edge-client/src/edge-client.ts":{"bytes":27085,"imports":[{"path":"isomorphic-ws","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"packages/core/mesh/edge-client/src/defs.ts","kind":"import-statement","original":"./defs"},{"path":"packages/core/mesh/edge-client/src/errors.ts","kind":"import-statement","original":"./errors"},{"path":"packages/core/mesh/edge-client/src/persistent-lifecycle.ts","kind":"import-statement","original":"./persistent-lifecycle"},{"path":"packages/core/mesh/edge-client/src/protocol.ts","kind":"import-statement","original":"./protocol"}],"format":"esm"},"packages/core/mesh/edge-client/src/index.ts":{"bytes":935,"imports":[{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"packages/core/mesh/edge-client/src/edge-client.ts","kind":"import-statement","original":"./edge-client"},{"path":"packages/core/mesh/edge-client/src/defs.ts","kind":"import-statement","original":"./defs"},{"path":"packages/core/mesh/edge-client/src/protocol.ts","kind":"import-statement","original":"./protocol"},{"path":"packages/core/mesh/edge-client/src/errors.ts","kind":"import-statement","original":"./errors"}],"format":"esm"},"packages/core/mesh/edge-client/src/testing/test-utils.ts":{"bytes":12455,"imports":[{"path":"isomorphic-ws","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"packages/core/mesh/edge-client/src/defs.ts","kind":"import-statement","original":"../defs"},{"path":"packages/core/mesh/edge-client/src/protocol.ts","kind":"import-statement","original":"../protocol"}],"format":"esm"},"packages/core/mesh/edge-client/src/testing/index.ts":{"bytes":516,"imports":[{"path":"packages/core/mesh/edge-client/src/testing/test-utils.ts","kind":"import-statement","original":"./test-utils"}],"format":"esm"}},"outputs":{"packages/core/mesh/edge-client/dist/lib/node-esm/index.mjs.map":{"imports":[],"exports":[],"inputs":{},"bytes":18218},"packages/core/mesh/edge-client/dist/lib/node-esm/index.mjs":{"imports":[{"path":"packages/core/mesh/edge-client/dist/lib/node-esm/chunk-HNVT57AU.mjs","kind":"import-statement"},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"isomorphic-ws","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/debug","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true}],"exports":["EdgeClient","EdgeConnectionClosedError","EdgeIdentityChangedError","Protocol","getTypename","protocol","toUint8Array"],"entryPoint":"packages/core/mesh/edge-client/src/index.ts","inputs":{"packages/core/mesh/edge-client/src/index.ts":{"bytesInOutput":60},"packages/core/mesh/edge-client/src/edge-client.ts":{"bytesInOutput":6943},"packages/core/mesh/edge-client/src/errors.ts":{"bytesInOutput":232},"packages/core/mesh/edge-client/src/persistent-lifecycle.ts":{"bytesInOutput":3015}},"bytes":10876},"packages/core/mesh/edge-client/dist/lib/node-esm/testing/index.mjs.map":{"imports":[],"exports":[],"inputs":{},"bytes":6342},"packages/core/mesh/edge-client/dist/lib/node-esm/testing/index.mjs":{"imports":[{"path":"packages/core/mesh/edge-client/dist/lib/node-esm/chunk-HNVT57AU.mjs","kind":"import-statement"},{"path":"isomorphic-ws","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true}],"exports":["DEFAULT_PORT","createTestEdgeWsServer"],"entryPoint":"packages/core/mesh/edge-client/src/testing/index.ts","inputs":{"packages/core/mesh/edge-client/src/testing/test-utils.ts":{"bytesInOutput":3276},"packages/core/mesh/edge-client/src/testing/index.ts":{"bytesInOutput":0}},"bytes":3585},"packages/core/mesh/edge-client/dist/lib/node-esm/chunk-HNVT57AU.mjs.map":{"imports":[],"exports":[],"inputs":{},"bytes":5678},"packages/core/mesh/edge-client/dist/lib/node-esm/chunk-HNVT57AU.mjs":{"imports":[{"path":"@dxos/invariant","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"@dxos/util","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true}],"exports":["Protocol","getTypename","protocol","toUint8Array"],"inputs":{"packages/core/mesh/edge-client/src/protocol.ts":{"bytesInOutput":2600},"packages/core/mesh/edge-client/src/defs.ts":{"bytesInOutput":298}},"bytes":3199}}}
+{"inputs":{"packages/core/mesh/edge-client/src/protocol.ts":{"bytes":10334,"imports":[{"path":"@dxos/invariant","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"@dxos/util","kind":"import-statement","external":true}],"format":"esm"},"packages/core/mesh/edge-client/src/defs.ts":{"bytes":1607,"imports":[{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"packages/core/mesh/edge-client/src/protocol.ts","kind":"import-statement","original":"./protocol"}],"format":"esm"},"packages/core/mesh/edge-client/src/errors.ts":{"bytes":1265,"imports":[],"format":"esm"},"packages/core/mesh/edge-client/src/persistent-lifecycle.ts":{"bytes":10868,"imports":[{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/debug","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true}],"format":"esm"},"packages/core/mesh/edge-client/src/edge-client.ts":{"bytes":32385,"imports":[{"path":"isomorphic-ws","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/crypto","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"@dxos/protocols/proto","kind":"import-statement","external":true},{"path":"packages/core/mesh/edge-client/src/defs.ts","kind":"import-statement","original":"./defs"},{"path":"packages/core/mesh/edge-client/src/errors.ts","kind":"import-statement","original":"./errors"},{"path":"packages/core/mesh/edge-client/src/persistent-lifecycle.ts","kind":"import-statement","original":"./persistent-lifecycle"},{"path":"packages/core/mesh/edge-client/src/protocol.ts","kind":"import-statement","original":"./protocol"}],"format":"esm"},"packages/core/mesh/edge-client/src/auth.ts":{"bytes":11621,"imports":[{"path":"@dxos/credentials","kind":"import-statement","external":true},{"path":"@dxos/keyring","kind":"import-statement","external":true},{"path":"@dxos/keys","kind":"import-statement","external":true}],"format":"esm"},"packages/core/mesh/edge-client/src/edge-http-client.ts":{"bytes":15155,"imports":[{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols","kind":"import-statement","external":true}],"format":"esm"},"packages/core/mesh/edge-client/src/index.ts":{"bytes":1127,"imports":[{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"packages/core/mesh/edge-client/src/edge-client.ts","kind":"import-statement","original":"./edge-client"},{"path":"packages/core/mesh/edge-client/src/defs.ts","kind":"import-statement","original":"./defs"},{"path":"packages/core/mesh/edge-client/src/protocol.ts","kind":"import-statement","original":"./protocol"},{"path":"packages/core/mesh/edge-client/src/errors.ts","kind":"import-statement","original":"./errors"},{"path":"packages/core/mesh/edge-client/src/auth.ts","kind":"import-statement","original":"./auth"},{"path":"packages/core/mesh/edge-client/src/edge-http-client.ts","kind":"import-statement","original":"./edge-http-client"}],"format":"esm"},"packages/core/mesh/edge-client/src/testing/test-utils.ts":{"bytes":12455,"imports":[{"path":"isomorphic-ws","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"packages/core/mesh/edge-client/src/defs.ts","kind":"import-statement","original":"../defs"},{"path":"packages/core/mesh/edge-client/src/protocol.ts","kind":"import-statement","original":"../protocol"}],"format":"esm"},"packages/core/mesh/edge-client/src/testing/index.ts":{"bytes":516,"imports":[{"path":"packages/core/mesh/edge-client/src/testing/test-utils.ts","kind":"import-statement","original":"./test-utils"}],"format":"esm"}},"outputs":{"packages/core/mesh/edge-client/dist/lib/node-esm/index.mjs.map":{"imports":[],"exports":[],"inputs":{},"bytes":34450},"packages/core/mesh/edge-client/dist/lib/node-esm/index.mjs":{"imports":[{"path":"packages/core/mesh/edge-client/dist/lib/node-esm/chunk-HNVT57AU.mjs","kind":"import-statement"},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"isomorphic-ws","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/crypto","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"@dxos/protocols/proto","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/debug","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/credentials","kind":"import-statement","external":true},{"path":"@dxos/keyring","kind":"import-statement","external":true},{"path":"@dxos/keys","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/context","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols","kind":"import-statement","external":true}],"exports":["EdgeClient","EdgeConnectionClosedError","EdgeHttpClient","EdgeIdentityChangedError","Protocol","createChainEdgeIdentity","createDeviceEdgeIdentity","createEphemeralEdgeIdentity","createStubEdgeIdentity","createTestHaloEdgeIdentity","getTypename","protocol","toUint8Array"],"entryPoint":"packages/core/mesh/edge-client/src/index.ts","inputs":{"packages/core/mesh/edge-client/src/index.ts":{"bytesInOutput":60},"packages/core/mesh/edge-client/src/edge-client.ts":{"bytesInOutput":7977},"packages/core/mesh/edge-client/src/errors.ts":{"bytesInOutput":232},"packages/core/mesh/edge-client/src/persistent-lifecycle.ts":{"bytesInOutput":3015},"packages/core/mesh/edge-client/src/auth.ts":{"bytesInOutput":2681},"packages/core/mesh/edge-client/src/edge-http-client.ts":{"bytesInOutput":3649}},"bytes":18506},"packages/core/mesh/edge-client/dist/lib/node-esm/testing/index.mjs.map":{"imports":[],"exports":[],"inputs":{},"bytes":6342},"packages/core/mesh/edge-client/dist/lib/node-esm/testing/index.mjs":{"imports":[{"path":"packages/core/mesh/edge-client/dist/lib/node-esm/chunk-HNVT57AU.mjs","kind":"import-statement"},{"path":"isomorphic-ws","kind":"import-statement","external":true},{"path":"@dxos/async","kind":"import-statement","external":true},{"path":"@dxos/log","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true}],"exports":["DEFAULT_PORT","createTestEdgeWsServer"],"entryPoint":"packages/core/mesh/edge-client/src/testing/index.ts","inputs":{"packages/core/mesh/edge-client/src/testing/test-utils.ts":{"bytesInOutput":3276},"packages/core/mesh/edge-client/src/testing/index.ts":{"bytesInOutput":0}},"bytes":3585},"packages/core/mesh/edge-client/dist/lib/node-esm/chunk-HNVT57AU.mjs.map":{"imports":[],"exports":[],"inputs":{},"bytes":5678},"packages/core/mesh/edge-client/dist/lib/node-esm/chunk-HNVT57AU.mjs":{"imports":[{"path":"@dxos/invariant","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true},{"path":"@dxos/util","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf","kind":"import-statement","external":true},{"path":"@dxos/protocols/buf/dxos/edge/messenger_pb","kind":"import-statement","external":true}],"exports":["Protocol","getTypename","protocol","toUint8Array"],"inputs":{"packages/core/mesh/edge-client/src/protocol.ts":{"bytesInOutput":2600},"packages/core/mesh/edge-client/src/defs.ts":{"bytesInOutput":298}},"bytes":3199}}}

package/dist/types/src/auth.d.ts

@@ -0,0 +1,22 @@
+import { type Signer } from '@dxos/crypto';
+import { PublicKey } from '@dxos/keys';
+import { type Chain, type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
+import type { EdgeIdentity } from './edge-client';
+/**
+ * Edge identity backed by a device key without a credential chain.
+ */
+export declare const createDeviceEdgeIdentity: (signer: Signer, key: PublicKey) => Promise<EdgeIdentity>;
+/**
+ * Edge identity backed by a chain of credentials.
+ */
+export declare const createChainEdgeIdentity: (signer: Signer, identityKey: PublicKey, peerKey: PublicKey, chain: Chain, credentials: Credential[]) => Promise<EdgeIdentity>;
+/**
+ * Edge identity backed by a random ephemeral key without HALO.
+ */
+export declare const createEphemeralEdgeIdentity: () => Promise<EdgeIdentity>;
+/**
+ * Creates a HALO chain of credentials to act as an edge identity.
+ */
+export declare const createTestHaloEdgeIdentity: (signer: Signer, identityKey: PublicKey, deviceKey: PublicKey) => Promise<EdgeIdentity>;
+export declare const createStubEdgeIdentity: () => EdgeIdentity;
+//# sourceMappingURL=auth.d.ts.map

package/dist/types/src/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,KAAK,KAAK,EAAE,KAAK,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAE1F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,wBAAwB,WAAkB,MAAM,OAAO,SAAS,KAAG,OAAO,CAAC,YAAY,CAyBnG,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,WAC1B,MAAM,eACD,SAAS,WACb,SAAS,SACX,KAAK,eACC,UAAU,EAAE,KACxB,OAAO,CAAC,YAAY,CAgCtB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,QAAa,OAAO,CAAC,YAAY,CAIxE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,WAC7B,MAAM,eACD,SAAS,aACX,SAAS,KACnB,OAAO,CAAC,YAAY,CAqBtB,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAO,YAUzC,CAAC"}

package/dist/types/src/edge-client.d.ts

@@ -1,6 +1,7 @@
 import { Event } from '@dxos/async';
 import { Resource, type Lifecycle } from '@dxos/context';
 import { type Message } from '@dxos/protocols/buf/dxos/edge/messenger_pb';
+import { type Presentation } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type Protocol } from './protocol';
 export type MessageListener = (message: Message) => void | Promise<void>;
 export interface EdgeConnection extends Required<Lifecycle> {
@@ -10,10 +11,8 @@ export interface EdgeConnection extends Required<Lifecycle> {
     get identityKey(): string;
     get peerKey(): string;
     get isOpen(): boolean;
-    setIdentity(params: {
-        peerKey: string;
-        identityKey: string;
-    }): void;
+    get isConnected(): boolean;
+    setIdentity(identity: EdgeIdentity): void;
     addListener(listener: MessageListener): () => void;
     send(message: Message): Promise<void>;
 }
@@ -22,12 +21,23 @@ export type MessengerConfig = {
     timeout?: number;
     protocol?: Protocol;
 };
+export interface EdgeIdentity {
+    peerKey: string;
+    identityKey: string;
+    /**
+     * Returns credential presentation issued by the identity key.
+     * Presentation must have the provided challenge.
+     * Presentation may include ServiceAccess credentials.
+     */
+    presentCredentials({ challenge }: {
+        challenge: Uint8Array;
+    }): Promise<Presentation>;
+}
 /**
  * Messenger client.
  */
 export declare class EdgeClient extends Resource implements EdgeConnection {
-    private _identityKey;
-    private _peerKey;
+    private _identity;
     private readonly _config;
     readonly reconnect: Event<void>;
     readonly connected: Event<void>;
@@ -37,18 +47,16 @@ export declare class EdgeClient extends Resource implements EdgeConnection {
     private _ws?;
     private _keepaliveCtx?;
     private _heartBeatContext?;
-    constructor(_identityKey: string, _peerKey: string, _config: MessengerConfig);
+    constructor(_identity: EdgeIdentity, _config: MessengerConfig);
     get info(): {
         open: boolean;
         identity: string;
         device: string;
     };
+    get isConnected(): boolean;
     get identityKey(): string;
     get peerKey(): string;
-    setIdentity({ peerKey, identityKey }: {
-        peerKey: string;
-        identityKey: string;
-    }): void;
+    setIdentity(identity: EdgeIdentity): void;
     addListener(listener: MessageListener): () => void;
     /**
      * Open connection to messaging service.

package/dist/types/src/edge-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"edge-client.d.ts","sourceRoot":"","sources":["../../../src/edge-client.ts"],"names":[],"mappings":"AAMA,OAAO,EAAW,KAAK,EAAoD,MAAM,aAAa,CAAC;AAC/F,OAAO,EAA2B,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,EAAE,KAAK,OAAO,EAAiB,MAAM,4CAA4C,CAAC;AAKzF,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,YAAY,CAAC;AAKzD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAAC,SAAS,CAAC;IACzD,SAAS,EAAE,KAAK,CAAC;IACjB,SAAS,EAAE,KAAK,CAAC;IAEjB,IAAI,IAAI,IAAI,GAAG,CAAC;IAChB,IAAI,WAAW,IAAI,MAAM,CAAC;IAC1B,IAAI,OAAO,IAAI,MAAM,CAAC;IACtB,IAAI,MAAM,IAAI,OAAO,CAAC;IACtB,WAAW,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpE,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,IAAI,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,CAAC;AAEF;;GAEG;AACH,qBAAa,UAAW,SAAQ,QAAS,YAAW,cAAc;IAgB9D,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAjB1B,SAAgB,SAAS,cAAe;IACxC,SAAgB,SAAS,cAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAIlC;IAEH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,GAAG,CAAC,CAAwB;IACpC,OAAO,CAAC,aAAa,CAAC,CAAsB;IAC5C,OAAO,CAAC,iBAAiB,CAAC,CAAsB;gBAGtC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EACP,OAAO,EAAE,eAAe;IAM3C,IAAW,IAAI;;;;MAMd;IAED,IAAI,WAAW,WAEd;IAED,IAAI,OAAO,WAEV;IAED,WAAW,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IAMvE,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,IAAI;IAKzD;;OAEG;cACsB,KAAK;IAO9B;;OAEG;cACsB,MAAM;YAKjB,cAAc;YAsDd,eAAe;IA0B7B;;;OAGG;IACU,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBlD,OAAO,CAAC,YAAY;CAcrB"}
+{"version":3,"file":"edge-client.d.ts","sourceRoot":"","sources":["../../../src/edge-client.ts"],"names":[],"mappings":"AAMA,OAAO,EAAW,KAAK,EAAoD,MAAM,aAAa,CAAC;AAC/F,OAAO,EAA2B,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAIlF,OAAO,EAAE,KAAK,OAAO,EAAiB,MAAM,4CAA4C,CAAC;AAEzF,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,6CAA6C,CAAC;AAKhF,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,YAAY,CAAC;AAKzD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAAC,SAAS,CAAC;IACzD,SAAS,EAAE,KAAK,CAAC;IACjB,SAAS,EAAE,KAAK,CAAC;IAEjB,IAAI,IAAI,IAAI,GAAG,CAAC;IAChB,IAAI,WAAW,IAAI,MAAM,CAAC;IAC1B,IAAI,OAAO,IAAI,MAAM,CAAC;IACtB,IAAI,MAAM,IAAI,OAAO,CAAC;IACtB,IAAI,WAAW,IAAI,OAAO,CAAC;IAC3B,WAAW,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1C,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,IAAI,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,SAAS,EAAE,EAAE;QAAE,SAAS,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACrF;AAID;;GAEG;AACH,qBAAa,UAAW,SAAQ,QAAS,YAAW,cAAc;IAgB9D,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAhB1B,SAAgB,SAAS,cAAe;IACxC,SAAgB,SAAS,cAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAIlC;IAEH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,GAAG,CAAC,CAAwB;IACpC,OAAO,CAAC,aAAa,CAAC,CAAsB;IAC5C,OAAO,CAAC,iBAAiB,CAAC,CAAsB;gBAGtC,SAAS,EAAE,YAAY,EACd,OAAO,EAAE,eAAe;IAM3C,IAAW,IAAI;;;;MAMd;IAED,IAAI,WAAW,YAEd;IAED,IAAI,WAAW,WAEd;IAED,IAAI,OAAO,WAEV;IAED,WAAW,CAAC,QAAQ,EAAE,YAAY;IAK3B,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,IAAI;IAKzD;;OAEG;cACsB,KAAK;IAO9B;;OAEG;cACsB,MAAM;YAKjB,cAAc;YAmEd,eAAe;IA0B7B;;;OAGG;IACU,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBlD,OAAO,CAAC,YAAY;CAcrB"}

package/dist/types/src/edge-http-client.d.ts

@@ -0,0 +1,34 @@
+import { Context } from '@dxos/context';
+import { type SpaceId } from '@dxos/keys';
+import { type GetNotarizationResponseBody, type PostNotarizationRequestBody } from '@dxos/protocols';
+export declare class EdgeHttpClient {
+    private readonly _baseUrl;
+    constructor(baseUrl: string);
+    getCredentialsForNotarization(spaceId: SpaceId, args?: EdgeHttpGetArgs): Promise<GetNotarizationResponseBody>;
+    notarizeCredentials(spaceId: SpaceId, body: PostNotarizationRequestBody, args?: EdgeHttpGetArgs): Promise<void>;
+    private _call;
+}
+export type RetryConfig = {
+    /**
+     * A number of call retries, not counting the initial request.
+     */
+    count: number;
+    /**
+     * Delay before retries in ms.
+     */
+    timeout?: number;
+    /**
+     * A random amount of time before retrying to help prevent large bursts of requests.
+     */
+    jitter?: number;
+};
+export type EdgeHttpGetArgs = {
+    context?: Context;
+    retry?: RetryConfig;
+};
+export type EdgeHttpPostArgs = {
+    context?: Context;
+    body?: any;
+    retry?: RetryConfig;
+};
+//# sourceMappingURL=edge-http-client.d.ts.map

package/dist/types/src/edge-http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-http-client.d.ts","sourceRoot":"","sources":["../../../src/edge-http-client.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAGL,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EACjC,MAAM,iBAAiB,CAAC;AAMzB,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,OAAO,EAAE,MAAM;IAOpB,6BAA6B,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAIvG,mBAAmB,CAC9B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,2BAA2B,EACjC,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,IAAI,CAAC;YAIF,KAAK;CA6CpB;AA0CD,MAAM,MAAM,WAAW,GAAG;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,gBAAgB,GAAG;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,CAAC"}

package/dist/types/src/index.d.ts

@@ -3,4 +3,6 @@ export * from './edge-client';
 export * from './defs';
 export * from './protocol';
 export * from './errors';
+export * from './auth';
+export * from './edge-http-client';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,4CAA4C,CAAC;AAE3D,cAAc,eAAe,CAAC;AAC9B,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,4CAA4C,CAAC;AAE3D,cAAc,eAAe,CAAC;AAC9B,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,oBAAoB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/edge-client",
-  "version": "0.6.12-main.78ddbdf",
+  "version": "0.6.12-main.89e9959",
   "description": "EDGE Client",
   "homepage": "https://dxos.org",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -40,18 +40,21 @@
   "dependencies": {
     "isomorphic-ws": "^5.0.0",
     "ws": "^8.14.2",
-    "@dxos/async": "0.6.12-main.78ddbdf",
-    "@dxos/context": "0.6.12-main.78ddbdf",
-    "@dxos/debug": "0.6.12-main.78ddbdf",
-    "@dxos/invariant": "0.6.12-main.78ddbdf",
-    "@dxos/log": "0.6.12-main.78ddbdf",
-    "@dxos/protocols": "0.6.12-main.78ddbdf",
-    "@dxos/node-std": "0.6.12-main.78ddbdf",
-    "@dxos/util": "0.6.12-main.78ddbdf"
+    "@dxos/async": "0.6.12-main.89e9959",
+    "@dxos/context": "0.6.12-main.89e9959",
+    "@dxos/credentials": "0.6.12-main.89e9959",
+    "@dxos/debug": "0.6.12-main.89e9959",
+    "@dxos/crypto": "0.6.12-main.89e9959",
+    "@dxos/keyring": "0.6.12-main.89e9959",
+    "@dxos/invariant": "0.6.12-main.89e9959",
+    "@dxos/log": "0.6.12-main.89e9959",
+    "@dxos/keys": "0.6.12-main.89e9959",
+    "@dxos/node-std": "0.6.12-main.89e9959",
+    "@dxos/protocols": "0.6.12-main.89e9959",
+    "@dxos/util": "0.6.12-main.89e9959"
   },
   "devDependencies": {
-    "@dxos/test-utils": "0.6.12-main.78ddbdf",
-    "@dxos/keys": "0.6.12-main.78ddbdf"
+    "@dxos/test-utils": "0.6.12-main.89e9959"
   },
   "publishConfig": {
     "access": "public"

package/src/auth.ts

@@ -0,0 +1,135 @@
+//
+// Copyright 2024 DXOS.org
+//
+
+import { createCredential, signPresentation } from '@dxos/credentials';
+import { type Signer } from '@dxos/crypto';
+import { Keyring } from '@dxos/keyring';
+import { PublicKey } from '@dxos/keys';
+import { type Chain, type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
+
+import type { EdgeIdentity } from './edge-client';
+
+/**
+ * Edge identity backed by a device key without a credential chain.
+ */
+export const createDeviceEdgeIdentity = async (signer: Signer, key: PublicKey): Promise<EdgeIdentity> => {
+  return {
+    identityKey: key.toHex(),
+    peerKey: key.toHex(),
+    presentCredentials: async ({ challenge }) => {
+      return signPresentation({
+        presentation: {
+          credentials: [
+            // Verifier requires at least one credential in the presentation to establish the subject.
+            await createCredential({
+              assertion: {
+                '@type': 'dxos.halo.credentials.Auth',
+              },
+              issuer: key,
+              subject: key,
+              signer,
+            }),
+          ],
+        },
+        signer,
+        signerKey: key,
+        nonce: challenge,
+      });
+    },
+  };
+};
+
+/**
+ * Edge identity backed by a chain of credentials.
+ */
+export const createChainEdgeIdentity = async (
+  signer: Signer,
+  identityKey: PublicKey,
+  peerKey: PublicKey,
+  chain: Chain,
+  credentials: Credential[],
+): Promise<EdgeIdentity> => {
+  const credentialsToSign =
+    credentials.length > 0
+      ? credentials
+      : [
+          await createCredential({
+            assertion: {
+              '@type': 'dxos.halo.credentials.Auth',
+            },
+            issuer: identityKey,
+            subject: identityKey,
+            signer,
+            chain,
+            signingKey: peerKey,
+          }),
+        ];
+
+  return {
+    identityKey: identityKey.toHex(),
+    peerKey: peerKey.toHex(),
+    presentCredentials: async ({ challenge }) => {
+      return signPresentation({
+        presentation: {
+          credentials: credentialsToSign,
+        },
+        signer,
+        nonce: challenge,
+        signerKey: peerKey,
+        chain,
+      });
+    },
+  };
+};
+
+/**
+ * Edge identity backed by a random ephemeral key without HALO.
+ */
+export const createEphemeralEdgeIdentity = async (): Promise<EdgeIdentity> => {
+  const keyring = new Keyring();
+  const key = await keyring.createKey();
+  return createDeviceEdgeIdentity(keyring, key);
+};
+
+/**
+ * Creates a HALO chain of credentials to act as an edge identity.
+ */
+export const createTestHaloEdgeIdentity = async (
+  signer: Signer,
+  identityKey: PublicKey,
+  deviceKey: PublicKey,
+): Promise<EdgeIdentity> => {
+  const deviceAdmission = await createCredential({
+    assertion: {
+      '@type': 'dxos.halo.credentials.AuthorizedDevice',
+      deviceKey,
+      identityKey,
+    },
+    issuer: identityKey,
+    subject: deviceKey,
+    signer,
+  });
+  return createChainEdgeIdentity(signer, identityKey, deviceKey, { credential: deviceAdmission }, [
+    await createCredential({
+      assertion: {
+        '@type': 'dxos.halo.credentials.Auth',
+      },
+      issuer: identityKey,
+      subject: identityKey,
+      signer,
+    }),
+  ]);
+};
+
+export const createStubEdgeIdentity = (): EdgeIdentity => {
+  const identityKey = PublicKey.random();
+  const deviceKey = PublicKey.random();
+  return {
+    identityKey: identityKey.toHex(),
+    peerKey: deviceKey.toHex(),
+    presentCredentials: async () => {
+      throw new Error('Stub identity does not support authentication.');
+    },
+  };
+};

package/src/edge-client.test.ts

@@ -2,12 +2,14 @@
 // Copyright 2024 DXOS.org
 //
 
-import { test, expect, describe, onTestFinished } from 'vitest';
+import { describe, expect, onTestFinished, test } from 'vitest';
 
-import { PublicKey } from '@dxos/keys';
+import { Trigger } from '@dxos/async';
+import { Keyring } from '@dxos/keyring';
 import { TextMessageSchema } from '@dxos/protocols/buf/dxos/edge/messenger_pb';
 import { openAndClose } from '@dxos/test-utils';
 
+import { createEphemeralEdgeIdentity, createTestHaloEdgeIdentity } from './auth';
 import { protocol } from './defs';
 import { EdgeClient } from './edge-client';
 import { createTestEdgeWsServer } from './testing';
@@ -19,8 +21,7 @@ describe('EdgeClient', () => {
     const { closeConnection, endpoint, cleanup } = await createTestEdgeWsServer(8001);
     onTestFinished(cleanup);
 
-    const id = PublicKey.random().toHex();
-    const client = new EdgeClient(id, id, { socketEndpoint: endpoint });
+    const client = new EdgeClient(await createEphemeralEdgeIdentity(), { socketEndpoint: endpoint });
     await openAndClose(client);
     await client.send(textMessage('Hello world 1'));
     expect(client.isOpen).is.true;
@@ -31,20 +32,51 @@ describe('EdgeClient', () => {
     await expect(client.send(textMessage('Hello world 2'))).resolves.not.toThrow();
   });
 
+  test('isConnected', async () => {
+    const admitConnection = new Trigger();
+    const { closeConnection, endpoint, cleanup } = await createTestEdgeWsServer(8001, { admitConnection });
+    onTestFinished(cleanup);
+
+    const client = new EdgeClient(await createEphemeralEdgeIdentity(), { socketEndpoint: endpoint });
+    await openAndClose(client);
+
+    expect(client.isConnected).toBeFalsy();
+    admitConnection.wake();
+    await expect.poll(() => client.isConnected).toBeTruthy();
+
+    admitConnection.reset();
+    await closeConnection();
+    expect(client.isOpen).is.true;
+    await expect.poll(() => client.isConnected).toBeFalsy();
+
+    admitConnection.wake();
+    await expect.poll(() => client.isConnected).toBeTruthy();
+  });
+
   test('set identity reconnects', async () => {
     const { endpoint, cleanup } = await createTestEdgeWsServer(8002);
     onTestFinished(cleanup);
 
-    const id = PublicKey.random().toHex();
-    const client = new EdgeClient(id, id, { socketEndpoint: endpoint });
+    const client = new EdgeClient(await createEphemeralEdgeIdentity(), { socketEndpoint: endpoint });
     await openAndClose(client);
     await client.send(textMessage('Hello world 1'));
     expect(client.isOpen).is.true;
 
-    const newId = PublicKey.random().toHex();
     const reconnected = client.reconnect.waitForCount(1);
-    client.setIdentity({ peerKey: newId, identityKey: newId });
+    client.setIdentity(await createEphemeralEdgeIdentity());
     await reconnected;
     await expect(client.send(textMessage('Hello world 2'))).resolves.not.toThrow();
   });
+
+  test.skipIf(!process.env.EDGE_ENDPOINT)('connect to local edge server', async () => {
+    // const identity = await createEphemeralEdgeIdentity();
+
+    const keyring = new Keyring();
+    const identity = await createTestHaloEdgeIdentity(keyring, await keyring.createKey(), await keyring.createKey());
+
+    const client = new EdgeClient(identity, { socketEndpoint: process.env.EDGE_ENDPOINT! });
+    await openAndClose(client);
+    await client.send(textMessage('Hello world 1'));
+    expect(client.isOpen).is.true;
+  });
 });

package/src/edge-client.ts

@@ -6,9 +6,12 @@ import WebSocket from 'isomorphic-ws';
 
 import { Trigger, Event, scheduleTaskInterval, scheduleTask, TriggerState } from '@dxos/async';
 import { Context, LifecycleState, Resource, type Lifecycle } from '@dxos/context';
+import { randomBytes } from '@dxos/crypto';
 import { log } from '@dxos/log';
 import { buf } from '@dxos/protocols/buf';
 import { type Message, MessageSchema } from '@dxos/protocols/buf/dxos/edge/messenger_pb';
+import { schema } from '@dxos/protocols/proto';
+import { type Presentation } from '@dxos/protocols/proto/dxos/halo/credentials';
 
 import { protocol } from './defs';
 import { EdgeConnectionClosedError, EdgeIdentityChangedError } from './errors';
@@ -28,7 +31,8 @@ export interface EdgeConnection extends Required<Lifecycle> {
   get identityKey(): string;
   get peerKey(): string;
   get isOpen(): boolean;
-  setIdentity(params: { peerKey: string; identityKey: string }): void;
+  get isConnected(): boolean;
+  setIdentity(identity: EdgeIdentity): void;
   addListener(listener: MessageListener): () => void;
   send(message: Message): Promise<void>;
 }
@@ -39,6 +43,19 @@ export type MessengerConfig = {
   protocol?: Protocol;
 };
 
+export interface EdgeIdentity {
+  peerKey: string;
+  identityKey: string;
+  /**
+   * Returns credential presentation issued by the identity key.
+   * Presentation must have the provided challenge.
+   * Presentation may include ServiceAccess credentials.
+   */
+  presentCredentials({ challenge }: { challenge: Uint8Array }): Promise<Presentation>;
+}
+
+const DISABLE_AUTH = true;
+
 /**
  * Messenger client.
  */
@@ -58,8 +75,7 @@ export class EdgeClient extends Resource implements EdgeConnection {
   private _heartBeatContext?: Context = undefined;
 
   constructor(
-    private _identityKey: string,
-    private _peerKey: string,
+    private _identity: EdgeIdentity,
     private readonly _config: MessengerConfig,
   ) {
     super();
@@ -69,22 +85,25 @@ export class EdgeClient extends Resource implements EdgeConnection {
   public get info() {
     return {
       open: this.isOpen,
-      identity: this._identityKey,
-      device: this._peerKey,
+      identity: this._identity.identityKey,
+      device: this._identity.peerKey,
     };
   }
 
+  get isConnected() {
+    return Boolean(this._ws) && this._ready.state === TriggerState.RESOLVED;
+  }
+
   get identityKey() {
-    return this._identityKey;
+    return this._identity.identityKey;
   }
 
   get peerKey() {
-    return this._peerKey;
+    return this._identity.peerKey;
   }
 
-  setIdentity({ peerKey, identityKey }: { peerKey: string; identityKey: string }) {
-    this._peerKey = peerKey;
-    this._identityKey = identityKey;
+  setIdentity(identity: EdgeIdentity) {
+    this._identity = identity;
     this._persistentLifecycle.scheduleRestart();
   }
 
@@ -107,13 +126,23 @@ export class EdgeClient extends Resource implements EdgeConnection {
    * Close connection and free resources.
    */
   protected override async _close() {
-    log('closing...', { peerKey: this._peerKey });
+    log('closing...', { peerKey: this._identity.peerKey });
     await this._persistentLifecycle.close();
   }
 
   private async _openWebSocket() {
-    const url = new URL(`/ws/${this._identityKey}/${this._peerKey}`, this._config.socketEndpoint);
-    this._ws = new WebSocket(url);
+    let protocolHeader: string | undefined;
+
+    if (!DISABLE_AUTH) {
+      // TODO(dmaretskyi): Get challenge from the WWW-Authenticate header returned by the endpoint.
+      const challenge = randomBytes(32);
+      const credential = await this._identity.presentCredentials({ challenge });
+      protocolHeader = encodePresentationIntoAuthHeader(credential);
+    }
+
+    const url = new URL(`/ws/${this._identity.identityKey}/${this._identity.peerKey}`, this._config.socketEndpoint);
+    log('Opening websocket', { url: url.toString(), protocolHeader });
+    this._ws = new WebSocket(url, protocolHeader ? [protocolHeader] : []);
 
     this._ws.onopen = () => {
       log('opened', this.info);
@@ -138,7 +167,7 @@ export class EdgeClient extends Resource implements EdgeConnection {
       }
       const data = await toUint8Array(event.data);
       const message = buf.fromBinary(MessageSchema, data);
-      log('received', { peerKey: this._peerKey, payload: protocol.getPayloadType(message) });
+      log('received', { peerKey: this._identity.peerKey, payload: protocol.getPayloadType(message) });
       if (message) {
         for (const listener of this._listeners) {
           try {
@@ -150,7 +179,10 @@ export class EdgeClient extends Resource implements EdgeConnection {
       }
     };
 
+    // TODO(dmaretskyi): Potential race condition here since web socket errors don't resolve this trigger.
     await this._ready.wait({ timeout: this._config.timeout ?? DEFAULT_TIMEOUT });
+
+    // TODO(dmaretskyi): Potential leak: context re-assigned without disposing the previous one.
     this._keepaliveCtx = new Context();
     scheduleTaskInterval(
       this._keepaliveCtx,
@@ -205,12 +237,12 @@ export class EdgeClient extends Resource implements EdgeConnection {
     }
     if (
       message.source &&
-      (message.source.peerKey !== this._peerKey || message.source.identityKey !== this.identityKey)
+      (message.source.peerKey !== this._identity.peerKey || message.source.identityKey !== this.identityKey)
     ) {
       throw new EdgeIdentityChangedError();
     }
 
-    log('sending...', { peerKey: this._peerKey, payload: protocol.getPayloadType(message) });
+    log('sending...', { peerKey: this._identity.peerKey, payload: protocol.getPayloadType(message) });
     this._ws.send(buf.toBinary(MessageSchema, message));
   }
 
@@ -229,3 +261,11 @@ export class EdgeClient extends Resource implements EdgeConnection {
     );
   }
 }
+
+const encodePresentationIntoAuthHeader = (presentation: Presentation): string => {
+  const encoded = schema.getCodecForType('dxos.halo.credentials.Presentation').encode(presentation);
+  // = and / characters are not allowed in the WebSocket subprotocol header.
+  const encodedToken = Buffer.from(encoded).toString('base64').replace(/=*$/, '').replaceAll('/', '|');
+
+  return `base64url.bearer.authorization.dxos.org.${encodedToken}`;
+};