@dxos/edge-client 0.6.13 → 0.6.14-main.1366248

package/dist/lib/node/index.cjs

@@ -30,143 +30,294 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var node_exports = {};
 __export(node_exports, {
   EdgeClient: () => EdgeClient,
-  Protocol: () => Protocol,
-  getTypename: () => getTypename,
-  protocol: () => protocol,
-  toUint8Array: () => toUint8Array
+  EdgeConnectionClosedError: () => EdgeConnectionClosedError,
+  EdgeHttpClient: () => EdgeHttpClient,
+  EdgeIdentityChangedError: () => EdgeIdentityChangedError,
+  Protocol: () => import_chunk_ANV2HBEH.Protocol,
+  createChainEdgeIdentity: () => createChainEdgeIdentity,
+  createDeviceEdgeIdentity: () => createDeviceEdgeIdentity,
+  createEphemeralEdgeIdentity: () => createEphemeralEdgeIdentity,
+  createStubEdgeIdentity: () => createStubEdgeIdentity,
+  createTestHaloEdgeIdentity: () => createTestHaloEdgeIdentity,
+  getTypename: () => import_chunk_ANV2HBEH.getTypename,
+  handleAuthChallenge: () => handleAuthChallenge,
+  protocol: () => import_chunk_ANV2HBEH.protocol,
+  toUint8Array: () => import_chunk_ANV2HBEH.toUint8Array
 });
 module.exports = __toCommonJS(node_exports);
+var import_chunk_ANV2HBEH = require("./chunk-ANV2HBEH.cjs");
 __reExport(node_exports, require("@dxos/protocols/buf/dxos/edge/messenger_pb"), module.exports);
-var import_isomorphic_ws = __toESM(require("isomorphic-ws"));
 var import_async = require("@dxos/async");
 var import_context = require("@dxos/context");
-var import_invariant = require("@dxos/invariant");
 var import_log = require("@dxos/log");
-var import_buf = require("@dxos/protocols/buf");
-var import_messenger_pb = require("@dxos/protocols/buf/dxos/edge/messenger_pb");
-var import_wkt = require("@bufbuild/protobuf/wkt");
-var import_messenger_pb2 = require("@dxos/protocols/buf/dxos/edge/messenger_pb");
-var import_invariant2 = require("@dxos/invariant");
-var import_buf2 = require("@dxos/protocols/buf");
-var import_messenger_pb3 = require("@dxos/protocols/buf/dxos/edge/messenger_pb");
-var import_util = require("@dxos/util");
+var import_invariant = require("@dxos/invariant");
+var import_proto = require("@dxos/protocols/proto");
+var import_isomorphic_ws = __toESM(require("isomorphic-ws"));
 var import_async2 = require("@dxos/async");
 var import_context2 = require("@dxos/context");
-var import_debug = require("@dxos/debug");
+var import_invariant2 = require("@dxos/invariant");
 var import_log2 = require("@dxos/log");
-var __dxlog_file = "/home/runner/work/dxos/dxos/packages/core/mesh/edge-client/src/protocol.ts";
-var getTypename = (typeName) => `type.googleapis.com/${typeName}`;
-var Protocol = class {
-  constructor(types) {
-    this._typeRegistry = import_buf2.buf.createRegistry(...types);
-  }
-  get typeRegistry() {
-    return this._typeRegistry;
+var import_buf = require("@dxos/protocols/buf");
+var import_messenger_pb = require("@dxos/protocols/buf/dxos/edge/messenger_pb");
+var import_async3 = require("@dxos/async");
+var import_context3 = require("@dxos/context");
+var import_debug = require("@dxos/debug");
+var import_log3 = require("@dxos/log");
+var import_credentials = require("@dxos/credentials");
+var import_keyring = require("@dxos/keyring");
+var import_keys = require("@dxos/keys");
+var import_async4 = require("@dxos/async");
+var import_context4 = require("@dxos/context");
+var import_log4 = require("@dxos/log");
+var import_protocols = require("@dxos/protocols");
+var __dxlog_file = "/home/runner/work/dxos/dxos/packages/core/mesh/edge-client/src/edge-identity.ts";
+var handleAuthChallenge = async (failedResponse, identity) => {
+  (0, import_invariant.invariant)(failedResponse.status === 401, void 0, {
+    F: __dxlog_file,
+    L: 21,
+    S: void 0,
+    A: [
+      "failedResponse.status === 401",
+      ""
+    ]
+  });
+  const headerValue = failedResponse.headers.get("Www-Authenticate");
+  (0, import_invariant.invariant)(headerValue?.startsWith("VerifiablePresentation challenge="), void 0, {
+    F: __dxlog_file,
+    L: 24,
+    S: void 0,
+    A: [
+      "headerValue?.startsWith('VerifiablePresentation challenge=')",
+      ""
+    ]
+  });
+  const challenge = headerValue?.slice("VerifiablePresentation challenge=".length);
+  (0, import_invariant.invariant)(challenge, void 0, {
+    F: __dxlog_file,
+    L: 27,
+    S: void 0,
+    A: [
+      "challenge",
+      ""
+    ]
+  });
+  const presentation = await identity.presentCredentials({
+    challenge: Buffer.from(challenge, "base64")
+  });
+  return import_proto.schema.getCodecForType("dxos.halo.credentials.Presentation").encode(presentation);
+};
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+var __dxlog_file2 = "/home/runner/work/dxos/dxos/packages/core/mesh/edge-client/src/edge-ws-connection.ts";
+var SIGNAL_KEEPALIVE_INTERVAL = 5e3;
+var EdgeWsConnection = class extends import_context2.Resource {
+  constructor(_identity, _connectionInfo, _callbacks) {
+    super();
+    this._identity = _identity;
+    this._connectionInfo = _connectionInfo;
+    this._callbacks = _callbacks;
   }
-  toJson(message) {
-    try {
-      return import_buf2.buf.toJson(import_messenger_pb3.MessageSchema, message, {
-        registry: this.typeRegistry
-      });
-    } catch (err) {
-      return {
-        type: this.getPayloadType(message)
-      };
-    }
+  get info() {
+    return {
+      open: this.isOpen,
+      identity: this._identity.identityKey,
+      device: this._identity.peerKey
+    };
   }
-  /**
-  * Return the payload with the given type.
-  */
-  getPayload(message, type) {
-    (0, import_invariant2.invariant)(message.payload, void 0, {
-      F: __dxlog_file,
-      L: 40,
+  send(message) {
+    (0, import_invariant2.invariant)(this._ws, void 0, {
+      F: __dxlog_file2,
+      L: 48,
       S: this,
       A: [
-        "message.payload",
+        "this._ws",
         ""
       ]
     });
-    const payloadTypename = this.getPayloadType(message);
-    if (type && type.typeName !== payloadTypename) {
-      throw new Error(`Unexpected payload type: ${payloadTypename}; expected ${type.typeName}`);
-    }
-    (0, import_invariant2.invariant)(import_buf2.bufWkt.anyIs(message.payload, type), `Unexpected payload type: ${payloadTypename}}`, {
-      F: __dxlog_file,
-      L: 46,
+    (0, import_log2.log)("sending...", {
+      peerKey: this._identity.peerKey,
+      payload: import_chunk_ANV2HBEH.protocol.getPayloadType(message)
+    }, {
+      F: __dxlog_file2,
+      L: 49,
       S: this,
-      A: [
-        "bufWkt.anyIs(message.payload, type)",
-        "`Unexpected payload type: ${payloadTypename}}`"
-      ]
+      C: (f, a) => f(...a)
     });
-    const payload = import_buf2.bufWkt.anyUnpack(message.payload, this.typeRegistry);
-    (0, import_invariant2.invariant)(payload, `Empty payload: ${payloadTypename}}`, {
-      F: __dxlog_file,
-      L: 48,
+    this._ws.send(import_buf.buf.toBinary(import_messenger_pb.MessageSchema, message));
+  }
+  async _open() {
+    this._ws = new import_isomorphic_ws.default(this._connectionInfo.url, this._connectionInfo.protocolHeader ? [
+      this._connectionInfo.protocolHeader
+    ] : []);
+    this._ws.onopen = () => {
+      if (this.isOpen) {
+        (0, import_log2.log)("connected", void 0, {
+          F: __dxlog_file2,
+          L: 61,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        this._callbacks.onConnected();
+        this._scheduleHeartbeats();
+      } else {
+        import_log2.log.verbose("connected after becoming inactive", {
+          currentIdentity: this._identity
+        }, {
+          F: __dxlog_file2,
+          L: 65,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      }
+    };
+    this._ws.onclose = () => {
+      if (this.isOpen) {
+        (0, import_log2.log)("disconnected while being open", void 0, {
+          F: __dxlog_file2,
+          L: 70,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        this._callbacks.onRestartRequired();
+      }
+    };
+    this._ws.onerror = (event) => {
+      if (this.isOpen) {
+        import_log2.log.warn("edge connection socket error", {
+          error: event.error,
+          info: event.message
+        }, {
+          F: __dxlog_file2,
+          L: 76,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        this._callbacks.onRestartRequired();
+      } else {
+        import_log2.log.verbose("error ignored on closed connection", {
+          error: event.error
+        }, {
+          F: __dxlog_file2,
+          L: 79,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      }
+    };
+    this._ws.onmessage = async (event) => {
+      if (!this.isOpen) {
+        import_log2.log.verbose("message ignored on closed connection", {
+          event: event.type
+        }, {
+          F: __dxlog_file2,
+          L: 87,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        return;
+      }
+      if (event.data === "__pong__") {
+        this._rescheduleHeartbeatTimeout();
+        return;
+      }
+      const data = await (0, import_chunk_ANV2HBEH.toUint8Array)(event.data);
+      if (this.isOpen) {
+        const message = import_buf.buf.fromBinary(import_messenger_pb.MessageSchema, data);
+        (0, import_log2.log)("received", {
+          from: message.source,
+          payload: import_chunk_ANV2HBEH.protocol.getPayloadType(message)
+        }, {
+          F: __dxlog_file2,
+          L: 97,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        this._callbacks.onMessage(message);
+      }
+    };
+  }
+  async _close() {
+    void this._inactivityTimeoutCtx?.dispose().catch(() => {
+    });
+    try {
+      this._ws?.close();
+      this._ws = void 0;
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("WebSocket is closed before the connection is established.")) {
+        return;
+      }
+      import_log2.log.warn("Error closing websocket", {
+        err
+      }, {
+        F: __dxlog_file2,
+        L: 113,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
+  }
+  _scheduleHeartbeats() {
+    (0, import_invariant2.invariant)(this._ws, void 0, {
+      F: __dxlog_file2,
+      L: 118,
       S: this,
       A: [
-        "payload",
-        "`Empty payload: ${payloadTypename}}`"
+        "this._ws",
+        ""
       ]
     });
-    return payload;
+    (0, import_async2.scheduleTaskInterval)(this._ctx, async () => {
+      this._ws?.send("__ping__");
+    }, SIGNAL_KEEPALIVE_INTERVAL);
+    this._ws.send("__ping__");
+    this._rescheduleHeartbeatTimeout();
   }
-  /**
-  * Get the payload type.
-  */
-  getPayloadType(message) {
-    if (!message.payload) {
-      return void 0;
+  _rescheduleHeartbeatTimeout() {
+    if (!this.isOpen) {
+      return;
     }
-    const [, type] = message.payload.typeUrl.split("/");
-    return type;
-  }
-  /**
-  * Create a packed message.
-  */
-  createMessage(type, { source, target, payload, serviceId }) {
-    return import_buf2.buf.create(import_messenger_pb3.MessageSchema, {
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      source,
-      target,
-      serviceId,
-      payload: payload ? import_buf2.bufWkt.anyPack(type, import_buf2.buf.create(type, payload)) : void 0
+    void this._inactivityTimeoutCtx?.dispose();
+    this._inactivityTimeoutCtx = new import_context2.Context(void 0, {
+      F: __dxlog_file2,
+      L: 137
     });
+    (0, import_async2.scheduleTask)(this._inactivityTimeoutCtx, () => {
+      if (this.isOpen) {
+        this._callbacks.onRestartRequired();
+      }
+    }, 2 * SIGNAL_KEEPALIVE_INTERVAL);
   }
 };
-var toUint8Array = async (data) => {
-  if (data instanceof Buffer) {
-    return (0, import_util.bufferToArray)(data);
-  }
-  if (data instanceof Blob) {
-    return new Uint8Array(await data.arrayBuffer());
+_ts_decorate([
+  import_log2.logInfo
+], EdgeWsConnection.prototype, "info", null);
+var EdgeConnectionClosedError = class extends Error {
+  constructor() {
+    super("Edge connection closed.");
   }
-  throw new Error(`Unexpected datatype: ${data}`);
 };
-var protocol = new Protocol([
-  import_messenger_pb2.SwarmRequestSchema,
-  import_messenger_pb2.SwarmResponseSchema,
-  import_messenger_pb2.TextMessageSchema,
-  import_wkt.AnySchema
-]);
-var WebsocketClosedError = class extends Error {
+var EdgeIdentityChangedError = class extends Error {
   constructor() {
-    super("WebSocket connection closed");
+    super("Edge identity changed.");
   }
 };
-function _ts_decorate(decorators, target, key, desc) {
+function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file2 = "/home/runner/work/dxos/dxos/packages/core/mesh/edge-client/src/persistent-lifecycle.ts";
+var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/mesh/edge-client/src/persistent-lifecycle.ts";
 var INIT_RESTART_DELAY = 100;
 var DEFAULT_MAX_RESTART_DELAY = 5e3;
-var PersistentLifecycle = class extends import_context2.Resource {
+var PersistentLifecycle = class extends import_context3.Resource {
   constructor({ start, stop, onRestart, maxRestartDelay = DEFAULT_MAX_RESTART_DELAY }) {
     super();
+    this._currentContext = void 0;
     this._restartTask = void 0;
     this._restartAfter = 0;
     this._start = start;
@@ -175,117 +326,177 @@ var PersistentLifecycle = class extends import_context2.Resource {
     this._maxRestartDelay = maxRestartDelay;
   }
   async _open() {
-    this._restartTask = new import_async2.DeferredTask(this._ctx, async () => {
+    this._restartTask = new import_async3.DeferredTask(this._ctx, async () => {
       try {
         await this._restart();
       } catch (err) {
-        import_log2.log.warn("Restart failed", {
+        import_log3.log.warn("Restart failed", {
           err
         }, {
-          F: __dxlog_file2,
-          L: 64,
+          F: __dxlog_file3,
+          L: 65,
           S: this,
           C: (f, a) => f(...a)
         });
         this._restartTask?.schedule();
       }
     });
-    await this._start().catch((err) => {
-      import_log2.log.warn("Start failed", {
+    this._currentContext = await this._start().catch((err) => {
+      import_log3.log.warn("Start failed", {
         err
       }, {
-        F: __dxlog_file2,
-        L: 69,
+        F: __dxlog_file3,
+        L: 70,
         S: this,
         C: (f, a) => f(...a)
       });
       this._restartTask?.schedule();
+      return void 0;
     });
   }
   async _close() {
     await this._restartTask?.join();
-    await this._stop();
+    await this._stopCurrentContext();
     this._restartTask = void 0;
   }
   async _restart() {
-    (0, import_log2.log)(`restarting in ${this._restartAfter}ms`, {
+    (0, import_log3.log)(`restarting in ${this._restartAfter}ms`, {
       state: this._lifecycleState
     }, {
-      F: __dxlog_file2,
-      L: 81,
+      F: __dxlog_file3,
+      L: 83,
       S: this,
       C: (f, a) => f(...a)
     });
-    await this._stop();
-    if (this._lifecycleState !== import_context2.LifecycleState.OPEN) {
+    await this._stopCurrentContext();
+    if (this._lifecycleState !== import_context3.LifecycleState.OPEN) {
       return;
     }
-    await (0, import_context2.cancelWithContext)(this._ctx, (0, import_async2.sleep)(this._restartAfter));
+    await (0, import_context3.cancelWithContext)(this._ctx, (0, import_async3.sleep)(this._restartAfter));
     this._restartAfter = Math.min(Math.max(this._restartAfter * 2, INIT_RESTART_DELAY), this._maxRestartDelay);
-    await (0, import_debug.warnAfterTimeout)(5e3, "Connection establishment takes too long", () => this._start());
+    await (0, import_debug.warnAfterTimeout)(5e3, "Connection establishment takes too long", async () => {
+      this._currentContext = await this._start();
+    });
     this._restartAfter = 0;
     await this._onRestart?.();
   }
+  async _stopCurrentContext() {
+    if (this._currentContext) {
+      try {
+        await this._stop(this._currentContext);
+      } catch (err) {
+        import_log3.log.catch(err, void 0, {
+          F: __dxlog_file3,
+          L: 105,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      }
+      this._currentContext = void 0;
+    }
+  }
   /**
   * Scheduling restart should be done from outside.
   */
   scheduleRestart() {
-    if (this._lifecycleState !== import_context2.LifecycleState.OPEN) {
+    if (this._lifecycleState !== import_context3.LifecycleState.OPEN) {
       return;
     }
     this._restartTask.schedule();
   }
 };
-_ts_decorate([
-  import_async2.synchronized
+_ts_decorate2([
+  import_async3.synchronized
 ], PersistentLifecycle.prototype, "_open", null);
-_ts_decorate([
-  import_async2.synchronized
+_ts_decorate2([
+  import_async3.synchronized
 ], PersistentLifecycle.prototype, "scheduleRestart", null);
-var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/mesh/edge-client/src/edge-client.ts";
+var getEdgeUrlWithProtocol = (baseUrl, protocol2) => {
+  const isSecure = baseUrl.startsWith("https") || baseUrl.startsWith("wss");
+  const url = new URL(baseUrl);
+  url.protocol = protocol2 + (isSecure ? "s" : "");
+  return url.toString();
+};
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/mesh/edge-client/src/edge-client.ts";
 var DEFAULT_TIMEOUT = 1e4;
-var SIGNAL_KEEPALIVE_INTERVAL = 5e3;
 var EdgeClient = class extends import_context.Resource {
-  constructor(_identityKey, _peerKey, _config) {
+  constructor(_identity, _config) {
     super();
-    this._identityKey = _identityKey;
-    this._peerKey = _peerKey;
+    this._identity = _identity;
     this._config = _config;
-    this.reconnect = new import_async.Event();
     this._persistentLifecycle = new PersistentLifecycle({
-      start: async () => this._openWebSocket(),
-      stop: async () => this._closeWebSocket(),
-      onRestart: async () => this.reconnect.emit()
+      start: async () => this._connect(),
+      stop: async (state) => this._disconnect(state)
     });
-    this._listeners = /* @__PURE__ */ new Set();
+    this._messageListeners = /* @__PURE__ */ new Set();
+    this._reconnectListeners = /* @__PURE__ */ new Set();
+    this._currentConnection = void 0;
     this._ready = new import_async.Trigger();
-    this._ws = void 0;
-    this._keepaliveCtx = void 0;
-    this._heartBeatContext = void 0;
-    this._protocol = this._config.protocol ?? protocol;
+    this._isActive = (connection) => connection === this._currentConnection;
+    this._baseWsUrl = getEdgeUrlWithProtocol(_config.socketEndpoint, "ws");
+    this._baseHttpUrl = getEdgeUrlWithProtocol(_config.socketEndpoint, "http");
   }
-  // TODO(burdon): Attach logging.
   get info() {
     return {
       open: this.isOpen,
-      identity: this._identityKey,
-      device: this._peerKey
+      identity: this._identity.identityKey,
+      device: this._identity.peerKey
     };
   }
+  get isConnected() {
+    return Boolean(this._currentConnection) && this._ready.state === import_async.TriggerState.RESOLVED;
+  }
   get identityKey() {
-    return this._identityKey;
+    return this._identity.identityKey;
   }
   get peerKey() {
-    return this._peerKey;
+    return this._identity.peerKey;
   }
-  setIdentity({ peerKey, identityKey }) {
-    this._peerKey = peerKey;
-    this._identityKey = identityKey;
-    this._persistentLifecycle.scheduleRestart();
+  setIdentity(identity) {
+    if (identity.identityKey !== this._identity.identityKey || identity.peerKey !== this._identity.peerKey) {
+      (0, import_log.log)("Edge identity changed", {
+        identity,
+        oldIdentity: this._identity
+      }, {
+        F: __dxlog_file4,
+        L: 95,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      this._identity = identity;
+      this._closeCurrentConnection(new EdgeIdentityChangedError());
+      this._persistentLifecycle.scheduleRestart();
+    }
   }
-  addListener(listener) {
-    this._listeners.add(listener);
-    return () => this._listeners.delete(listener);
+  onMessage(listener) {
+    this._messageListeners.add(listener);
+    return () => this._messageListeners.delete(listener);
+  }
+  onReconnected(listener) {
+    this._reconnectListeners.add(listener);
+    if (this._ready.state === import_async.TriggerState.RESOLVED) {
+      (0, import_async.scheduleMicroTask)(this._ctx, () => {
+        if (this._reconnectListeners.has(listener)) {
+          try {
+            listener();
+          } catch (error) {
+            import_log.log.catch(error, void 0, {
+              F: __dxlog_file4,
+              L: 117,
+              S: this,
+              C: (f, a) => f(...a)
+            });
+          }
+        }
+      });
+    }
+    return () => this._reconnectListeners.delete(listener);
   }
   /**
   * Open connection to messaging service.
@@ -294,8 +505,8 @@ var EdgeClient = class extends import_context.Resource {
     (0, import_log.log)("opening...", {
       info: this.info
     }, {
-      F: __dxlog_file3,
-      L: 101,
+      F: __dxlog_file4,
+      L: 129,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -303,8 +514,8 @@ var EdgeClient = class extends import_context.Resource {
       import_log.log.warn("Error while opening connection", {
         err
       }, {
-        F: __dxlog_file3,
-        L: 103,
+        F: __dxlog_file4,
+        L: 131,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -315,126 +526,139 @@ var EdgeClient = class extends import_context.Resource {
   */
   async _close() {
     (0, import_log.log)("closing...", {
-      peerKey: this._peerKey
+      peerKey: this._identity.peerKey
     }, {
-      F: __dxlog_file3,
-      L: 111,
+      F: __dxlog_file4,
+      L: 139,
       S: this,
       C: (f, a) => f(...a)
     });
+    this._closeCurrentConnection();
     await this._persistentLifecycle.close();
   }
-  async _openWebSocket() {
-    const url = new URL(`/ws/${this._identityKey}/${this._peerKey}`, this._config.socketEndpoint);
-    this._ws = new import_isomorphic_ws.default(url);
-    this._ws.onopen = () => {
-      (0, import_log.log)("opened", this.info, {
-        F: __dxlog_file3,
-        L: 120,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      this._ready.wake();
-    };
-    this._ws.onclose = () => {
-      (0, import_log.log)("closed", this.info, {
-        F: __dxlog_file3,
-        L: 124,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      this._persistentLifecycle.scheduleRestart();
-    };
-    this._ws.onerror = (event) => {
-      import_log.log.warn("EdgeClient socket error", {
-        error: event.error,
-        info: event.message
-      }, {
-        F: __dxlog_file3,
-        L: 128,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      this._persistentLifecycle.scheduleRestart();
-    };
-    this._ws.onmessage = async (event) => {
-      if (event.data === "__pong__") {
-        this._onHeartbeat();
-        return;
-      }
-      const data = await toUint8Array(event.data);
-      const message = import_buf.buf.fromBinary(import_messenger_pb.MessageSchema, data);
-      (0, import_log.log)("received", {
-        peerKey: this._peerKey,
-        payload: protocol.getPayloadType(message)
-      }, {
-        F: __dxlog_file3,
-        L: 141,
+  async _connect() {
+    if (this._ctx.disposed) {
+      return void 0;
+    }
+    const identity = this._identity;
+    const path = `/ws/${identity.identityKey}/${identity.peerKey}`;
+    const protocolHeader = this._config.disableAuth ? void 0 : await this._createAuthHeader(path);
+    if (this._identity !== identity) {
+      (0, import_log.log)("identity changed during auth header request", void 0, {
+        F: __dxlog_file4,
+        L: 153,
         S: this,
         C: (f, a) => f(...a)
       });
-      if (message) {
-        for (const listener of this._listeners) {
-          try {
-            await listener(message);
-          } catch (err) {
-            import_log.log.error("processing", {
-              err,
-              payload: protocol.getPayloadType(message)
-            }, {
-              F: __dxlog_file3,
-              L: 147,
-              S: this,
-              C: (f, a) => f(...a)
-            });
-          }
+      return void 0;
+    }
+    const restartRequired = new import_async.Trigger();
+    const url = new URL(path, this._baseWsUrl);
+    (0, import_log.log)("Opening websocket", {
+      url: url.toString(),
+      protocolHeader
+    }, {
+      F: __dxlog_file4,
+      L: 159,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const connection = new EdgeWsConnection(identity, {
+      url,
+      protocolHeader
+    }, {
+      onConnected: () => {
+        if (this._isActive(connection)) {
+          this._ready.wake();
+          this._notifyReconnected();
+        } else {
+          import_log.log.verbose("connected callback ignored, because connection is not active", void 0, {
+            F: __dxlog_file4,
+            L: 169,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+        }
+      },
+      onRestartRequired: () => {
+        if (this._isActive(connection)) {
+          this._closeCurrentConnection();
+          this._persistentLifecycle.scheduleRestart();
+        } else {
+          import_log.log.verbose("restart requested by inactive connection", void 0, {
+            F: __dxlog_file4,
+            L: 177,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+        }
+        restartRequired.wake();
+      },
+      onMessage: (message) => {
+        if (this._isActive(connection)) {
+          this._notifyMessageReceived(message);
+        } else {
+          import_log.log.verbose("ignored a message on inactive connection", {
+            from: message.source,
+            type: message.payload?.typeUrl
+          }, {
+            F: __dxlog_file4,
+            L: 185,
+            S: this,
+            C: (f, a) => f(...a)
+          });
         }
       }
-    };
-    await this._ready.wait({
-      timeout: this._config.timeout ?? DEFAULT_TIMEOUT
-    });
-    this._keepaliveCtx = new import_context.Context(void 0, {
-      F: __dxlog_file3,
-      L: 154
     });
-    (0, import_async.scheduleTaskInterval)(this._keepaliveCtx, async () => {
-      this._ws?.send("__ping__");
-    }, SIGNAL_KEEPALIVE_INTERVAL);
-    this._ws.send("__ping__");
-    this._onHeartbeat();
+    this._currentConnection = connection;
+    await connection.open();
+    await Promise.race([
+      this._ready.wait({
+        timeout: this._config.timeout ?? DEFAULT_TIMEOUT
+      }),
+      restartRequired
+    ]);
+    return connection;
   }
-  async _closeWebSocket() {
-    if (!this._ws) {
-      return;
+  async _disconnect(state) {
+    await state.close();
+  }
+  _closeCurrentConnection(error = new EdgeConnectionClosedError()) {
+    this._currentConnection = void 0;
+    this._ready.throw(error);
+    this._ready.reset();
+  }
+  _notifyReconnected() {
+    for (const listener of this._reconnectListeners) {
+      try {
+        listener();
+      } catch (err) {
+        import_log.log.error("ws reconnect listener failed", {
+          err
+        }, {
+          F: __dxlog_file4,
+          L: 218,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      }
     }
-    try {
-      this._ready.throw(new WebsocketClosedError());
-      this._ready.reset();
-      void this._keepaliveCtx?.dispose();
-      this._keepaliveCtx = void 0;
-      void this._heartBeatContext?.dispose();
-      this._heartBeatContext = void 0;
-      this._ws.onopen = () => {
-      };
-      this._ws.onclose = () => {
-      };
-      this._ws.onerror = () => {
-      };
-      this._ws.close();
-      this._ws = void 0;
-    } catch (err) {
-      if (err instanceof Error && err.message.includes("WebSocket is closed before the connection is established.")) {
-        return;
+  }
+  _notifyMessageReceived(message) {
+    for (const listener of this._messageListeners) {
+      try {
+        listener(message);
+      } catch (err) {
+        import_log.log.error("ws incoming message processing failed", {
+          err,
+          payload: import_chunk_ANV2HBEH.protocol.getPayloadType(message)
+        }, {
+          F: __dxlog_file4,
+          L: 228,
+          S: this,
+          C: (f, a) => f(...a)
+        });
       }
-      import_log.log.warn("Error closing websocket", {
-        err
-      }, {
-        F: __dxlog_file3,
-        L: 190,
-        S: this,
-        C: (f, a) => f(...a)
-      });
     }
   }
   /**
@@ -443,58 +667,349 @@ var EdgeClient = class extends import_context.Resource {
   */
   async send(message) {
     if (this._ready.state !== import_async.TriggerState.RESOLVED) {
+      (0, import_log.log)("waiting for websocket to become ready", void 0, {
+        F: __dxlog_file4,
+        L: 239,
+        S: this,
+        C: (f, a) => f(...a)
+      });
       await this._ready.wait({
         timeout: this._config.timeout ?? DEFAULT_TIMEOUT
       });
     }
-    (0, import_invariant.invariant)(this._ws, void 0, {
-      F: __dxlog_file3,
-      L: 202,
-      S: this,
-      A: [
-        "this._ws",
-        ""
-      ]
+    if (!this._currentConnection) {
+      throw new EdgeConnectionClosedError();
+    }
+    if (message.source && (message.source.peerKey !== this._identity.peerKey || message.source.identityKey !== this.identityKey)) {
+      throw new EdgeIdentityChangedError();
+    }
+    this._currentConnection.send(message);
+  }
+  async _createAuthHeader(path) {
+    const httpUrl = new URL(path, this._baseHttpUrl);
+    httpUrl.protocol = getEdgeUrlWithProtocol(this._baseWsUrl.toString(), "http");
+    const response = await fetch(httpUrl, {
+      method: "GET"
     });
-    (0, import_invariant.invariant)(!message.source || message.source.peerKey === this._peerKey, void 0, {
-      F: __dxlog_file3,
-      L: 203,
+    if (response.status === 401) {
+      return encodePresentationWsAuthHeader(await handleAuthChallenge(response, this._identity));
+    } else {
+      import_log.log.warn("no auth challenge from edge", {
+        status: response.status,
+        statusText: response.statusText
+      }, {
+        F: __dxlog_file4,
+        L: 264,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return void 0;
+    }
+  }
+};
+_ts_decorate3([
+  import_log.logInfo
+], EdgeClient.prototype, "info", null);
+var encodePresentationWsAuthHeader = (encodedPresentation) => {
+  const encodedToken = Buffer.from(encodedPresentation).toString("base64").replace(/=*$/, "").replaceAll("/", "|");
+  return `base64url.bearer.authorization.dxos.org.${encodedToken}`;
+};
+var createDeviceEdgeIdentity = async (signer, key) => {
+  return {
+    identityKey: key.toHex(),
+    peerKey: key.toHex(),
+    presentCredentials: async ({ challenge }) => {
+      return (0, import_credentials.signPresentation)({
+        presentation: {
+          credentials: [
+            // Verifier requires at least one credential in the presentation to establish the subject.
+            await (0, import_credentials.createCredential)({
+              assertion: {
+                "@type": "dxos.halo.credentials.Auth"
+              },
+              issuer: key,
+              subject: key,
+              signer
+            })
+          ]
+        },
+        signer,
+        signerKey: key,
+        nonce: challenge
+      });
+    }
+  };
+};
+var createChainEdgeIdentity = async (signer, identityKey, peerKey, chain, credentials) => {
+  const credentialsToSign = credentials.length > 0 ? credentials : [
+    await (0, import_credentials.createCredential)({
+      assertion: {
+        "@type": "dxos.halo.credentials.Auth"
+      },
+      issuer: identityKey,
+      subject: identityKey,
+      signer,
+      chain,
+      signingKey: peerKey
+    })
+  ];
+  return {
+    identityKey: identityKey.toHex(),
+    peerKey: peerKey.toHex(),
+    presentCredentials: async ({ challenge }) => {
+      return (0, import_credentials.signPresentation)({
+        presentation: {
+          credentials: credentialsToSign
+        },
+        signer,
+        nonce: challenge,
+        signerKey: peerKey,
+        chain
+      });
+    }
+  };
+};
+var createEphemeralEdgeIdentity = async () => {
+  const keyring = new import_keyring.Keyring();
+  const key = await keyring.createKey();
+  return createDeviceEdgeIdentity(keyring, key);
+};
+var createTestHaloEdgeIdentity = async (signer, identityKey, deviceKey) => {
+  const deviceAdmission = await (0, import_credentials.createCredential)({
+    assertion: {
+      "@type": "dxos.halo.credentials.AuthorizedDevice",
+      deviceKey,
+      identityKey
+    },
+    issuer: identityKey,
+    subject: deviceKey,
+    signer
+  });
+  return createChainEdgeIdentity(signer, identityKey, deviceKey, {
+    credential: deviceAdmission
+  }, [
+    await (0, import_credentials.createCredential)({
+      assertion: {
+        "@type": "dxos.halo.credentials.Auth"
+      },
+      issuer: identityKey,
+      subject: identityKey,
+      signer
+    })
+  ]);
+};
+var createStubEdgeIdentity = () => {
+  const identityKey = import_keys.PublicKey.random();
+  const deviceKey = import_keys.PublicKey.random();
+  return {
+    identityKey: identityKey.toHex(),
+    peerKey: deviceKey.toHex(),
+    presentCredentials: async () => {
+      throw new Error("Stub identity does not support authentication.");
+    }
+  };
+};
+var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/mesh/edge-client/src/edge-http-client.ts";
+var DEFAULT_RETRY_TIMEOUT = 1500;
+var DEFAULT_RETRY_JITTER = 500;
+var DEFAULT_MAX_RETRIES_COUNT = 3;
+var EdgeHttpClient = class {
+  constructor(baseUrl) {
+    this._baseUrl = getEdgeUrlWithProtocol(baseUrl, "http");
+    (0, import_log4.log)("created", {
+      url: this._baseUrl
+    }, {
+      F: __dxlog_file5,
+      L: 42,
       S: this,
-      A: [
-        "!message.source || message.source.peerKey === this._peerKey",
-        ""
-      ]
+      C: (f, a) => f(...a)
     });
-    (0, import_log.log)("sending...", {
-      peerKey: this._peerKey,
-      payload: protocol.getPayloadType(message)
+  }
+  setIdentity(identity) {
+    if (this._edgeIdentity?.identityKey !== identity.identityKey || this._edgeIdentity?.peerKey !== identity.peerKey) {
+      this._edgeIdentity = identity;
+      this._authHeader = void 0;
+    }
+  }
+  createAgent(body, args) {
+    return this._call("/agents/create", {
+      ...args,
+      method: "POST",
+      body
+    });
+  }
+  getAgentStatus(request, args) {
+    return this._call(`/users/${request.ownerIdentityKey.toHex()}/agent/status`, {
+      ...args,
+      method: "GET"
+    });
+  }
+  getCredentialsForNotarization(spaceId, args) {
+    return this._call(`/spaces/${spaceId}/notarization`, {
+      ...args,
+      method: "GET"
+    });
+  }
+  async notarizeCredentials(spaceId, body, args) {
+    await this._call(`/spaces/${spaceId}/notarization`, {
+      ...args,
+      body,
+      method: "POST"
+    });
+  }
+  async joinSpaceByInvitation(spaceId, body, args) {
+    return this._call(`/spaces/${spaceId}/join`, {
+      ...args,
+      body,
+      method: "POST"
+    });
+  }
+  async recoverIdentity(body, args) {
+    return this._call("/identity/recover", {
+      ...args,
+      body,
+      method: "POST"
+    });
+  }
+  async _call(path, args) {
+    const requestContext = args.context ?? new import_context4.Context(void 0, {
+      F: __dxlog_file5,
+      L: 91
+    });
+    const shouldRetry = createRetryHandler(args);
+    const url = `${this._baseUrl}${path.startsWith("/") ? path.slice(1) : path}`;
+    import_log4.log.info("call", {
+      method: args.method,
+      path,
+      request: args.body
     }, {
-      F: __dxlog_file3,
-      L: 204,
+      F: __dxlog_file5,
+      L: 95,
       S: this,
       C: (f, a) => f(...a)
     });
-    this._ws.send(import_buf.buf.toBinary(import_messenger_pb.MessageSchema, message));
+    let handledAuth = false;
+    let authHeader = this._authHeader;
+    while (true) {
+      let processingError;
+      let retryAfterHeaderValue = Number.NaN;
+      try {
+        const request = createRequest(args, authHeader);
+        const response = await fetch(url, request);
+        retryAfterHeaderValue = Number(response.headers.get("Retry-After"));
+        if (response.ok) {
+          const body = await response.json();
+          if (body.success) {
+            return body.data;
+          }
+          import_log4.log.info("unsuccessful edge response", {
+            path,
+            body
+          }, {
+            F: __dxlog_file5,
+            L: 114,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          if (body.errorData?.type === "auth_challenge" && typeof body.errorData?.challenge === "string") {
+            processingError = new import_protocols.EdgeAuthChallengeError(body.errorData.challenge, body.errorData);
+          } else {
+            processingError = import_protocols.EdgeCallFailedError.fromUnsuccessfulResponse(response, body);
+          }
+        } else if (response.status === 401 && !handledAuth) {
+          authHeader = await this._handleUnauthorized(response);
+          handledAuth = true;
+          continue;
+        } else {
+          processingError = import_protocols.EdgeCallFailedError.fromHttpFailure(response);
+        }
+      } catch (error) {
+        processingError = import_protocols.EdgeCallFailedError.fromProcessingFailureCause(error);
+      }
+      if (processingError.isRetryable && await shouldRetry(requestContext, retryAfterHeaderValue)) {
+        import_log4.log.info("retrying edge request", {
+          path,
+          processingError
+        }, {
+          F: __dxlog_file5,
+          L: 133,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+      } else {
+        throw processingError;
+      }
+    }
   }
-  _onHeartbeat() {
-    if (this._lifecycleState !== import_context.LifecycleState.OPEN) {
-      return;
+  async _handleUnauthorized(response) {
+    if (!this._edgeIdentity) {
+      import_log4.log.warn("edge unauthorized response received before identity was set", void 0, {
+        F: __dxlog_file5,
+        L: 142,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      throw import_protocols.EdgeCallFailedError.fromHttpFailure(response);
     }
-    void this._heartBeatContext?.dispose();
-    this._heartBeatContext = new import_context.Context(void 0, {
-      F: __dxlog_file3,
-      L: 213
+    const challenge = await handleAuthChallenge(response, this._edgeIdentity);
+    this._authHeader = encodeAuthHeader(challenge);
+    (0, import_log4.log)("auth header updated", void 0, {
+      F: __dxlog_file5,
+      L: 147,
+      S: this,
+      C: (f, a) => f(...a)
     });
-    (0, import_async.scheduleTask)(this._heartBeatContext, () => {
-      this._persistentLifecycle.scheduleRestart();
-    }, 2 * SIGNAL_KEEPALIVE_INTERVAL);
+    return this._authHeader;
+  }
+};
+var createRetryHandler = (args) => {
+  if (!args.retry || args.retry.count < 1) {
+    return async () => false;
   }
+  let retries = 0;
+  const maxRetries = args.retry.count ?? DEFAULT_MAX_RETRIES_COUNT;
+  const baseTimeout = args.retry.timeout ?? DEFAULT_RETRY_TIMEOUT;
+  const jitter = args.retry.jitter ?? DEFAULT_RETRY_JITTER;
+  return async (ctx, retryAfter) => {
+    if (++retries > maxRetries || ctx.disposed) {
+      return false;
+    }
+    if (retryAfter) {
+      await (0, import_async4.sleep)(retryAfter);
+    } else {
+      const timeout = baseTimeout + Math.random() * jitter;
+      await (0, import_async4.sleep)(timeout);
+    }
+    return true;
+  };
+};
+var createRequest = (args, authHeader) => {
+  return {
+    method: args.method,
+    body: args.body && JSON.stringify(args.body),
+    headers: authHeader ? {
+      Authorization: authHeader
+    } : void 0
+  };
+};
+var encodeAuthHeader = (challenge) => {
+  const encodedChallenge = Buffer.from(challenge).toString("base64");
+  return `VerifiablePresentation pb;base64,${encodedChallenge}`;
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   EdgeClient,
+  EdgeConnectionClosedError,
+  EdgeHttpClient,
+  EdgeIdentityChangedError,
   Protocol,
+  createChainEdgeIdentity,
+  createDeviceEdgeIdentity,
+  createEphemeralEdgeIdentity,
+  createStubEdgeIdentity,
+  createTestHaloEdgeIdentity,
   getTypename,
+  handleAuthChallenge,
   protocol,
   toUint8Array,
   ...require("@dxos/protocols/buf/dxos/edge/messenger_pb")