@dxos/edge-client 0.8.4-main.84f28bd → 0.8.4-main.a4bbb77

package/dist/lib/node-esm/index.mjs

@@ -7,24 +7,135 @@ import {
   getTypename,
   protocol,
   toUint8Array
-} from "./chunk-X7J46ISZ.mjs";
+} from "./chunk-DR5YNW5K.mjs";
 
 // src/index.ts
 export * from "@dxos/protocols/buf/dxos/edge/messenger_pb";
 
+// src/auth.ts
+import { createCredential, signPresentation } from "@dxos/credentials";
+import { invariant } from "@dxos/invariant";
+import { Keyring } from "@dxos/keyring";
+import { PublicKey } from "@dxos/keys";
+var __dxlog_file = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/auth.ts";
+var createDeviceEdgeIdentity = async (signer, key) => {
+  return {
+    identityKey: key.toHex(),
+    peerKey: key.toHex(),
+    presentCredentials: async ({ challenge }) => {
+      return signPresentation({
+        presentation: {
+          credentials: [
+            // Verifier requires at least one credential in the presentation to establish the subject.
+            await createCredential({
+              assertion: {
+                "@type": "dxos.halo.credentials.Auth"
+              },
+              issuer: key,
+              subject: key,
+              signer
+            })
+          ]
+        },
+        signer,
+        signerKey: key,
+        nonce: challenge
+      });
+    }
+  };
+};
+var createChainEdgeIdentity = async (signer, identityKey, peerKey, chain, credentials) => {
+  const credentialsToSign = credentials.length > 0 ? credentials : [
+    await createCredential({
+      assertion: {
+        "@type": "dxos.halo.credentials.Auth"
+      },
+      issuer: identityKey,
+      subject: identityKey,
+      signer,
+      chain,
+      signingKey: peerKey
+    })
+  ];
+  return {
+    identityKey: identityKey.toHex(),
+    peerKey: peerKey.toHex(),
+    presentCredentials: async ({ challenge }) => {
+      invariant(chain, void 0, {
+        F: __dxlog_file,
+        L: 75,
+        S: void 0,
+        A: [
+          "chain",
+          ""
+        ]
+      });
+      return signPresentation({
+        presentation: {
+          credentials: credentialsToSign
+        },
+        signer,
+        nonce: challenge,
+        signerKey: peerKey,
+        chain
+      });
+    }
+  };
+};
+var createEphemeralEdgeIdentity = async () => {
+  const keyring = new Keyring();
+  const key = await keyring.createKey();
+  return createDeviceEdgeIdentity(keyring, key);
+};
+var createTestHaloEdgeIdentity = async (signer, identityKey, deviceKey) => {
+  const deviceAdmission = await createCredential({
+    assertion: {
+      "@type": "dxos.halo.credentials.AuthorizedDevice",
+      deviceKey,
+      identityKey
+    },
+    issuer: identityKey,
+    subject: deviceKey,
+    signer
+  });
+  return createChainEdgeIdentity(signer, identityKey, deviceKey, {
+    credential: deviceAdmission
+  }, [
+    await createCredential({
+      assertion: {
+        "@type": "dxos.halo.credentials.Auth"
+      },
+      issuer: identityKey,
+      subject: identityKey,
+      signer
+    })
+  ]);
+};
+var createStubEdgeIdentity = () => {
+  const identityKey = PublicKey.random();
+  const deviceKey = PublicKey.random();
+  return {
+    identityKey: identityKey.toHex(),
+    peerKey: deviceKey.toHex(),
+    presentCredentials: async () => {
+      throw new Error("Stub identity does not support authentication.");
+    }
+  };
+};
+
 // src/edge-client.ts
-import { Trigger, scheduleMicroTask, TriggerState, PersistentLifecycle, Event } from "@dxos/async";
+import { Event, PersistentLifecycle, Trigger, TriggerState, scheduleMicroTask } from "@dxos/async";
 import { Resource as Resource2 } from "@dxos/context";
 import { log as log2, logInfo as logInfo2 } from "@dxos/log";
 import { EdgeStatus } from "@dxos/protocols/proto/dxos/client/services";
 
 // src/edge-identity.ts
-import { invariant } from "@dxos/invariant";
+import { invariant as invariant2 } from "@dxos/invariant";
 import { schema } from "@dxos/protocols/proto";
-var __dxlog_file = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-identity.ts";
+var __dxlog_file2 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-identity.ts";
 var handleAuthChallenge = async (failedResponse, identity) => {
-  invariant(failedResponse.status === 401, void 0, {
-    F: __dxlog_file,
+  invariant2(failedResponse.status === 401, void 0, {
+    F: __dxlog_file2,
     L: 21,
     S: void 0,
     A: [
@@ -33,8 +144,8 @@ var handleAuthChallenge = async (failedResponse, identity) => {
     ]
   });
   const headerValue = failedResponse.headers.get("Www-Authenticate");
-  invariant(headerValue?.startsWith("VerifiablePresentation challenge="), void 0, {
-    F: __dxlog_file,
+  invariant2(headerValue?.startsWith("VerifiablePresentation challenge="), void 0, {
+    F: __dxlog_file2,
     L: 24,
     S: void 0,
     A: [
@@ -43,8 +154,8 @@ var handleAuthChallenge = async (failedResponse, identity) => {
     ]
   });
   const challenge = headerValue?.slice("VerifiablePresentation challenge=".length);
-  invariant(challenge, void 0, {
-    F: __dxlog_file,
+  invariant2(challenge, void 0, {
+    F: __dxlog_file2,
     L: 27,
     S: void 0,
     A: [
@@ -62,24 +173,34 @@ var handleAuthChallenge = async (failedResponse, identity) => {
 import WebSocket from "isomorphic-ws";
 import { scheduleTask, scheduleTaskInterval } from "@dxos/async";
 import { Context, Resource } from "@dxos/context";
-import { invariant as invariant2 } from "@dxos/invariant";
+import { invariant as invariant3 } from "@dxos/invariant";
 import { log, logInfo } from "@dxos/log";
 import { EdgeWebsocketProtocol } from "@dxos/protocols";
 import { buf } from "@dxos/protocols/buf";
 import { MessageSchema } from "@dxos/protocols/buf/dxos/edge/messenger_pb";
+function _define_property(obj, key, value) {
+  if (key in obj) {
+    Object.defineProperty(obj, key, {
+      value,
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
+  } else {
+    obj[key] = value;
+  }
+  return obj;
+}
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file2 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-ws-connection.ts";
+var __dxlog_file3 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-ws-connection.ts";
 var SIGNAL_KEEPALIVE_INTERVAL = 4e3;
 var SIGNAL_KEEPALIVE_TIMEOUT = 12e3;
 var EdgeWsConnection = class extends Resource {
-  constructor(_identity, _connectionInfo, _callbacks) {
-    super(), this._identity = _identity, this._connectionInfo = _connectionInfo, this._callbacks = _callbacks;
-  }
   get info() {
     return {
       open: this.isOpen,
@@ -88,18 +209,18 @@ var EdgeWsConnection = class extends Resource {
     };
   }
   send(message) {
-    invariant2(this._ws, void 0, {
-      F: __dxlog_file2,
-      L: 52,
+    invariant3(this._ws, void 0, {
+      F: __dxlog_file3,
+      L: 53,
       S: this,
       A: [
         "this._ws",
         ""
       ]
     });
-    invariant2(this._wsMuxer, void 0, {
-      F: __dxlog_file2,
-      L: 53,
+    invariant3(this._wsMuxer, void 0, {
+      F: __dxlog_file3,
+      L: 54,
       S: this,
       A: [
         "this._wsMuxer",
@@ -110,8 +231,8 @@ var EdgeWsConnection = class extends Resource {
       peerKey: this._identity.peerKey,
       payload: protocol.getPayloadType(message)
     }, {
-      F: __dxlog_file2,
-      L: 54,
+      F: __dxlog_file3,
+      L: 55,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -123,8 +244,8 @@ var EdgeWsConnection = class extends Resource {
           serviceId: message.serviceId,
           payload: protocol.getPayloadType(message)
         }, {
-          F: __dxlog_file2,
-          L: 58,
+          F: __dxlog_file3,
+          L: 59,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -133,8 +254,8 @@ var EdgeWsConnection = class extends Resource {
       this._ws.send(binary);
     } else {
       this._wsMuxer.send(message).catch((e) => log.catch(e, void 0, {
-        F: __dxlog_file2,
-        L: 67,
+        F: __dxlog_file3,
+        L: 68,
         S: this,
         C: (f, a) => f(...a)
       }));
@@ -155,8 +276,8 @@ var EdgeWsConnection = class extends Resource {
     this._ws.onopen = () => {
       if (this.isOpen) {
         log("connected", void 0, {
-          F: __dxlog_file2,
-          L: 84,
+          F: __dxlog_file3,
+          L: 85,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -166,8 +287,8 @@ var EdgeWsConnection = class extends Resource {
         log.verbose("connected after becoming inactive", {
           currentIdentity: this._identity
         }, {
-          F: __dxlog_file2,
-          L: 88,
+          F: __dxlog_file3,
+          L: 89,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -179,8 +300,8 @@ var EdgeWsConnection = class extends Resource {
           code: event.code,
           reason: event.reason
         }, {
-          F: __dxlog_file2,
-          L: 93,
+          F: __dxlog_file3,
+          L: 94,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -194,8 +315,8 @@ var EdgeWsConnection = class extends Resource {
           error: event.error,
           info: event.message
         }, {
-          F: __dxlog_file2,
-          L: 100,
+          F: __dxlog_file3,
+          L: 101,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -204,8 +325,8 @@ var EdgeWsConnection = class extends Resource {
         log.verbose("error ignored on closed connection", {
           error: event.error
         }, {
-          F: __dxlog_file2,
-          L: 103,
+          F: __dxlog_file3,
+          L: 104,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -216,13 +337,14 @@ var EdgeWsConnection = class extends Resource {
         log.verbose("message ignored on closed connection", {
           event: event.type
         }, {
-          F: __dxlog_file2,
-          L: 111,
+          F: __dxlog_file3,
+          L: 112,
           S: this,
           C: (f, a) => f(...a)
         });
         return;
       }
+      this._lastReceivedMessageTimestamp = Date.now();
       if (event.data === "__pong__") {
         this._rescheduleHeartbeatTimeout();
         return;
@@ -237,8 +359,8 @@ var EdgeWsConnection = class extends Resource {
           from: message.source,
           payload: protocol.getPayloadType(message)
         }, {
-          F: __dxlog_file2,
-          L: 128,
+          F: __dxlog_file3,
+          L: 130,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -261,17 +383,17 @@ var EdgeWsConnection = class extends Resource {
       log.warn("Error closing websocket", {
         err
       }, {
-        F: __dxlog_file2,
-        L: 146,
+        F: __dxlog_file3,
+        L: 148,
         S: this,
         C: (f, a) => f(...a)
       });
     }
   }
   _scheduleHeartbeats() {
-    invariant2(this._ws, void 0, {
-      F: __dxlog_file2,
-      L: 151,
+    invariant3(this._ws, void 0, {
+      F: __dxlog_file3,
+      L: 153,
       S: this,
       A: [
         "this._ws",
@@ -290,21 +412,30 @@ var EdgeWsConnection = class extends Resource {
     }
     void this._inactivityTimeoutCtx?.dispose();
     this._inactivityTimeoutCtx = new Context(void 0, {
-      F: __dxlog_file2,
-      L: 170
+      F: __dxlog_file3,
+      L: 172
     });
     scheduleTask(this._inactivityTimeoutCtx, () => {
       if (this.isOpen) {
-        log.warn("restart due to inactivity timeout", void 0, {
-          F: __dxlog_file2,
-          L: 175,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        this._callbacks.onRestartRequired();
+        if (Date.now() - this._lastReceivedMessageTimestamp > SIGNAL_KEEPALIVE_TIMEOUT) {
+          log.warn("restart due to inactivity timeout", {
+            lastReceivedMessageTimestamp: this._lastReceivedMessageTimestamp
+          }, {
+            F: __dxlog_file3,
+            L: 178,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          this._callbacks.onRestartRequired();
+        } else {
+          this._rescheduleHeartbeatTimeout();
+        }
       }
     }, SIGNAL_KEEPALIVE_TIMEOUT);
   }
+  constructor(_identity, _connectionInfo, _callbacks) {
+    super(), _define_property(this, "_identity", void 0), _define_property(this, "_connectionInfo", void 0), _define_property(this, "_callbacks", void 0), _define_property(this, "_inactivityTimeoutCtx", void 0), _define_property(this, "_ws", void 0), _define_property(this, "_wsMuxer", void 0), _define_property(this, "_lastReceivedMessageTimestamp", void 0), this._identity = _identity, this._connectionInfo = _connectionInfo, this._callbacks = _callbacks, this._lastReceivedMessageTimestamp = Date.now();
+  }
 };
 _ts_decorate([
   logInfo
@@ -331,23 +462,28 @@ var getEdgeUrlWithProtocol = (baseUrl, protocol2) => {
 };
 
 // src/edge-client.ts
+function _define_property2(obj, key, value) {
+  if (key in obj) {
+    Object.defineProperty(obj, key, {
+      value,
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
+  } else {
+    obj[key] = value;
+  }
+  return obj;
+}
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file3 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-client.ts";
+var __dxlog_file4 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-client.ts";
 var DEFAULT_TIMEOUT = 1e4;
 var EdgeClient = class extends Resource2 {
-  constructor(_identity, _config) {
-    super(), this._identity = _identity, this._config = _config, this.statusChanged = new Event(), this._persistentLifecycle = new PersistentLifecycle({
-      start: async () => this._connect(),
-      stop: async (state) => this._disconnect(state)
-    }), this._messageListeners = /* @__PURE__ */ new Set(), this._reconnectListeners = /* @__PURE__ */ new Set(), this._currentConnection = void 0, this._ready = new Trigger(), this._isActive = (connection) => connection === this._currentConnection;
-    this._baseWsUrl = getEdgeUrlWithProtocol(_config.socketEndpoint, "ws");
-    this._baseHttpUrl = getEdgeUrlWithProtocol(_config.socketEndpoint, "http");
-  }
   get info() {
     return {
       open: this.isOpen,
@@ -371,7 +507,7 @@ var EdgeClient = class extends Resource2 {
         identity,
         oldIdentity: this._identity
       }, {
-        F: __dxlog_file3,
+        F: __dxlog_file4,
         L: 99,
         S: this,
         C: (f, a) => f(...a)
@@ -381,6 +517,30 @@ var EdgeClient = class extends Resource2 {
       void this._persistentLifecycle.scheduleRestart();
     }
   }
+  /**
+  * Send message.
+  * NOTE: The message is guaranteed to be delivered but the service must respond with a message to confirm processing.
+  */
+  async send(message) {
+    if (this._ready.state !== TriggerState.RESOLVED) {
+      log2("waiting for websocket", void 0, {
+        F: __dxlog_file4,
+        L: 112,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      await this._ready.wait({
+        timeout: this._config.timeout ?? DEFAULT_TIMEOUT
+      });
+    }
+    if (!this._currentConnection) {
+      throw new EdgeConnectionClosedError();
+    }
+    if (message.source && (message.source.peerKey !== this._identity.peerKey || message.source.identityKey !== this.identityKey)) {
+      throw new EdgeIdentityChangedError();
+    }
+    this._currentConnection.send(message);
+  }
   onMessage(listener) {
     this._messageListeners.add(listener);
     return () => this._messageListeners.delete(listener);
@@ -394,8 +554,8 @@ var EdgeClient = class extends Resource2 {
             listener();
           } catch (error) {
             log2.catch(error, void 0, {
-              F: __dxlog_file3,
-              L: 121,
+              F: __dxlog_file4,
+              L: 145,
               S: this,
               C: (f, a) => f(...a)
             });
@@ -412,8 +572,8 @@ var EdgeClient = class extends Resource2 {
     log2("opening...", {
       info: this.info
     }, {
-      F: __dxlog_file3,
-      L: 133,
+      F: __dxlog_file4,
+      L: 158,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -421,8 +581,8 @@ var EdgeClient = class extends Resource2 {
       log2.warn("Error while opening connection", {
         err
       }, {
-        F: __dxlog_file3,
-        L: 135,
+        F: __dxlog_file4,
+        L: 160,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -435,8 +595,8 @@ var EdgeClient = class extends Resource2 {
     log2("closing...", {
       peerKey: this._identity.peerKey
     }, {
-      F: __dxlog_file3,
-      L: 143,
+      F: __dxlog_file4,
+      L: 168,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -452,8 +612,8 @@ var EdgeClient = class extends Resource2 {
     const protocolHeader = this._config.disableAuth ? void 0 : await this._createAuthHeader(path);
     if (this._identity !== identity) {
       log2("identity changed during auth header request", void 0, {
-        F: __dxlog_file3,
-        L: 157,
+        F: __dxlog_file4,
+        L: 182,
         S: this,
         C: (f, a) => f(...a)
       });
@@ -465,8 +625,8 @@ var EdgeClient = class extends Resource2 {
       url: url.toString(),
       protocolHeader
     }, {
-      F: __dxlog_file3,
-      L: 163,
+      F: __dxlog_file4,
+      L: 188,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -480,8 +640,8 @@ var EdgeClient = class extends Resource2 {
           this._notifyReconnected();
         } else {
           log2.verbose("connected callback ignored, because connection is not active", void 0, {
-            F: __dxlog_file3,
-            L: 173,
+            F: __dxlog_file4,
+            L: 198,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -493,8 +653,8 @@ var EdgeClient = class extends Resource2 {
           void this._persistentLifecycle.scheduleRestart();
         } else {
           log2.verbose("restart requested by inactive connection", void 0, {
-            F: __dxlog_file3,
-            L: 181,
+            F: __dxlog_file4,
+            L: 206,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -509,8 +669,8 @@ var EdgeClient = class extends Resource2 {
             from: message.source,
             type: message.payload?.typeUrl
           }, {
-            F: __dxlog_file3,
-            L: 189,
+            F: __dxlog_file4,
+            L: 214,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -546,8 +706,8 @@ var EdgeClient = class extends Resource2 {
         log2.error("ws reconnect listener failed", {
           err
         }, {
-          F: __dxlog_file3,
-          L: 225,
+          F: __dxlog_file4,
+          L: 249,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -563,38 +723,14 @@ var EdgeClient = class extends Resource2 {
           err,
           payload: protocol.getPayloadType(message)
         }, {
-          F: __dxlog_file3,
-          L: 235,
+          F: __dxlog_file4,
+          L: 259,
           S: this,
           C: (f, a) => f(...a)
         });
       }
     }
   }
-  /**
-  * Send message.
-  * NOTE: The message is guaranteed to be delivered but the service must respond with a message to confirm processing.
-  */
-  async send(message) {
-    if (this._ready.state !== TriggerState.RESOLVED) {
-      log2("waiting for websocket to become ready", void 0, {
-        F: __dxlog_file3,
-        L: 246,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      await this._ready.wait({
-        timeout: this._config.timeout ?? DEFAULT_TIMEOUT
-      });
-    }
-    if (!this._currentConnection) {
-      throw new EdgeConnectionClosedError();
-    }
-    if (message.source && (message.source.peerKey !== this._identity.peerKey || message.source.identityKey !== this.identityKey)) {
-      throw new EdgeIdentityChangedError();
-    }
-    this._currentConnection.send(message);
-  }
   async _createAuthHeader(path) {
     const httpUrl = new URL(path, this._baseHttpUrl);
     httpUrl.protocol = getEdgeUrlWithProtocol(this._baseWsUrl.toString(), "http");
@@ -608,7 +744,7 @@ var EdgeClient = class extends Resource2 {
         status: response.status,
         statusText: response.statusText
       }, {
-        F: __dxlog_file3,
+        F: __dxlog_file4,
         L: 271,
         S: this,
         C: (f, a) => f(...a)
@@ -616,6 +752,14 @@ var EdgeClient = class extends Resource2 {
       return void 0;
     }
   }
+  constructor(_identity, _config) {
+    super(), _define_property2(this, "_identity", void 0), _define_property2(this, "_config", void 0), _define_property2(this, "statusChanged", void 0), _define_property2(this, "_persistentLifecycle", void 0), _define_property2(this, "_messageListeners", void 0), _define_property2(this, "_reconnectListeners", void 0), _define_property2(this, "_baseWsUrl", void 0), _define_property2(this, "_baseHttpUrl", void 0), _define_property2(this, "_currentConnection", void 0), _define_property2(this, "_ready", void 0), _define_property2(this, "_isActive", void 0), this._identity = _identity, this._config = _config, this.statusChanged = new Event(), this._persistentLifecycle = new PersistentLifecycle({
+      start: async () => this._connect(),
+      stop: async (state) => this._disconnect(state)
+    }), this._messageListeners = /* @__PURE__ */ new Set(), this._reconnectListeners = /* @__PURE__ */ new Set(), this._currentConnection = void 0, this._ready = new Trigger(), this._isActive = (connection) => connection === this._currentConnection;
+    this._baseWsUrl = getEdgeUrlWithProtocol(_config.socketEndpoint, "ws");
+    this._baseHttpUrl = getEdgeUrlWithProtocol(_config.socketEndpoint, "http");
+  }
 };
 _ts_decorate2([
   logInfo2
@@ -625,117 +769,6 @@ var encodePresentationWsAuthHeader = (encodedPresentation) => {
   return `base64url.bearer.authorization.dxos.org.${encodedToken}`;
 };
 
-// src/auth.ts
-import { createCredential, signPresentation } from "@dxos/credentials";
-import { invariant as invariant3 } from "@dxos/invariant";
-import { Keyring } from "@dxos/keyring";
-import { PublicKey } from "@dxos/keys";
-var __dxlog_file4 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/auth.ts";
-var createDeviceEdgeIdentity = async (signer, key) => {
-  return {
-    identityKey: key.toHex(),
-    peerKey: key.toHex(),
-    presentCredentials: async ({ challenge }) => {
-      return signPresentation({
-        presentation: {
-          credentials: [
-            // Verifier requires at least one credential in the presentation to establish the subject.
-            await createCredential({
-              assertion: {
-                "@type": "dxos.halo.credentials.Auth"
-              },
-              issuer: key,
-              subject: key,
-              signer
-            })
-          ]
-        },
-        signer,
-        signerKey: key,
-        nonce: challenge
-      });
-    }
-  };
-};
-var createChainEdgeIdentity = async (signer, identityKey, peerKey, chain, credentials) => {
-  const credentialsToSign = credentials.length > 0 ? credentials : [
-    await createCredential({
-      assertion: {
-        "@type": "dxos.halo.credentials.Auth"
-      },
-      issuer: identityKey,
-      subject: identityKey,
-      signer,
-      chain,
-      signingKey: peerKey
-    })
-  ];
-  return {
-    identityKey: identityKey.toHex(),
-    peerKey: peerKey.toHex(),
-    presentCredentials: async ({ challenge }) => {
-      invariant3(chain, void 0, {
-        F: __dxlog_file4,
-        L: 75,
-        S: void 0,
-        A: [
-          "chain",
-          ""
-        ]
-      });
-      return signPresentation({
-        presentation: {
-          credentials: credentialsToSign
-        },
-        signer,
-        nonce: challenge,
-        signerKey: peerKey,
-        chain
-      });
-    }
-  };
-};
-var createEphemeralEdgeIdentity = async () => {
-  const keyring = new Keyring();
-  const key = await keyring.createKey();
-  return createDeviceEdgeIdentity(keyring, key);
-};
-var createTestHaloEdgeIdentity = async (signer, identityKey, deviceKey) => {
-  const deviceAdmission = await createCredential({
-    assertion: {
-      "@type": "dxos.halo.credentials.AuthorizedDevice",
-      deviceKey,
-      identityKey
-    },
-    issuer: identityKey,
-    subject: deviceKey,
-    signer
-  });
-  return createChainEdgeIdentity(signer, identityKey, deviceKey, {
-    credential: deviceAdmission
-  }, [
-    await createCredential({
-      assertion: {
-        "@type": "dxos.halo.credentials.Auth"
-      },
-      issuer: identityKey,
-      subject: identityKey,
-      signer
-    })
-  ]);
-};
-var createStubEdgeIdentity = () => {
-  const identityKey = PublicKey.random();
-  const deviceKey = PublicKey.random();
-  return {
-    identityKey: identityKey.toHex(),
-    peerKey: deviceKey.toHex(),
-    presentCredentials: async () => {
-      throw new Error("Stub identity does not support authentication.");
-    }
-  };
-};
-
 // src/edge-http-client.ts
 import { FetchHttpClient, HttpClient } from "@effect/platform";
 import { Effect as Effect2, pipe } from "effect";
@@ -748,16 +781,28 @@ import { createUrl } from "@dxos/util";
 // src/http-client.ts
 import { Context as Context2, Duration, Effect, Layer, Schedule } from "effect";
 import { log as log3 } from "@dxos/log";
-var __dxlog_file5 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/http-client.ts";
-var HttpConfig = class _HttpConfig extends Context2.Tag("HttpConfig")() {
-  static {
-    this.default = Layer.succeed(_HttpConfig, {
-      timeout: Duration.millis(1e3),
-      retryTimes: 3,
-      retryBaseDelay: Duration.millis(1e3)
+function _define_property3(obj, key, value) {
+  if (key in obj) {
+    Object.defineProperty(obj, key, {
+      value,
+      enumerable: true,
+      configurable: true,
+      writable: true
     });
+  } else {
+    obj[key] = value;
   }
+  return obj;
+}
+var __dxlog_file5 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/http-client.ts";
+var _Context_Tag;
+var HttpConfig = class extends (_Context_Tag = Context2.Tag("HttpConfig")()) {
 };
+_define_property3(HttpConfig, "default", Layer.succeed(HttpConfig, {
+  timeout: Duration.millis(1e3),
+  retryTimes: 3,
+  retryBaseDelay: Duration.millis(1e3)
+}));
 var withRetry = (effect, { timeout = Duration.millis(1e3), retryBaseDelay = Duration.millis(1e3), retryTimes = 3 } = {}) => {
   return effect.pipe(Effect.flatMap((res) => (
     // Treat 500 errors as retryable?
@@ -785,22 +830,25 @@ var encodeAuthHeader = (challenge) => {
 };
 
 // src/edge-http-client.ts
+function _define_property4(obj, key, value) {
+  if (key in obj) {
+    Object.defineProperty(obj, key, {
+      value,
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
+  } else {
+    obj[key] = value;
+  }
+  return obj;
+}
 var __dxlog_file6 = "/__w/dxos/dxos/packages/core/mesh/edge-client/src/edge-http-client.ts";
 var DEFAULT_RETRY_TIMEOUT = 1500;
 var DEFAULT_RETRY_JITTER = 500;
 var DEFAULT_MAX_RETRIES_COUNT = 3;
+var WARNING_BODY_SIZE = 10 * 1024 * 1024;
 var EdgeHttpClient = class {
-  constructor(baseUrl) {
-    this._baseUrl = getEdgeUrlWithProtocol(baseUrl, "http");
-    log4("created", {
-      url: this._baseUrl
-    }, {
-      F: __dxlog_file6,
-      L: 84,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-  }
   get baseUrl() {
     return this._baseUrl;
   }
@@ -928,6 +976,18 @@ var EdgeHttpClient = class {
   // Functions
   //
   async uploadFunction(pathParts, body, args) {
+    const formData = new FormData();
+    formData.append("name", body.name ?? "");
+    formData.append("version", body.version);
+    formData.append("ownerPublicKey", body.ownerPublicKey);
+    formData.append("entryPoint", body.entryPoint);
+    for (const [filename, content] of Object.entries(body.assets)) {
+      formData.append("assets", new Blob([
+        content
+      ], {
+        type: getFileMimeType(filename)
+      }), filename);
+    }
     const path = [
       "functions",
       ...pathParts.functionId ? [
@@ -936,8 +996,36 @@ var EdgeHttpClient = class {
     ].join("/");
     return this._call(new URL(path, this.baseUrl), {
       ...args,
-      body,
-      method: "PUT"
+      body: formData,
+      method: "PUT",
+      json: false
+    });
+  }
+  async listFunctions(args) {
+    return this._call(new URL("/functions", this.baseUrl), {
+      ...args,
+      method: "GET"
+    });
+  }
+  async invokeFunction(params, input, args) {
+    const url = new URL(`/functions/${params.functionId}`, this.baseUrl);
+    if (params.version) {
+      url.searchParams.set("version", params.version);
+    }
+    if (params.spaceId) {
+      url.searchParams.set("spaceId", params.spaceId.toString());
+    }
+    if (params.cpuTimeLimit) {
+      url.searchParams.set("cpuTimeLimit", params.cpuTimeLimit.toString());
+    }
+    if (params.subrequestsLimit) {
+      url.searchParams.set("subrequestsLimit", params.subrequestsLimit.toString());
+    }
+    return this._call(url, {
+      ...args,
+      body: input,
+      method: "POST",
+      rawResponse: true
     });
   }
   //
@@ -951,6 +1039,31 @@ var EdgeHttpClient = class {
     });
   }
   //
+  // Triggers
+  //
+  async getCronTriggers(spaceId) {
+    return this._call(new URL(`/test/functions/${spaceId}/triggers/crons`, this.baseUrl), {
+      method: "GET"
+    });
+  }
+  //
+  // Import/Export space.
+  //
+  async importBundle(spaceId, body, args) {
+    return this._call(new URL(`/spaces/${spaceId}/import`, this.baseUrl), {
+      ...args,
+      body,
+      method: "PUT"
+    });
+  }
+  async exportBundle(spaceId, body, args) {
+    return this._call(new URL(`/spaces/${spaceId}/export`, this.baseUrl), {
+      ...args,
+      body,
+      method: "POST"
+    });
+  }
+  //
   // Internal
   //
   async _fetch(url, args) {
@@ -961,20 +1074,20 @@ var EdgeHttpClient = class {
     const shouldRetry = createRetryHandler(args);
     const requestContext = args.context ?? new Context3(void 0, {
       F: __dxlog_file6,
-      L: 289
+      L: 389
     });
     log4("fetch", {
       url,
       request: args.body
     }, {
       F: __dxlog_file6,
-      L: 290,
+      L: 390,
       S: this,
       C: (f, a) => f(...a)
     });
     let handledAuth = false;
     while (true) {
-      let processingError;
+      let processingError = void 0;
       let retryAfterHeaderValue = Number.NaN;
       try {
         const request = createRequest(args, this._authHeader);
@@ -982,6 +1095,12 @@ var EdgeHttpClient = class {
         retryAfterHeaderValue = Number(response.headers.get("Retry-After"));
         if (response.ok) {
           const body = await response.json();
+          if (args.rawResponse) {
+            return body;
+          }
+          if (!("success" in body)) {
+            return body;
+          }
           if (body.success) {
             return body.data;
           }
@@ -990,13 +1109,13 @@ var EdgeHttpClient = class {
             body
           }, {
             F: __dxlog_file6,
-            L: 306,
+            L: 415,
             S: this,
             C: (f, a) => f(...a)
           });
           if (body.errorData?.type === "auth_challenge" && typeof body.errorData?.challenge === "string") {
             processingError = new EdgeAuthChallengeError(body.errorData.challenge, body.errorData);
-          } else {
+          } else if (body.errorData) {
             processingError = EdgeCallFailedError.fromUnsuccessfulResponse(response, body);
           }
         } else if (response.status === 401 && !handledAuth) {
@@ -1004,18 +1123,18 @@ var EdgeHttpClient = class {
           handledAuth = true;
           continue;
         } else {
-          processingError = EdgeCallFailedError.fromHttpFailure(response);
+          processingError = await EdgeCallFailedError.fromHttpFailure(response);
         }
       } catch (error) {
         processingError = EdgeCallFailedError.fromProcessingFailureCause(error);
       }
-      if (processingError.isRetryable && await shouldRetry(requestContext, retryAfterHeaderValue)) {
+      if (processingError?.isRetryable && await shouldRetry(requestContext, retryAfterHeaderValue)) {
         log4("retrying edge request", {
           url,
           processingError
         }, {
           F: __dxlog_file6,
-          L: 324,
+          L: 433,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1028,23 +1147,56 @@ var EdgeHttpClient = class {
     if (!this._edgeIdentity) {
       log4.warn("unauthorized response received before identity was set", void 0, {
         F: __dxlog_file6,
-        L: 333,
+        L: 442,
         S: this,
         C: (f, a) => f(...a)
       });
-      throw EdgeCallFailedError.fromHttpFailure(response);
+      throw await EdgeCallFailedError.fromHttpFailure(response);
     }
     const challenge = await handleAuthChallenge(response, this._edgeIdentity);
     return encodeAuthHeader(challenge);
   }
+  constructor(baseUrl) {
+    _define_property4(this, "_baseUrl", void 0);
+    _define_property4(this, "_edgeIdentity", void 0);
+    _define_property4(this, "_authHeader", void 0);
+    this._baseUrl = getEdgeUrlWithProtocol(baseUrl, "http");
+    log4("created", {
+      url: this._baseUrl
+    }, {
+      F: __dxlog_file6,
+      L: 97,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+  }
 };
-var createRequest = ({ method, body }, authHeader) => {
+var createRequest = ({ method, body, json = true }, authHeader) => {
+  let requestBody;
+  const headers = {};
+  if (json) {
+    requestBody = body && JSON.stringify(body);
+    headers["Content-Type"] = "application/json";
+  } else {
+    requestBody = body;
+  }
+  if (typeof requestBody === "string" && requestBody.length > WARNING_BODY_SIZE) {
+    log4.warn("Request with large body", {
+      bodySize: requestBody.length
+    }, {
+      F: __dxlog_file6,
+      L: 466,
+      S: void 0,
+      C: (f, a) => f(...a)
+    });
+  }
+  if (authHeader) {
+    headers["Authorization"] = authHeader;
+  }
   return {
     method,
-    body: body && JSON.stringify(body),
-    headers: authHeader ? {
-      Authorization: authHeader
-    } : void 0
+    body: requestBody,
+    headers
   };
 };
 var createRetryHandler = ({ retry }) => {
@@ -1068,6 +1220,10 @@ var createRetryHandler = ({ retry }) => {
     return true;
   };
 };
+var getFileMimeType = (filename) => [
+  ".js",
+  ".mjs"
+].some((codeExtension) => filename.endsWith(codeExtension)) ? "application/javascript+module" : filename.endsWith(".wasm") ? "application/wasm" : "application/octet-stream";
 export {
   CLOUDFLARE_MESSAGE_MAX_BYTES,
   CLOUDFLARE_RPC_MAX_BYTES,
@@ -1075,6 +1231,7 @@ export {
   EdgeConnectionClosedError,
   EdgeHttpClient,
   EdgeIdentityChangedError,
+  HttpConfig,
   Protocol,
   WebSocketMuxer,
   createChainEdgeIdentity,
@@ -1082,9 +1239,13 @@ export {
   createEphemeralEdgeIdentity,
   createStubEdgeIdentity,
   createTestHaloEdgeIdentity,
+  encodeAuthHeader,
   getTypename,
   handleAuthChallenge,
   protocol,
-  toUint8Array
+  toUint8Array,
+  withLogging,
+  withRetry,
+  withRetryConfig
 };
 //# sourceMappingURL=index.mjs.map