@dxos/credentials 0.10.0 → 0.11.0

package/dist/lib/neutral/index.mjs

@@ -1,1684 +0,0 @@
-import "@dxos/node-std/globals";
-
-// src/did.ts
-import { subtleCrypto } from "@dxos/crypto";
-import { IdentityDid, PublicKey } from "@dxos/keys";
-import { ComplexMap } from "@dxos/util";
-var IDENTITY_DIDS_CACHE = new ComplexMap(PublicKey.hash);
-var createDidFromIdentityKey = async (identityKey) => {
-  const cachedValue = IDENTITY_DIDS_CACHE.get(identityKey);
-  if (cachedValue !== void 0) {
-    return cachedValue;
-  }
-  const digest = await subtleCrypto.digest("SHA-256", identityKey.asUint8Array());
-  const bytes = new Uint8Array(digest).slice(0, IdentityDid.byteLength);
-  const identityDid = IdentityDid.encode(bytes);
-  IDENTITY_DIDS_CACHE.set(identityKey, identityDid);
-  return identityDid;
-};
-
-// src/invitations.ts
-var defaultSecretProvider = async () => Buffer.from("0000");
-var defaultSecretValidator = async (invitation, secret) => true;
-
-// src/seedphrase.ts
-import { generateMnemonic, mnemonicToSeedSync } from "bip39";
-import { createKeyPair } from "@dxos/crypto";
-import { invariant } from "@dxos/invariant";
-var __dxlog_file = "/__w/dxos/dxos/packages/core/halo/credentials/src/seedphrase.ts";
-var generateSeedPhrase = () => generateMnemonic();
-var keyPairFromSeedPhrase = (seedPhrase) => {
-  invariant(seedPhrase, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file, L: 13, S: void 0, A: ["seedPhrase", ""] });
-  const seed = mnemonicToSeedSync(seedPhrase);
-  return createKeyPair(seed);
-};
-
-// src/passcode.ts
-var generatePasscode = (length = 4) => {
-  let passcode = "";
-  for (let i = 0; i < length; i++) {
-    passcode += `${Math.floor(Math.random() * 10)}`;
-  }
-  return passcode;
-};
-
-// src/credentials/signing.ts
-import stableStringify from "json-stable-stringify";
-import { PublicKey as PublicKey2 } from "@dxos/keys";
-import { Timeframe } from "@dxos/timeframe";
-import { arrayToBuffer } from "@dxos/util";
-var getCredentialProofPayload = (credential) => {
-  const copy = {
-    ...credential,
-    proof: {
-      ...credential.proof,
-      value: new Uint8Array(),
-      chain: void 0
-    }
-  };
-  if (copy.parentCredentialIds?.length === 0) {
-    delete copy.parentCredentialIds;
-  }
-  delete copy.id;
-  const originalAssertion = copy.subject?.assertion;
-  if (originalAssertion) {
-    const normalizedAssertion = {
-      ...originalAssertion
-    };
-    for (const key of Object.keys(normalizedAssertion)) {
-      const val = normalizedAssertion[key];
-      if (val === void 0 || val === null || val === 0 || val === "" || val === false || Array.isArray(val) && val.length === 0) {
-        delete normalizedAssertion[key];
-      }
-    }
-    copy.subject = {
-      ...copy.subject,
-      assertion: normalizedAssertion
-    };
-  }
-  return Buffer.from(canonicalStringify(copy));
-};
-var canonicalStringify = (obj) => stableStringify(obj, {
-  /* The point of signing and verifying is not that the internal, private state of the objects be
-  * identical, but that the public contents can be verified not to have been altered. For that reason,
-  * really private fields (indicated by '__') are not included in the signature.
-  * This gives a mechanism for attaching other attributes to an object without breaking the signature.
-  * We also skip @type.
-  */
-  // TODO(dmaretskyi): Should we actually skip the @type field?
-  replacer: function(key, value) {
-    if (key.toString().startsWith("__") || key.toString() === "@type") {
-      return void 0;
-    }
-    if (value === null) {
-      return void 0;
-    }
-    const original = this[key];
-    if (value) {
-      if (PublicKey2.isPublicKey(value)) {
-        return value.toHex();
-      }
-      if (Buffer.isBuffer(value)) {
-        return value.toString("hex");
-      }
-      if (value instanceof Uint8Array) {
-        return arrayToBuffer(value).toString("hex");
-      }
-      if (value.data && value.type === "Buffer") {
-        return Buffer.from(value).toString("hex");
-      }
-      if (original instanceof Timeframe) {
-        return original.frames().reduce((frames, [key2, seq]) => {
-          frames[truncateKey(key2)] = seq;
-          return frames;
-        }, {});
-      }
-    }
-    return value;
-  }
-});
-var truncateKey = (key) => {
-  const str = key.toHex();
-  return `${str.substring(0, 4)}...${str.substring(str.length - 4)}`;
-};
-
-// src/presentations/signing.ts
-var getPresentationProofPayload = (credentials, proof) => {
-  const copy = {
-    credentials: credentials.map((credential) => removeEmptyParentCredentialIds(credential)),
-    proof: {
-      ...proof,
-      value: new Uint8Array(),
-      chain: void 0
-    }
-  };
-  return Buffer.from(canonicalStringify(copy));
-};
-var removeEmptyParentCredentialIds = (credential) => {
-  const copy = {
-    ...credential,
-    proof: credential.proof ? {
-      ...credential.proof,
-      chain: credential.proof.chain ? {
-        credential: removeEmptyParentCredentialIds(credential.proof.chain.credential)
-      } : void 0
-    } : void 0
-  };
-  if (copy.parentCredentialIds?.length === 0) {
-    delete copy.parentCredentialIds;
-  }
-  return copy;
-};
-
-// src/credentials/assertions.ts
-var getCredentialAssertion = (credential) => credential.subject.assertion;
-var isValidAuthorizedDeviceCredential = (credential, identityKey, deviceKey) => {
-  const assertion = getCredentialAssertion(credential);
-  return credential.subject.id.equals(deviceKey) && credential.issuer.equals(identityKey) && assertion["@type"] === "dxos.halo.credentials.AuthorizedDevice" && assertion.identityKey.equals(identityKey) && assertion.deviceKey.equals(deviceKey);
-};
-var checkCredentialType = (credential, type) => credential.subject.assertion["@type"] === type;
-var credentialTypeFilter = (type) => (credential) => checkCredentialType(credential, type);
-
-// src/credentials/credential-factory.ts
-import { subtleCrypto as subtleCrypto2 } from "@dxos/crypto";
-import { invariant as invariant2 } from "@dxos/invariant";
-import { PublicKey as PublicKey3 } from "@dxos/keys";
-
-// src/credentials/verifier.ts
-import { verifySignature } from "@dxos/crypto";
-var SIGNATURE_TYPE_ED25519 = "ED25519Signature";
-var verifyCredential = async (credential) => {
-  if (credential.parentCredentialIds?.length === 0) {
-    delete credential.parentCredentialIds;
-  }
-  if (!credential.issuer.equals(credential.proof.signer)) {
-    if (!credential.proof.chain) {
-      return {
-        kind: "fail",
-        errors: [
-          "Delegated credential is missing credential chain."
-        ]
-      };
-    }
-    const result2 = await verifyChain(credential.proof.chain, credential.issuer, credential.proof.signer);
-    if (result2.kind === "fail") {
-      return result2;
-    }
-  }
-  const result = await verifyCredentialSignature(credential);
-  if (result.kind === "fail") {
-    return result;
-  }
-  return {
-    kind: "pass"
-  };
-};
-var verifyCredentialSignature = async (credential) => {
-  if (credential.proof.type !== SIGNATURE_TYPE_ED25519) {
-    return {
-      kind: "fail",
-      errors: [
-        `Invalid signature type: ${credential.proof.type}`
-      ]
-    };
-  }
-  const signData = getCredentialProofPayload(credential);
-  if (!await verifySignature(credential.proof.signer, signData, credential.proof.value)) {
-    return {
-      kind: "fail",
-      errors: [
-        "Invalid signature"
-      ]
-    };
-  }
-  return {
-    kind: "pass"
-  };
-};
-var verifyChain = async (chain, authority, subject) => {
-  const result = await verifyCredential(chain.credential);
-  if (result.kind === "fail") {
-    return result;
-  }
-  if (!isValidAuthorizedDeviceCredential(chain.credential, authority, subject)) {
-    return {
-      kind: "fail",
-      errors: [
-        `Invalid credential chain: invalid assertion for key: ${subject}`
-      ]
-    };
-  }
-  return {
-    kind: "pass"
-  };
-};
-
-// src/credentials/credential-factory.ts
-var __dxlog_file2 = "/__w/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
-var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
-  invariant2(assertion["@type"], "Invalid assertion.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 12, S: void 0, A: ["assertion['@type']", "'Invalid assertion.'"] });
-  invariant2(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 13, S: void 0, A: ["!!signingKey === !!chain", "'Chain must be provided if and only if the signing key differs from the issuer.'"] });
-  if (chain) {
-    const result = await verifyChain(chain, issuer, signingKey);
-    invariant2(result.kind === "pass", "Invalid chain.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 16, S: void 0, A: ["result.kind === 'pass'", "'Invalid chain.'"] });
-  }
-  const credential = {
-    issuer,
-    issuanceDate: /* @__PURE__ */ new Date(),
-    subject: {
-      id: subject,
-      assertion
-    },
-    parentCredentialIds,
-    proof: {
-      type: SIGNATURE_TYPE_ED25519,
-      creationDate: /* @__PURE__ */ new Date(),
-      signer: signingKey ?? issuer,
-      value: new Uint8Array(),
-      nonce
-    }
-  };
-  const signedPayload = getCredentialProofPayload(credential);
-  credential.proof.value = await signer.sign(signingKey ?? issuer, signedPayload);
-  if (chain) {
-    credential.proof.chain = chain;
-  }
-  credential.id = PublicKey3.from(await subtleCrypto2.digest("SHA-256", signedPayload));
-  return credential;
-};
-var createCredentialMessage = (credential) => {
-  return {
-    "@type": "dxos.echo.feed.CredentialsMessage",
-    credential
-  };
-};
-var createCredentialSignerWithKey = (signer, issuer) => ({
-  getIssuer: () => issuer,
-  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
-    signer,
-    issuer,
-    subject,
-    assertion,
-    nonce,
-    parentCredentialIds
-  })
-});
-var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
-  getIssuer: () => chain.credential.issuer,
-  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
-    signer,
-    issuer: chain.credential.issuer,
-    signingKey,
-    chain,
-    subject,
-    assertion,
-    nonce,
-    parentCredentialIds
-  })
-});
-
-// src/credentials/credential-generator.ts
-import { AdmittedFeed, MembershipPolicy, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { Timeframe as Timeframe2 } from "@dxos/timeframe";
-var CredentialGenerator = class {
-  _signer;
-  _identityKey;
-  _deviceKey;
-  constructor(_signer, _identityKey, _deviceKey) {
-    this._signer = _signer;
-    this._identityKey = _identityKey;
-    this._deviceKey = _deviceKey;
-  }
-  /**
-  * Create genesis messages for new Space.
-  */
-  async createSpaceGenesis(spaceKey, controlKey, creatorProfile, membershipPolicy = MembershipPolicy.INVITE) {
-    return [
-      await createCredential({
-        signer: this._signer,
-        issuer: spaceKey,
-        subject: spaceKey,
-        assertion: {
-          "@type": "dxos.halo.credentials.SpaceGenesis",
-          spaceKey,
-          membershipPolicy
-        }
-      }),
-      await createCredential({
-        signer: this._signer,
-        issuer: spaceKey,
-        subject: this._identityKey,
-        assertion: {
-          "@type": "dxos.halo.credentials.SpaceMember",
-          spaceKey,
-          "role": SpaceMember.Role.ADMIN,
-          "profile": creatorProfile,
-          "genesisFeedKey": controlKey
-        }
-      }),
-      await this.createFeedAdmission(spaceKey, controlKey, AdmittedFeed.Designation.CONTROL)
-    ];
-  }
-  /**
-  * Create invitation.
-  * Admit identity and control and data feeds.
-  */
-  // TODO(burdon): Reconcile with above (esp. Signer).
-  async createMemberInvitation(spaceKey, identityKey, deviceKey, controlKey, dataKey, genesisFeedKey) {
-    return [
-      await createCredential({
-        signer: this._signer,
-        issuer: this._identityKey,
-        subject: identityKey,
-        assertion: {
-          "@type": "dxos.halo.credentials.SpaceMember",
-          spaceKey,
-          "role": SpaceMember.Role.EDITOR,
-          genesisFeedKey
-        }
-      }),
-      await this.createFeedAdmission(spaceKey, controlKey, AdmittedFeed.Designation.CONTROL),
-      await this.createFeedAdmission(spaceKey, dataKey, AdmittedFeed.Designation.DATA)
-    ];
-  }
-  /**
-  * Add device to space.
-  */
-  // TODO(burdon): Reconcile with below.
-  async createDeviceAuthorization(deviceKey) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: deviceKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.AuthorizedDevice",
-        "identityKey": this._identityKey,
-        deviceKey
-      }
-    });
-  }
-  /**
-  * Add device metadata.
-  */
-  async createDeviceProfile(profile) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: this._deviceKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.DeviceProfile",
-        profile
-      }
-    });
-  }
-  /**
-  * Add feed to space.
-  */
-  async createFeedAdmission(spaceKey, feedKey, designation) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: feedKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.AdmittedFeed",
-        spaceKey,
-        "identityKey": this._identityKey,
-        "deviceKey": this._deviceKey,
-        designation
-      }
-    });
-  }
-  async createProfileCredential(profile) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: this._identityKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.IdentityProfile",
-        profile
-      }
-    });
-  }
-  async createEpochCredential(spaceKey) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: spaceKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.Epoch",
-        "number": 0,
-        "timeframe": new Timeframe2()
-      }
-    });
-  }
-};
-var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
-  const credentials = await Promise.all([
-    await signer.createCredential({
-      subject: deviceKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.AuthorizedDevice",
-        identityKey,
-        deviceKey
-      }
-    })
-  ]);
-  return credentials.map((credential) => ({
-    "@type": "dxos.echo.feed.CredentialsMessage",
-    credential
-  }));
-};
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId, tags) => {
-  const credentials = await Promise.all([
-    await signer.createCredential({
-      subject: identityKey,
-      parentCredentialIds: membershipChainHeads,
-      assertion: {
-        "@type": "dxos.halo.credentials.SpaceMember",
-        spaceKey,
-        role,
-        profile,
-        genesisFeedKey,
-        invitationCredentialId,
-        "tags": tags ?? []
-      }
-    })
-  ]);
-  return credentials.map((credential) => ({
-    credential: {
-      credential
-    }
-  }));
-};
-var createDelegatedSpaceInvitationCredential = async (signer, subject, invitation) => {
-  const credential = await signer.createCredential({
-    subject,
-    assertion: {
-      "@type": "dxos.halo.invitations.DelegateSpaceInvitation",
-      "invitationId": invitation.invitationId,
-      "authMethod": invitation.authMethod,
-      "swarmKey": invitation.swarmKey,
-      "role": invitation.role,
-      "guestKey": invitation.guestKey,
-      "expiresOn": invitation.expiresOn,
-      "multiUse": invitation.multiUse
-    }
-  });
-  return {
-    credential: {
-      credential
-    }
-  };
-};
-var createCancelDelegatedSpaceInvitationCredential = async (signer, subject, invitationCredentialId) => {
-  const credential = await signer.createCredential({
-    subject,
-    assertion: {
-      "@type": "dxos.halo.invitations.CancelDelegatedInvitation",
-      "credentialId": invitationCredentialId
-    }
-  });
-  return {
-    credential: {
-      credential
-    }
-  };
-};
-
-// src/presentations/presentation.ts
-var signPresentation = async ({ presentation, signer, signerKey, chain, nonce }) => {
-  const proof = {
-    type: SIGNATURE_TYPE_ED25519,
-    value: new Uint8Array(),
-    creationDate: /* @__PURE__ */ new Date(),
-    signer: signerKey,
-    nonce
-  };
-  const signedPayload = getPresentationProofPayload(presentation.credentials ?? [], proof);
-  proof.value = await signer.sign(signerKey, signedPayload);
-  if (chain) {
-    proof.chain = chain;
-  }
-  return {
-    credentials: presentation.credentials,
-    proofs: [
-      ...presentation.proofs ?? [],
-      proof
-    ]
-  };
-};
-
-// src/presentations/verifier.ts
-import { verifySignature as verifySignature2 } from "@dxos/crypto";
-var verifyPresentation = async (presentation) => {
-  const errors = [];
-  const credentialsVerifications = await Promise.all(presentation.credentials?.map((credential) => verifyCredential(credential)) ?? []);
-  for (const verification of credentialsVerifications) {
-    if (verification.kind === "fail") {
-      errors.push(...verification.errors);
-    }
-  }
-  const proofVerification = await Promise.all(presentation.proofs?.map(async (proof) => {
-    const chainVerification = await verifyPresentationChain(presentation, proof);
-    if (chainVerification.kind === "fail") {
-      return chainVerification;
-    }
-    const signatureVerification = await verifyPresentationSignature(presentation, proof);
-    if (signatureVerification.kind === "fail") {
-      return signatureVerification;
-    }
-    return {
-      kind: "pass"
-    };
-  }) ?? []);
-  for (const verification of proofVerification) {
-    if (verification.kind === "fail") {
-      errors.push(...verification.errors);
-    }
-  }
-  if (errors.length === 0) {
-    return {
-      kind: "pass"
-    };
-  }
-  {
-    return {
-      kind: "fail",
-      errors
-    };
-  }
-};
-var verifyPresentationChain = async (presentation, proof) => {
-  for (const credential of presentation.credentials ?? []) {
-    if (!credential.issuer.equals(proof.signer)) {
-      if (!proof.chain) {
-        return {
-          kind: "fail",
-          errors: [
-            "Delegated credential is missing credential chain."
-          ]
-        };
-      }
-      const chainVerification = await verifyChain(proof.chain, credential.subject.id, proof.signer);
-      if (chainVerification.kind === "fail") {
-        return chainVerification;
-      }
-    }
-  }
-  return {
-    kind: "pass"
-  };
-};
-var verifyPresentationSignature = async (presentation, proof) => {
-  if (proof.type !== SIGNATURE_TYPE_ED25519) {
-    return {
-      kind: "fail",
-      errors: [
-        `Invalid signature type: ${proof.type}`
-      ]
-    };
-  }
-  const signData = getPresentationProofPayload(presentation.credentials ?? [], proof);
-  if (!await verifySignature2(proof.signer, signData, proof.value)) {
-    return {
-      kind: "fail",
-      errors: [
-        "Invalid signature"
-      ]
-    };
-  }
-  return {
-    kind: "pass"
-  };
-};
-
-// src/state-machine/space-state-machine.ts
-import { runInContextAsync, synchronized } from "@dxos/async";
-import { Context } from "@dxos/context";
-import { PublicKey as PublicKey8 } from "@dxos/keys";
-import { log as log3 } from "@dxos/log";
-import { MembershipPolicy as MembershipPolicy2, SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { Callback as Callback4, ComplexMap as ComplexMap6, ComplexSet as ComplexSet3 } from "@dxos/util";
-
-// src/state-machine/feed-state-machine.ts
-import { invariant as invariant3 } from "@dxos/invariant";
-import { PublicKey as PublicKey4 } from "@dxos/keys";
-import { Callback, ComplexMap as ComplexMap2 } from "@dxos/util";
-var __dxlog_file3 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
-var FeedStateMachine = class {
-  _spaceKey;
-  _feeds = new ComplexMap2(PublicKey4.hash);
-  onFeedAdmitted = new Callback();
-  constructor(_spaceKey) {
-    this._spaceKey = _spaceKey;
-  }
-  get feeds() {
-    return this._feeds;
-  }
-  /**
-  * Processes the AdmittedFeed credential.
-  * Assumes the credential is already pre-verified
-  * and the issuer has been authorized to issue credentials of this type.
-  * @param fromFeed Key of the feed where this credential is recorded.
-  */
-  async process(credential, fromFeed) {
-    const assertion = getCredentialAssertion(credential);
-    invariant3(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 28, S: this, A: ["assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'", ""] });
-    invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 29, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
-    const info = {
-      key: credential.subject.id,
-      credential,
-      assertion,
-      parent: fromFeed
-    };
-    this._feeds.set(credential.subject.id, info);
-    await this.onFeedAdmitted.callIfSet(info);
-  }
-};
-
-// src/state-machine/invitation-state-machine.ts
-import { PublicKey as PublicKey5 } from "@dxos/keys";
-import { Callback as Callback2, ComplexMap as ComplexMap3, ComplexSet } from "@dxos/util";
-var InvitationStateMachine = class {
-  _invitations = new ComplexMap3(PublicKey5.hash);
-  _redeemedInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
-  _cancelledInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
-  onDelegatedInvitation = new Callback2();
-  onDelegatedInvitationRemoved = new Callback2();
-  get invitations() {
-    return this._invitations;
-  }
-  async process(credential) {
-    const credentialId = credential.id;
-    if (credentialId == null) {
-      return;
-    }
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.invitations.CancelDelegatedInvitation": {
-        this._cancelledInvitationCredentialIds.add(assertion.credentialId);
-        const existingInvitation = this._invitations.get(assertion.credentialId);
-        if (existingInvitation != null) {
-          this._invitations.delete(assertion.credentialId);
-          await this.onDelegatedInvitationRemoved.callIfSet({
-            credentialId: assertion.credentialId,
-            invitation: existingInvitation
-          });
-        }
-        break;
-      }
-      case "dxos.halo.invitations.DelegateSpaceInvitation": {
-        if (credential.id) {
-          const isExpired = assertion.expiresOn && assertion.expiresOn.getTime() < Date.now();
-          const wasUsed = this._redeemedInvitationCredentialIds.has(credential.id) && !assertion.multiUse;
-          const wasCancelled = this._cancelledInvitationCredentialIds.has(credential.id);
-          if (isExpired || wasCancelled || wasUsed) {
-            return;
-          }
-          const invitation = {
-            ...assertion
-          };
-          this._invitations.set(credential.id, invitation);
-          await this.onDelegatedInvitation.callIfSet({
-            credentialId: credential.id,
-            invitation
-          });
-        }
-        break;
-      }
-      case "dxos.halo.credentials.SpaceMember": {
-        if (assertion.invitationCredentialId != null) {
-          this._redeemedInvitationCredentialIds.add(assertion.invitationCredentialId);
-          const existingInvitation = this._invitations.get(assertion.invitationCredentialId);
-          if (existingInvitation != null && !existingInvitation.multiUse) {
-            this._invitations.delete(assertion.invitationCredentialId);
-            await this.onDelegatedInvitationRemoved.callIfSet({
-              credentialId: assertion.invitationCredentialId,
-              invitation: existingInvitation
-            });
-          }
-        }
-        break;
-      }
-    }
-  }
-};
-
-// src/state-machine/member-state-machine.ts
-import { invariant as invariant5 } from "@dxos/invariant";
-import { PublicKey as PublicKey7 } from "@dxos/keys";
-import { log as log2 } from "@dxos/log";
-import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { ComplexMap as ComplexMap5 } from "@dxos/util";
-
-// src/graph/credential-graph.ts
-import { invariant as invariant4 } from "@dxos/invariant";
-import { PublicKey as PublicKey6 } from "@dxos/keys";
-import { log } from "@dxos/log";
-import { Callback as Callback3, ComplexMap as ComplexMap4, ComplexSet as ComplexSet2 } from "@dxos/util";
-var __dxlog_file4 = "/__w/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
-var CredentialGraph = class {
-  _stateHandler;
-  /**
-  * Local ids are used during traversals.
-  */
-  _vertexIdGenerator = 1;
-  /**
-  * All credentials without parent references are connected to the root.
-  */
-  _root = {
-    id: -1,
-    parents: [],
-    children: []
-  };
-  /**
-  * A credential which is not a parent of any other credential has the sentinel as a child.
-  * Sentinel is a virtual merge-point of all credentials.
-  */
-  _sentinel = {
-    id: -2,
-    parents: [],
-    children: []
-  };
-  /**
-  * Vertex references are used for fast credential inserts into the graph.
-  */
-  _vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
-  /**
-  * The current state of the graph.
-  */
-  _subjectToVertex = new ComplexMap4(PublicKey6.hash);
-  _subjectToState = new ComplexMap4(PublicKey6.hash);
-  onSubjectStateChanged = new Callback3();
-  constructor(_stateHandler) {
-    this._stateHandler = _stateHandler;
-  }
-  getSubjectState(subjectId) {
-    return this._subjectToState.get(subjectId);
-  }
-  getState() {
-    return this._subjectToState;
-  }
-  getLeafIds() {
-    return this._sentinel.parents.map((v) => v.credential.id);
-  }
-  getGlobalStateScope() {
-    return {
-      state: this._subjectToVertex
-    };
-  }
-  addVertex(credential, assertion) {
-    const newVertex = {
-      id: this._vertexIdGenerator++,
-      credential,
-      assertion,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId.set(credential.id, newVertex);
-    const parentIds = credential.parentCredentialIds ?? [];
-    if (parentIds.length === 0) {
-      this._root.children.push(newVertex);
-      newVertex.parents.push(this._root);
-    } else {
-      for (const parentId of parentIds) {
-        const parentVertex = this._vertexByCredentialId.get(parentId);
-        if (parentVertex == null) {
-          log.error("credential skipped because of the unknown parent", {
-            credential,
-            parentId
-          }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 70, S: this });
-          continue;
-        }
-        parentVertex.children.push(newVertex);
-        newVertex.parents.push(parentVertex);
-        this._removeSentinelConnection(parentVertex);
-      }
-    }
-    newVertex.children.push(this._sentinel);
-    this._sentinel.parents.push(newVertex);
-    return this._onVertexInserted(newVertex);
-  }
-  _removeSentinelConnection(vertex) {
-    const sentinelIdx = vertex.children.indexOf(this._sentinel);
-    if (sentinelIdx >= 0) {
-      vertex.children.splice(sentinelIdx, 1);
-      const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
-      invariant4(vertexInSentinelIdx >= 0, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 90, S: this, A: ["vertexInSentinelIdx >= 0", ""] });
-      this._sentinel.parents.splice(vertexInSentinelIdx, 1);
-    }
-  }
-  async _onVertexInserted(newVertex) {
-    const { credential, assertion } = newVertex;
-    invariant4(credential, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 96, S: this, A: ["credential", ""] });
-    let changedSubjects = [];
-    const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
-    if (isUpdateAppliedOnTopOfThePreviousState) {
-      const subjectId = credential.subject.id;
-      if (this._stateHandler.isUpdateAllowed(this.getGlobalStateScope(), credential, assertion)) {
-        const newSubjectState = this._stateHandler.createState(credential, newVertex.assertion);
-        const prevSubjectState = this._subjectToState.get(subjectId);
-        this._subjectToState.set(subjectId, newSubjectState);
-        this._subjectToVertex.set(subjectId, newVertex);
-        if (this._stateHandler.hasStateChanged(newSubjectState, prevSubjectState)) {
-          changedSubjects.push(newSubjectState);
-        }
-      }
-    } else {
-      changedSubjects = this._recomputeState();
-    }
-    if (changedSubjects.length > 0) {
-      await this.onSubjectStateChanged.callIfSet(changedSubjects);
-    }
-  }
-  /**
-  * DFS the graph from root to sentinel pausing on merge points (nodes with multiple parents).
-  * Continue after all paths leading to a merge point converge by merging their states.
-  * In case of a concurrent update paths are replayed taking into account the state set
-  * by the winning branch.
-  */
-  _recomputeState() {
-    const pendingPaths = /* @__PURE__ */ new Map();
-    const paths = [
-      this._createRootPath()
-    ];
-    let lastPath = null;
-    while (lastPath == null) {
-      const path = paths.pop();
-      log("visit vertex", {
-        id: path.head.id
-      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 131, S: this });
-      this._updatePathState(path);
-      const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
-      if (convergedPaths == null) {
-        log("waiting for other paths", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 137, S: this });
-        continue;
-      }
-      const mergeResult = this._mergePaths(convergedPaths);
-      if (mergeResult.type === "replay_required") {
-        this._replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths);
-        continue;
-      }
-      const merged = mergeResult.path;
-      if (merged.head.children.length === 0) {
-        lastPath = merged;
-      } else if (merged.head.children.length === 1) {
-        merged.head = merged.head.children[0];
-        paths.push(merged);
-      } else {
-        this._forkTraversal(paths, merged);
-      }
-    }
-    if (paths.length > 0) {
-      log.error("traversal finished while there were active paths", {
-        paths: paths.map((p) => ({
-          path: toChosenPath(p),
-          head: p.head.id
-        }))
-      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 156, S: this });
-    }
-    return this._setCurrentState(lastPath);
-  }
-  _replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths) {
-    paths.push(...mergeResult.replay.map((path) => {
-      const stateOverrides = path.stateOverrides ?? new ComplexMap4(PublicKey6.hash);
-      mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));
-      return {
-        ...mergeResult.from,
-        chosenPath: path.chosenPath,
-        stateOverrides
-      };
-    }));
-    log("replay paths", () => ({
-      count: paths.length,
-      paths: paths.map((path) => ({
-        from: mergeResult.from.head.id,
-        path: toChosenPath(path),
-        overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }))
-    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 175, S: this });
-    const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
-    pendingPaths.set(convergedPaths[0].head.id, clearedPending);
-  }
-  _handleMergePoint(paths, pendingPaths, path) {
-    const pendingList = pendingPaths.get(path.head.id) ?? [];
-    pendingPaths.set(path.head.id, pendingList);
-    pendingList.push(path);
-    if (pendingList.length < path.head.parents.length) {
-      return null;
-    }
-    if (path.head.id === this._sentinel.id && paths.length > 0) {
-      log("waiting for all the active paths to converge on the sentinel", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 194, S: this });
-      return null;
-    }
-    pendingPaths.delete(path.head.id);
-    return pendingList;
-  }
-  _updatePathState(path) {
-    const headCredential = path.head.credential;
-    if (headCredential == null) {
-      return;
-    }
-    const updatedSubject = headCredential.subject.id;
-    path.credentials.add(headCredential.id);
-    let isUpdateAllowed = this._stateHandler.isUpdateAllowed(path, headCredential, path.head.assertion);
-    if (!isUpdateAllowed && path.head.parents[0]?.id === this._root.id) {
-      const globalState = this.getGlobalStateScope();
-      isUpdateAllowed = this._stateHandler.isUpdateAllowed(globalState, headCredential, path.head.assertion);
-    }
-    if (isUpdateAllowed) {
-      path.forkChangedSubjects.add(updatedSubject);
-      path.forkIssuers.add(headCredential.issuer);
-      path.state.set(updatedSubject, path.head);
-      log("path state updated", () => ({
-        subject: updatedSubject,
-        newState: this._stateHandler.toLogString(path.head.assertion)
-      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 217, S: this });
-    }
-  }
-  _forkTraversal(paths, path) {
-    const replayChoice = path.chosenPath?.[path.head.id];
-    const choices = replayChoice ?? path.head.children;
-    for (const choice of choices) {
-      log("edge traversal", {
-        from: path.head.id,
-        to: choice.id
-      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 227, S: this });
-      const fork = {
-        forkPoint: path,
-        chosenPath: {
-          ...path.chosenPath,
-          [path.head.id]: [
-            choice
-          ]
-        },
-        head: choice,
-        credentials: new ComplexSet2(PublicKey6.hash, path.credentials),
-        state: new ComplexMap4(PublicKey6.hash, [
-          ...path.state.entries()
-        ]),
-        forkIssuers: new ComplexSet2(PublicKey6.hash),
-        forkChangedSubjects: new ComplexSet2(PublicKey6.hash),
-        stateOverrides: path.stateOverrides
-      };
-      paths.push(fork);
-    }
-  }
-  /**
-  * Updates the current graph state.
-  * @returns changed states.
-  */
-  _setCurrentState(path) {
-    const changedSubjects = [];
-    const newStateMap = new ComplexMap4(PublicKey6.hash);
-    const newVertexMap = new ComplexMap4(PublicKey6.hash);
-    for (const [subjectKey, subjectVertex] of path.state.entries()) {
-      const newState = this._stateHandler.createState(subjectVertex.credential, subjectVertex.assertion);
-      const prevState = this._subjectToState.get(subjectKey);
-      newStateMap.set(subjectKey, newState);
-      newVertexMap.set(subjectKey, subjectVertex);
-      if (this._stateHandler.hasStateChanged(newState, prevState)) {
-        changedSubjects.push(newState);
-      }
-    }
-    this._subjectToState = newStateMap;
-    this._subjectToVertex = newVertexMap;
-    return changedSubjects;
-  }
-  /*
-  * Walk up all the fork points and return the first one present in all the paths.
-  * We use local id to determine vertex position in the graph, because nodes can't
-  * be inserted in the middle (between a parent and a child) and ids are monotonically increasing.
-  */
-  _leastCommonAncestor(paths) {
-    const uniqueForkPoints = paths.reduce((acc, path) => {
-      let it = path.forkPoint;
-      while (it) {
-        acc.set(it.head.id, it);
-        it = it.forkPoint;
-      }
-      return acc;
-    }, /* @__PURE__ */ new Map());
-    let maxId = this._root.id;
-    let maxState = null;
-    for (const [id, state] of uniqueForkPoints.entries()) {
-      const headCredential = state.head.credential;
-      if (headCredential != null) {
-        const isPointInEveryPath = paths.every((p) => p.credentials.has(headCredential.id));
-        if (isPointInEveryPath && id > maxId) {
-          maxId = id;
-          maxState = state;
-        }
-      }
-    }
-    return maxState ?? this._createRootPath();
-  }
-  /**
-  * We might be merging paths where some of them had fork points after the initial forking.
-  * We need all the paths to point to the least common fork point and contain all the changes
-  * that happened after it.
-  */
-  _moveUpToForkPoint(forkPoint, path) {
-    const isForkPointInPath = path.chosenPath[forkPoint.head.id] == null || path.forkPoint == null;
-    if (isForkPointInPath) {
-      return path;
-    }
-    if (forkPoint.head.id === path.forkPoint?.head.id) {
-      return path;
-    }
-    let it = path.forkPoint;
-    while (it.head.id !== forkPoint.head.id) {
-      it.forkIssuers.forEach((iss) => path.forkIssuers.add(iss));
-      it.forkChangedSubjects.forEach((m) => path.forkChangedSubjects.add(m));
-      it = it.forkPoint;
-      path.forkPoint = it;
-    }
-    return path;
-  }
-  _mergePaths(convergedPaths) {
-    invariant4(convergedPaths.length >= 1, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 320, S: this, A: ["convergedPaths.length >= 1", ""] });
-    if (convergedPaths.length === 1) {
-      return {
-        type: "merged",
-        path: convergedPaths[0]
-      };
-    }
-    const forkPoint = this._leastCommonAncestor(convergedPaths);
-    log("merging paths", () => ({
-      forkPointId: forkPoint.head.id,
-      pathCount: convergedPaths.length,
-      forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
-    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 328, S: this });
-    const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
-    invariant4(forkPoint, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 334, S: this, A: ["forkPoint", ""] });
-    const result = {
-      forkPoint: forkPoint.forkPoint,
-      chosenPath: {
-        ...forkPoint.chosenPath,
-        [forkPoint.head.id]: []
-      },
-      stateOverrides: forkPoint.stateOverrides,
-      credentials: new ComplexSet2(PublicKey6.hash, forkPoint.credentials),
-      forkIssuers: new ComplexSet2(PublicKey6.hash, forkPoint.forkIssuers),
-      forkChangedSubjects: new ComplexSet2(PublicKey6.hash, forkPoint.forkChangedSubjects),
-      state: forkPoint.state.mapValues((v) => v),
-      head: paths[0].head
-    };
-    const subjectToBranch = new ComplexMap4(PublicKey6.hash);
-    for (const path of paths) {
-      log("processing a path", () => ({
-        choices: toChosenPath(path),
-        modified: path.forkChangedSubjects,
-        forkIssuers: path.forkIssuers,
-        state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 350, S: this });
-      path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
-      path.credentials.forEach((cred) => result.credentials.add(cred));
-      result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
-      for (const modifiedSubject of path.forkChangedSubjects) {
-        const existingBranch = subjectToBranch.get(modifiedSubject);
-        if (existingBranch == null || this._shouldOverrideCredential(existingBranch, path, modifiedSubject)) {
-          subjectToBranch.set(modifiedSubject, path);
-        }
-      }
-    }
-    const replayPaths = /* @__PURE__ */ new Set();
-    const addReplayPath = replayPaths.add.bind(replayPaths);
-    for (const [subject, branch] of subjectToBranch.entries()) {
-      result.forkChangedSubjects.add(subject);
-      const vertex = branch.state.get(subject);
-      result.state.set(subject, vertex);
-      log("set subject state", () => ({
-        subject,
-        state: this._stateHandler.toLogString(vertex.assertion)
-      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 372, S: this });
-      const otherPaths = paths.filter((p) => p !== branch);
-      this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
-    }
-    if (replayPaths.size > 0) {
-      return {
-        type: "replay_required",
-        replay: [
-          ...replayPaths.values()
-        ],
-        from: forkPoint,
-        stateOverrides: subjectToBranch.mapValues((v, key) => v.state.get(key))
-      };
-    }
-    return {
-      type: "merged",
-      path: result
-    };
-  }
-  /**
-  * A candidate credential is preferred over the existing credential if:
-  *  1. It is the merge-point, because it's the last credential that was issued in awareness of all
-  *  the previously existing ones.
-  *  2. A path where candidate was set contains existing credential in it, which means that the candidate
-  *  was issued after the existing credential by a legitimate issuer.
-  *  3. A state-specific logic (_stateHandler) is able to justify using the candidate credential.
-  *  4. The path where candidate was set has more issuers than the existing path (longer branch).
-  *  5. The issuance time of the candidate is after the issuance time of the existing credential (LWW).
-  */
-  _shouldOverrideCredential(existing, candidate, modifiedSubject) {
-    const candidateVertex = candidate.state.get(modifiedSubject);
-    const currentVertex = existing.state.get(modifiedSubject);
-    if (candidateVertex.id === currentVertex.id) {
-      return false;
-    }
-    const mergePointId = existing.head.id;
-    if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
-      log("merge point chosen to break the tie", {
-        mergePointId: existing.head.id
-      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 412, S: this });
-      return mergePointId === candidateVertex.id;
-    }
-    const candidateCredential = candidateVertex.credential;
-    const currentCredential = currentVertex.credential;
-    if (existing.credentials.has(candidateCredential.id) !== candidate.credentials.has(currentCredential.id)) {
-      log("one of the credentials was overridden in another branch", {
-        current: currentVertex.id,
-        candidate: candidateVertex.id
-      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 421, S: this });
-      return candidate.credentials.has(currentCredential.id);
-    }
-    const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
-    if (winningCredential != null) {
-      return winningCredential === candidateCredential;
-    }
-    if (candidate.forkIssuers.size !== existing.forkIssuers.size) {
-      log("longer issuers branch used to break the tie", {
-        issuerCount: [
-          existing.forkIssuers.size,
-          candidate.forkIssuers.size
-        ]
-      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 433, S: this });
-      return candidate.forkIssuers.size > existing.forkIssuers.size;
-    }
-    log("issuance date used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 441, S: this });
-    return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
-  }
-  _createRootPath() {
-    return {
-      head: this._root,
-      chosenPath: {},
-      forkIssuers: new ComplexSet2(PublicKey6.hash),
-      forkChangedSubjects: new ComplexSet2(PublicKey6.hash),
-      state: new ComplexMap4(PublicKey6.hash),
-      credentials: new ComplexSet2(PublicKey6.hash)
-    };
-  }
-};
-var toChosenPath = (path) => {
-  return Object.fromEntries(Object.entries(path.chosenPath).map(([k, vs]) => [
-    k,
-    vs.map((v) => v.id)
-  ]));
-};
-
-// src/state-machine/member-state-machine.ts
-var __dxlog_file5 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
-var MemberStateMachine = class {
-  _spaceKey;
-  _ownerKey;
-  _memberProfiles = new ComplexMap5(PublicKey7.hash);
-  _hashgraph = new CredentialGraph(this);
-  onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
-  constructor(_spaceKey) {
-    this._spaceKey = _spaceKey;
-  }
-  get creator() {
-    return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
-  }
-  get members() {
-    return this._hashgraph.getState();
-  }
-  get membershipChainHeads() {
-    return this._hashgraph.getLeafIds();
-  }
-  getRole(member) {
-    return this._getRole(this._hashgraph.getGlobalStateScope(), member);
-  }
-  /**
-  * Processes the SpaceMember credential.
-  * Assumes the credential is already pre-verified and the issuer has been authorized to issue credentials of this type.
-  */
-  async process(credential) {
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.credentials.SpaceMember": {
-        invariant5(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 43, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
-        if (this._ownerKey == null && credential.issuer === this._spaceKey) {
-          this._ownerKey = credential.subject.id;
-        }
-        if (assertion.profile != null) {
-          this._memberProfiles.set(credential.subject.id, assertion.profile);
-        }
-        await this._hashgraph.addVertex(credential, assertion);
-        break;
-      }
-      case "dxos.halo.credentials.MemberProfile": {
-        const member = this._hashgraph.getSubjectState(credential.subject.id);
-        if (member) {
-          member.profile = assertion.profile;
-        } else {
-          log2.warn("Member not found", {
-            id: credential.subject.id
-          }, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 59, S: this });
-        }
-        this._memberProfiles.set(credential.subject.id, assertion.profile);
-        break;
-      }
-      default:
-        throw new Error("Invalid assertion type");
-    }
-  }
-  createState(credential, assertion) {
-    const memberKey = credential.subject.id;
-    return {
-      key: memberKey,
-      role: assertion.role,
-      credential,
-      assertion,
-      profile: this._memberProfiles.get(memberKey)
-    };
-  }
-  isUpdateAllowed(scope, credential, assertion) {
-    if (assertion.role === SpaceMember2.Role.OWNER) {
-      return credential.issuer.equals(this._spaceKey);
-    }
-    const issuer = credential.issuer;
-    const isChangingOwnRole = issuer.equals(credential.subject.id);
-    if (isChangingOwnRole) {
-      return false;
-    }
-    if (issuer.equals(assertion.spaceKey)) {
-      return true;
-    }
-    const issuerRole = this._getRole(scope, issuer);
-    return issuerRole === SpaceMember2.Role.ADMIN || issuerRole === SpaceMember2.Role.OWNER;
-  }
-  getConflictingPaths(paths, update) {
-    if (update.assertion.role !== SpaceMember2.Role.REMOVED && update.assertion.role !== SpaceMember2.Role.EDITOR) {
-      return [];
-    }
-    const memberId = update.credential.subject.id;
-    return paths.filter((p) => p.forkIssuers.has(memberId));
-  }
-  tryPickWinningUpdate(scope1, update1, scope2, update2) {
-    const path1IssuerRole = this._getRole(scope1, update1.issuer);
-    const path2IssuerRole = this._getRole(scope2, update2.issuer);
-    if (path2IssuerRole === SpaceMember2.Role.OWNER !== (path1IssuerRole === SpaceMember2.Role.OWNER)) {
-      log2("owner decision used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 107, S: this });
-      return path1IssuerRole === SpaceMember2.Role.OWNER ? update1 : update2;
-    }
-    return null;
-  }
-  toLogString(assertion) {
-    const role = assertion?.role ?? SpaceMember2.Role.REMOVED;
-    return Object.entries(SpaceMember2.Role).find(([_, value]) => value === role)[0];
-  }
-  hasStateChanged(s1, s2) {
-    return s1?.role !== s2?.role;
-  }
-  _getRole(scope, memberId) {
-    if (this._ownerKey?.equals(memberId)) {
-      return SpaceMember2.Role.OWNER;
-    }
-    const realRole = scope.state.get(memberId)?.assertion?.role ?? SpaceMember2.Role.REMOVED;
-    if (scope.stateOverrides != null) {
-      const override = scope.stateOverrides.get(memberId);
-      if (override != null) {
-        log2("member role overridden in path", () => ({
-          headId: scope.head?.id,
-          roleOverride: this.toLogString(override.assertion),
-          realRole: this.toLogString(scope.state.get(memberId)?.assertion)
-        }), { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 127, S: this });
-        return override.assertion.role;
-      }
-    }
-    return realRole;
-  }
-};
-
-// src/state-machine/space-state-machine.ts
-var __dxlog_file6 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-var SpaceStateMachine = class {
-  _spaceKey;
-  _members;
-  _feeds;
-  _invitations = new InvitationStateMachine();
-  _credentials = [];
-  _credentialsById = new ComplexMap6(PublicKey8.hash);
-  _processedCredentials = new ComplexSet3(PublicKey8.hash);
-  _genesisCredential;
-  _tags = [];
-  _membershipPolicy = MembershipPolicy2.INVITE;
-  _credentialProcessors = [];
-  onCredentialProcessed = new Callback4();
-  onMemberRoleChanged;
-  onFeedAdmitted;
-  onDelegatedInvitation = this._invitations.onDelegatedInvitation;
-  onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
-  constructor(_spaceKey) {
-    this._spaceKey = _spaceKey;
-    this._members = new MemberStateMachine(this._spaceKey);
-    this._feeds = new FeedStateMachine(this._spaceKey);
-    this.onMemberRoleChanged = this._members.onMemberRoleChanged;
-    this.onFeedAdmitted = this._feeds.onFeedAdmitted;
-  }
-  get creator() {
-    return this._members.creator;
-  }
-  get members() {
-    return this._members.members;
-  }
-  get membershipChainHeads() {
-    return this._members.membershipChainHeads;
-  }
-  get feeds() {
-    return this._feeds.feeds;
-  }
-  get credentials() {
-    return this._credentials.map((entry) => entry.credential);
-  }
-  get credentialEntries() {
-    return this._credentials;
-  }
-  get genesisCredential() {
-    return this._genesisCredential;
-  }
-  get tags() {
-    return this._tags;
-  }
-  get membershipPolicy() {
-    return this._membershipPolicy;
-  }
-  get invitations() {
-    return this._invitations.invitations;
-  }
-  async addCredentialProcessor(processor) {
-    if (this._credentialProcessors.find((p) => p.processor === processor)) {
-      throw new Error("Credential processor already added.");
-    }
-    const consumer = new CredentialConsumer(processor, async () => {
-      for (const credential of this.credentials) {
-        await consumer._process(credential);
-      }
-      consumer._isReadyForLiveCredentials = true;
-    }, async () => {
-      this._credentialProcessors = this._credentialProcessors.filter((p) => p !== consumer);
-    });
-    this._credentialProcessors.push(consumer);
-    await consumer.open();
-  }
-  async removeCredentialProcessor(processor) {
-    const consumer = this._credentialProcessors.find((p) => p.processor === processor);
-    await consumer?.close();
-  }
-  getCredentialsOfType(type) {
-    return this.credentials.filter((credential) => getCredentialAssertion(credential)["@type"] === type);
-  }
-  /**
-  * @param credential Message to process.
-  * @param fromFeed Key of the feed where this credential is recorded.
-  */
-  async process(credential, { sourceFeed, skipVerification }) {
-    if (credential.id) {
-      if (this._processedCredentials.has(credential.id)) {
-        return true;
-      }
-      this._processedCredentials.add(credential.id);
-    }
-    if (!skipVerification) {
-      const result = await verifyCredential(credential);
-      if (result.kind !== "pass") {
-        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 116, S: this });
-        return false;
-      }
-    }
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.credentials.SpaceGenesis": {
-        if (this._genesisCredential) {
-          log3.warn("Space already has a genesis credential.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 125, S: this });
-          return false;
-        }
-        if (!credential.issuer.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued by space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 129, S: this });
-          return false;
-        }
-        if (!credential.subject.id.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued to space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 133, S: this });
-          return false;
-        }
-        this._genesisCredential = credential;
-        this._tags = assertion.tags ?? [];
-        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy2.INVITE;
-        break;
-      }
-      case "dxos.halo.credentials.SpaceMember": {
-        if (!assertion.spaceKey.equals(this._spaceKey)) {
-          break;
-        }
-        if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 147, S: this });
-          return false;
-        }
-        if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 151, S: this });
-          return false;
-        }
-        await this._members.process(credential);
-        await this._invitations.process(credential);
-        break;
-      }
-      case "dxos.halo.credentials.MemberProfile": {
-        if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 161, S: this });
-          return false;
-        }
-        await this._members.process(credential);
-        break;
-      }
-      case "dxos.halo.credentials.AdmittedFeed": {
-        if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 170, S: this });
-          return false;
-        }
-        await this._feeds.process(credential, sourceFeed);
-        break;
-      }
-      case "dxos.halo.invitations.CancelDelegatedInvitation":
-      case "dxos.halo.invitations.DelegateSpaceInvitation": {
-        if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 181, S: this });
-          return false;
-        }
-        await this._invitations.process(credential);
-        break;
-      }
-    }
-    const newEntry = {
-      credential,
-      sourceFeed,
-      revoked: false
-    };
-    this._credentials.push(newEntry);
-    if (credential.id) {
-      this._credentialsById.set(credential.id, newEntry);
-    }
-    for (const processor of this._credentialProcessors) {
-      if (processor._isReadyForLiveCredentials) {
-        await processor._process(credential);
-      }
-    }
-    await this.onCredentialProcessed.callIfSet(credential);
-    return true;
-  }
-  getMemberRole(memberKey) {
-    return this._members.getRole(memberKey);
-  }
-  hasMembershipManagementPermission(memberKey) {
-    return this._canInviteNewMembers(memberKey);
-  }
-  _canInviteNewMembers(key) {
-    if (this._membershipPolicy === MembershipPolicy2.LOCKED) {
-      return key.equals(this._spaceKey) && this._members.members.size === 0;
-    }
-    return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
-  }
-};
-_ts_decorate([
-  synchronized
-], SpaceStateMachine.prototype, "process", null);
-var CredentialConsumer = class {
-  processor;
-  _onOpen;
-  _onClose;
-  _ctx = new Context(void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 229 });
-  /**
-  * @internal
-  * Processor is ready to process live credentials.
-  * NOTE: Setting this flag before all existing credentials are processed will cause them to be processed out of order.
-  * Set externally.
-  */
-  _isReadyForLiveCredentials = false;
-  constructor(processor, _onOpen, _onClose) {
-    this.processor = processor;
-    this._onOpen = _onOpen;
-    this._onClose = _onClose;
-  }
-  /**
-  * @internal
-  */
-  async _process(credential) {
-    await runInContextAsync(this._ctx, async () => {
-      await this.processor.processCredential(credential);
-    });
-  }
-  async open() {
-    if (this._ctx.disposed) {
-      throw new Error("CredentialProcessor is disposed");
-    }
-    await this._onOpen();
-  }
-  async close() {
-    await this._ctx.dispose();
-    await this._onClose();
-  }
-};
-
-// src/processor/device-state-machine.ts
-import { Trigger } from "@dxos/async";
-import { invariant as invariant6 } from "@dxos/invariant";
-import { PublicKey as PublicKey9 } from "@dxos/keys";
-import { log as log4 } from "@dxos/log";
-import { ComplexMap as ComplexMap7 } from "@dxos/util";
-var __dxlog_file7 = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
-var DeviceStateMachine = class {
-  _params;
-  // TODO(burdon): Return values via getter.
-  authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
-  deviceChainReady = new Trigger();
-  deviceCredentialChain;
-  constructor(_params) {
-    this._params = _params;
-  }
-  async processCredential(credential) {
-    log4("processing credential...", {
-      identityKey: this._params.identityKey,
-      deviceKey: this._params.deviceKey,
-      credential
-    }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 22, S: this });
-    if (isValidAuthorizedDeviceCredential(credential, this._params.identityKey, this._params.deviceKey)) {
-      this.deviceCredentialChain = {
-        credential
-      };
-      this.deviceChainReady.wake();
-    }
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.credentials.AuthorizedDevice": {
-        this.authorizedDeviceKeys.set(assertion.deviceKey, this.authorizedDeviceKeys.get(assertion.deviceKey) ?? {});
-        log4("added device", {
-          localDeviceKey: this._params.deviceKey,
-          deviceKey: assertion.deviceKey,
-          size: this.authorizedDeviceKeys.size
-        }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 41, S: this });
-        this._params.onUpdate?.();
-        break;
-      }
-      case "dxos.halo.credentials.DeviceProfile": {
-        invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 51, S: this, A: ["this.authorizedDeviceKeys.has(credential.subject.id)", "'Device not found.'"] });
-        if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
-          log4.trace("dxos.halo.device", {
-            deviceKey: credential.subject.id,
-            profile: assertion.profile
-          }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 53, S: this });
-        }
-        this.authorizedDeviceKeys.set(credential.subject.id, assertion.profile);
-        this._params.onUpdate?.();
-        break;
-      }
-    }
-  }
-};
-
-// src/processor/profile-state-machine.ts
-import { log as log5 } from "@dxos/log";
-var __dxlog_file8 = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
-var ProfileStateMachine = class {
-  _params;
-  // TODO(burdon): Return values via getter.
-  profile;
-  constructor(_params) {
-    this._params = _params;
-  }
-  async processCredential(credential) {
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.credentials.IdentityProfile": {
-        if (!credential.issuer.equals(this._params.identityKey) || !credential.subject.id.equals(this._params.identityKey)) {
-          log5.warn("Invalid profile credential", {
-            expectedIdentity: this._params.identityKey,
-            credential
-          }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 21, S: this });
-          return;
-        }
-        this.profile = assertion.profile;
-        log5("updated profile", {
-          identityKey: this._params.identityKey,
-          profile: this.profile
-        }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 29, S: this });
-        this._params.onUpdate?.();
-        break;
-      }
-    }
-  }
-};
-export {
-  CredentialGenerator,
-  DeviceStateMachine,
-  FeedStateMachine,
-  InvitationStateMachine,
-  MemberStateMachine,
-  ProfileStateMachine,
-  SIGNATURE_TYPE_ED25519,
-  SpaceStateMachine,
-  canonicalStringify,
-  checkCredentialType,
-  createAdmissionCredentials,
-  createCancelDelegatedSpaceInvitationCredential,
-  createCredential,
-  createCredentialMessage,
-  createCredentialSignerWithChain,
-  createCredentialSignerWithKey,
-  createDelegatedSpaceInvitationCredential,
-  createDeviceAuthorization,
-  createDidFromIdentityKey,
-  credentialTypeFilter,
-  defaultSecretProvider,
-  defaultSecretValidator,
-  generatePasscode,
-  generateSeedPhrase,
-  getCredentialAssertion,
-  getCredentialProofPayload,
-  getPresentationProofPayload,
-  isValidAuthorizedDeviceCredential,
-  keyPairFromSeedPhrase,
-  signPresentation,
-  verifyChain,
-  verifyCredential,
-  verifyCredentialSignature,
-  verifyPresentation,
-  verifyPresentationChain,
-  verifyPresentationSignature
-};
-//# sourceMappingURL=index.mjs.map