@dxos/credentials 0.5.1-next.638da00 → 0.5.1-next.65aaa36

package/dist/lib/browser/index.mjs

@@ -112,9 +112,6 @@ import { PublicKey as PublicKey2 } from "@dxos/keys";
 import { verifySignature } from "@dxos/crypto";
 var SIGNATURE_TYPE_ED25519 = "ED25519Signature";
 var verifyCredential = async (credential) => {
-  if (credential.parentCredentialIds?.length === 0) {
-    delete credential.parentCredentialIds;
-  }
   if (!credential.issuer.equals(credential.proof.signer)) {
     if (!credential.proof.chain) {
       return {
@@ -179,10 +176,10 @@ var verifyChain = async (chain, authority, subject) => {
 
 // packages/core/halo/credentials/src/credentials/credential-factory.ts
 var __dxlog_file = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
-var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
+var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce }) => {
   invariant(assertion["@type"], "Invalid assertion.", {
     F: __dxlog_file,
-    L: 48,
+    L: 45,
     S: void 0,
     A: [
       "assertion['@type']",
@@ -191,7 +188,7 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
   });
   invariant(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
     F: __dxlog_file,
-    L: 49,
+    L: 46,
     S: void 0,
     A: [
       "!!signingKey === !!chain",
@@ -202,7 +199,7 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
     const result = await verifyChain(chain, issuer, signingKey);
     invariant(result.kind === "pass", "Invalid chain.", {
       F: __dxlog_file,
-      L: 52,
+      L: 49,
       S: void 0,
       A: [
         "result.kind === 'pass'",
@@ -225,9 +222,6 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
       nonce
     }
   };
-  if ((parentCredentialIds?.length ?? 0) > 0) {
-    credential.parentCredentialIds = parentCredentialIds;
-  }
   const signedPayload = getCredentialProofPayload(credential);
   credential.proof.value = await signer.sign(signingKey ?? issuer, signedPayload);
   if (chain) {
@@ -244,13 +238,12 @@ var createCredentialMessage = (credential) => {
 };
 var createCredentialSignerWithKey = (signer, issuer) => ({
   getIssuer: () => issuer,
-  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
+  createCredential: ({ subject, assertion, nonce }) => createCredential({
     signer,
     issuer,
     subject,
     assertion,
-    nonce,
-    parentCredentialIds
+    nonce
   })
 });
 var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
@@ -318,7 +311,7 @@ var CredentialGenerator = class {
         assertion: {
           "@type": "dxos.halo.credentials.SpaceMember",
           spaceKey,
-          role: SpaceMember.Role.EDITOR,
+          role: SpaceMember.Role.MEMBER,
           genesisFeedKey
         }
       }),
@@ -413,15 +406,14 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, profile, invitationCredentialId) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
-      parentCredentialIds: membershipChainHeads,
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey,
-        role,
+        role: SpaceMember.Role.ADMIN,
         profile,
         genesisFeedKey,
         invitationCredentialId
@@ -579,10 +571,10 @@ var verifyPresentationSignature = async (presentation, proof) => {
 // packages/core/halo/credentials/src/state-machine/space-state-machine.ts
 import { runInContextAsync } from "@dxos/async";
 import { Context } from "@dxos/context";
-import { PublicKey as PublicKey7 } from "@dxos/keys";
-import { log as log3 } from "@dxos/log";
-import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { Callback as Callback4, ComplexMap as ComplexMap5, ComplexSet as ComplexSet3 } from "@dxos/util";
+import { PublicKey as PublicKey6 } from "@dxos/keys";
+import { log as log2 } from "@dxos/log";
+import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { Callback as Callback4, ComplexMap as ComplexMap4, ComplexSet as ComplexSet2 } from "@dxos/util";
 
 // packages/core/halo/credentials/src/state-machine/feed-state-machine.ts
 import { invariant as invariant2 } from "@dxos/invariant";
@@ -706,587 +698,25 @@ var InvitationStateMachine = class {
 };
 
 // packages/core/halo/credentials/src/state-machine/member-state-machine.ts
-import { invariant as invariant4 } from "@dxos/invariant";
-import { PublicKey as PublicKey6 } from "@dxos/keys";
-import { log as log2 } from "@dxos/log";
-import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { ComplexMap as ComplexMap4 } from "@dxos/util";
-
-// packages/core/halo/credentials/src/graph/credential-graph.ts
 import { invariant as invariant3 } from "@dxos/invariant";
 import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log } from "@dxos/log";
-import { Callback as Callback3, ComplexMap as ComplexMap3, ComplexSet as ComplexSet2 } from "@dxos/util";
-var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
-var CredentialGraph = class {
-  constructor(_stateHandler) {
-    this._stateHandler = _stateHandler;
-    this._vertexIdGenerator = 1;
-    this._root = {
-      id: -1,
-      parents: [],
-      children: []
-    };
-    this._sentinel = {
-      id: -2,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId = new ComplexMap3(PublicKey5.hash);
-    this._subjectToVertex = new ComplexMap3(PublicKey5.hash);
-    this._subjectToState = new ComplexMap3(PublicKey5.hash);
-    this.onSubjectStateChanged = new Callback3();
-  }
-  getSubjectState(subjectId) {
-    return this._subjectToState.get(subjectId);
-  }
-  getState() {
-    return this._subjectToState;
-  }
-  getLeafIds() {
-    return this._sentinel.parents.map((v) => v.credential.id);
-  }
-  getGlobalStateScope() {
-    return {
-      state: this._subjectToVertex
-    };
-  }
-  addVertex(credential, assertion) {
-    const newVertex = {
-      id: this._vertexIdGenerator++,
-      credential,
-      assertion,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId.set(credential.id, newVertex);
-    const parentIds = credential.parentCredentialIds ?? [];
-    if (parentIds.length === 0) {
-      this._root.children.push(newVertex);
-      newVertex.parents.push(this._root);
-    } else {
-      for (const parentId of parentIds) {
-        const parentVertex = this._vertexByCredentialId.get(parentId);
-        if (parentVertex == null) {
-          log.error("credential skipped because of the unknown parent", {
-            credential,
-            parentId
-          }, {
-            F: __dxlog_file3,
-            L: 72,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          continue;
-        }
-        parentVertex.children.push(newVertex);
-        newVertex.parents.push(parentVertex);
-        this._removeSentinelConnection(parentVertex);
-      }
-    }
-    newVertex.children.push(this._sentinel);
-    this._sentinel.parents.push(newVertex);
-    return this._onVertexInserted(newVertex);
-  }
-  _removeSentinelConnection(vertex) {
-    const sentinelIdx = vertex.children.indexOf(this._sentinel);
-    if (sentinelIdx >= 0) {
-      vertex.children.splice(sentinelIdx, 1);
-      const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
-      invariant3(vertexInSentinelIdx >= 0, void 0, {
-        F: __dxlog_file3,
-        L: 90,
-        S: this,
-        A: [
-          "vertexInSentinelIdx >= 0",
-          ""
-        ]
-      });
-      this._sentinel.parents.splice(vertexInSentinelIdx, 1);
-    }
-  }
-  async _onVertexInserted(newVertex) {
-    const { credential, assertion } = newVertex;
-    invariant3(credential, void 0, {
-      F: __dxlog_file3,
-      L: 97,
-      S: this,
-      A: [
-        "credential",
-        ""
-      ]
-    });
-    let changedSubjects = [];
-    const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
-    if (isUpdateAppliedOnTopOfThePreviousState) {
-      const subjectId = credential.subject.id;
-      if (this._stateHandler.isUpdateAllowed(this.getGlobalStateScope(), credential, assertion)) {
-        const newSubjectState = this._stateHandler.createState(credential, newVertex.assertion);
-        const prevSubjectState = this._subjectToState.get(subjectId);
-        this._subjectToState.set(subjectId, newSubjectState);
-        this._subjectToVertex.set(subjectId, newVertex);
-        if (this._stateHandler.hasStateChanged(newSubjectState, prevSubjectState)) {
-          changedSubjects.push(newSubjectState);
-        }
-      }
-    } else {
-      changedSubjects = this._recomputeState();
-    }
-    if (changedSubjects.length > 0) {
-      await this.onSubjectStateChanged.callIfSet(changedSubjects);
-    }
-  }
-  /**
-  * DFS the graph from root to sentinel pausing on merge points (nodes with multiple parents).
-  * Continue after all paths leading to a merge point converge by merging their states.
-  * In case of a concurrent update paths are replayed taking into account the state set
-  * by the winning branch.
-  */
-  _recomputeState() {
-    const pendingPaths = /* @__PURE__ */ new Map();
-    const paths = [
-      this._createRootPath()
-    ];
-    let lastPath = null;
-    while (lastPath == null) {
-      const path = paths.pop();
-      log("visit vertex", {
-        id: path.head.id
-      }, {
-        F: __dxlog_file3,
-        L: 132,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      this._updatePathState(path);
-      const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
-      if (convergedPaths == null) {
-        log("waiting for other paths", void 0, {
-          F: __dxlog_file3,
-          L: 136,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        continue;
-      }
-      const mergeResult = this._mergePaths(convergedPaths);
-      if (mergeResult.type === "replay_required") {
-        this._replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths);
-        continue;
-      }
-      const merged = mergeResult.path;
-      if (merged.head.children.length === 0) {
-        lastPath = merged;
-      } else if (merged.head.children.length === 1) {
-        merged.head = merged.head.children[0];
-        paths.push(merged);
-      } else {
-        this._forkTraversal(paths, merged);
-      }
-    }
-    if (paths.length > 0) {
-      log.error("traversal finished while there were active paths", {
-        paths: paths.map((p) => ({
-          path: toChosenPath(p),
-          head: p.head.id
-        }))
-      }, {
-        F: __dxlog_file3,
-        L: 155,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    }
-    return this._setCurrentState(lastPath);
-  }
-  _replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths) {
-    paths.push(...mergeResult.replay.map((path) => {
-      const stateOverrides = path.stateOverrides ?? new ComplexMap3(PublicKey5.hash);
-      mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));
-      return {
-        ...mergeResult.from,
-        chosenPath: path.chosenPath,
-        stateOverrides
-      };
-    }));
-    log("replay paths", () => ({
-      count: paths.length,
-      paths: paths.map((path) => ({
-        from: mergeResult.from.head.id,
-        path: toChosenPath(path),
-        overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }))
-    }), {
-      F: __dxlog_file3,
-      L: 175,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
-    pendingPaths.set(convergedPaths[0].head.id, clearedPending);
-  }
-  _handleMergePoint(paths, pendingPaths, path) {
-    const pendingList = pendingPaths.get(path.head.id) ?? [];
-    pendingPaths.set(path.head.id, pendingList);
-    pendingList.push(path);
-    if (pendingList.length < path.head.parents.length) {
-      return null;
-    }
-    if (path.head.id === this._sentinel.id && paths.length > 0) {
-      log("waiting for all the active paths to converge on the sentinel", void 0, {
-        F: __dxlog_file3,
-        L: 199,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return null;
-    }
-    pendingPaths.delete(path.head.id);
-    return pendingList;
-  }
-  _updatePathState(path) {
-    const headCredential = path.head.credential;
-    if (headCredential == null) {
-      return;
-    }
-    const updatedSubject = headCredential.subject.id;
-    path.credentials.add(headCredential.id);
-    let isUpdateAllowed = this._stateHandler.isUpdateAllowed(path, headCredential, path.head.assertion);
-    if (!isUpdateAllowed && path.head.parents[0]?.id === this._root.id) {
-      const globalState = this.getGlobalStateScope();
-      isUpdateAllowed = this._stateHandler.isUpdateAllowed(globalState, headCredential, path.head.assertion);
-    }
-    if (isUpdateAllowed) {
-      path.forkChangedSubjects.add(updatedSubject);
-      path.forkIssuers.add(headCredential.issuer);
-      path.state.set(updatedSubject, path.head);
-      log("path state updated", () => ({
-        subject: updatedSubject,
-        newState: this._stateHandler.toLogString(path.head.assertion)
-      }), {
-        F: __dxlog_file3,
-        L: 223,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    }
-  }
-  _forkTraversal(paths, path) {
-    const replayChoice = path.chosenPath?.[path.head.id];
-    const choices = replayChoice ?? path.head.children;
-    for (const choice of choices) {
-      log("edge traversal", {
-        from: path.head.id,
-        to: choice.id
-      }, {
-        F: __dxlog_file3,
-        L: 234,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      const fork = {
-        forkPoint: path,
-        chosenPath: {
-          ...path.chosenPath,
-          [path.head.id]: [
-            choice
-          ]
-        },
-        head: choice,
-        credentials: new ComplexSet2(PublicKey5.hash, path.credentials),
-        state: new ComplexMap3(PublicKey5.hash, [
-          ...path.state.entries()
-        ]),
-        forkIssuers: new ComplexSet2(PublicKey5.hash),
-        forkChangedSubjects: new ComplexSet2(PublicKey5.hash),
-        stateOverrides: path.stateOverrides
-      };
-      paths.push(fork);
-    }
-  }
-  /**
-  * Updates the current graph state.
-  * @returns changed states.
-  */
-  _setCurrentState(path) {
-    const changedSubjects = [];
-    const newStateMap = new ComplexMap3(PublicKey5.hash);
-    const newVertexMap = new ComplexMap3(PublicKey5.hash);
-    for (const [subjectKey, subjectVertex] of path.state.entries()) {
-      const newState = this._stateHandler.createState(subjectVertex.credential, subjectVertex.assertion);
-      const prevState = this._subjectToState.get(subjectKey);
-      newStateMap.set(subjectKey, newState);
-      newVertexMap.set(subjectKey, subjectVertex);
-      if (this._stateHandler.hasStateChanged(newState, prevState)) {
-        changedSubjects.push(newState);
-      }
-    }
-    this._subjectToState = newStateMap;
-    this._subjectToVertex = newVertexMap;
-    return changedSubjects;
-  }
-  /*
-  * Walk up all the fork points and return the first one present in all the paths.
-  * We use local id to determine vertex position in the graph, because nodes can't
-  * be inserted in the middle (between a parent and a child) and ids are monotonically increasing.
-  */
-  _leastCommonAncestor(paths) {
-    const uniqueForkPoints = paths.reduce((acc, path) => {
-      let it = path.forkPoint;
-      while (it) {
-        acc.set(it.head.id, it);
-        it = it.forkPoint;
-      }
-      return acc;
-    }, /* @__PURE__ */ new Map());
-    let maxId = this._root.id;
-    let maxState = null;
-    for (const [id, state] of uniqueForkPoints.entries()) {
-      const headCredential = state.head.credential;
-      if (headCredential != null) {
-        const isPointInEveryPath = paths.every((p) => p.credentials.has(headCredential.id));
-        if (isPointInEveryPath && id > maxId) {
-          maxId = id;
-          maxState = state;
-        }
-      }
-    }
-    return maxState ?? this._createRootPath();
-  }
-  /**
-  * We might be merging paths where some of them had fork points after the initial forking.
-  * We need all the paths to point to the least common fork point and contain all the changes
-  * that happened after it.
-  */
-  _moveUpToForkPoint(forkPoint, path) {
-    const isForkPointInPath = path.chosenPath[forkPoint.head.id] == null || path.forkPoint == null;
-    if (isForkPointInPath) {
-      return path;
-    }
-    if (forkPoint.head.id === path.forkPoint?.head.id) {
-      return path;
-    }
-    let it = path.forkPoint;
-    while (it.head.id !== forkPoint.head.id) {
-      it.forkIssuers.forEach((iss) => path.forkIssuers.add(iss));
-      it.forkChangedSubjects.forEach((m) => path.forkChangedSubjects.add(m));
-      it = it.forkPoint;
-      path.forkPoint = it;
-    }
-    return path;
-  }
-  _mergePaths(convergedPaths) {
-    invariant3(convergedPaths.length >= 1, void 0, {
-      F: __dxlog_file3,
-      L: 324,
-      S: this,
-      A: [
-        "convergedPaths.length >= 1",
-        ""
-      ]
-    });
-    if (convergedPaths.length === 1) {
-      return {
-        type: "merged",
-        path: convergedPaths[0]
-      };
-    }
-    const forkPoint = this._leastCommonAncestor(convergedPaths);
-    log("merging paths", () => ({
-      forkPointId: forkPoint.head.id,
-      pathCount: convergedPaths.length,
-      forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
-    }), {
-      F: __dxlog_file3,
-      L: 329,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
-    invariant3(forkPoint, void 0, {
-      F: __dxlog_file3,
-      L: 335,
-      S: this,
-      A: [
-        "forkPoint",
-        ""
-      ]
-    });
-    const result = {
-      forkPoint: forkPoint.forkPoint,
-      chosenPath: {
-        ...forkPoint.chosenPath,
-        [forkPoint.head.id]: []
-      },
-      stateOverrides: forkPoint.stateOverrides,
-      credentials: new ComplexSet2(PublicKey5.hash, forkPoint.credentials),
-      forkIssuers: new ComplexSet2(PublicKey5.hash, forkPoint.forkIssuers),
-      forkChangedSubjects: new ComplexSet2(PublicKey5.hash, forkPoint.forkChangedSubjects),
-      state: forkPoint.state.mapValues((v) => v),
-      head: paths[0].head
-    };
-    const subjectToBranch = new ComplexMap3(PublicKey5.hash);
-    for (const path of paths) {
-      log("processing a path", () => ({
-        choices: toChosenPath(path),
-        modified: path.forkChangedSubjects,
-        forkIssuers: path.forkIssuers,
-        state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }), {
-        F: __dxlog_file3,
-        L: 348,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
-      path.credentials.forEach((cred) => result.credentials.add(cred));
-      result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
-      for (const modifiedSubject of path.forkChangedSubjects) {
-        const existingBranch = subjectToBranch.get(modifiedSubject);
-        if (existingBranch == null || this._shouldOverrideCredential(existingBranch, path, modifiedSubject)) {
-          subjectToBranch.set(modifiedSubject, path);
-        }
-      }
-    }
-    const replayPaths = /* @__PURE__ */ new Set();
-    const addReplayPath = replayPaths.add.bind(replayPaths);
-    for (const [subject, branch] of subjectToBranch.entries()) {
-      result.forkChangedSubjects.add(subject);
-      const vertex = branch.state.get(subject);
-      result.state.set(subject, vertex);
-      log("set subject state", () => ({
-        subject,
-        state: this._stateHandler.toLogString(vertex.assertion)
-      }), {
-        F: __dxlog_file3,
-        L: 370,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      const otherPaths = paths.filter((p) => p !== branch);
-      this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
-    }
-    if (replayPaths.size > 0) {
-      return {
-        type: "replay_required",
-        replay: [
-          ...replayPaths.values()
-        ],
-        from: forkPoint,
-        stateOverrides: subjectToBranch.mapValues((v, key) => v.state.get(key))
-      };
-    }
-    return {
-      type: "merged",
-      path: result
-    };
-  }
-  /**
-  * A candidate credential is preferred over the existing credential if:
-  *  1. It is the merge-point, because it's the last credential that was issued in awareness of all
-  *  the previously existing ones.
-  *  2. A path where candidate was set contains existing credential in it, which means that the candidate
-  *  was issued after the existing credential by a legitimate issuer.
-  *  3. A state-specific logic (_stateHandler) is able to justify using the candidate credential.
-  *  4. The path where candidate was set has more issuers than the existing path (longer branch).
-  *  5. The issuance time of the candidate is after the issuance time of the existing credential (LWW).
-  */
-  _shouldOverrideCredential(existing, candidate, modifiedSubject) {
-    const candidateVertex = candidate.state.get(modifiedSubject);
-    const currentVertex = existing.state.get(modifiedSubject);
-    if (candidateVertex.id === currentVertex.id) {
-      return false;
-    }
-    const mergePointId = existing.head.id;
-    if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
-      log("merge point chosen to break the tie", {
-        mergePointId: existing.head.id
-      }, {
-        F: __dxlog_file3,
-        L: 408,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return mergePointId === candidateVertex.id;
-    }
-    const candidateCredential = candidateVertex.credential;
-    const currentCredential = currentVertex.credential;
-    if (existing.credentials.has(candidateCredential.id) !== candidate.credentials.has(currentCredential.id)) {
-      log("one of the credentials was overridden in another branch", {
-        current: currentVertex.id,
-        candidate: candidateVertex.id
-      }, {
-        F: __dxlog_file3,
-        L: 415,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return candidate.credentials.has(currentCredential.id);
-    }
-    const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
-    if (winningCredential != null) {
-      return winningCredential === candidateCredential;
-    }
-    if (candidate.forkIssuers.size !== existing.forkIssuers.size) {
-      log("longer issuers branch used to break the tie", {
-        issuerCount: [
-          existing.forkIssuers.size,
-          candidate.forkIssuers.size
-        ]
-      }, {
-        F: __dxlog_file3,
-        L: 432,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return candidate.forkIssuers.size > existing.forkIssuers.size;
-    }
-    log("issuance date used to break the tie", void 0, {
-      F: __dxlog_file3,
-      L: 437,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
-  }
-  _createRootPath() {
-    return {
-      head: this._root,
-      chosenPath: {},
-      forkIssuers: new ComplexSet2(PublicKey5.hash),
-      forkChangedSubjects: new ComplexSet2(PublicKey5.hash),
-      state: new ComplexMap3(PublicKey5.hash),
-      credentials: new ComplexSet2(PublicKey5.hash)
-    };
-  }
-};
-var toChosenPath = (path) => {
-  return Object.fromEntries(Object.entries(path.chosenPath).map(([k, vs]) => [
-    k,
-    vs.map((v) => v.id)
-  ]));
-};
-
-// packages/core/halo/credentials/src/state-machine/member-state-machine.ts
-var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
+import { Callback as Callback3, ComplexMap as ComplexMap3 } from "@dxos/util";
+var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
 var MemberStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._memberProfiles = new ComplexMap4(PublicKey6.hash);
-    this._hashgraph = new CredentialGraph(this);
-    this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
+    this._members = new ComplexMap3(PublicKey5.hash);
+    this.onMemberAdmitted = new Callback3();
   }
   get creator() {
-    return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
+    return this._creator;
   }
   get members() {
-    return this._hashgraph.getState();
-  }
-  get membershipChainHeads() {
-    return this._hashgraph.getLeafIds();
+    return this._members;
   }
   getRole(member) {
-    return this._getRole(this._hashgraph.getGlobalStateScope(), member);
+    return this._members.get(member)?.assertion.role;
   }
   /**
   * Processes the SpaceMember credential.
@@ -1296,125 +726,87 @@ var MemberStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceMember": {
-        invariant4(assertion.spaceKey.equals(this._spaceKey), void 0, {
-          F: __dxlog_file4,
-          L: 66,
+        invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, {
+          F: __dxlog_file3,
+          L: 58,
           S: this,
           A: [
             "assertion.spaceKey.equals(this._spaceKey)",
             ""
           ]
         });
-        if (this._ownerKey == null && credential.issuer === this._spaceKey) {
-          this._ownerKey = credential.subject.id;
+        if (this._members.has(credential.subject.id)) {
+          return;
         }
-        if (assertion.profile != null) {
-          this._memberProfiles.set(credential.subject.id, assertion.profile);
+        const info = {
+          key: credential.subject.id,
+          credential,
+          assertion,
+          removed: false,
+          profile: assertion.profile
+        };
+        if (!this._creator) {
+          this._creator = info;
         }
-        await this._hashgraph.addVertex(credential, assertion);
+        this._members.set(credential.subject.id, info);
+        log("member added", {
+          member: credential.subject.id,
+          space: this._spaceKey,
+          role: assertion.role,
+          profile: assertion.profile
+        }, {
+          F: __dxlog_file3,
+          L: 79,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        await this.onMemberAdmitted.callIfSet(info);
         break;
       }
       case "dxos.halo.credentials.MemberProfile": {
-        const member = this._hashgraph.getSubjectState(credential.subject.id);
-        if (member) {
-          member.profile = assertion.profile;
-        } else {
-          log2.warn("Member not found", {
+        const member = this._members.get(credential.subject.id);
+        if (!member) {
+          log.warn("Member not found", {
             id: credential.subject.id
           }, {
-            F: __dxlog_file4,
-            L: 81,
+            F: __dxlog_file3,
+            L: 93,
             S: this,
             C: (f, a) => f(...a)
           });
+        } else {
+          member.profile = assertion.profile;
         }
-        this._memberProfiles.set(credential.subject.id, assertion.profile);
         break;
       }
       default:
         throw new Error("Invalid assertion type");
     }
   }
-  createState(credential, assertion) {
-    const memberKey = credential.subject.id;
-    return {
-      key: memberKey,
-      role: assertion.role,
-      credential,
-      assertion,
-      profile: this._memberProfiles.get(memberKey)
-    };
-  }
-  isUpdateAllowed(scope, credential, assertion) {
-    if (assertion.role === SpaceMember2.Role.OWNER) {
-      return credential.issuer.equals(this._spaceKey);
-    }
-    const issuer = credential.issuer;
-    const isChangingOwnRole = issuer.equals(credential.subject.id);
-    if (isChangingOwnRole) {
-      return false;
-    }
-    if (issuer.equals(assertion.spaceKey)) {
-      return true;
-    }
-    const issuerRole = this._getRole(scope, issuer);
-    return issuerRole === SpaceMember2.Role.ADMIN || issuerRole === SpaceMember2.Role.OWNER;
-  }
-  getConflictingPaths(paths, update) {
-    if (update.assertion.role !== SpaceMember2.Role.REMOVED && update.assertion.role !== SpaceMember2.Role.EDITOR) {
-      return [];
-    }
-    const memberId = update.credential.subject.id;
-    return paths.filter((p) => p.forkIssuers.has(memberId));
-  }
-  tryPickWinningUpdate(scope1, update1, scope2, update2) {
-    const path1IssuerRole = this._getRole(scope1, update1.issuer);
-    const path2IssuerRole = this._getRole(scope2, update2.issuer);
-    if (path2IssuerRole === SpaceMember2.Role.OWNER !== (path1IssuerRole === SpaceMember2.Role.OWNER)) {
-      log2("owner decision used to break the tie", void 0, {
-        F: __dxlog_file4,
-        L: 139,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return path1IssuerRole === SpaceMember2.Role.OWNER ? update1 : update2;
-    }
-    return null;
-  }
-  toLogString(assertion) {
-    const role = assertion?.role ?? SpaceMember2.Role.REMOVED;
-    return Object.entries(SpaceMember2.Role).find(([_, value]) => value === role)[0];
-  }
-  hasStateChanged(s1, s2) {
-    return s1?.role !== s2?.role;
-  }
-  _getRole(scope, memberId) {
-    if (this._ownerKey?.equals(memberId)) {
-      return SpaceMember2.Role.OWNER;
-    }
-    const realRole = scope.state.get(memberId)?.assertion?.role ?? SpaceMember2.Role.REMOVED;
-    if (scope.stateOverrides != null) {
-      const override = scope.stateOverrides.get(memberId);
-      if (override != null) {
-        log2("member role overridden in path", () => ({
-          headId: scope.head?.id,
-          roleOverride: this.toLogString(override.assertion),
-          realRole: this.toLogString(scope.state.get(memberId)?.assertion)
-        }), {
-          F: __dxlog_file4,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        return override.assertion.role;
+  async onRevoked(revoked, revocation) {
+    invariant3(revoked.id, void 0, {
+      F: __dxlog_file3,
+      L: 106,
+      S: this,
+      A: [
+        "revoked.id",
+        ""
+      ]
+    });
+    for (const member of this._members.values()) {
+      if (member.credential.id?.equals(revoked.id)) {
+        member.removed = true;
+        break;
       }
     }
-    return realRole;
   }
 };
 
 // packages/core/halo/credentials/src/state-machine/space-state-machine.ts
-var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
+var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
+var REVOCABLE_CREDENTIALS = [
+  "dxos.halo.credentials.SpaceMember"
+];
 var SpaceStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
@@ -1422,11 +814,11 @@ var SpaceStateMachine = class {
     this._feeds = new FeedStateMachine(this._spaceKey);
     this._invitations = new InvitationStateMachine();
     this._credentials = [];
-    this._credentialsById = new ComplexMap5(PublicKey7.hash);
-    this._processedCredentials = new ComplexSet3(PublicKey7.hash);
+    this._credentialsById = new ComplexMap4(PublicKey6.hash);
+    this._processedCredentials = new ComplexSet2(PublicKey6.hash);
     this._credentialProcessors = [];
     this.onCredentialProcessed = new Callback4();
-    this.onMemberRoleChanged = this._members.onMemberRoleChanged;
+    this.onMemberAdmitted = this._members.onMemberAdmitted;
     this.onFeedAdmitted = this._feeds.onFeedAdmitted;
     this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
     this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
@@ -1437,9 +829,6 @@ var SpaceStateMachine = class {
   get members() {
     return this._members.members;
   }
-  get membershipChainHeads() {
-    return this._members.membershipChainHeads;
-  }
   get feeds() {
     return this._feeds.feeds;
   }
@@ -1491,9 +880,9 @@ var SpaceStateMachine = class {
     if (!skipVerification) {
       const result = await verifyCredential(credential);
       if (result.kind !== "pass") {
-        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
-          F: __dxlog_file5,
-          L: 152,
+        log2.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
+          F: __dxlog_file4,
+          L: 149,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1502,29 +891,61 @@ var SpaceStateMachine = class {
     }
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
+      case "dxos.halo.credentials.Revocation": {
+        if (!this._canRevokeCredentials(credential.issuer)) {
+          log2.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+            F: __dxlog_file4,
+            L: 158,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        const toBeRevoked = this._credentialsById.get(credential.subject.id);
+        if (!toBeRevoked) {
+          log2.warn(`Credential to revoke not found: ${credential.subject.id}`, void 0, {
+            F: __dxlog_file4,
+            L: 163,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        if (!this._credentialCanBeRevoked(toBeRevoked)) {
+          log2.warn(`Credential cannot be revoked: ${credential.subject.id}`, void 0, {
+            F: __dxlog_file4,
+            L: 167,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+        }
+        toBeRevoked.revoked = true;
+        await this._members.onRevoked(toBeRevoked.credential, credential);
+        break;
+      }
       case "dxos.halo.credentials.SpaceGenesis": {
         if (this._genesisCredential) {
-          log3.warn("Space already has a genesis credential.", void 0, {
-            F: __dxlog_file5,
-            L: 161,
+          log2.warn("Space already has a genesis credential.", void 0, {
+            F: __dxlog_file4,
+            L: 176,
             S: this,
             C: (f, a) => f(...a)
           });
           return false;
         }
         if (!credential.issuer.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued by space.", void 0, {
-            F: __dxlog_file5,
-            L: 165,
+          log2.warn("Space genesis credential must be issued by space.", void 0, {
+            F: __dxlog_file4,
+            L: 180,
             S: this,
             C: (f, a) => f(...a)
           });
           return false;
         }
         if (!credential.subject.id.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued to space.", void 0, {
-            F: __dxlog_file5,
-            L: 169,
+          log2.warn("Space genesis credential must be issued to space.", void 0, {
+            F: __dxlog_file4,
+            L: 184,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1538,18 +959,18 @@ var SpaceStateMachine = class {
           break;
         }
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file5,
-            L: 182,
+          log2.warn("Space must have a genesis credential before adding members.", void 0, {
+            F: __dxlog_file4,
+            L: 198,
             S: this,
             C: (f, a) => f(...a)
           });
           return false;
         }
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file5,
-            L: 186,
+          log2.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+            F: __dxlog_file4,
+            L: 202,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1561,9 +982,9 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.MemberProfile": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file5,
-            L: 197,
+          log2.warn("Space must have a genesis credential before adding members.", void 0, {
+            F: __dxlog_file4,
+            L: 213,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1574,18 +995,18 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.AdmittedFeed": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
-            F: __dxlog_file5,
-            L: 207,
+          log2.warn("Space must have a genesis credential before admitting feeds.", void 0, {
+            F: __dxlog_file4,
+            L: 223,
             S: this,
             C: (f, a) => f(...a)
           });
           return false;
         }
         if (!this._canAdmitFeeds(credential.issuer)) {
-          log3.warn(`Space member is not authorized to admit feeds: ${credential.issuer}`, void 0, {
-            F: __dxlog_file5,
-            L: 211,
+          log2.warn(`Space member is not authorized to admit feeds: ${credential.issuer}`, void 0, {
+            F: __dxlog_file4,
+            L: 227,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1597,9 +1018,9 @@ var SpaceStateMachine = class {
       case "dxos.halo.invitations.CancelDelegatedInvitation":
       case "dxos.halo.invitations.DelegateSpaceInvitation": {
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file5,
-            L: 222,
+          log2.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+            F: __dxlog_file4,
+            L: 238,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1627,11 +1048,17 @@ var SpaceStateMachine = class {
     return true;
   }
   _canInviteNewMembers(key) {
-    return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
+    return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember2.Role.ADMIN;
   }
   _canAdmitFeeds(key) {
     const role = this._members.getRole(key);
-    return role === SpaceMember3.Role.EDITOR || role === SpaceMember3.Role.ADMIN || role === SpaceMember3.Role.OWNER;
+    return role === SpaceMember2.Role.MEMBER || role === SpaceMember2.Role.ADMIN;
+  }
+  _canRevokeCredentials(key) {
+    return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember2.Role.ADMIN;
+  }
+  _credentialCanBeRevoked(entry) {
+    return REVOCABLE_CREDENTIALS.includes(entry.credential.subject.assertion["@type"]);
   }
 };
 var CredentialConsumer = class {
@@ -1664,24 +1091,24 @@ var CredentialConsumer = class {
 
 // packages/core/halo/credentials/src/processor/device-state-machine.ts
 import { Trigger } from "@dxos/async";
-import { invariant as invariant5 } from "@dxos/invariant";
-import { PublicKey as PublicKey8 } from "@dxos/keys";
-import { log as log4 } from "@dxos/log";
-import { ComplexMap as ComplexMap6 } from "@dxos/util";
-var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
+import { invariant as invariant4 } from "@dxos/invariant";
+import { PublicKey as PublicKey7 } from "@dxos/keys";
+import { log as log3 } from "@dxos/log";
+import { ComplexMap as ComplexMap5 } from "@dxos/util";
+var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
 var DeviceStateMachine = class {
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new ComplexMap6(PublicKey8.hash);
+    this.authorizedDeviceKeys = new ComplexMap5(PublicKey7.hash);
     this.deviceChainReady = new Trigger();
   }
   async processCredential(credential) {
-    log4("processing credential...", {
+    log3("processing credential...", {
       identityKey: this._params.identityKey,
       deviceKey: this._params.deviceKey,
       credential
     }, {
-      F: __dxlog_file6,
+      F: __dxlog_file5,
       L: 35,
       S: this,
       C: (f, a) => f(...a)
@@ -1695,8 +1122,8 @@ var DeviceStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.AuthorizedDevice": {
-        invariant5(!this.authorizedDeviceKeys.has(assertion.deviceKey), "Device already added.", {
-          F: __dxlog_file6,
+        invariant4(!this.authorizedDeviceKeys.has(assertion.deviceKey), "Device already added.", {
+          F: __dxlog_file5,
           L: 51,
           S: this,
           A: [
@@ -1705,12 +1132,12 @@ var DeviceStateMachine = class {
           ]
         });
         this.authorizedDeviceKeys.set(assertion.deviceKey, {});
-        log4("added device", {
+        log3("added device", {
           localDeviceKey: this._params.deviceKey,
           deviceKey: assertion.deviceKey,
           size: this.authorizedDeviceKeys.size
         }, {
-          F: __dxlog_file6,
+          F: __dxlog_file5,
           L: 54,
           S: this,
           C: (f, a) => f(...a)
@@ -1719,8 +1146,8 @@ var DeviceStateMachine = class {
         break;
       }
       case "dxos.halo.credentials.DeviceProfile": {
-        invariant5(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
-          F: __dxlog_file6,
+        invariant4(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
+          F: __dxlog_file5,
           L: 64,
           S: this,
           A: [
@@ -1729,11 +1156,11 @@ var DeviceStateMachine = class {
           ]
         });
         if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
-          log4.trace("dxos.halo.device", {
+          log3.trace("dxos.halo.device", {
             deviceKey: credential.subject.id,
             profile: assertion.profile
           }, {
-            F: __dxlog_file6,
+            F: __dxlog_file5,
             L: 67,
             S: this,
             C: (f, a) => f(...a)
@@ -1748,8 +1175,8 @@ var DeviceStateMachine = class {
 };
 
 // packages/core/halo/credentials/src/processor/profile-state-machine.ts
-import { log as log5 } from "@dxos/log";
-var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
+import { log as log4 } from "@dxos/log";
+var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
 var ProfileStateMachine = class {
   constructor(_params) {
     this._params = _params;
@@ -1759,11 +1186,11 @@ var ProfileStateMachine = class {
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.IdentityProfile": {
         if (!credential.issuer.equals(this._params.identityKey) || !credential.subject.id.equals(this._params.identityKey)) {
-          log5.warn("Invalid profile credential", {
+          log4.warn("Invalid profile credential", {
             expectedIdentity: this._params.identityKey,
             credential
           }, {
-            F: __dxlog_file7,
+            F: __dxlog_file6,
             L: 34,
             S: this,
             C: (f, a) => f(...a)
@@ -1771,11 +1198,11 @@ var ProfileStateMachine = class {
           return;
         }
         this.profile = assertion.profile;
-        log5("updated profile", {
+        log4("updated profile", {
           identityKey: this._params.identityKey,
           profile: this.profile
         }, {
-          F: __dxlog_file7,
+          F: __dxlog_file6,
           L: 40,
           S: this,
           C: (f, a) => f(...a)