@dxos/credentials 0.5.1-next.638da00 → 0.5.1-next.65aaa36

package/dist/lib/node/index.cjs

@@ -88,18 +88,13 @@ var import_util4 = require("@dxos/util");
 var import_invariant3 = require("@dxos/invariant");
 var import_keys6 = require("@dxos/keys");
 var import_log2 = require("@dxos/log");
-var import_credentials3 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util5 = require("@dxos/util");
+var import_async2 = require("@dxos/async");
 var import_invariant4 = require("@dxos/invariant");
 var import_keys7 = require("@dxos/keys");
 var import_log3 = require("@dxos/log");
 var import_util6 = require("@dxos/util");
-var import_async2 = require("@dxos/async");
-var import_invariant5 = require("@dxos/invariant");
-var import_keys8 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
-var import_util7 = require("@dxos/util");
-var import_log5 = require("@dxos/log");
 var defaultSecretProvider = async () => Buffer.from("0000");
 var defaultSecretValidator = async (invitation, secret) => true;
 var generatePasscode = (length = 4) => {
@@ -184,9 +179,6 @@ var checkCredentialType = (credential, type) => credential.subject.assertion["@t
 var credentialTypeFilter = (type) => (credential) => checkCredentialType(credential, type);
 var SIGNATURE_TYPE_ED25519 = "ED25519Signature";
 var verifyCredential = async (credential) => {
-  if (credential.parentCredentialIds?.length === 0) {
-    delete credential.parentCredentialIds;
-  }
   if (!credential.issuer.equals(credential.proof.signer)) {
     if (!credential.proof.chain) {
       return {
@@ -249,10 +241,10 @@ var verifyChain = async (chain, authority, subject) => {
   };
 };
 var __dxlog_file = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
-var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
+var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce }) => {
   (0, import_invariant.invariant)(assertion["@type"], "Invalid assertion.", {
     F: __dxlog_file,
-    L: 48,
+    L: 45,
     S: void 0,
     A: [
       "assertion['@type']",
@@ -261,7 +253,7 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
   });
   (0, import_invariant.invariant)(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
     F: __dxlog_file,
-    L: 49,
+    L: 46,
     S: void 0,
     A: [
       "!!signingKey === !!chain",
@@ -272,7 +264,7 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
     const result = await verifyChain(chain, issuer, signingKey);
     (0, import_invariant.invariant)(result.kind === "pass", "Invalid chain.", {
       F: __dxlog_file,
-      L: 52,
+      L: 49,
       S: void 0,
       A: [
         "result.kind === 'pass'",
@@ -295,9 +287,6 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
       nonce
     }
   };
-  if ((parentCredentialIds?.length ?? 0) > 0) {
-    credential.parentCredentialIds = parentCredentialIds;
-  }
   const signedPayload = getCredentialProofPayload(credential);
   credential.proof.value = await signer.sign(signingKey ?? issuer, signedPayload);
   if (chain) {
@@ -314,13 +303,12 @@ var createCredentialMessage = (credential) => {
 };
 var createCredentialSignerWithKey = (signer, issuer) => ({
   getIssuer: () => issuer,
-  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
+  createCredential: ({ subject, assertion, nonce }) => createCredential({
     signer,
     issuer,
     subject,
     assertion,
-    nonce,
-    parentCredentialIds
+    nonce
   })
 });
 var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
@@ -384,7 +372,7 @@ var CredentialGenerator = class {
         assertion: {
           "@type": "dxos.halo.credentials.SpaceMember",
           spaceKey,
-          role: import_credentials.SpaceMember.Role.EDITOR,
+          role: import_credentials.SpaceMember.Role.MEMBER,
           genesisFeedKey
         }
       }),
@@ -479,15 +467,14 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = import_credentials.SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, profile, invitationCredentialId) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
-      parentCredentialIds: membershipChainHeads,
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey,
-        role,
+        role: import_credentials.SpaceMember.Role.ADMIN,
         profile,
         genesisFeedKey,
         invitationCredentialId
@@ -748,574 +735,21 @@ var InvitationStateMachine = class {
     }
   }
 };
-var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
-var CredentialGraph = class {
-  constructor(_stateHandler) {
-    this._stateHandler = _stateHandler;
-    this._vertexIdGenerator = 1;
-    this._root = {
-      id: -1,
-      parents: [],
-      children: []
-    };
-    this._sentinel = {
-      id: -2,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
-    this._subjectToVertex = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
-    this._subjectToState = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
-    this.onSubjectStateChanged = new import_util6.Callback();
-  }
-  getSubjectState(subjectId) {
-    return this._subjectToState.get(subjectId);
-  }
-  getState() {
-    return this._subjectToState;
-  }
-  getLeafIds() {
-    return this._sentinel.parents.map((v) => v.credential.id);
-  }
-  getGlobalStateScope() {
-    return {
-      state: this._subjectToVertex
-    };
-  }
-  addVertex(credential, assertion) {
-    const newVertex = {
-      id: this._vertexIdGenerator++,
-      credential,
-      assertion,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId.set(credential.id, newVertex);
-    const parentIds = credential.parentCredentialIds ?? [];
-    if (parentIds.length === 0) {
-      this._root.children.push(newVertex);
-      newVertex.parents.push(this._root);
-    } else {
-      for (const parentId of parentIds) {
-        const parentVertex = this._vertexByCredentialId.get(parentId);
-        if (parentVertex == null) {
-          import_log3.log.error("credential skipped because of the unknown parent", {
-            credential,
-            parentId
-          }, {
-            F: __dxlog_file3,
-            L: 72,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          continue;
-        }
-        parentVertex.children.push(newVertex);
-        newVertex.parents.push(parentVertex);
-        this._removeSentinelConnection(parentVertex);
-      }
-    }
-    newVertex.children.push(this._sentinel);
-    this._sentinel.parents.push(newVertex);
-    return this._onVertexInserted(newVertex);
-  }
-  _removeSentinelConnection(vertex) {
-    const sentinelIdx = vertex.children.indexOf(this._sentinel);
-    if (sentinelIdx >= 0) {
-      vertex.children.splice(sentinelIdx, 1);
-      const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
-      (0, import_invariant4.invariant)(vertexInSentinelIdx >= 0, void 0, {
-        F: __dxlog_file3,
-        L: 90,
-        S: this,
-        A: [
-          "vertexInSentinelIdx >= 0",
-          ""
-        ]
-      });
-      this._sentinel.parents.splice(vertexInSentinelIdx, 1);
-    }
-  }
-  async _onVertexInserted(newVertex) {
-    const { credential, assertion } = newVertex;
-    (0, import_invariant4.invariant)(credential, void 0, {
-      F: __dxlog_file3,
-      L: 97,
-      S: this,
-      A: [
-        "credential",
-        ""
-      ]
-    });
-    let changedSubjects = [];
-    const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
-    if (isUpdateAppliedOnTopOfThePreviousState) {
-      const subjectId = credential.subject.id;
-      if (this._stateHandler.isUpdateAllowed(this.getGlobalStateScope(), credential, assertion)) {
-        const newSubjectState = this._stateHandler.createState(credential, newVertex.assertion);
-        const prevSubjectState = this._subjectToState.get(subjectId);
-        this._subjectToState.set(subjectId, newSubjectState);
-        this._subjectToVertex.set(subjectId, newVertex);
-        if (this._stateHandler.hasStateChanged(newSubjectState, prevSubjectState)) {
-          changedSubjects.push(newSubjectState);
-        }
-      }
-    } else {
-      changedSubjects = this._recomputeState();
-    }
-    if (changedSubjects.length > 0) {
-      await this.onSubjectStateChanged.callIfSet(changedSubjects);
-    }
-  }
-  /**
-  * DFS the graph from root to sentinel pausing on merge points (nodes with multiple parents).
-  * Continue after all paths leading to a merge point converge by merging their states.
-  * In case of a concurrent update paths are replayed taking into account the state set
-  * by the winning branch.
-  */
-  _recomputeState() {
-    const pendingPaths = /* @__PURE__ */ new Map();
-    const paths = [
-      this._createRootPath()
-    ];
-    let lastPath = null;
-    while (lastPath == null) {
-      const path = paths.pop();
-      (0, import_log3.log)("visit vertex", {
-        id: path.head.id
-      }, {
-        F: __dxlog_file3,
-        L: 132,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      this._updatePathState(path);
-      const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
-      if (convergedPaths == null) {
-        (0, import_log3.log)("waiting for other paths", void 0, {
-          F: __dxlog_file3,
-          L: 136,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        continue;
-      }
-      const mergeResult = this._mergePaths(convergedPaths);
-      if (mergeResult.type === "replay_required") {
-        this._replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths);
-        continue;
-      }
-      const merged = mergeResult.path;
-      if (merged.head.children.length === 0) {
-        lastPath = merged;
-      } else if (merged.head.children.length === 1) {
-        merged.head = merged.head.children[0];
-        paths.push(merged);
-      } else {
-        this._forkTraversal(paths, merged);
-      }
-    }
-    if (paths.length > 0) {
-      import_log3.log.error("traversal finished while there were active paths", {
-        paths: paths.map((p) => ({
-          path: toChosenPath(p),
-          head: p.head.id
-        }))
-      }, {
-        F: __dxlog_file3,
-        L: 155,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    }
-    return this._setCurrentState(lastPath);
-  }
-  _replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths) {
-    paths.push(...mergeResult.replay.map((path) => {
-      const stateOverrides = path.stateOverrides ?? new import_util6.ComplexMap(import_keys7.PublicKey.hash);
-      mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));
-      return {
-        ...mergeResult.from,
-        chosenPath: path.chosenPath,
-        stateOverrides
-      };
-    }));
-    (0, import_log3.log)("replay paths", () => ({
-      count: paths.length,
-      paths: paths.map((path) => ({
-        from: mergeResult.from.head.id,
-        path: toChosenPath(path),
-        overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }))
-    }), {
-      F: __dxlog_file3,
-      L: 175,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
-    pendingPaths.set(convergedPaths[0].head.id, clearedPending);
-  }
-  _handleMergePoint(paths, pendingPaths, path) {
-    const pendingList = pendingPaths.get(path.head.id) ?? [];
-    pendingPaths.set(path.head.id, pendingList);
-    pendingList.push(path);
-    if (pendingList.length < path.head.parents.length) {
-      return null;
-    }
-    if (path.head.id === this._sentinel.id && paths.length > 0) {
-      (0, import_log3.log)("waiting for all the active paths to converge on the sentinel", void 0, {
-        F: __dxlog_file3,
-        L: 199,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return null;
-    }
-    pendingPaths.delete(path.head.id);
-    return pendingList;
-  }
-  _updatePathState(path) {
-    const headCredential = path.head.credential;
-    if (headCredential == null) {
-      return;
-    }
-    const updatedSubject = headCredential.subject.id;
-    path.credentials.add(headCredential.id);
-    let isUpdateAllowed = this._stateHandler.isUpdateAllowed(path, headCredential, path.head.assertion);
-    if (!isUpdateAllowed && path.head.parents[0]?.id === this._root.id) {
-      const globalState = this.getGlobalStateScope();
-      isUpdateAllowed = this._stateHandler.isUpdateAllowed(globalState, headCredential, path.head.assertion);
-    }
-    if (isUpdateAllowed) {
-      path.forkChangedSubjects.add(updatedSubject);
-      path.forkIssuers.add(headCredential.issuer);
-      path.state.set(updatedSubject, path.head);
-      (0, import_log3.log)("path state updated", () => ({
-        subject: updatedSubject,
-        newState: this._stateHandler.toLogString(path.head.assertion)
-      }), {
-        F: __dxlog_file3,
-        L: 223,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    }
-  }
-  _forkTraversal(paths, path) {
-    const replayChoice = path.chosenPath?.[path.head.id];
-    const choices = replayChoice ?? path.head.children;
-    for (const choice of choices) {
-      (0, import_log3.log)("edge traversal", {
-        from: path.head.id,
-        to: choice.id
-      }, {
-        F: __dxlog_file3,
-        L: 234,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      const fork = {
-        forkPoint: path,
-        chosenPath: {
-          ...path.chosenPath,
-          [path.head.id]: [
-            choice
-          ]
-        },
-        head: choice,
-        credentials: new import_util6.ComplexSet(import_keys7.PublicKey.hash, path.credentials),
-        state: new import_util6.ComplexMap(import_keys7.PublicKey.hash, [
-          ...path.state.entries()
-        ]),
-        forkIssuers: new import_util6.ComplexSet(import_keys7.PublicKey.hash),
-        forkChangedSubjects: new import_util6.ComplexSet(import_keys7.PublicKey.hash),
-        stateOverrides: path.stateOverrides
-      };
-      paths.push(fork);
-    }
-  }
-  /**
-  * Updates the current graph state.
-  * @returns changed states.
-  */
-  _setCurrentState(path) {
-    const changedSubjects = [];
-    const newStateMap = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
-    const newVertexMap = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
-    for (const [subjectKey, subjectVertex] of path.state.entries()) {
-      const newState = this._stateHandler.createState(subjectVertex.credential, subjectVertex.assertion);
-      const prevState = this._subjectToState.get(subjectKey);
-      newStateMap.set(subjectKey, newState);
-      newVertexMap.set(subjectKey, subjectVertex);
-      if (this._stateHandler.hasStateChanged(newState, prevState)) {
-        changedSubjects.push(newState);
-      }
-    }
-    this._subjectToState = newStateMap;
-    this._subjectToVertex = newVertexMap;
-    return changedSubjects;
-  }
-  /*
-  * Walk up all the fork points and return the first one present in all the paths.
-  * We use local id to determine vertex position in the graph, because nodes can't
-  * be inserted in the middle (between a parent and a child) and ids are monotonically increasing.
-  */
-  _leastCommonAncestor(paths) {
-    const uniqueForkPoints = paths.reduce((acc, path) => {
-      let it = path.forkPoint;
-      while (it) {
-        acc.set(it.head.id, it);
-        it = it.forkPoint;
-      }
-      return acc;
-    }, /* @__PURE__ */ new Map());
-    let maxId = this._root.id;
-    let maxState = null;
-    for (const [id, state] of uniqueForkPoints.entries()) {
-      const headCredential = state.head.credential;
-      if (headCredential != null) {
-        const isPointInEveryPath = paths.every((p) => p.credentials.has(headCredential.id));
-        if (isPointInEveryPath && id > maxId) {
-          maxId = id;
-          maxState = state;
-        }
-      }
-    }
-    return maxState ?? this._createRootPath();
-  }
-  /**
-  * We might be merging paths where some of them had fork points after the initial forking.
-  * We need all the paths to point to the least common fork point and contain all the changes
-  * that happened after it.
-  */
-  _moveUpToForkPoint(forkPoint, path) {
-    const isForkPointInPath = path.chosenPath[forkPoint.head.id] == null || path.forkPoint == null;
-    if (isForkPointInPath) {
-      return path;
-    }
-    if (forkPoint.head.id === path.forkPoint?.head.id) {
-      return path;
-    }
-    let it = path.forkPoint;
-    while (it.head.id !== forkPoint.head.id) {
-      it.forkIssuers.forEach((iss) => path.forkIssuers.add(iss));
-      it.forkChangedSubjects.forEach((m) => path.forkChangedSubjects.add(m));
-      it = it.forkPoint;
-      path.forkPoint = it;
-    }
-    return path;
-  }
-  _mergePaths(convergedPaths) {
-    (0, import_invariant4.invariant)(convergedPaths.length >= 1, void 0, {
-      F: __dxlog_file3,
-      L: 324,
-      S: this,
-      A: [
-        "convergedPaths.length >= 1",
-        ""
-      ]
-    });
-    if (convergedPaths.length === 1) {
-      return {
-        type: "merged",
-        path: convergedPaths[0]
-      };
-    }
-    const forkPoint = this._leastCommonAncestor(convergedPaths);
-    (0, import_log3.log)("merging paths", () => ({
-      forkPointId: forkPoint.head.id,
-      pathCount: convergedPaths.length,
-      forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
-    }), {
-      F: __dxlog_file3,
-      L: 329,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
-    (0, import_invariant4.invariant)(forkPoint, void 0, {
-      F: __dxlog_file3,
-      L: 335,
-      S: this,
-      A: [
-        "forkPoint",
-        ""
-      ]
-    });
-    const result = {
-      forkPoint: forkPoint.forkPoint,
-      chosenPath: {
-        ...forkPoint.chosenPath,
-        [forkPoint.head.id]: []
-      },
-      stateOverrides: forkPoint.stateOverrides,
-      credentials: new import_util6.ComplexSet(import_keys7.PublicKey.hash, forkPoint.credentials),
-      forkIssuers: new import_util6.ComplexSet(import_keys7.PublicKey.hash, forkPoint.forkIssuers),
-      forkChangedSubjects: new import_util6.ComplexSet(import_keys7.PublicKey.hash, forkPoint.forkChangedSubjects),
-      state: forkPoint.state.mapValues((v) => v),
-      head: paths[0].head
-    };
-    const subjectToBranch = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
-    for (const path of paths) {
-      (0, import_log3.log)("processing a path", () => ({
-        choices: toChosenPath(path),
-        modified: path.forkChangedSubjects,
-        forkIssuers: path.forkIssuers,
-        state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }), {
-        F: __dxlog_file3,
-        L: 348,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
-      path.credentials.forEach((cred) => result.credentials.add(cred));
-      result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
-      for (const modifiedSubject of path.forkChangedSubjects) {
-        const existingBranch = subjectToBranch.get(modifiedSubject);
-        if (existingBranch == null || this._shouldOverrideCredential(existingBranch, path, modifiedSubject)) {
-          subjectToBranch.set(modifiedSubject, path);
-        }
-      }
-    }
-    const replayPaths = /* @__PURE__ */ new Set();
-    const addReplayPath = replayPaths.add.bind(replayPaths);
-    for (const [subject, branch] of subjectToBranch.entries()) {
-      result.forkChangedSubjects.add(subject);
-      const vertex = branch.state.get(subject);
-      result.state.set(subject, vertex);
-      (0, import_log3.log)("set subject state", () => ({
-        subject,
-        state: this._stateHandler.toLogString(vertex.assertion)
-      }), {
-        F: __dxlog_file3,
-        L: 370,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      const otherPaths = paths.filter((p) => p !== branch);
-      this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
-    }
-    if (replayPaths.size > 0) {
-      return {
-        type: "replay_required",
-        replay: [
-          ...replayPaths.values()
-        ],
-        from: forkPoint,
-        stateOverrides: subjectToBranch.mapValues((v, key) => v.state.get(key))
-      };
-    }
-    return {
-      type: "merged",
-      path: result
-    };
-  }
-  /**
-  * A candidate credential is preferred over the existing credential if:
-  *  1. It is the merge-point, because it's the last credential that was issued in awareness of all
-  *  the previously existing ones.
-  *  2. A path where candidate was set contains existing credential in it, which means that the candidate
-  *  was issued after the existing credential by a legitimate issuer.
-  *  3. A state-specific logic (_stateHandler) is able to justify using the candidate credential.
-  *  4. The path where candidate was set has more issuers than the existing path (longer branch).
-  *  5. The issuance time of the candidate is after the issuance time of the existing credential (LWW).
-  */
-  _shouldOverrideCredential(existing, candidate, modifiedSubject) {
-    const candidateVertex = candidate.state.get(modifiedSubject);
-    const currentVertex = existing.state.get(modifiedSubject);
-    if (candidateVertex.id === currentVertex.id) {
-      return false;
-    }
-    const mergePointId = existing.head.id;
-    if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
-      (0, import_log3.log)("merge point chosen to break the tie", {
-        mergePointId: existing.head.id
-      }, {
-        F: __dxlog_file3,
-        L: 408,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return mergePointId === candidateVertex.id;
-    }
-    const candidateCredential = candidateVertex.credential;
-    const currentCredential = currentVertex.credential;
-    if (existing.credentials.has(candidateCredential.id) !== candidate.credentials.has(currentCredential.id)) {
-      (0, import_log3.log)("one of the credentials was overridden in another branch", {
-        current: currentVertex.id,
-        candidate: candidateVertex.id
-      }, {
-        F: __dxlog_file3,
-        L: 415,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return candidate.credentials.has(currentCredential.id);
-    }
-    const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
-    if (winningCredential != null) {
-      return winningCredential === candidateCredential;
-    }
-    if (candidate.forkIssuers.size !== existing.forkIssuers.size) {
-      (0, import_log3.log)("longer issuers branch used to break the tie", {
-        issuerCount: [
-          existing.forkIssuers.size,
-          candidate.forkIssuers.size
-        ]
-      }, {
-        F: __dxlog_file3,
-        L: 432,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return candidate.forkIssuers.size > existing.forkIssuers.size;
-    }
-    (0, import_log3.log)("issuance date used to break the tie", void 0, {
-      F: __dxlog_file3,
-      L: 437,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
-  }
-  _createRootPath() {
-    return {
-      head: this._root,
-      chosenPath: {},
-      forkIssuers: new import_util6.ComplexSet(import_keys7.PublicKey.hash),
-      forkChangedSubjects: new import_util6.ComplexSet(import_keys7.PublicKey.hash),
-      state: new import_util6.ComplexMap(import_keys7.PublicKey.hash),
-      credentials: new import_util6.ComplexSet(import_keys7.PublicKey.hash)
-    };
-  }
-};
-var toChosenPath = (path) => {
-  return Object.fromEntries(Object.entries(path.chosenPath).map(([k, vs]) => [
-    k,
-    vs.map((v) => v.id)
-  ]));
-};
-var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
+var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
 var MemberStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._memberProfiles = new import_util5.ComplexMap(import_keys6.PublicKey.hash);
-    this._hashgraph = new CredentialGraph(this);
-    this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
+    this._members = new import_util5.ComplexMap(import_keys6.PublicKey.hash);
+    this.onMemberAdmitted = new import_util5.Callback();
   }
   get creator() {
-    return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
+    return this._creator;
   }
   get members() {
-    return this._hashgraph.getState();
-  }
-  get membershipChainHeads() {
-    return this._hashgraph.getLeafIds();
+    return this._members;
   }
   getRole(member) {
-    return this._getRole(this._hashgraph.getGlobalStateScope(), member);
+    return this._members.get(member)?.assertion.role;
   }
   /**
   * Processes the SpaceMember credential.
@@ -1326,122 +760,84 @@ var MemberStateMachine = class {
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceMember": {
         (0, import_invariant3.invariant)(assertion.spaceKey.equals(this._spaceKey), void 0, {
-          F: __dxlog_file4,
-          L: 66,
+          F: __dxlog_file3,
+          L: 58,
           S: this,
           A: [
             "assertion.spaceKey.equals(this._spaceKey)",
             ""
           ]
         });
-        if (this._ownerKey == null && credential.issuer === this._spaceKey) {
-          this._ownerKey = credential.subject.id;
+        if (this._members.has(credential.subject.id)) {
+          return;
         }
-        if (assertion.profile != null) {
-          this._memberProfiles.set(credential.subject.id, assertion.profile);
+        const info = {
+          key: credential.subject.id,
+          credential,
+          assertion,
+          removed: false,
+          profile: assertion.profile
+        };
+        if (!this._creator) {
+          this._creator = info;
         }
-        await this._hashgraph.addVertex(credential, assertion);
+        this._members.set(credential.subject.id, info);
+        (0, import_log2.log)("member added", {
+          member: credential.subject.id,
+          space: this._spaceKey,
+          role: assertion.role,
+          profile: assertion.profile
+        }, {
+          F: __dxlog_file3,
+          L: 79,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        await this.onMemberAdmitted.callIfSet(info);
         break;
       }
       case "dxos.halo.credentials.MemberProfile": {
-        const member = this._hashgraph.getSubjectState(credential.subject.id);
-        if (member) {
-          member.profile = assertion.profile;
-        } else {
+        const member = this._members.get(credential.subject.id);
+        if (!member) {
           import_log2.log.warn("Member not found", {
             id: credential.subject.id
           }, {
-            F: __dxlog_file4,
-            L: 81,
+            F: __dxlog_file3,
+            L: 93,
             S: this,
             C: (f, a) => f(...a)
           });
+        } else {
+          member.profile = assertion.profile;
         }
-        this._memberProfiles.set(credential.subject.id, assertion.profile);
         break;
       }
       default:
         throw new Error("Invalid assertion type");
     }
   }
-  createState(credential, assertion) {
-    const memberKey = credential.subject.id;
-    return {
-      key: memberKey,
-      role: assertion.role,
-      credential,
-      assertion,
-      profile: this._memberProfiles.get(memberKey)
-    };
-  }
-  isUpdateAllowed(scope, credential, assertion) {
-    if (assertion.role === import_credentials3.SpaceMember.Role.OWNER) {
-      return credential.issuer.equals(this._spaceKey);
-    }
-    const issuer = credential.issuer;
-    const isChangingOwnRole = issuer.equals(credential.subject.id);
-    if (isChangingOwnRole) {
-      return false;
-    }
-    if (issuer.equals(assertion.spaceKey)) {
-      return true;
-    }
-    const issuerRole = this._getRole(scope, issuer);
-    return issuerRole === import_credentials3.SpaceMember.Role.ADMIN || issuerRole === import_credentials3.SpaceMember.Role.OWNER;
-  }
-  getConflictingPaths(paths, update) {
-    if (update.assertion.role !== import_credentials3.SpaceMember.Role.REMOVED && update.assertion.role !== import_credentials3.SpaceMember.Role.EDITOR) {
-      return [];
-    }
-    const memberId = update.credential.subject.id;
-    return paths.filter((p) => p.forkIssuers.has(memberId));
-  }
-  tryPickWinningUpdate(scope1, update1, scope2, update2) {
-    const path1IssuerRole = this._getRole(scope1, update1.issuer);
-    const path2IssuerRole = this._getRole(scope2, update2.issuer);
-    if (path2IssuerRole === import_credentials3.SpaceMember.Role.OWNER !== (path1IssuerRole === import_credentials3.SpaceMember.Role.OWNER)) {
-      (0, import_log2.log)("owner decision used to break the tie", void 0, {
-        F: __dxlog_file4,
-        L: 139,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return path1IssuerRole === import_credentials3.SpaceMember.Role.OWNER ? update1 : update2;
-    }
-    return null;
-  }
-  toLogString(assertion) {
-    const role = assertion?.role ?? import_credentials3.SpaceMember.Role.REMOVED;
-    return Object.entries(import_credentials3.SpaceMember.Role).find(([_, value]) => value === role)[0];
-  }
-  hasStateChanged(s1, s2) {
-    return s1?.role !== s2?.role;
-  }
-  _getRole(scope, memberId) {
-    if (this._ownerKey?.equals(memberId)) {
-      return import_credentials3.SpaceMember.Role.OWNER;
-    }
-    const realRole = scope.state.get(memberId)?.assertion?.role ?? import_credentials3.SpaceMember.Role.REMOVED;
-    if (scope.stateOverrides != null) {
-      const override = scope.stateOverrides.get(memberId);
-      if (override != null) {
-        (0, import_log2.log)("member role overridden in path", () => ({
-          headId: scope.head?.id,
-          roleOverride: this.toLogString(override.assertion),
-          realRole: this.toLogString(scope.state.get(memberId)?.assertion)
-        }), {
-          F: __dxlog_file4,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        return override.assertion.role;
+  async onRevoked(revoked, revocation) {
+    (0, import_invariant3.invariant)(revoked.id, void 0, {
+      F: __dxlog_file3,
+      L: 106,
+      S: this,
+      A: [
+        "revoked.id",
+        ""
+      ]
+    });
+    for (const member of this._members.values()) {
+      if (member.credential.id?.equals(revoked.id)) {
+        member.removed = true;
+        break;
       }
     }
-    return realRole;
   }
 };
-var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
+var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
+var REVOCABLE_CREDENTIALS = [
+  "dxos.halo.credentials.SpaceMember"
+];
 var SpaceStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
@@ -1453,7 +849,7 @@ var SpaceStateMachine = class {
     this._processedCredentials = new import_util2.ComplexSet(import_keys3.PublicKey.hash);
     this._credentialProcessors = [];
     this.onCredentialProcessed = new import_util2.Callback();
-    this.onMemberRoleChanged = this._members.onMemberRoleChanged;
+    this.onMemberAdmitted = this._members.onMemberAdmitted;
     this.onFeedAdmitted = this._feeds.onFeedAdmitted;
     this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
     this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
@@ -1464,9 +860,6 @@ var SpaceStateMachine = class {
   get members() {
     return this._members.members;
   }
-  get membershipChainHeads() {
-    return this._members.membershipChainHeads;
-  }
   get feeds() {
     return this._feeds.feeds;
   }
@@ -1519,8 +912,8 @@ var SpaceStateMachine = class {
       const result = await verifyCredential(credential);
       if (result.kind !== "pass") {
         import_log.log.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
-          F: __dxlog_file5,
-          L: 152,
+          F: __dxlog_file4,
+          L: 149,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1529,11 +922,43 @@ var SpaceStateMachine = class {
     }
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
+      case "dxos.halo.credentials.Revocation": {
+        if (!this._canRevokeCredentials(credential.issuer)) {
+          import_log.log.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+            F: __dxlog_file4,
+            L: 158,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        const toBeRevoked = this._credentialsById.get(credential.subject.id);
+        if (!toBeRevoked) {
+          import_log.log.warn(`Credential to revoke not found: ${credential.subject.id}`, void 0, {
+            F: __dxlog_file4,
+            L: 163,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        if (!this._credentialCanBeRevoked(toBeRevoked)) {
+          import_log.log.warn(`Credential cannot be revoked: ${credential.subject.id}`, void 0, {
+            F: __dxlog_file4,
+            L: 167,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+        }
+        toBeRevoked.revoked = true;
+        await this._members.onRevoked(toBeRevoked.credential, credential);
+        break;
+      }
       case "dxos.halo.credentials.SpaceGenesis": {
         if (this._genesisCredential) {
           import_log.log.warn("Space already has a genesis credential.", void 0, {
-            F: __dxlog_file5,
-            L: 161,
+            F: __dxlog_file4,
+            L: 176,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1541,8 +966,8 @@ var SpaceStateMachine = class {
         }
         if (!credential.issuer.equals(this._spaceKey)) {
           import_log.log.warn("Space genesis credential must be issued by space.", void 0, {
-            F: __dxlog_file5,
-            L: 165,
+            F: __dxlog_file4,
+            L: 180,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1550,8 +975,8 @@ var SpaceStateMachine = class {
         }
         if (!credential.subject.id.equals(this._spaceKey)) {
           import_log.log.warn("Space genesis credential must be issued to space.", void 0, {
-            F: __dxlog_file5,
-            L: 169,
+            F: __dxlog_file4,
+            L: 184,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1566,8 +991,8 @@ var SpaceStateMachine = class {
         }
         if (!this._genesisCredential) {
           import_log.log.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file5,
-            L: 182,
+            F: __dxlog_file4,
+            L: 198,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1575,8 +1000,8 @@ var SpaceStateMachine = class {
         }
         if (!this._canInviteNewMembers(credential.issuer)) {
           import_log.log.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file5,
-            L: 186,
+            F: __dxlog_file4,
+            L: 202,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1589,8 +1014,8 @@ var SpaceStateMachine = class {
       case "dxos.halo.credentials.MemberProfile": {
         if (!this._genesisCredential) {
           import_log.log.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file5,
-            L: 197,
+            F: __dxlog_file4,
+            L: 213,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1602,8 +1027,8 @@ var SpaceStateMachine = class {
       case "dxos.halo.credentials.AdmittedFeed": {
         if (!this._genesisCredential) {
           import_log.log.warn("Space must have a genesis credential before admitting feeds.", void 0, {
-            F: __dxlog_file5,
-            L: 207,
+            F: __dxlog_file4,
+            L: 223,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1611,8 +1036,8 @@ var SpaceStateMachine = class {
         }
         if (!this._canAdmitFeeds(credential.issuer)) {
           import_log.log.warn(`Space member is not authorized to admit feeds: ${credential.issuer}`, void 0, {
-            F: __dxlog_file5,
-            L: 211,
+            F: __dxlog_file4,
+            L: 227,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1625,8 +1050,8 @@ var SpaceStateMachine = class {
       case "dxos.halo.invitations.DelegateSpaceInvitation": {
         if (!this._canInviteNewMembers(credential.issuer)) {
           import_log.log.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file5,
-            L: 222,
+            F: __dxlog_file4,
+            L: 238,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1654,11 +1079,17 @@ var SpaceStateMachine = class {
     return true;
   }
   _canInviteNewMembers(key) {
-    return key.equals(this._spaceKey) || this._members.getRole(key) === import_credentials2.SpaceMember.Role.ADMIN || this._members.getRole(key) === import_credentials2.SpaceMember.Role.OWNER;
+    return key.equals(this._spaceKey) || this._members.getRole(key) === import_credentials2.SpaceMember.Role.ADMIN;
   }
   _canAdmitFeeds(key) {
     const role = this._members.getRole(key);
-    return role === import_credentials2.SpaceMember.Role.EDITOR || role === import_credentials2.SpaceMember.Role.ADMIN || role === import_credentials2.SpaceMember.Role.OWNER;
+    return role === import_credentials2.SpaceMember.Role.MEMBER || role === import_credentials2.SpaceMember.Role.ADMIN;
+  }
+  _canRevokeCredentials(key) {
+    return key.equals(this._spaceKey) || this._members.getRole(key) === import_credentials2.SpaceMember.Role.ADMIN;
+  }
+  _credentialCanBeRevoked(entry) {
+    return REVOCABLE_CREDENTIALS.includes(entry.credential.subject.assertion["@type"]);
   }
 };
 var CredentialConsumer = class {
@@ -1688,20 +1119,20 @@ var CredentialConsumer = class {
     await this._onClose();
   }
 };
-var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
+var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
 var DeviceStateMachine = class {
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new import_util7.ComplexMap(import_keys8.PublicKey.hash);
+    this.authorizedDeviceKeys = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
     this.deviceChainReady = new import_async2.Trigger();
   }
   async processCredential(credential) {
-    (0, import_log4.log)("processing credential...", {
+    (0, import_log3.log)("processing credential...", {
       identityKey: this._params.identityKey,
       deviceKey: this._params.deviceKey,
       credential
     }, {
-      F: __dxlog_file6,
+      F: __dxlog_file5,
       L: 35,
       S: this,
       C: (f, a) => f(...a)
@@ -1715,8 +1146,8 @@ var DeviceStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.AuthorizedDevice": {
-        (0, import_invariant5.invariant)(!this.authorizedDeviceKeys.has(assertion.deviceKey), "Device already added.", {
-          F: __dxlog_file6,
+        (0, import_invariant4.invariant)(!this.authorizedDeviceKeys.has(assertion.deviceKey), "Device already added.", {
+          F: __dxlog_file5,
           L: 51,
           S: this,
           A: [
@@ -1725,12 +1156,12 @@ var DeviceStateMachine = class {
           ]
         });
         this.authorizedDeviceKeys.set(assertion.deviceKey, {});
-        (0, import_log4.log)("added device", {
+        (0, import_log3.log)("added device", {
           localDeviceKey: this._params.deviceKey,
           deviceKey: assertion.deviceKey,
           size: this.authorizedDeviceKeys.size
         }, {
-          F: __dxlog_file6,
+          F: __dxlog_file5,
           L: 54,
           S: this,
           C: (f, a) => f(...a)
@@ -1739,8 +1170,8 @@ var DeviceStateMachine = class {
         break;
       }
       case "dxos.halo.credentials.DeviceProfile": {
-        (0, import_invariant5.invariant)(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
-          F: __dxlog_file6,
+        (0, import_invariant4.invariant)(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
+          F: __dxlog_file5,
           L: 64,
           S: this,
           A: [
@@ -1749,11 +1180,11 @@ var DeviceStateMachine = class {
           ]
         });
         if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
-          import_log4.log.trace("dxos.halo.device", {
+          import_log3.log.trace("dxos.halo.device", {
             deviceKey: credential.subject.id,
             profile: assertion.profile
           }, {
-            F: __dxlog_file6,
+            F: __dxlog_file5,
             L: 67,
             S: this,
             C: (f, a) => f(...a)
@@ -1766,7 +1197,7 @@ var DeviceStateMachine = class {
     }
   }
 };
-var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
+var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
 var ProfileStateMachine = class {
   constructor(_params) {
     this._params = _params;
@@ -1776,11 +1207,11 @@ var ProfileStateMachine = class {
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.IdentityProfile": {
         if (!credential.issuer.equals(this._params.identityKey) || !credential.subject.id.equals(this._params.identityKey)) {
-          import_log5.log.warn("Invalid profile credential", {
+          import_log4.log.warn("Invalid profile credential", {
             expectedIdentity: this._params.identityKey,
             credential
           }, {
-            F: __dxlog_file7,
+            F: __dxlog_file6,
             L: 34,
             S: this,
             C: (f, a) => f(...a)
@@ -1788,11 +1219,11 @@ var ProfileStateMachine = class {
           return;
         }
         this.profile = assertion.profile;
-        (0, import_log5.log)("updated profile", {
+        (0, import_log4.log)("updated profile", {
           identityKey: this._params.identityKey,
           profile: this.profile
         }, {
-          F: __dxlog_file7,
+          F: __dxlog_file6,
           L: 40,
           S: this,
           C: (f, a) => f(...a)