@dxos/credentials 0.5.1-next.f040be1 → 0.5.2-main.80497e2

package/dist/lib/node/index.cjs

@@ -88,13 +88,18 @@ var import_util4 = require("@dxos/util");
 var import_invariant3 = require("@dxos/invariant");
 var import_keys6 = require("@dxos/keys");
 var import_log2 = require("@dxos/log");
+var import_credentials3 = require("@dxos/protocols/proto/dxos/halo/credentials");
 var import_util5 = require("@dxos/util");
-var import_async2 = require("@dxos/async");
 var import_invariant4 = require("@dxos/invariant");
 var import_keys7 = require("@dxos/keys");
 var import_log3 = require("@dxos/log");
 var import_util6 = require("@dxos/util");
+var import_async2 = require("@dxos/async");
+var import_invariant5 = require("@dxos/invariant");
+var import_keys8 = require("@dxos/keys");
 var import_log4 = require("@dxos/log");
+var import_util7 = require("@dxos/util");
+var import_log5 = require("@dxos/log");
 var defaultSecretProvider = async () => Buffer.from("0000");
 var defaultSecretValidator = async (invitation, secret) => true;
 var generatePasscode = (length = 4) => {
@@ -179,6 +184,9 @@ var checkCredentialType = (credential, type) => credential.subject.assertion["@t
 var credentialTypeFilter = (type) => (credential) => checkCredentialType(credential, type);
 var SIGNATURE_TYPE_ED25519 = "ED25519Signature";
 var verifyCredential = async (credential) => {
+  if (credential.parentCredentialIds?.length === 0) {
+    delete credential.parentCredentialIds;
+  }
   if (!credential.issuer.equals(credential.proof.signer)) {
     if (!credential.proof.chain) {
       return {
@@ -241,10 +249,10 @@ var verifyChain = async (chain, authority, subject) => {
   };
 };
 var __dxlog_file = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
-var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce }) => {
+var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
   (0, import_invariant.invariant)(assertion["@type"], "Invalid assertion.", {
     F: __dxlog_file,
-    L: 45,
+    L: 48,
     S: void 0,
     A: [
       "assertion['@type']",
@@ -253,7 +261,7 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
   });
   (0, import_invariant.invariant)(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
     F: __dxlog_file,
-    L: 46,
+    L: 49,
     S: void 0,
     A: [
       "!!signingKey === !!chain",
@@ -264,7 +272,7 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
     const result = await verifyChain(chain, issuer, signingKey);
     (0, import_invariant.invariant)(result.kind === "pass", "Invalid chain.", {
       F: __dxlog_file,
-      L: 49,
+      L: 52,
       S: void 0,
       A: [
         "result.kind === 'pass'",
@@ -287,6 +295,9 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
       nonce
     }
   };
+  if ((parentCredentialIds?.length ?? 0) > 0) {
+    credential.parentCredentialIds = parentCredentialIds;
+  }
   const signedPayload = getCredentialProofPayload(credential);
   credential.proof.value = await signer.sign(signingKey ?? issuer, signedPayload);
   if (chain) {
@@ -303,12 +314,13 @@ var createCredentialMessage = (credential) => {
 };
 var createCredentialSignerWithKey = (signer, issuer) => ({
   getIssuer: () => issuer,
-  createCredential: ({ subject, assertion, nonce }) => createCredential({
+  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
     signer,
     issuer,
     subject,
     assertion,
-    nonce
+    nonce,
+    parentCredentialIds
   })
 });
 var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
@@ -372,7 +384,7 @@ var CredentialGenerator = class {
         assertion: {
           "@type": "dxos.halo.credentials.SpaceMember",
           spaceKey,
-          role: import_credentials.SpaceMember.Role.MEMBER,
+          role: import_credentials.SpaceMember.Role.EDITOR,
           genesisFeedKey
         }
       }),
@@ -467,14 +479,15 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, profile, invitationCredentialId) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = import_credentials.SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
+      parentCredentialIds: membershipChainHeads,
       assertion: {
         "@type": "dxos.halo.credentials.SpaceMember",
         spaceKey,
-        role: import_credentials.SpaceMember.Role.ADMIN,
+        role,
         profile,
         genesisFeedKey,
         invitationCredentialId
@@ -735,21 +748,574 @@ var InvitationStateMachine = class {
     }
   }
 };
-var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
+var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
+var CredentialGraph = class {
+  constructor(_stateHandler) {
+    this._stateHandler = _stateHandler;
+    this._vertexIdGenerator = 1;
+    this._root = {
+      id: -1,
+      parents: [],
+      children: []
+    };
+    this._sentinel = {
+      id: -2,
+      parents: [],
+      children: []
+    };
+    this._vertexByCredentialId = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+    this._subjectToVertex = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+    this._subjectToState = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+    this.onSubjectStateChanged = new import_util6.Callback();
+  }
+  getSubjectState(subjectId) {
+    return this._subjectToState.get(subjectId);
+  }
+  getState() {
+    return this._subjectToState;
+  }
+  getLeafIds() {
+    return this._sentinel.parents.map((v) => v.credential.id);
+  }
+  getGlobalStateScope() {
+    return {
+      state: this._subjectToVertex
+    };
+  }
+  addVertex(credential, assertion) {
+    const newVertex = {
+      id: this._vertexIdGenerator++,
+      credential,
+      assertion,
+      parents: [],
+      children: []
+    };
+    this._vertexByCredentialId.set(credential.id, newVertex);
+    const parentIds = credential.parentCredentialIds ?? [];
+    if (parentIds.length === 0) {
+      this._root.children.push(newVertex);
+      newVertex.parents.push(this._root);
+    } else {
+      for (const parentId of parentIds) {
+        const parentVertex = this._vertexByCredentialId.get(parentId);
+        if (parentVertex == null) {
+          import_log3.log.error("credential skipped because of the unknown parent", {
+            credential,
+            parentId
+          }, {
+            F: __dxlog_file3,
+            L: 72,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          continue;
+        }
+        parentVertex.children.push(newVertex);
+        newVertex.parents.push(parentVertex);
+        this._removeSentinelConnection(parentVertex);
+      }
+    }
+    newVertex.children.push(this._sentinel);
+    this._sentinel.parents.push(newVertex);
+    return this._onVertexInserted(newVertex);
+  }
+  _removeSentinelConnection(vertex) {
+    const sentinelIdx = vertex.children.indexOf(this._sentinel);
+    if (sentinelIdx >= 0) {
+      vertex.children.splice(sentinelIdx, 1);
+      const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
+      (0, import_invariant4.invariant)(vertexInSentinelIdx >= 0, void 0, {
+        F: __dxlog_file3,
+        L: 90,
+        S: this,
+        A: [
+          "vertexInSentinelIdx >= 0",
+          ""
+        ]
+      });
+      this._sentinel.parents.splice(vertexInSentinelIdx, 1);
+    }
+  }
+  async _onVertexInserted(newVertex) {
+    const { credential, assertion } = newVertex;
+    (0, import_invariant4.invariant)(credential, void 0, {
+      F: __dxlog_file3,
+      L: 97,
+      S: this,
+      A: [
+        "credential",
+        ""
+      ]
+    });
+    let changedSubjects = [];
+    const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
+    if (isUpdateAppliedOnTopOfThePreviousState) {
+      const subjectId = credential.subject.id;
+      if (this._stateHandler.isUpdateAllowed(this.getGlobalStateScope(), credential, assertion)) {
+        const newSubjectState = this._stateHandler.createState(credential, newVertex.assertion);
+        const prevSubjectState = this._subjectToState.get(subjectId);
+        this._subjectToState.set(subjectId, newSubjectState);
+        this._subjectToVertex.set(subjectId, newVertex);
+        if (this._stateHandler.hasStateChanged(newSubjectState, prevSubjectState)) {
+          changedSubjects.push(newSubjectState);
+        }
+      }
+    } else {
+      changedSubjects = this._recomputeState();
+    }
+    if (changedSubjects.length > 0) {
+      await this.onSubjectStateChanged.callIfSet(changedSubjects);
+    }
+  }
+  /**
+  * DFS the graph from root to sentinel pausing on merge points (nodes with multiple parents).
+  * Continue after all paths leading to a merge point converge by merging their states.
+  * In case of a concurrent update paths are replayed taking into account the state set
+  * by the winning branch.
+  */
+  _recomputeState() {
+    const pendingPaths = /* @__PURE__ */ new Map();
+    const paths = [
+      this._createRootPath()
+    ];
+    let lastPath = null;
+    while (lastPath == null) {
+      const path = paths.pop();
+      (0, import_log3.log)("visit vertex", {
+        id: path.head.id
+      }, {
+        F: __dxlog_file3,
+        L: 132,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      this._updatePathState(path);
+      const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
+      if (convergedPaths == null) {
+        (0, import_log3.log)("waiting for other paths", void 0, {
+          F: __dxlog_file3,
+          L: 136,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        continue;
+      }
+      const mergeResult = this._mergePaths(convergedPaths);
+      if (mergeResult.type === "replay_required") {
+        this._replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths);
+        continue;
+      }
+      const merged = mergeResult.path;
+      if (merged.head.children.length === 0) {
+        lastPath = merged;
+      } else if (merged.head.children.length === 1) {
+        merged.head = merged.head.children[0];
+        paths.push(merged);
+      } else {
+        this._forkTraversal(paths, merged);
+      }
+    }
+    if (paths.length > 0) {
+      import_log3.log.error("traversal finished while there were active paths", {
+        paths: paths.map((p) => ({
+          path: toChosenPath(p),
+          head: p.head.id
+        }))
+      }, {
+        F: __dxlog_file3,
+        L: 155,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
+    return this._setCurrentState(lastPath);
+  }
+  _replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths) {
+    paths.push(...mergeResult.replay.map((path) => {
+      const stateOverrides = path.stateOverrides ?? new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+      mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));
+      return {
+        ...mergeResult.from,
+        chosenPath: path.chosenPath,
+        stateOverrides
+      };
+    }));
+    (0, import_log3.log)("replay paths", () => ({
+      count: paths.length,
+      paths: paths.map((path) => ({
+        from: mergeResult.from.head.id,
+        path: toChosenPath(path),
+        overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
+      }))
+    }), {
+      F: __dxlog_file3,
+      L: 175,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
+    pendingPaths.set(convergedPaths[0].head.id, clearedPending);
+  }
+  _handleMergePoint(paths, pendingPaths, path) {
+    const pendingList = pendingPaths.get(path.head.id) ?? [];
+    pendingPaths.set(path.head.id, pendingList);
+    pendingList.push(path);
+    if (pendingList.length < path.head.parents.length) {
+      return null;
+    }
+    if (path.head.id === this._sentinel.id && paths.length > 0) {
+      (0, import_log3.log)("waiting for all the active paths to converge on the sentinel", void 0, {
+        F: __dxlog_file3,
+        L: 199,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return null;
+    }
+    pendingPaths.delete(path.head.id);
+    return pendingList;
+  }
+  _updatePathState(path) {
+    const headCredential = path.head.credential;
+    if (headCredential == null) {
+      return;
+    }
+    const updatedSubject = headCredential.subject.id;
+    path.credentials.add(headCredential.id);
+    let isUpdateAllowed = this._stateHandler.isUpdateAllowed(path, headCredential, path.head.assertion);
+    if (!isUpdateAllowed && path.head.parents[0]?.id === this._root.id) {
+      const globalState = this.getGlobalStateScope();
+      isUpdateAllowed = this._stateHandler.isUpdateAllowed(globalState, headCredential, path.head.assertion);
+    }
+    if (isUpdateAllowed) {
+      path.forkChangedSubjects.add(updatedSubject);
+      path.forkIssuers.add(headCredential.issuer);
+      path.state.set(updatedSubject, path.head);
+      (0, import_log3.log)("path state updated", () => ({
+        subject: updatedSubject,
+        newState: this._stateHandler.toLogString(path.head.assertion)
+      }), {
+        F: __dxlog_file3,
+        L: 223,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
+  }
+  _forkTraversal(paths, path) {
+    const replayChoice = path.chosenPath?.[path.head.id];
+    const choices = replayChoice ?? path.head.children;
+    for (const choice of choices) {
+      (0, import_log3.log)("edge traversal", {
+        from: path.head.id,
+        to: choice.id
+      }, {
+        F: __dxlog_file3,
+        L: 234,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      const fork = {
+        forkPoint: path,
+        chosenPath: {
+          ...path.chosenPath,
+          [path.head.id]: [
+            choice
+          ]
+        },
+        head: choice,
+        credentials: new import_util6.ComplexSet(import_keys7.PublicKey.hash, path.credentials),
+        state: new import_util6.ComplexMap(import_keys7.PublicKey.hash, [
+          ...path.state.entries()
+        ]),
+        forkIssuers: new import_util6.ComplexSet(import_keys7.PublicKey.hash),
+        forkChangedSubjects: new import_util6.ComplexSet(import_keys7.PublicKey.hash),
+        stateOverrides: path.stateOverrides
+      };
+      paths.push(fork);
+    }
+  }
+  /**
+  * Updates the current graph state.
+  * @returns changed states.
+  */
+  _setCurrentState(path) {
+    const changedSubjects = [];
+    const newStateMap = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+    const newVertexMap = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+    for (const [subjectKey, subjectVertex] of path.state.entries()) {
+      const newState = this._stateHandler.createState(subjectVertex.credential, subjectVertex.assertion);
+      const prevState = this._subjectToState.get(subjectKey);
+      newStateMap.set(subjectKey, newState);
+      newVertexMap.set(subjectKey, subjectVertex);
+      if (this._stateHandler.hasStateChanged(newState, prevState)) {
+        changedSubjects.push(newState);
+      }
+    }
+    this._subjectToState = newStateMap;
+    this._subjectToVertex = newVertexMap;
+    return changedSubjects;
+  }
+  /*
+  * Walk up all the fork points and return the first one present in all the paths.
+  * We use local id to determine vertex position in the graph, because nodes can't
+  * be inserted in the middle (between a parent and a child) and ids are monotonically increasing.
+  */
+  _leastCommonAncestor(paths) {
+    const uniqueForkPoints = paths.reduce((acc, path) => {
+      let it = path.forkPoint;
+      while (it) {
+        acc.set(it.head.id, it);
+        it = it.forkPoint;
+      }
+      return acc;
+    }, /* @__PURE__ */ new Map());
+    let maxId = this._root.id;
+    let maxState = null;
+    for (const [id, state] of uniqueForkPoints.entries()) {
+      const headCredential = state.head.credential;
+      if (headCredential != null) {
+        const isPointInEveryPath = paths.every((p) => p.credentials.has(headCredential.id));
+        if (isPointInEveryPath && id > maxId) {
+          maxId = id;
+          maxState = state;
+        }
+      }
+    }
+    return maxState ?? this._createRootPath();
+  }
+  /**
+  * We might be merging paths where some of them had fork points after the initial forking.
+  * We need all the paths to point to the least common fork point and contain all the changes
+  * that happened after it.
+  */
+  _moveUpToForkPoint(forkPoint, path) {
+    const isForkPointInPath = path.chosenPath[forkPoint.head.id] == null || path.forkPoint == null;
+    if (isForkPointInPath) {
+      return path;
+    }
+    if (forkPoint.head.id === path.forkPoint?.head.id) {
+      return path;
+    }
+    let it = path.forkPoint;
+    while (it.head.id !== forkPoint.head.id) {
+      it.forkIssuers.forEach((iss) => path.forkIssuers.add(iss));
+      it.forkChangedSubjects.forEach((m) => path.forkChangedSubjects.add(m));
+      it = it.forkPoint;
+      path.forkPoint = it;
+    }
+    return path;
+  }
+  _mergePaths(convergedPaths) {
+    (0, import_invariant4.invariant)(convergedPaths.length >= 1, void 0, {
+      F: __dxlog_file3,
+      L: 324,
+      S: this,
+      A: [
+        "convergedPaths.length >= 1",
+        ""
+      ]
+    });
+    if (convergedPaths.length === 1) {
+      return {
+        type: "merged",
+        path: convergedPaths[0]
+      };
+    }
+    const forkPoint = this._leastCommonAncestor(convergedPaths);
+    (0, import_log3.log)("merging paths", () => ({
+      forkPointId: forkPoint.head.id,
+      pathCount: convergedPaths.length,
+      forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
+    }), {
+      F: __dxlog_file3,
+      L: 329,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
+    (0, import_invariant4.invariant)(forkPoint, void 0, {
+      F: __dxlog_file3,
+      L: 335,
+      S: this,
+      A: [
+        "forkPoint",
+        ""
+      ]
+    });
+    const result = {
+      forkPoint: forkPoint.forkPoint,
+      chosenPath: {
+        ...forkPoint.chosenPath,
+        [forkPoint.head.id]: []
+      },
+      stateOverrides: forkPoint.stateOverrides,
+      credentials: new import_util6.ComplexSet(import_keys7.PublicKey.hash, forkPoint.credentials),
+      forkIssuers: new import_util6.ComplexSet(import_keys7.PublicKey.hash, forkPoint.forkIssuers),
+      forkChangedSubjects: new import_util6.ComplexSet(import_keys7.PublicKey.hash, forkPoint.forkChangedSubjects),
+      state: forkPoint.state.mapValues((v) => v),
+      head: paths[0].head
+    };
+    const subjectToBranch = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+    for (const path of paths) {
+      (0, import_log3.log)("processing a path", () => ({
+        choices: toChosenPath(path),
+        modified: path.forkChangedSubjects,
+        forkIssuers: path.forkIssuers,
+        state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
+      }), {
+        F: __dxlog_file3,
+        L: 348,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
+      path.credentials.forEach((cred) => result.credentials.add(cred));
+      result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
+      for (const modifiedSubject of path.forkChangedSubjects) {
+        const existingBranch = subjectToBranch.get(modifiedSubject);
+        if (existingBranch == null || this._shouldOverrideCredential(existingBranch, path, modifiedSubject)) {
+          subjectToBranch.set(modifiedSubject, path);
+        }
+      }
+    }
+    const replayPaths = /* @__PURE__ */ new Set();
+    const addReplayPath = replayPaths.add.bind(replayPaths);
+    for (const [subject, branch] of subjectToBranch.entries()) {
+      result.forkChangedSubjects.add(subject);
+      const vertex = branch.state.get(subject);
+      result.state.set(subject, vertex);
+      (0, import_log3.log)("set subject state", () => ({
+        subject,
+        state: this._stateHandler.toLogString(vertex.assertion)
+      }), {
+        F: __dxlog_file3,
+        L: 370,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      const otherPaths = paths.filter((p) => p !== branch);
+      this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
+    }
+    if (replayPaths.size > 0) {
+      return {
+        type: "replay_required",
+        replay: [
+          ...replayPaths.values()
+        ],
+        from: forkPoint,
+        stateOverrides: subjectToBranch.mapValues((v, key) => v.state.get(key))
+      };
+    }
+    return {
+      type: "merged",
+      path: result
+    };
+  }
+  /**
+  * A candidate credential is preferred over the existing credential if:
+  *  1. It is the merge-point, because it's the last credential that was issued in awareness of all
+  *  the previously existing ones.
+  *  2. A path where candidate was set contains existing credential in it, which means that the candidate
+  *  was issued after the existing credential by a legitimate issuer.
+  *  3. A state-specific logic (_stateHandler) is able to justify using the candidate credential.
+  *  4. The path where candidate was set has more issuers than the existing path (longer branch).
+  *  5. The issuance time of the candidate is after the issuance time of the existing credential (LWW).
+  */
+  _shouldOverrideCredential(existing, candidate, modifiedSubject) {
+    const candidateVertex = candidate.state.get(modifiedSubject);
+    const currentVertex = existing.state.get(modifiedSubject);
+    if (candidateVertex.id === currentVertex.id) {
+      return false;
+    }
+    const mergePointId = existing.head.id;
+    if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
+      (0, import_log3.log)("merge point chosen to break the tie", {
+        mergePointId: existing.head.id
+      }, {
+        F: __dxlog_file3,
+        L: 408,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return mergePointId === candidateVertex.id;
+    }
+    const candidateCredential = candidateVertex.credential;
+    const currentCredential = currentVertex.credential;
+    if (existing.credentials.has(candidateCredential.id) !== candidate.credentials.has(currentCredential.id)) {
+      (0, import_log3.log)("one of the credentials was overridden in another branch", {
+        current: currentVertex.id,
+        candidate: candidateVertex.id
+      }, {
+        F: __dxlog_file3,
+        L: 415,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return candidate.credentials.has(currentCredential.id);
+    }
+    const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
+    if (winningCredential != null) {
+      return winningCredential === candidateCredential;
+    }
+    if (candidate.forkIssuers.size !== existing.forkIssuers.size) {
+      (0, import_log3.log)("longer issuers branch used to break the tie", {
+        issuerCount: [
+          existing.forkIssuers.size,
+          candidate.forkIssuers.size
+        ]
+      }, {
+        F: __dxlog_file3,
+        L: 432,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return candidate.forkIssuers.size > existing.forkIssuers.size;
+    }
+    (0, import_log3.log)("issuance date used to break the tie", void 0, {
+      F: __dxlog_file3,
+      L: 437,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
+  }
+  _createRootPath() {
+    return {
+      head: this._root,
+      chosenPath: {},
+      forkIssuers: new import_util6.ComplexSet(import_keys7.PublicKey.hash),
+      forkChangedSubjects: new import_util6.ComplexSet(import_keys7.PublicKey.hash),
+      state: new import_util6.ComplexMap(import_keys7.PublicKey.hash),
+      credentials: new import_util6.ComplexSet(import_keys7.PublicKey.hash)
+    };
+  }
+};
+var toChosenPath = (path) => {
+  return Object.fromEntries(Object.entries(path.chosenPath).map(([k, vs]) => [
+    k,
+    vs.map((v) => v.id)
+  ]));
+};
+var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
 var MemberStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._members = new import_util5.ComplexMap(import_keys6.PublicKey.hash);
-    this.onMemberAdmitted = new import_util5.Callback();
+    this._memberProfiles = new import_util5.ComplexMap(import_keys6.PublicKey.hash);
+    this._hashgraph = new CredentialGraph(this);
+    this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
   }
   get creator() {
-    return this._creator;
+    return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
   }
   get members() {
-    return this._members;
+    return this._hashgraph.getState();
+  }
+  get membershipChainHeads() {
+    return this._hashgraph.getLeafIds();
   }
   getRole(member) {
-    return this._members.get(member)?.assertion.role;
+    return this._getRole(this._hashgraph.getGlobalStateScope(), member);
   }
   /**
   * Processes the SpaceMember credential.
@@ -760,84 +1326,122 @@ var MemberStateMachine = class {
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceMember": {
         (0, import_invariant3.invariant)(assertion.spaceKey.equals(this._spaceKey), void 0, {
-          F: __dxlog_file3,
-          L: 58,
+          F: __dxlog_file4,
+          L: 66,
           S: this,
           A: [
             "assertion.spaceKey.equals(this._spaceKey)",
             ""
           ]
         });
-        if (this._members.has(credential.subject.id)) {
-          return;
+        if (this._ownerKey == null && credential.issuer === this._spaceKey) {
+          this._ownerKey = credential.subject.id;
         }
-        const info = {
-          key: credential.subject.id,
-          credential,
-          assertion,
-          removed: false,
-          profile: assertion.profile
-        };
-        if (!this._creator) {
-          this._creator = info;
+        if (assertion.profile != null) {
+          this._memberProfiles.set(credential.subject.id, assertion.profile);
         }
-        this._members.set(credential.subject.id, info);
-        (0, import_log2.log)("member added", {
-          member: credential.subject.id,
-          space: this._spaceKey,
-          role: assertion.role,
-          profile: assertion.profile
-        }, {
-          F: __dxlog_file3,
-          L: 79,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        await this.onMemberAdmitted.callIfSet(info);
+        await this._hashgraph.addVertex(credential, assertion);
         break;
       }
       case "dxos.halo.credentials.MemberProfile": {
-        const member = this._members.get(credential.subject.id);
-        if (!member) {
+        const member = this._hashgraph.getSubjectState(credential.subject.id);
+        if (member) {
+          member.profile = assertion.profile;
+        } else {
           import_log2.log.warn("Member not found", {
             id: credential.subject.id
           }, {
-            F: __dxlog_file3,
-            L: 93,
+            F: __dxlog_file4,
+            L: 81,
             S: this,
             C: (f, a) => f(...a)
           });
-        } else {
-          member.profile = assertion.profile;
         }
+        this._memberProfiles.set(credential.subject.id, assertion.profile);
         break;
       }
       default:
         throw new Error("Invalid assertion type");
     }
   }
-  async onRevoked(revoked, revocation) {
-    (0, import_invariant3.invariant)(revoked.id, void 0, {
-      F: __dxlog_file3,
-      L: 106,
-      S: this,
-      A: [
-        "revoked.id",
-        ""
-      ]
-    });
-    for (const member of this._members.values()) {
-      if (member.credential.id?.equals(revoked.id)) {
-        member.removed = true;
-        break;
+  createState(credential, assertion) {
+    const memberKey = credential.subject.id;
+    return {
+      key: memberKey,
+      role: assertion.role,
+      credential,
+      assertion,
+      profile: this._memberProfiles.get(memberKey)
+    };
+  }
+  isUpdateAllowed(scope, credential, assertion) {
+    if (assertion.role === import_credentials3.SpaceMember.Role.OWNER) {
+      return credential.issuer.equals(this._spaceKey);
+    }
+    const issuer = credential.issuer;
+    const isChangingOwnRole = issuer.equals(credential.subject.id);
+    if (isChangingOwnRole) {
+      return false;
+    }
+    if (issuer.equals(assertion.spaceKey)) {
+      return true;
+    }
+    const issuerRole = this._getRole(scope, issuer);
+    return issuerRole === import_credentials3.SpaceMember.Role.ADMIN || issuerRole === import_credentials3.SpaceMember.Role.OWNER;
+  }
+  getConflictingPaths(paths, update) {
+    if (update.assertion.role !== import_credentials3.SpaceMember.Role.REMOVED && update.assertion.role !== import_credentials3.SpaceMember.Role.EDITOR) {
+      return [];
+    }
+    const memberId = update.credential.subject.id;
+    return paths.filter((p) => p.forkIssuers.has(memberId));
+  }
+  tryPickWinningUpdate(scope1, update1, scope2, update2) {
+    const path1IssuerRole = this._getRole(scope1, update1.issuer);
+    const path2IssuerRole = this._getRole(scope2, update2.issuer);
+    if (path2IssuerRole === import_credentials3.SpaceMember.Role.OWNER !== (path1IssuerRole === import_credentials3.SpaceMember.Role.OWNER)) {
+      (0, import_log2.log)("owner decision used to break the tie", void 0, {
+        F: __dxlog_file4,
+        L: 139,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return path1IssuerRole === import_credentials3.SpaceMember.Role.OWNER ? update1 : update2;
+    }
+    return null;
+  }
+  toLogString(assertion) {
+    const role = assertion?.role ?? import_credentials3.SpaceMember.Role.REMOVED;
+    return Object.entries(import_credentials3.SpaceMember.Role).find(([_, value]) => value === role)[0];
+  }
+  hasStateChanged(s1, s2) {
+    return s1?.role !== s2?.role;
+  }
+  _getRole(scope, memberId) {
+    if (this._ownerKey?.equals(memberId)) {
+      return import_credentials3.SpaceMember.Role.OWNER;
+    }
+    const realRole = scope.state.get(memberId)?.assertion?.role ?? import_credentials3.SpaceMember.Role.REMOVED;
+    if (scope.stateOverrides != null) {
+      const override = scope.stateOverrides.get(memberId);
+      if (override != null) {
+        (0, import_log2.log)("member role overridden in path", () => ({
+          headId: scope.head?.id,
+          roleOverride: this.toLogString(override.assertion),
+          realRole: this.toLogString(scope.state.get(memberId)?.assertion)
+        }), {
+          F: __dxlog_file4,
+          L: 162,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        return override.assertion.role;
       }
     }
+    return realRole;
   }
 };
-var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
-var REVOCABLE_CREDENTIALS = [
-  "dxos.halo.credentials.SpaceMember"
-];
+var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 var SpaceStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
@@ -849,7 +1453,7 @@ var SpaceStateMachine = class {
     this._processedCredentials = new import_util2.ComplexSet(import_keys3.PublicKey.hash);
     this._credentialProcessors = [];
     this.onCredentialProcessed = new import_util2.Callback();
-    this.onMemberAdmitted = this._members.onMemberAdmitted;
+    this.onMemberRoleChanged = this._members.onMemberRoleChanged;
     this.onFeedAdmitted = this._feeds.onFeedAdmitted;
     this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
     this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
@@ -860,6 +1464,9 @@ var SpaceStateMachine = class {
   get members() {
     return this._members.members;
   }
+  get membershipChainHeads() {
+    return this._members.membershipChainHeads;
+  }
   get feeds() {
     return this._feeds.feeds;
   }
@@ -912,8 +1519,8 @@ var SpaceStateMachine = class {
       const result = await verifyCredential(credential);
       if (result.kind !== "pass") {
         import_log.log.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
-          F: __dxlog_file4,
-          L: 149,
+          F: __dxlog_file5,
+          L: 152,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -922,43 +1529,11 @@ var SpaceStateMachine = class {
     }
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
-      case "dxos.halo.credentials.Revocation": {
-        if (!this._canRevokeCredentials(credential.issuer)) {
-          import_log.log.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file4,
-            L: 158,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        const toBeRevoked = this._credentialsById.get(credential.subject.id);
-        if (!toBeRevoked) {
-          import_log.log.warn(`Credential to revoke not found: ${credential.subject.id}`, void 0, {
-            F: __dxlog_file4,
-            L: 163,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        if (!this._credentialCanBeRevoked(toBeRevoked)) {
-          import_log.log.warn(`Credential cannot be revoked: ${credential.subject.id}`, void 0, {
-            F: __dxlog_file4,
-            L: 167,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-        }
-        toBeRevoked.revoked = true;
-        await this._members.onRevoked(toBeRevoked.credential, credential);
-        break;
-      }
       case "dxos.halo.credentials.SpaceGenesis": {
         if (this._genesisCredential) {
           import_log.log.warn("Space already has a genesis credential.", void 0, {
-            F: __dxlog_file4,
-            L: 176,
+            F: __dxlog_file5,
+            L: 161,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -966,8 +1541,8 @@ var SpaceStateMachine = class {
         }
         if (!credential.issuer.equals(this._spaceKey)) {
           import_log.log.warn("Space genesis credential must be issued by space.", void 0, {
-            F: __dxlog_file4,
-            L: 180,
+            F: __dxlog_file5,
+            L: 165,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -975,8 +1550,8 @@ var SpaceStateMachine = class {
         }
         if (!credential.subject.id.equals(this._spaceKey)) {
           import_log.log.warn("Space genesis credential must be issued to space.", void 0, {
-            F: __dxlog_file4,
-            L: 184,
+            F: __dxlog_file5,
+            L: 169,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -991,8 +1566,8 @@ var SpaceStateMachine = class {
         }
         if (!this._genesisCredential) {
           import_log.log.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file4,
-            L: 198,
+            F: __dxlog_file5,
+            L: 182,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1000,8 +1575,8 @@ var SpaceStateMachine = class {
         }
         if (!this._canInviteNewMembers(credential.issuer)) {
           import_log.log.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file4,
-            L: 202,
+            F: __dxlog_file5,
+            L: 186,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1014,8 +1589,8 @@ var SpaceStateMachine = class {
       case "dxos.halo.credentials.MemberProfile": {
         if (!this._genesisCredential) {
           import_log.log.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file4,
-            L: 213,
+            F: __dxlog_file5,
+            L: 197,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1027,8 +1602,8 @@ var SpaceStateMachine = class {
       case "dxos.halo.credentials.AdmittedFeed": {
         if (!this._genesisCredential) {
           import_log.log.warn("Space must have a genesis credential before admitting feeds.", void 0, {
-            F: __dxlog_file4,
-            L: 223,
+            F: __dxlog_file5,
+            L: 207,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1036,8 +1611,8 @@ var SpaceStateMachine = class {
         }
         if (!this._canAdmitFeeds(credential.issuer)) {
           import_log.log.warn(`Space member is not authorized to admit feeds: ${credential.issuer}`, void 0, {
-            F: __dxlog_file4,
-            L: 227,
+            F: __dxlog_file5,
+            L: 211,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1050,8 +1625,8 @@ var SpaceStateMachine = class {
       case "dxos.halo.invitations.DelegateSpaceInvitation": {
         if (!this._canInviteNewMembers(credential.issuer)) {
           import_log.log.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file4,
-            L: 238,
+            F: __dxlog_file5,
+            L: 222,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1079,17 +1654,11 @@ var SpaceStateMachine = class {
     return true;
   }
   _canInviteNewMembers(key) {
-    return key.equals(this._spaceKey) || this._members.getRole(key) === import_credentials2.SpaceMember.Role.ADMIN;
+    return key.equals(this._spaceKey) || this._members.getRole(key) === import_credentials2.SpaceMember.Role.ADMIN || this._members.getRole(key) === import_credentials2.SpaceMember.Role.OWNER;
   }
   _canAdmitFeeds(key) {
     const role = this._members.getRole(key);
-    return role === import_credentials2.SpaceMember.Role.MEMBER || role === import_credentials2.SpaceMember.Role.ADMIN;
-  }
-  _canRevokeCredentials(key) {
-    return key.equals(this._spaceKey) || this._members.getRole(key) === import_credentials2.SpaceMember.Role.ADMIN;
-  }
-  _credentialCanBeRevoked(entry) {
-    return REVOCABLE_CREDENTIALS.includes(entry.credential.subject.assertion["@type"]);
+    return role === import_credentials2.SpaceMember.Role.EDITOR || role === import_credentials2.SpaceMember.Role.ADMIN || role === import_credentials2.SpaceMember.Role.OWNER;
   }
 };
 var CredentialConsumer = class {
@@ -1119,20 +1688,20 @@ var CredentialConsumer = class {
     await this._onClose();
   }
 };
-var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
+var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
 var DeviceStateMachine = class {
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
+    this.authorizedDeviceKeys = new import_util7.ComplexMap(import_keys8.PublicKey.hash);
     this.deviceChainReady = new import_async2.Trigger();
   }
   async processCredential(credential) {
-    (0, import_log3.log)("processing credential...", {
+    (0, import_log4.log)("processing credential...", {
       identityKey: this._params.identityKey,
       deviceKey: this._params.deviceKey,
       credential
     }, {
-      F: __dxlog_file5,
+      F: __dxlog_file6,
       L: 35,
       S: this,
       C: (f, a) => f(...a)
@@ -1146,8 +1715,8 @@ var DeviceStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.AuthorizedDevice": {
-        (0, import_invariant4.invariant)(!this.authorizedDeviceKeys.has(assertion.deviceKey), "Device already added.", {
-          F: __dxlog_file5,
+        (0, import_invariant5.invariant)(!this.authorizedDeviceKeys.has(assertion.deviceKey), "Device already added.", {
+          F: __dxlog_file6,
           L: 51,
           S: this,
           A: [
@@ -1156,12 +1725,12 @@ var DeviceStateMachine = class {
           ]
         });
         this.authorizedDeviceKeys.set(assertion.deviceKey, {});
-        (0, import_log3.log)("added device", {
+        (0, import_log4.log)("added device", {
           localDeviceKey: this._params.deviceKey,
           deviceKey: assertion.deviceKey,
           size: this.authorizedDeviceKeys.size
         }, {
-          F: __dxlog_file5,
+          F: __dxlog_file6,
           L: 54,
           S: this,
           C: (f, a) => f(...a)
@@ -1170,8 +1739,8 @@ var DeviceStateMachine = class {
         break;
       }
       case "dxos.halo.credentials.DeviceProfile": {
-        (0, import_invariant4.invariant)(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
-          F: __dxlog_file5,
+        (0, import_invariant5.invariant)(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
+          F: __dxlog_file6,
           L: 64,
           S: this,
           A: [
@@ -1180,11 +1749,11 @@ var DeviceStateMachine = class {
           ]
         });
         if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
-          import_log3.log.trace("dxos.halo.device", {
+          import_log4.log.trace("dxos.halo.device", {
             deviceKey: credential.subject.id,
             profile: assertion.profile
           }, {
-            F: __dxlog_file5,
+            F: __dxlog_file6,
             L: 67,
             S: this,
             C: (f, a) => f(...a)
@@ -1197,7 +1766,7 @@ var DeviceStateMachine = class {
     }
   }
 };
-var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
+var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
 var ProfileStateMachine = class {
   constructor(_params) {
     this._params = _params;
@@ -1207,11 +1776,11 @@ var ProfileStateMachine = class {
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.IdentityProfile": {
         if (!credential.issuer.equals(this._params.identityKey) || !credential.subject.id.equals(this._params.identityKey)) {
-          import_log4.log.warn("Invalid profile credential", {
+          import_log5.log.warn("Invalid profile credential", {
             expectedIdentity: this._params.identityKey,
             credential
           }, {
-            F: __dxlog_file6,
+            F: __dxlog_file7,
             L: 34,
             S: this,
             C: (f, a) => f(...a)
@@ -1219,11 +1788,11 @@ var ProfileStateMachine = class {
           return;
         }
         this.profile = assertion.profile;
-        (0, import_log4.log)("updated profile", {
+        (0, import_log5.log)("updated profile", {
           identityKey: this._params.identityKey,
           profile: this.profile
         }, {
-          F: __dxlog_file6,
+          F: __dxlog_file7,
           L: 40,
           S: this,
           C: (f, a) => f(...a)