@dxos/credentials 0.6.12 → 0.6.13-main.548ca8d

package/dist/lib/node-esm/index.mjs

@@ -0,0 +1,1843 @@
+import { createRequire } from 'node:module';const require = createRequire(import.meta.url);
+
+// packages/core/halo/credentials/src/invitations.ts
+var defaultSecretProvider = async () => Buffer.from("0000");
+var defaultSecretValidator = async (invitation, secret) => true;
+
+// packages/core/halo/credentials/src/passcode.ts
+var generatePasscode = (length = 4) => {
+  let passcode = "";
+  for (let i = 0; i < length; i++) {
+    passcode += `${Math.floor(Math.random() * 10)}`;
+  }
+  return passcode;
+};
+
+// packages/core/halo/credentials/src/credentials/signing.ts
+import stableStringify from "json-stable-stringify";
+import { PublicKey } from "@dxos/keys";
+import { Timeframe } from "@dxos/timeframe";
+import { arrayToBuffer } from "@dxos/util";
+var getCredentialProofPayload = (credential) => {
+  const copy = {
+    ...credential,
+    proof: {
+      ...credential.proof,
+      value: new Uint8Array(),
+      chain: void 0
+    }
+  };
+  if (copy.parentCredentialIds?.length === 0) {
+    delete copy.parentCredentialIds;
+  }
+  delete copy.id;
+  return Buffer.from(canonicalStringify(copy));
+};
+var canonicalStringify = (obj) => stableStringify(obj, {
+  /* The point of signing and verifying is not that the internal, private state of the objects be
+  * identical, but that the public contents can be verified not to have been altered. For that reason,
+  * really private fields (indicated by '__') are not included in the signature.
+  * This gives a mechanism for attaching other attributes to an object without breaking the signature.
+  * We also skip @type.
+  */
+  // TODO(dmaretskyi): Should we actually skip the @type field?
+  replacer: function(key, value) {
+    if (key.toString().startsWith("__") || key.toString() === "@type") {
+      return void 0;
+    }
+    if (value === null) {
+      return void 0;
+    }
+    const original = this[key];
+    if (value) {
+      if (PublicKey.isPublicKey(value)) {
+        return value.toHex();
+      }
+      if (Buffer.isBuffer(value)) {
+        return value.toString("hex");
+      }
+      if (value instanceof Uint8Array) {
+        return arrayToBuffer(value).toString("hex");
+      }
+      if (value.data && value.type === "Buffer") {
+        return Buffer.from(value).toString("hex");
+      }
+      if (original instanceof Timeframe) {
+        return original.frames().reduce((frames, [key2, seq]) => {
+          frames[truncateKey(key2)] = seq;
+          return frames;
+        }, {});
+      }
+    }
+    return value;
+  }
+});
+var truncateKey = (key) => {
+  const str = key.toHex();
+  return `${str.substring(0, 4)}...${str.substring(str.length - 4)}`;
+};
+
+// packages/core/halo/credentials/src/presentations/signing.ts
+var getPresentationProofPayload = (credentials, proof) => {
+  const copy = {
+    credentials: credentials.map((credential) => removeEmptyParentCredentialIds(credential)),
+    proof: {
+      ...proof,
+      value: new Uint8Array(),
+      chain: void 0
+    }
+  };
+  return Buffer.from(canonicalStringify(copy));
+};
+var removeEmptyParentCredentialIds = (credential) => {
+  const copy = {
+    ...credential,
+    proof: credential.proof ? {
+      ...credential.proof,
+      chain: credential.proof.chain ? {
+        credential: removeEmptyParentCredentialIds(credential.proof.chain.credential)
+      } : void 0
+    } : void 0
+  };
+  if (copy.parentCredentialIds?.length === 0) {
+    delete copy.parentCredentialIds;
+  }
+  return copy;
+};
+
+// packages/core/halo/credentials/src/credentials/assertions.ts
+var getCredentialAssertion = (credential) => credential.subject.assertion;
+var isValidAuthorizedDeviceCredential = (credential, identityKey, deviceKey) => {
+  const assertion = getCredentialAssertion(credential);
+  return credential.subject.id.equals(deviceKey) && credential.issuer.equals(identityKey) && assertion["@type"] === "dxos.halo.credentials.AuthorizedDevice" && assertion.identityKey.equals(identityKey) && assertion.deviceKey.equals(deviceKey);
+};
+var checkCredentialType = (credential, type) => credential.subject.assertion["@type"] === type;
+var credentialTypeFilter = (type) => (credential) => checkCredentialType(credential, type);
+
+// packages/core/halo/credentials/src/credentials/credential-factory.ts
+import { subtleCrypto } from "@dxos/crypto";
+import { invariant } from "@dxos/invariant";
+import { PublicKey as PublicKey2 } from "@dxos/keys";
+
+// packages/core/halo/credentials/src/credentials/verifier.ts
+import { verifySignature } from "@dxos/crypto";
+var SIGNATURE_TYPE_ED25519 = "ED25519Signature";
+var verifyCredential = async (credential) => {
+  if (credential.parentCredentialIds?.length === 0) {
+    delete credential.parentCredentialIds;
+  }
+  if (!credential.issuer.equals(credential.proof.signer)) {
+    if (!credential.proof.chain) {
+      return {
+        kind: "fail",
+        errors: [
+          "Delegated credential is missing credential chain."
+        ]
+      };
+    }
+    const result2 = await verifyChain(credential.proof.chain, credential.issuer, credential.proof.signer);
+    if (result2.kind === "fail") {
+      return result2;
+    }
+  }
+  const result = await verifyCredentialSignature(credential);
+  if (result.kind === "fail") {
+    return result;
+  }
+  return {
+    kind: "pass"
+  };
+};
+var verifyCredentialSignature = async (credential) => {
+  if (credential.proof.type !== SIGNATURE_TYPE_ED25519) {
+    return {
+      kind: "fail",
+      errors: [
+        `Invalid signature type: ${credential.proof.type}`
+      ]
+    };
+  }
+  const signData = getCredentialProofPayload(credential);
+  if (!await verifySignature(credential.proof.signer, signData, credential.proof.value)) {
+    return {
+      kind: "fail",
+      errors: [
+        "Invalid signature"
+      ]
+    };
+  }
+  return {
+    kind: "pass"
+  };
+};
+var verifyChain = async (chain, authority, subject) => {
+  const result = await verifyCredential(chain.credential);
+  if (result.kind === "fail") {
+    return result;
+  }
+  if (!isValidAuthorizedDeviceCredential(chain.credential, authority, subject)) {
+    return {
+      kind: "fail",
+      errors: [
+        `Invalid credential chain: invalid assertion for key: ${subject}`
+      ]
+    };
+  }
+  return {
+    kind: "pass"
+  };
+};
+
+// packages/core/halo/credentials/src/credentials/credential-factory.ts
+var __dxlog_file = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
+var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
+  invariant(assertion["@type"], "Invalid assertion.", {
+    F: __dxlog_file,
+    L: 48,
+    S: void 0,
+    A: [
+      "assertion['@type']",
+      "'Invalid assertion.'"
+    ]
+  });
+  invariant(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
+    F: __dxlog_file,
+    L: 49,
+    S: void 0,
+    A: [
+      "!!signingKey === !!chain",
+      "'Chain must be provided if and only if the signing key differs from the issuer.'"
+    ]
+  });
+  if (chain) {
+    const result = await verifyChain(chain, issuer, signingKey);
+    invariant(result.kind === "pass", "Invalid chain.", {
+      F: __dxlog_file,
+      L: 52,
+      S: void 0,
+      A: [
+        "result.kind === 'pass'",
+        "'Invalid chain.'"
+      ]
+    });
+  }
+  const credential = {
+    issuer,
+    issuanceDate: /* @__PURE__ */ new Date(),
+    subject: {
+      id: subject,
+      assertion
+    },
+    parentCredentialIds,
+    proof: {
+      type: SIGNATURE_TYPE_ED25519,
+      creationDate: /* @__PURE__ */ new Date(),
+      signer: signingKey ?? issuer,
+      value: new Uint8Array(),
+      nonce
+    }
+  };
+  const signedPayload = getCredentialProofPayload(credential);
+  credential.proof.value = await signer.sign(signingKey ?? issuer, signedPayload);
+  if (chain) {
+    credential.proof.chain = chain;
+  }
+  credential.id = PublicKey2.from(await subtleCrypto.digest("SHA-256", signedPayload));
+  return credential;
+};
+var createCredentialMessage = (credential) => {
+  return {
+    "@type": "dxos.echo.feed.CredentialsMessage",
+    credential
+  };
+};
+var createCredentialSignerWithKey = (signer, issuer) => ({
+  getIssuer: () => issuer,
+  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
+    signer,
+    issuer,
+    subject,
+    assertion,
+    nonce,
+    parentCredentialIds
+  })
+});
+var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
+  getIssuer: () => chain.credential.issuer,
+  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
+    signer,
+    issuer: chain.credential.issuer,
+    signingKey,
+    chain,
+    subject,
+    assertion,
+    nonce,
+    parentCredentialIds
+  })
+});
+
+// packages/core/halo/credentials/src/credentials/credential-generator.ts
+import { AdmittedFeed, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { Timeframe as Timeframe2 } from "@dxos/timeframe";
+var CredentialGenerator = class {
+  constructor(_signer, _identityKey, _deviceKey) {
+    this._signer = _signer;
+    this._identityKey = _identityKey;
+    this._deviceKey = _deviceKey;
+  }
+  /**
+  * Create genesis messages for new Space.
+  */
+  async createSpaceGenesis(spaceKey, controlKey, creatorProfile) {
+    return [
+      await createCredential({
+        signer: this._signer,
+        issuer: spaceKey,
+        subject: spaceKey,
+        assertion: {
+          "@type": "dxos.halo.credentials.SpaceGenesis",
+          spaceKey
+        }
+      }),
+      await createCredential({
+        signer: this._signer,
+        issuer: spaceKey,
+        subject: this._identityKey,
+        assertion: {
+          "@type": "dxos.halo.credentials.SpaceMember",
+          spaceKey,
+          role: SpaceMember.Role.ADMIN,
+          profile: creatorProfile,
+          genesisFeedKey: controlKey
+        }
+      }),
+      await this.createFeedAdmission(spaceKey, controlKey, AdmittedFeed.Designation.CONTROL)
+    ];
+  }
+  /**
+  * Create invitation.
+  * Admit identity and control and data feeds.
+  */
+  // TODO(burdon): Reconcile with above (esp. Signer).
+  async createMemberInvitation(spaceKey, identityKey, deviceKey, controlKey, dataKey, genesisFeedKey) {
+    return [
+      await createCredential({
+        signer: this._signer,
+        issuer: this._identityKey,
+        subject: identityKey,
+        assertion: {
+          "@type": "dxos.halo.credentials.SpaceMember",
+          spaceKey,
+          role: SpaceMember.Role.EDITOR,
+          genesisFeedKey
+        }
+      }),
+      await this.createFeedAdmission(spaceKey, controlKey, AdmittedFeed.Designation.CONTROL),
+      await this.createFeedAdmission(spaceKey, dataKey, AdmittedFeed.Designation.DATA)
+    ];
+  }
+  /**
+  * Add device to space.
+  */
+  // TODO(burdon): Reconcile with below.
+  async createDeviceAuthorization(deviceKey) {
+    return createCredential({
+      signer: this._signer,
+      issuer: this._identityKey,
+      subject: deviceKey,
+      assertion: {
+        "@type": "dxos.halo.credentials.AuthorizedDevice",
+        identityKey: this._identityKey,
+        deviceKey
+      }
+    });
+  }
+  /**
+  * Add device metadata.
+  */
+  async createDeviceProfile(profile) {
+    return createCredential({
+      signer: this._signer,
+      issuer: this._identityKey,
+      subject: this._deviceKey,
+      assertion: {
+        "@type": "dxos.halo.credentials.DeviceProfile",
+        profile
+      }
+    });
+  }
+  /**
+  * Add feed to space.
+  */
+  async createFeedAdmission(spaceKey, feedKey, designation) {
+    return createCredential({
+      signer: this._signer,
+      issuer: this._identityKey,
+      subject: feedKey,
+      assertion: {
+        "@type": "dxos.halo.credentials.AdmittedFeed",
+        spaceKey,
+        identityKey: this._identityKey,
+        deviceKey: this._deviceKey,
+        designation
+      }
+    });
+  }
+  async createProfileCredential(profile) {
+    return createCredential({
+      signer: this._signer,
+      issuer: this._identityKey,
+      subject: this._identityKey,
+      assertion: {
+        "@type": "dxos.halo.credentials.IdentityProfile",
+        profile
+      }
+    });
+  }
+  async createEpochCredential(spaceKey) {
+    return createCredential({
+      signer: this._signer,
+      issuer: this._identityKey,
+      subject: spaceKey,
+      assertion: {
+        "@type": "dxos.halo.credentials.Epoch",
+        number: 0,
+        timeframe: new Timeframe2()
+      }
+    });
+  }
+};
+var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
+  const credentials = await Promise.all([
+    await signer.createCredential({
+      subject: deviceKey,
+      assertion: {
+        "@type": "dxos.halo.credentials.AuthorizedDevice",
+        identityKey,
+        deviceKey
+      }
+    })
+  ]);
+  return credentials.map((credential) => ({
+    "@type": "dxos.echo.feed.CredentialsMessage",
+    credential
+  }));
+};
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
+  const credentials = await Promise.all([
+    await signer.createCredential({
+      subject: identityKey,
+      parentCredentialIds: membershipChainHeads,
+      assertion: {
+        "@type": "dxos.halo.credentials.SpaceMember",
+        spaceKey,
+        role,
+        profile,
+        genesisFeedKey,
+        invitationCredentialId
+      }
+    })
+  ]);
+  return credentials.map((credential) => ({
+    credential: {
+      credential
+    }
+  }));
+};
+var createDelegatedSpaceInvitationCredential = async (signer, subject, invitation) => {
+  const credential = await signer.createCredential({
+    subject,
+    assertion: {
+      "@type": "dxos.halo.invitations.DelegateSpaceInvitation",
+      invitationId: invitation.invitationId,
+      authMethod: invitation.authMethod,
+      swarmKey: invitation.swarmKey,
+      role: invitation.role,
+      guestKey: invitation.guestKey,
+      expiresOn: invitation.expiresOn,
+      multiUse: invitation.multiUse
+    }
+  });
+  return {
+    credential: {
+      credential
+    }
+  };
+};
+var createCancelDelegatedSpaceInvitationCredential = async (signer, subject, invitationCredentialId) => {
+  const credential = await signer.createCredential({
+    subject,
+    assertion: {
+      "@type": "dxos.halo.invitations.CancelDelegatedInvitation",
+      credentialId: invitationCredentialId
+    }
+  });
+  return {
+    credential: {
+      credential
+    }
+  };
+};
+
+// packages/core/halo/credentials/src/presentations/presentation.ts
+var signPresentation = async ({ presentation, signer, signerKey, chain, nonce }) => {
+  const proof = {
+    type: SIGNATURE_TYPE_ED25519,
+    value: new Uint8Array(),
+    creationDate: /* @__PURE__ */ new Date(),
+    signer: signerKey,
+    nonce
+  };
+  const signedPayload = getPresentationProofPayload(presentation.credentials ?? [], proof);
+  proof.value = await signer.sign(signerKey, signedPayload);
+  if (chain) {
+    proof.chain = chain;
+  }
+  return {
+    credentials: presentation.credentials,
+    proofs: [
+      ...presentation.proofs ?? [],
+      proof
+    ]
+  };
+};
+
+// packages/core/halo/credentials/src/presentations/verifier.ts
+import { verifySignature as verifySignature2 } from "@dxos/crypto";
+var verifyPresentation = async (presentation) => {
+  const errors = [];
+  const credentialsVerifications = await Promise.all(presentation.credentials?.map((credential) => verifyCredential(credential)) ?? []);
+  for (const verification of credentialsVerifications) {
+    if (verification.kind === "fail") {
+      errors.push(...verification.errors);
+    }
+  }
+  const proofVerification = await Promise.all(presentation.proofs?.map(async (proof) => {
+    const chainVerification = await verifyPresentationChain(presentation, proof);
+    if (chainVerification.kind === "fail") {
+      return chainVerification;
+    }
+    const signatureVerification = await verifyPresentationSignature(presentation, proof);
+    if (signatureVerification.kind === "fail") {
+      return signatureVerification;
+    }
+    return {
+      kind: "pass"
+    };
+  }) ?? []);
+  for (const verification of proofVerification) {
+    if (verification.kind === "fail") {
+      errors.push(...verification.errors);
+    }
+  }
+  if (errors.length === 0) {
+    return {
+      kind: "pass"
+    };
+  }
+  {
+    return {
+      kind: "fail",
+      errors
+    };
+  }
+};
+var verifyPresentationChain = async (presentation, proof) => {
+  for (const credential of presentation.credentials ?? []) {
+    if (!credential.issuer.equals(proof.signer)) {
+      if (!proof.chain) {
+        return {
+          kind: "fail",
+          errors: [
+            "Delegated credential is missing credential chain."
+          ]
+        };
+      }
+      const chainVerification = await verifyChain(proof.chain, credential.subject.id, proof.signer);
+      if (chainVerification.kind === "fail") {
+        return chainVerification;
+      }
+    }
+  }
+  return {
+    kind: "pass"
+  };
+};
+var verifyPresentationSignature = async (presentation, proof) => {
+  if (proof.type !== SIGNATURE_TYPE_ED25519) {
+    return {
+      kind: "fail",
+      errors: [
+        `Invalid signature type: ${proof.type}`
+      ]
+    };
+  }
+  const signData = getPresentationProofPayload(presentation.credentials ?? [], proof);
+  if (!await verifySignature2(proof.signer, signData, proof.value)) {
+    return {
+      kind: "fail",
+      errors: [
+        "Invalid signature"
+      ]
+    };
+  }
+  return {
+    kind: "pass"
+  };
+};
+
+// packages/core/halo/credentials/src/state-machine/space-state-machine.ts
+import { runInContextAsync } from "@dxos/async";
+import { Context } from "@dxos/context";
+import { PublicKey as PublicKey7 } from "@dxos/keys";
+import { log as log3 } from "@dxos/log";
+import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { Callback as Callback4, ComplexMap as ComplexMap5, ComplexSet as ComplexSet3 } from "@dxos/util";
+
+// packages/core/halo/credentials/src/state-machine/feed-state-machine.ts
+import { invariant as invariant2 } from "@dxos/invariant";
+import { PublicKey as PublicKey3 } from "@dxos/keys";
+import { Callback, ComplexMap } from "@dxos/util";
+var __dxlog_file2 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
+var FeedStateMachine = class {
+  constructor(_spaceKey) {
+    this._spaceKey = _spaceKey;
+    this._feeds = new ComplexMap(PublicKey3.hash);
+    this.onFeedAdmitted = new Callback();
+  }
+  get feeds() {
+    return this._feeds;
+  }
+  /**
+  * Processes the AdmittedFeed credential.
+  * Assumes the credential is already pre-verified
+  * and the issuer has been authorized to issue credentials of this type.
+  * @param fromFeed Key of the feed where this credential is recorded.
+  */
+  async process(credential, fromFeed) {
+    const assertion = getCredentialAssertion(credential);
+    invariant2(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, {
+      F: __dxlog_file2,
+      L: 47,
+      S: this,
+      A: [
+        "assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'",
+        ""
+      ]
+    });
+    invariant2(assertion.spaceKey.equals(this._spaceKey), void 0, {
+      F: __dxlog_file2,
+      L: 48,
+      S: this,
+      A: [
+        "assertion.spaceKey.equals(this._spaceKey)",
+        ""
+      ]
+    });
+    const info = {
+      key: credential.subject.id,
+      credential,
+      assertion,
+      parent: fromFeed
+    };
+    this._feeds.set(credential.subject.id, info);
+    await this.onFeedAdmitted.callIfSet(info);
+  }
+};
+
+// packages/core/halo/credentials/src/state-machine/invitation-state-machine.ts
+import { PublicKey as PublicKey4 } from "@dxos/keys";
+import { Callback as Callback2, ComplexMap as ComplexMap2, ComplexSet } from "@dxos/util";
+var InvitationStateMachine = class {
+  constructor() {
+    this._invitations = new ComplexMap2(PublicKey4.hash);
+    this._redeemedInvitationCredentialIds = new ComplexSet(PublicKey4.hash);
+    this._cancelledInvitationCredentialIds = new ComplexSet(PublicKey4.hash);
+    this.onDelegatedInvitation = new Callback2();
+    this.onDelegatedInvitationRemoved = new Callback2();
+  }
+  get invitations() {
+    return this._invitations;
+  }
+  async process(credential) {
+    const credentialId = credential.id;
+    if (credentialId == null) {
+      return;
+    }
+    const assertion = getCredentialAssertion(credential);
+    switch (assertion["@type"]) {
+      case "dxos.halo.invitations.CancelDelegatedInvitation": {
+        this._cancelledInvitationCredentialIds.add(assertion.credentialId);
+        const existingInvitation = this._invitations.get(assertion.credentialId);
+        if (existingInvitation != null) {
+          this._invitations.delete(assertion.credentialId);
+          await this.onDelegatedInvitationRemoved.callIfSet({
+            credentialId: assertion.credentialId,
+            invitation: existingInvitation
+          });
+        }
+        break;
+      }
+      case "dxos.halo.invitations.DelegateSpaceInvitation": {
+        if (credential.id) {
+          const isExpired = assertion.expiresOn && assertion.expiresOn.getTime() < Date.now();
+          const wasUsed = this._redeemedInvitationCredentialIds.has(credential.id) && !assertion.multiUse;
+          const wasCancelled = this._cancelledInvitationCredentialIds.has(credential.id);
+          if (isExpired || wasCancelled || wasUsed) {
+            return;
+          }
+          const invitation = {
+            ...assertion
+          };
+          this._invitations.set(credential.id, invitation);
+          await this.onDelegatedInvitation.callIfSet({
+            credentialId: credential.id,
+            invitation
+          });
+        }
+        break;
+      }
+      case "dxos.halo.credentials.SpaceMember": {
+        if (assertion.invitationCredentialId != null) {
+          this._redeemedInvitationCredentialIds.add(assertion.invitationCredentialId);
+          const existingInvitation = this._invitations.get(assertion.invitationCredentialId);
+          if (existingInvitation != null && !existingInvitation.multiUse) {
+            this._invitations.delete(assertion.invitationCredentialId);
+            await this.onDelegatedInvitationRemoved.callIfSet({
+              credentialId: assertion.invitationCredentialId,
+              invitation: existingInvitation
+            });
+          }
+        }
+        break;
+      }
+    }
+  }
+};
+
+// packages/core/halo/credentials/src/state-machine/member-state-machine.ts
+import { invariant as invariant4 } from "@dxos/invariant";
+import { PublicKey as PublicKey6 } from "@dxos/keys";
+import { log as log2 } from "@dxos/log";
+import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { ComplexMap as ComplexMap4 } from "@dxos/util";
+
+// packages/core/halo/credentials/src/graph/credential-graph.ts
+import { invariant as invariant3 } from "@dxos/invariant";
+import { PublicKey as PublicKey5 } from "@dxos/keys";
+import { log } from "@dxos/log";
+import { Callback as Callback3, ComplexMap as ComplexMap3, ComplexSet as ComplexSet2 } from "@dxos/util";
+var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
+var CredentialGraph = class {
+  constructor(_stateHandler) {
+    this._stateHandler = _stateHandler;
+    this._vertexIdGenerator = 1;
+    this._root = {
+      id: -1,
+      parents: [],
+      children: []
+    };
+    this._sentinel = {
+      id: -2,
+      parents: [],
+      children: []
+    };
+    this._vertexByCredentialId = new ComplexMap3(PublicKey5.hash);
+    this._subjectToVertex = new ComplexMap3(PublicKey5.hash);
+    this._subjectToState = new ComplexMap3(PublicKey5.hash);
+    this.onSubjectStateChanged = new Callback3();
+  }
+  getSubjectState(subjectId) {
+    return this._subjectToState.get(subjectId);
+  }
+  getState() {
+    return this._subjectToState;
+  }
+  getLeafIds() {
+    return this._sentinel.parents.map((v) => v.credential.id);
+  }
+  getGlobalStateScope() {
+    return {
+      state: this._subjectToVertex
+    };
+  }
+  addVertex(credential, assertion) {
+    const newVertex = {
+      id: this._vertexIdGenerator++,
+      credential,
+      assertion,
+      parents: [],
+      children: []
+    };
+    this._vertexByCredentialId.set(credential.id, newVertex);
+    const parentIds = credential.parentCredentialIds ?? [];
+    if (parentIds.length === 0) {
+      this._root.children.push(newVertex);
+      newVertex.parents.push(this._root);
+    } else {
+      for (const parentId of parentIds) {
+        const parentVertex = this._vertexByCredentialId.get(parentId);
+        if (parentVertex == null) {
+          log.error("credential skipped because of the unknown parent", {
+            credential,
+            parentId
+          }, {
+            F: __dxlog_file3,
+            L: 72,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          continue;
+        }
+        parentVertex.children.push(newVertex);
+        newVertex.parents.push(parentVertex);
+        this._removeSentinelConnection(parentVertex);
+      }
+    }
+    newVertex.children.push(this._sentinel);
+    this._sentinel.parents.push(newVertex);
+    return this._onVertexInserted(newVertex);
+  }
+  _removeSentinelConnection(vertex) {
+    const sentinelIdx = vertex.children.indexOf(this._sentinel);
+    if (sentinelIdx >= 0) {
+      vertex.children.splice(sentinelIdx, 1);
+      const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
+      invariant3(vertexInSentinelIdx >= 0, void 0, {
+        F: __dxlog_file3,
+        L: 90,
+        S: this,
+        A: [
+          "vertexInSentinelIdx >= 0",
+          ""
+        ]
+      });
+      this._sentinel.parents.splice(vertexInSentinelIdx, 1);
+    }
+  }
+  async _onVertexInserted(newVertex) {
+    const { credential, assertion } = newVertex;
+    invariant3(credential, void 0, {
+      F: __dxlog_file3,
+      L: 97,
+      S: this,
+      A: [
+        "credential",
+        ""
+      ]
+    });
+    let changedSubjects = [];
+    const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
+    if (isUpdateAppliedOnTopOfThePreviousState) {
+      const subjectId = credential.subject.id;
+      if (this._stateHandler.isUpdateAllowed(this.getGlobalStateScope(), credential, assertion)) {
+        const newSubjectState = this._stateHandler.createState(credential, newVertex.assertion);
+        const prevSubjectState = this._subjectToState.get(subjectId);
+        this._subjectToState.set(subjectId, newSubjectState);
+        this._subjectToVertex.set(subjectId, newVertex);
+        if (this._stateHandler.hasStateChanged(newSubjectState, prevSubjectState)) {
+          changedSubjects.push(newSubjectState);
+        }
+      }
+    } else {
+      changedSubjects = this._recomputeState();
+    }
+    if (changedSubjects.length > 0) {
+      await this.onSubjectStateChanged.callIfSet(changedSubjects);
+    }
+  }
+  /**
+  * DFS the graph from root to sentinel pausing on merge points (nodes with multiple parents).
+  * Continue after all paths leading to a merge point converge by merging their states.
+  * In case of a concurrent update paths are replayed taking into account the state set
+  * by the winning branch.
+  */
+  _recomputeState() {
+    const pendingPaths = /* @__PURE__ */ new Map();
+    const paths = [
+      this._createRootPath()
+    ];
+    let lastPath = null;
+    while (lastPath == null) {
+      const path = paths.pop();
+      log("visit vertex", {
+        id: path.head.id
+      }, {
+        F: __dxlog_file3,
+        L: 132,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      this._updatePathState(path);
+      const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
+      if (convergedPaths == null) {
+        log("waiting for other paths", void 0, {
+          F: __dxlog_file3,
+          L: 136,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        continue;
+      }
+      const mergeResult = this._mergePaths(convergedPaths);
+      if (mergeResult.type === "replay_required") {
+        this._replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths);
+        continue;
+      }
+      const merged = mergeResult.path;
+      if (merged.head.children.length === 0) {
+        lastPath = merged;
+      } else if (merged.head.children.length === 1) {
+        merged.head = merged.head.children[0];
+        paths.push(merged);
+      } else {
+        this._forkTraversal(paths, merged);
+      }
+    }
+    if (paths.length > 0) {
+      log.error("traversal finished while there were active paths", {
+        paths: paths.map((p) => ({
+          path: toChosenPath(p),
+          head: p.head.id
+        }))
+      }, {
+        F: __dxlog_file3,
+        L: 155,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
+    return this._setCurrentState(lastPath);
+  }
+  _replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths) {
+    paths.push(...mergeResult.replay.map((path) => {
+      const stateOverrides = path.stateOverrides ?? new ComplexMap3(PublicKey5.hash);
+      mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));
+      return {
+        ...mergeResult.from,
+        chosenPath: path.chosenPath,
+        stateOverrides
+      };
+    }));
+    log("replay paths", () => ({
+      count: paths.length,
+      paths: paths.map((path) => ({
+        from: mergeResult.from.head.id,
+        path: toChosenPath(path),
+        overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
+      }))
+    }), {
+      F: __dxlog_file3,
+      L: 175,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
+    pendingPaths.set(convergedPaths[0].head.id, clearedPending);
+  }
+  _handleMergePoint(paths, pendingPaths, path) {
+    const pendingList = pendingPaths.get(path.head.id) ?? [];
+    pendingPaths.set(path.head.id, pendingList);
+    pendingList.push(path);
+    if (pendingList.length < path.head.parents.length) {
+      return null;
+    }
+    if (path.head.id === this._sentinel.id && paths.length > 0) {
+      log("waiting for all the active paths to converge on the sentinel", void 0, {
+        F: __dxlog_file3,
+        L: 199,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return null;
+    }
+    pendingPaths.delete(path.head.id);
+    return pendingList;
+  }
+  _updatePathState(path) {
+    const headCredential = path.head.credential;
+    if (headCredential == null) {
+      return;
+    }
+    const updatedSubject = headCredential.subject.id;
+    path.credentials.add(headCredential.id);
+    let isUpdateAllowed = this._stateHandler.isUpdateAllowed(path, headCredential, path.head.assertion);
+    if (!isUpdateAllowed && path.head.parents[0]?.id === this._root.id) {
+      const globalState = this.getGlobalStateScope();
+      isUpdateAllowed = this._stateHandler.isUpdateAllowed(globalState, headCredential, path.head.assertion);
+    }
+    if (isUpdateAllowed) {
+      path.forkChangedSubjects.add(updatedSubject);
+      path.forkIssuers.add(headCredential.issuer);
+      path.state.set(updatedSubject, path.head);
+      log("path state updated", () => ({
+        subject: updatedSubject,
+        newState: this._stateHandler.toLogString(path.head.assertion)
+      }), {
+        F: __dxlog_file3,
+        L: 223,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+    }
+  }
+  _forkTraversal(paths, path) {
+    const replayChoice = path.chosenPath?.[path.head.id];
+    const choices = replayChoice ?? path.head.children;
+    for (const choice of choices) {
+      log("edge traversal", {
+        from: path.head.id,
+        to: choice.id
+      }, {
+        F: __dxlog_file3,
+        L: 234,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      const fork = {
+        forkPoint: path,
+        chosenPath: {
+          ...path.chosenPath,
+          [path.head.id]: [
+            choice
+          ]
+        },
+        head: choice,
+        credentials: new ComplexSet2(PublicKey5.hash, path.credentials),
+        state: new ComplexMap3(PublicKey5.hash, [
+          ...path.state.entries()
+        ]),
+        forkIssuers: new ComplexSet2(PublicKey5.hash),
+        forkChangedSubjects: new ComplexSet2(PublicKey5.hash),
+        stateOverrides: path.stateOverrides
+      };
+      paths.push(fork);
+    }
+  }
+  /**
+  * Updates the current graph state.
+  * @returns changed states.
+  */
+  _setCurrentState(path) {
+    const changedSubjects = [];
+    const newStateMap = new ComplexMap3(PublicKey5.hash);
+    const newVertexMap = new ComplexMap3(PublicKey5.hash);
+    for (const [subjectKey, subjectVertex] of path.state.entries()) {
+      const newState = this._stateHandler.createState(subjectVertex.credential, subjectVertex.assertion);
+      const prevState = this._subjectToState.get(subjectKey);
+      newStateMap.set(subjectKey, newState);
+      newVertexMap.set(subjectKey, subjectVertex);
+      if (this._stateHandler.hasStateChanged(newState, prevState)) {
+        changedSubjects.push(newState);
+      }
+    }
+    this._subjectToState = newStateMap;
+    this._subjectToVertex = newVertexMap;
+    return changedSubjects;
+  }
+  /*
+  * Walk up all the fork points and return the first one present in all the paths.
+  * We use local id to determine vertex position in the graph, because nodes can't
+  * be inserted in the middle (between a parent and a child) and ids are monotonically increasing.
+  */
+  _leastCommonAncestor(paths) {
+    const uniqueForkPoints = paths.reduce((acc, path) => {
+      let it = path.forkPoint;
+      while (it) {
+        acc.set(it.head.id, it);
+        it = it.forkPoint;
+      }
+      return acc;
+    }, /* @__PURE__ */ new Map());
+    let maxId = this._root.id;
+    let maxState = null;
+    for (const [id, state] of uniqueForkPoints.entries()) {
+      const headCredential = state.head.credential;
+      if (headCredential != null) {
+        const isPointInEveryPath = paths.every((p) => p.credentials.has(headCredential.id));
+        if (isPointInEveryPath && id > maxId) {
+          maxId = id;
+          maxState = state;
+        }
+      }
+    }
+    return maxState ?? this._createRootPath();
+  }
+  /**
+  * We might be merging paths where some of them had fork points after the initial forking.
+  * We need all the paths to point to the least common fork point and contain all the changes
+  * that happened after it.
+  */
+  _moveUpToForkPoint(forkPoint, path) {
+    const isForkPointInPath = path.chosenPath[forkPoint.head.id] == null || path.forkPoint == null;
+    if (isForkPointInPath) {
+      return path;
+    }
+    if (forkPoint.head.id === path.forkPoint?.head.id) {
+      return path;
+    }
+    let it = path.forkPoint;
+    while (it.head.id !== forkPoint.head.id) {
+      it.forkIssuers.forEach((iss) => path.forkIssuers.add(iss));
+      it.forkChangedSubjects.forEach((m) => path.forkChangedSubjects.add(m));
+      it = it.forkPoint;
+      path.forkPoint = it;
+    }
+    return path;
+  }
+  _mergePaths(convergedPaths) {
+    invariant3(convergedPaths.length >= 1, void 0, {
+      F: __dxlog_file3,
+      L: 324,
+      S: this,
+      A: [
+        "convergedPaths.length >= 1",
+        ""
+      ]
+    });
+    if (convergedPaths.length === 1) {
+      return {
+        type: "merged",
+        path: convergedPaths[0]
+      };
+    }
+    const forkPoint = this._leastCommonAncestor(convergedPaths);
+    log("merging paths", () => ({
+      forkPointId: forkPoint.head.id,
+      pathCount: convergedPaths.length,
+      forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
+    }), {
+      F: __dxlog_file3,
+      L: 329,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
+    invariant3(forkPoint, void 0, {
+      F: __dxlog_file3,
+      L: 335,
+      S: this,
+      A: [
+        "forkPoint",
+        ""
+      ]
+    });
+    const result = {
+      forkPoint: forkPoint.forkPoint,
+      chosenPath: {
+        ...forkPoint.chosenPath,
+        [forkPoint.head.id]: []
+      },
+      stateOverrides: forkPoint.stateOverrides,
+      credentials: new ComplexSet2(PublicKey5.hash, forkPoint.credentials),
+      forkIssuers: new ComplexSet2(PublicKey5.hash, forkPoint.forkIssuers),
+      forkChangedSubjects: new ComplexSet2(PublicKey5.hash, forkPoint.forkChangedSubjects),
+      state: forkPoint.state.mapValues((v) => v),
+      head: paths[0].head
+    };
+    const subjectToBranch = new ComplexMap3(PublicKey5.hash);
+    for (const path of paths) {
+      log("processing a path", () => ({
+        choices: toChosenPath(path),
+        modified: path.forkChangedSubjects,
+        forkIssuers: path.forkIssuers,
+        state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
+      }), {
+        F: __dxlog_file3,
+        L: 348,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
+      path.credentials.forEach((cred) => result.credentials.add(cred));
+      result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
+      for (const modifiedSubject of path.forkChangedSubjects) {
+        const existingBranch = subjectToBranch.get(modifiedSubject);
+        if (existingBranch == null || this._shouldOverrideCredential(existingBranch, path, modifiedSubject)) {
+          subjectToBranch.set(modifiedSubject, path);
+        }
+      }
+    }
+    const replayPaths = /* @__PURE__ */ new Set();
+    const addReplayPath = replayPaths.add.bind(replayPaths);
+    for (const [subject, branch] of subjectToBranch.entries()) {
+      result.forkChangedSubjects.add(subject);
+      const vertex = branch.state.get(subject);
+      result.state.set(subject, vertex);
+      log("set subject state", () => ({
+        subject,
+        state: this._stateHandler.toLogString(vertex.assertion)
+      }), {
+        F: __dxlog_file3,
+        L: 370,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      const otherPaths = paths.filter((p) => p !== branch);
+      this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
+    }
+    if (replayPaths.size > 0) {
+      return {
+        type: "replay_required",
+        replay: [
+          ...replayPaths.values()
+        ],
+        from: forkPoint,
+        stateOverrides: subjectToBranch.mapValues((v, key) => v.state.get(key))
+      };
+    }
+    return {
+      type: "merged",
+      path: result
+    };
+  }
+  /**
+  * A candidate credential is preferred over the existing credential if:
+  *  1. It is the merge-point, because it's the last credential that was issued in awareness of all
+  *  the previously existing ones.
+  *  2. A path where candidate was set contains existing credential in it, which means that the candidate
+  *  was issued after the existing credential by a legitimate issuer.
+  *  3. A state-specific logic (_stateHandler) is able to justify using the candidate credential.
+  *  4. The path where candidate was set has more issuers than the existing path (longer branch).
+  *  5. The issuance time of the candidate is after the issuance time of the existing credential (LWW).
+  */
+  _shouldOverrideCredential(existing, candidate, modifiedSubject) {
+    const candidateVertex = candidate.state.get(modifiedSubject);
+    const currentVertex = existing.state.get(modifiedSubject);
+    if (candidateVertex.id === currentVertex.id) {
+      return false;
+    }
+    const mergePointId = existing.head.id;
+    if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
+      log("merge point chosen to break the tie", {
+        mergePointId: existing.head.id
+      }, {
+        F: __dxlog_file3,
+        L: 408,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return mergePointId === candidateVertex.id;
+    }
+    const candidateCredential = candidateVertex.credential;
+    const currentCredential = currentVertex.credential;
+    if (existing.credentials.has(candidateCredential.id) !== candidate.credentials.has(currentCredential.id)) {
+      log("one of the credentials was overridden in another branch", {
+        current: currentVertex.id,
+        candidate: candidateVertex.id
+      }, {
+        F: __dxlog_file3,
+        L: 415,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return candidate.credentials.has(currentCredential.id);
+    }
+    const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
+    if (winningCredential != null) {
+      return winningCredential === candidateCredential;
+    }
+    if (candidate.forkIssuers.size !== existing.forkIssuers.size) {
+      log("longer issuers branch used to break the tie", {
+        issuerCount: [
+          existing.forkIssuers.size,
+          candidate.forkIssuers.size
+        ]
+      }, {
+        F: __dxlog_file3,
+        L: 432,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return candidate.forkIssuers.size > existing.forkIssuers.size;
+    }
+    log("issuance date used to break the tie", void 0, {
+      F: __dxlog_file3,
+      L: 437,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
+  }
+  _createRootPath() {
+    return {
+      head: this._root,
+      chosenPath: {},
+      forkIssuers: new ComplexSet2(PublicKey5.hash),
+      forkChangedSubjects: new ComplexSet2(PublicKey5.hash),
+      state: new ComplexMap3(PublicKey5.hash),
+      credentials: new ComplexSet2(PublicKey5.hash)
+    };
+  }
+};
+var toChosenPath = (path) => {
+  return Object.fromEntries(Object.entries(path.chosenPath).map(([k, vs]) => [
+    k,
+    vs.map((v) => v.id)
+  ]));
+};
+
+// packages/core/halo/credentials/src/state-machine/member-state-machine.ts
+var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
+var MemberStateMachine = class {
+  constructor(_spaceKey) {
+    this._spaceKey = _spaceKey;
+    this._memberProfiles = new ComplexMap4(PublicKey6.hash);
+    this._hashgraph = new CredentialGraph(this);
+    this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
+  }
+  get creator() {
+    return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
+  }
+  get members() {
+    return this._hashgraph.getState();
+  }
+  get membershipChainHeads() {
+    return this._hashgraph.getLeafIds();
+  }
+  getRole(member) {
+    return this._getRole(this._hashgraph.getGlobalStateScope(), member);
+  }
+  /**
+  * Processes the SpaceMember credential.
+  * Assumes the credential is already pre-verified and the issuer has been authorized to issue credentials of this type.
+  */
+  async process(credential) {
+    const assertion = getCredentialAssertion(credential);
+    switch (assertion["@type"]) {
+      case "dxos.halo.credentials.SpaceMember": {
+        invariant4(assertion.spaceKey.equals(this._spaceKey), void 0, {
+          F: __dxlog_file4,
+          L: 66,
+          S: this,
+          A: [
+            "assertion.spaceKey.equals(this._spaceKey)",
+            ""
+          ]
+        });
+        if (this._ownerKey == null && credential.issuer === this._spaceKey) {
+          this._ownerKey = credential.subject.id;
+        }
+        if (assertion.profile != null) {
+          this._memberProfiles.set(credential.subject.id, assertion.profile);
+        }
+        await this._hashgraph.addVertex(credential, assertion);
+        break;
+      }
+      case "dxos.halo.credentials.MemberProfile": {
+        const member = this._hashgraph.getSubjectState(credential.subject.id);
+        if (member) {
+          member.profile = assertion.profile;
+        } else {
+          log2.warn("Member not found", {
+            id: credential.subject.id
+          }, {
+            F: __dxlog_file4,
+            L: 81,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+        }
+        this._memberProfiles.set(credential.subject.id, assertion.profile);
+        break;
+      }
+      default:
+        throw new Error("Invalid assertion type");
+    }
+  }
+  createState(credential, assertion) {
+    const memberKey = credential.subject.id;
+    return {
+      key: memberKey,
+      role: assertion.role,
+      credential,
+      assertion,
+      profile: this._memberProfiles.get(memberKey)
+    };
+  }
+  isUpdateAllowed(scope, credential, assertion) {
+    if (assertion.role === SpaceMember2.Role.OWNER) {
+      return credential.issuer.equals(this._spaceKey);
+    }
+    const issuer = credential.issuer;
+    const isChangingOwnRole = issuer.equals(credential.subject.id);
+    if (isChangingOwnRole) {
+      return false;
+    }
+    if (issuer.equals(assertion.spaceKey)) {
+      return true;
+    }
+    const issuerRole = this._getRole(scope, issuer);
+    return issuerRole === SpaceMember2.Role.ADMIN || issuerRole === SpaceMember2.Role.OWNER;
+  }
+  getConflictingPaths(paths, update) {
+    if (update.assertion.role !== SpaceMember2.Role.REMOVED && update.assertion.role !== SpaceMember2.Role.EDITOR) {
+      return [];
+    }
+    const memberId = update.credential.subject.id;
+    return paths.filter((p) => p.forkIssuers.has(memberId));
+  }
+  tryPickWinningUpdate(scope1, update1, scope2, update2) {
+    const path1IssuerRole = this._getRole(scope1, update1.issuer);
+    const path2IssuerRole = this._getRole(scope2, update2.issuer);
+    if (path2IssuerRole === SpaceMember2.Role.OWNER !== (path1IssuerRole === SpaceMember2.Role.OWNER)) {
+      log2("owner decision used to break the tie", void 0, {
+        F: __dxlog_file4,
+        L: 139,
+        S: this,
+        C: (f, a) => f(...a)
+      });
+      return path1IssuerRole === SpaceMember2.Role.OWNER ? update1 : update2;
+    }
+    return null;
+  }
+  toLogString(assertion) {
+    const role = assertion?.role ?? SpaceMember2.Role.REMOVED;
+    return Object.entries(SpaceMember2.Role).find(([_, value]) => value === role)[0];
+  }
+  hasStateChanged(s1, s2) {
+    return s1?.role !== s2?.role;
+  }
+  _getRole(scope, memberId) {
+    if (this._ownerKey?.equals(memberId)) {
+      return SpaceMember2.Role.OWNER;
+    }
+    const realRole = scope.state.get(memberId)?.assertion?.role ?? SpaceMember2.Role.REMOVED;
+    if (scope.stateOverrides != null) {
+      const override = scope.stateOverrides.get(memberId);
+      if (override != null) {
+        log2("member role overridden in path", () => ({
+          headId: scope.head?.id,
+          roleOverride: this.toLogString(override.assertion),
+          realRole: this.toLogString(scope.state.get(memberId)?.assertion)
+        }), {
+          F: __dxlog_file4,
+          L: 162,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        return override.assertion.role;
+      }
+    }
+    return realRole;
+  }
+};
+
+// packages/core/halo/credentials/src/state-machine/space-state-machine.ts
+var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
+var SpaceStateMachine = class {
+  constructor(_spaceKey) {
+    this._spaceKey = _spaceKey;
+    this._members = new MemberStateMachine(this._spaceKey);
+    this._feeds = new FeedStateMachine(this._spaceKey);
+    this._invitations = new InvitationStateMachine();
+    this._credentials = [];
+    this._credentialsById = new ComplexMap5(PublicKey7.hash);
+    this._processedCredentials = new ComplexSet3(PublicKey7.hash);
+    this._credentialProcessors = [];
+    this.onCredentialProcessed = new Callback4();
+    this.onMemberRoleChanged = this._members.onMemberRoleChanged;
+    this.onFeedAdmitted = this._feeds.onFeedAdmitted;
+    this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
+    this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
+  }
+  get creator() {
+    return this._members.creator;
+  }
+  get members() {
+    return this._members.members;
+  }
+  get membershipChainHeads() {
+    return this._members.membershipChainHeads;
+  }
+  get feeds() {
+    return this._feeds.feeds;
+  }
+  get credentials() {
+    return this._credentials.map((entry) => entry.credential);
+  }
+  get credentialEntries() {
+    return this._credentials;
+  }
+  get genesisCredential() {
+    return this._genesisCredential;
+  }
+  get invitations() {
+    return this._invitations.invitations;
+  }
+  async addCredentialProcessor(processor) {
+    if (this._credentialProcessors.find((p) => p.processor === processor)) {
+      throw new Error("Credential processor already added.");
+    }
+    const consumer = new CredentialConsumer(processor, async () => {
+      for (const credential of this.credentials) {
+        await consumer._process(credential);
+      }
+      consumer._isReadyForLiveCredentials = true;
+    }, async () => {
+      this._credentialProcessors = this._credentialProcessors.filter((p) => p !== consumer);
+    });
+    this._credentialProcessors.push(consumer);
+    await consumer.open();
+  }
+  async removeCredentialProcessor(processor) {
+    const consumer = this._credentialProcessors.find((p) => p.processor === processor);
+    await consumer?.close();
+  }
+  getCredentialsOfType(type) {
+    return this.credentials.filter((credential) => getCredentialAssertion(credential)["@type"] === type);
+  }
+  /**
+  * @param credential Message to process.
+  * @param fromFeed Key of the feed where this credential is recorded.
+  */
+  async process(credential, { sourceFeed, skipVerification }) {
+    if (credential.id) {
+      if (this._processedCredentials.has(credential.id)) {
+        return true;
+      }
+      this._processedCredentials.add(credential.id);
+    }
+    if (!skipVerification) {
+      const result = await verifyCredential(credential);
+      if (result.kind !== "pass") {
+        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
+          F: __dxlog_file5,
+          L: 155,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        return false;
+      }
+    }
+    const assertion = getCredentialAssertion(credential);
+    switch (assertion["@type"]) {
+      case "dxos.halo.credentials.SpaceGenesis": {
+        if (this._genesisCredential) {
+          log3.warn("Space already has a genesis credential.", void 0, {
+            F: __dxlog_file5,
+            L: 164,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        if (!credential.issuer.equals(this._spaceKey)) {
+          log3.warn("Space genesis credential must be issued by space.", void 0, {
+            F: __dxlog_file5,
+            L: 168,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        if (!credential.subject.id.equals(this._spaceKey)) {
+          log3.warn("Space genesis credential must be issued to space.", void 0, {
+            F: __dxlog_file5,
+            L: 172,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        this._genesisCredential = credential;
+        break;
+      }
+      case "dxos.halo.credentials.SpaceMember": {
+        if (!assertion.spaceKey.equals(this._spaceKey)) {
+          break;
+        }
+        if (!this._genesisCredential) {
+          log3.warn("Space must have a genesis credential before adding members.", void 0, {
+            F: __dxlog_file5,
+            L: 185,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        if (!this._canInviteNewMembers(credential.issuer)) {
+          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+            F: __dxlog_file5,
+            L: 189,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        await this._members.process(credential);
+        await this._invitations.process(credential);
+        break;
+      }
+      case "dxos.halo.credentials.MemberProfile": {
+        if (!this._genesisCredential) {
+          log3.warn("Space must have a genesis credential before adding members.", void 0, {
+            F: __dxlog_file5,
+            L: 200,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        await this._members.process(credential);
+        break;
+      }
+      case "dxos.halo.credentials.AdmittedFeed": {
+        if (!this._genesisCredential) {
+          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
+            F: __dxlog_file5,
+            L: 210,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        if (!this._canAdmitFeeds(credential.issuer)) {
+          log3.warn(`Space member is not authorized to admit feeds: ${credential.issuer}`, void 0, {
+            F: __dxlog_file5,
+            L: 214,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        await this._feeds.process(credential, sourceFeed);
+        break;
+      }
+      case "dxos.halo.invitations.CancelDelegatedInvitation":
+      case "dxos.halo.invitations.DelegateSpaceInvitation": {
+        if (!this._canInviteNewMembers(credential.issuer)) {
+          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+            F: __dxlog_file5,
+            L: 225,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        await this._invitations.process(credential);
+        break;
+      }
+    }
+    const newEntry = {
+      credential,
+      sourceFeed,
+      revoked: false
+    };
+    this._credentials.push(newEntry);
+    if (credential.id) {
+      this._credentialsById.set(credential.id, newEntry);
+    }
+    for (const processor of this._credentialProcessors) {
+      if (processor._isReadyForLiveCredentials) {
+        await processor._process(credential);
+      }
+    }
+    await this.onCredentialProcessed.callIfSet(credential);
+    return true;
+  }
+  getMemberRole(memberKey) {
+    return this._members.getRole(memberKey);
+  }
+  hasMembershipManagementPermission(memberKey) {
+    return this._canInviteNewMembers(memberKey);
+  }
+  _canInviteNewMembers(key) {
+    return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
+  }
+  _canAdmitFeeds(key) {
+    const role = this._members.getRole(key);
+    return role === SpaceMember3.Role.EDITOR || role === SpaceMember3.Role.ADMIN || role === SpaceMember3.Role.OWNER;
+  }
+};
+var CredentialConsumer = class {
+  constructor(processor, _onOpen, _onClose) {
+    this.processor = processor;
+    this._onOpen = _onOpen;
+    this._onClose = _onClose;
+    this._ctx = new Context(void 0, {
+      F: __dxlog_file5,
+      L: 275
+    });
+    this._isReadyForLiveCredentials = false;
+  }
+  /**
+  * @internal
+  */
+  async _process(credential) {
+    await runInContextAsync(this._ctx, async () => {
+      await this.processor.processCredential(credential);
+    });
+  }
+  async open() {
+    if (this._ctx.disposed) {
+      throw new Error("CredentialProcessor is disposed");
+    }
+    await this._onOpen();
+  }
+  async close() {
+    await this._ctx.dispose();
+    await this._onClose();
+  }
+};
+
+// packages/core/halo/credentials/src/processor/device-state-machine.ts
+import { Trigger } from "@dxos/async";
+import { invariant as invariant5 } from "@dxos/invariant";
+import { PublicKey as PublicKey8 } from "@dxos/keys";
+import { log as log4 } from "@dxos/log";
+import { ComplexMap as ComplexMap6 } from "@dxos/util";
+var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
+var DeviceStateMachine = class {
+  constructor(_params) {
+    this._params = _params;
+    this.authorizedDeviceKeys = new ComplexMap6(PublicKey8.hash);
+    this.deviceChainReady = new Trigger();
+  }
+  async processCredential(credential) {
+    log4("processing credential...", {
+      identityKey: this._params.identityKey,
+      deviceKey: this._params.deviceKey,
+      credential
+    }, {
+      F: __dxlog_file6,
+      L: 35,
+      S: this,
+      C: (f, a) => f(...a)
+    });
+    if (isValidAuthorizedDeviceCredential(credential, this._params.identityKey, this._params.deviceKey)) {
+      this.deviceCredentialChain = {
+        credential
+      };
+      this.deviceChainReady.wake();
+    }
+    const assertion = getCredentialAssertion(credential);
+    switch (assertion["@type"]) {
+      case "dxos.halo.credentials.AuthorizedDevice": {
+        invariant5(!this.authorizedDeviceKeys.has(assertion.deviceKey), "Device already added.", {
+          F: __dxlog_file6,
+          L: 51,
+          S: this,
+          A: [
+            "!this.authorizedDeviceKeys.has(assertion.deviceKey)",
+            "'Device already added.'"
+          ]
+        });
+        this.authorizedDeviceKeys.set(assertion.deviceKey, {});
+        log4("added device", {
+          localDeviceKey: this._params.deviceKey,
+          deviceKey: assertion.deviceKey,
+          size: this.authorizedDeviceKeys.size
+        }, {
+          F: __dxlog_file6,
+          L: 54,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        this._params.onUpdate?.();
+        break;
+      }
+      case "dxos.halo.credentials.DeviceProfile": {
+        invariant5(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
+          F: __dxlog_file6,
+          L: 64,
+          S: this,
+          A: [
+            "this.authorizedDeviceKeys.has(credential.subject.id)",
+            "'Device not found.'"
+          ]
+        });
+        if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
+          log4.trace("dxos.halo.device", {
+            deviceKey: credential.subject.id,
+            profile: assertion.profile
+          }, {
+            F: __dxlog_file6,
+            L: 67,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+        }
+        this.authorizedDeviceKeys.set(credential.subject.id, assertion.profile);
+        this._params.onUpdate?.();
+        break;
+      }
+    }
+  }
+};
+
+// packages/core/halo/credentials/src/processor/profile-state-machine.ts
+import { log as log5 } from "@dxos/log";
+var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
+var ProfileStateMachine = class {
+  constructor(_params) {
+    this._params = _params;
+  }
+  async processCredential(credential) {
+    const assertion = getCredentialAssertion(credential);
+    switch (assertion["@type"]) {
+      case "dxos.halo.credentials.IdentityProfile": {
+        if (!credential.issuer.equals(this._params.identityKey) || !credential.subject.id.equals(this._params.identityKey)) {
+          log5.warn("Invalid profile credential", {
+            expectedIdentity: this._params.identityKey,
+            credential
+          }, {
+            F: __dxlog_file7,
+            L: 34,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return;
+        }
+        this.profile = assertion.profile;
+        log5("updated profile", {
+          identityKey: this._params.identityKey,
+          profile: this.profile
+        }, {
+          F: __dxlog_file7,
+          L: 40,
+          S: this,
+          C: (f, a) => f(...a)
+        });
+        this._params.onUpdate?.();
+        break;
+      }
+    }
+  }
+};
+export {
+  CredentialGenerator,
+  DeviceStateMachine,
+  FeedStateMachine,
+  InvitationStateMachine,
+  MemberStateMachine,
+  ProfileStateMachine,
+  SIGNATURE_TYPE_ED25519,
+  SpaceStateMachine,
+  canonicalStringify,
+  checkCredentialType,
+  createAdmissionCredentials,
+  createCancelDelegatedSpaceInvitationCredential,
+  createCredential,
+  createCredentialMessage,
+  createCredentialSignerWithChain,
+  createCredentialSignerWithKey,
+  createDelegatedSpaceInvitationCredential,
+  createDeviceAuthorization,
+  credentialTypeFilter,
+  defaultSecretProvider,
+  defaultSecretValidator,
+  generatePasscode,
+  getCredentialAssertion,
+  getCredentialProofPayload,
+  getPresentationProofPayload,
+  isValidAuthorizedDeviceCredential,
+  signPresentation,
+  verifyChain,
+  verifyCredential,
+  verifyCredentialSignature,
+  verifyPresentation,
+  verifyPresentationChain,
+  verifyPresentationSignature
+};
+//# sourceMappingURL=index.mjs.map