@dxos/credentials 0.7.5-main.e9bb01b → 0.7.5-staging.2ff1350

package/dist/lib/browser/index.mjs

@@ -1,5 +1,22 @@
 import "@dxos/node-std/globals";
 
+// packages/core/halo/credentials/src/did.ts
+import { subtleCrypto } from "@dxos/crypto";
+import { PublicKey, IdentityDid } from "@dxos/keys";
+import { ComplexMap } from "@dxos/util";
+var IDENTITY_DIDS_CACHE = new ComplexMap(PublicKey.hash);
+var createDidFromIdentityKey = async (identityKey) => {
+  const cachedValue = IDENTITY_DIDS_CACHE.get(identityKey);
+  if (cachedValue !== void 0) {
+    return cachedValue;
+  }
+  const digest = await subtleCrypto.digest("SHA-256", identityKey.asUint8Array());
+  const bytes = new Uint8Array(digest).slice(0, IdentityDid.byteLength);
+  const identityDid = IdentityDid.encode(bytes);
+  IDENTITY_DIDS_CACHE.set(identityKey, identityDid);
+  return identityDid;
+};
+
 // packages/core/halo/credentials/src/invitations.ts
 var defaultSecretProvider = async () => Buffer.from("0000");
 var defaultSecretValidator = async (invitation, secret) => true;
@@ -35,7 +52,7 @@ var generatePasscode = (length = 4) => {
 
 // packages/core/halo/credentials/src/credentials/signing.ts
 import stableStringify from "json-stable-stringify";
-import { PublicKey } from "@dxos/keys";
+import { PublicKey as PublicKey2 } from "@dxos/keys";
 import { Timeframe } from "@dxos/timeframe";
 import { arrayToBuffer } from "@dxos/util";
 var getCredentialProofPayload = (credential) => {
@@ -70,7 +87,7 @@ var canonicalStringify = (obj) => stableStringify(obj, {
     }
     const original = this[key];
     if (value) {
-      if (PublicKey.isPublicKey(value)) {
+      if (PublicKey2.isPublicKey(value)) {
         return value.toHex();
       }
       if (Buffer.isBuffer(value)) {
@@ -135,9 +152,9 @@ var checkCredentialType = (credential, type) => credential.subject.assertion["@t
 var credentialTypeFilter = (type) => (credential) => checkCredentialType(credential, type);
 
 // packages/core/halo/credentials/src/credentials/credential-factory.ts
-import { subtleCrypto } from "@dxos/crypto";
+import { subtleCrypto as subtleCrypto2 } from "@dxos/crypto";
 import { invariant as invariant2 } from "@dxos/invariant";
-import { PublicKey as PublicKey2 } from "@dxos/keys";
+import { PublicKey as PublicKey3 } from "@dxos/keys";
 
 // packages/core/halo/credentials/src/credentials/verifier.ts
 import { verifySignature } from "@dxos/crypto";
@@ -262,7 +279,7 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
   if (chain) {
     credential.proof.chain = chain;
   }
-  credential.id = PublicKey2.from(await subtleCrypto.digest("SHA-256", signedPayload));
+  credential.id = PublicKey3.from(await subtleCrypto2.digest("SHA-256", signedPayload));
   return credential;
 };
 var createCredentialMessage = (credential) => {
@@ -607,22 +624,22 @@ var verifyPresentationSignature = async (presentation, proof) => {
 };
 
 // packages/core/halo/credentials/src/state-machine/space-state-machine.ts
-import { runInContextAsync } from "@dxos/async";
+import { runInContextAsync, synchronized } from "@dxos/async";
 import { Context } from "@dxos/context";
-import { PublicKey as PublicKey7 } from "@dxos/keys";
+import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log3 } from "@dxos/log";
 import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { Callback as Callback4, ComplexMap as ComplexMap5, ComplexSet as ComplexSet3 } from "@dxos/util";
+import { Callback as Callback4, ComplexMap as ComplexMap6, ComplexSet as ComplexSet3 } from "@dxos/util";
 
 // packages/core/halo/credentials/src/state-machine/feed-state-machine.ts
 import { invariant as invariant3 } from "@dxos/invariant";
-import { PublicKey as PublicKey3 } from "@dxos/keys";
-import { Callback, ComplexMap } from "@dxos/util";
+import { PublicKey as PublicKey4 } from "@dxos/keys";
+import { Callback, ComplexMap as ComplexMap2 } from "@dxos/util";
 var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
 var FeedStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._feeds = new ComplexMap(PublicKey3.hash);
+    this._feeds = new ComplexMap2(PublicKey4.hash);
     this.onFeedAdmitted = new Callback();
   }
   get feeds() {
@@ -666,13 +683,13 @@ var FeedStateMachine = class {
 };
 
 // packages/core/halo/credentials/src/state-machine/invitation-state-machine.ts
-import { PublicKey as PublicKey4 } from "@dxos/keys";
-import { Callback as Callback2, ComplexMap as ComplexMap2, ComplexSet } from "@dxos/util";
+import { PublicKey as PublicKey5 } from "@dxos/keys";
+import { Callback as Callback2, ComplexMap as ComplexMap3, ComplexSet } from "@dxos/util";
 var InvitationStateMachine = class {
   constructor() {
-    this._invitations = new ComplexMap2(PublicKey4.hash);
-    this._redeemedInvitationCredentialIds = new ComplexSet(PublicKey4.hash);
-    this._cancelledInvitationCredentialIds = new ComplexSet(PublicKey4.hash);
+    this._invitations = new ComplexMap3(PublicKey5.hash);
+    this._redeemedInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
+    this._cancelledInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
     this.onDelegatedInvitation = new Callback2();
     this.onDelegatedInvitationRemoved = new Callback2();
   }
@@ -737,16 +754,16 @@ var InvitationStateMachine = class {
 
 // packages/core/halo/credentials/src/state-machine/member-state-machine.ts
 import { invariant as invariant5 } from "@dxos/invariant";
-import { PublicKey as PublicKey6 } from "@dxos/keys";
+import { PublicKey as PublicKey7 } from "@dxos/keys";
 import { log as log2 } from "@dxos/log";
 import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { ComplexMap as ComplexMap4 } from "@dxos/util";
+import { ComplexMap as ComplexMap5 } from "@dxos/util";
 
 // packages/core/halo/credentials/src/graph/credential-graph.ts
 import { invariant as invariant4 } from "@dxos/invariant";
-import { PublicKey as PublicKey5 } from "@dxos/keys";
+import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { log } from "@dxos/log";
-import { Callback as Callback3, ComplexMap as ComplexMap3, ComplexSet as ComplexSet2 } from "@dxos/util";
+import { Callback as Callback3, ComplexMap as ComplexMap4, ComplexSet as ComplexSet2 } from "@dxos/util";
 var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
 var CredentialGraph = class {
   constructor(_stateHandler) {
@@ -762,9 +779,9 @@ var CredentialGraph = class {
       parents: [],
       children: []
     };
-    this._vertexByCredentialId = new ComplexMap3(PublicKey5.hash);
-    this._subjectToVertex = new ComplexMap3(PublicKey5.hash);
-    this._subjectToState = new ComplexMap3(PublicKey5.hash);
+    this._vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
+    this._subjectToVertex = new ComplexMap4(PublicKey6.hash);
+    this._subjectToState = new ComplexMap4(PublicKey6.hash);
     this.onSubjectStateChanged = new Callback3();
   }
   getSubjectState(subjectId) {
@@ -931,7 +948,7 @@ var CredentialGraph = class {
   }
   _replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths) {
     paths.push(...mergeResult.replay.map((path) => {
-      const stateOverrides = path.stateOverrides ?? new ComplexMap3(PublicKey5.hash);
+      const stateOverrides = path.stateOverrides ?? new ComplexMap4(PublicKey6.hash);
       mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));
       return {
         ...mergeResult.from,
@@ -1023,12 +1040,12 @@ var CredentialGraph = class {
           ]
         },
         head: choice,
-        credentials: new ComplexSet2(PublicKey5.hash, path.credentials),
-        state: new ComplexMap3(PublicKey5.hash, [
+        credentials: new ComplexSet2(PublicKey6.hash, path.credentials),
+        state: new ComplexMap4(PublicKey6.hash, [
           ...path.state.entries()
         ]),
-        forkIssuers: new ComplexSet2(PublicKey5.hash),
-        forkChangedSubjects: new ComplexSet2(PublicKey5.hash),
+        forkIssuers: new ComplexSet2(PublicKey6.hash),
+        forkChangedSubjects: new ComplexSet2(PublicKey6.hash),
         stateOverrides: path.stateOverrides
       };
       paths.push(fork);
@@ -1040,8 +1057,8 @@ var CredentialGraph = class {
   */
   _setCurrentState(path) {
     const changedSubjects = [];
-    const newStateMap = new ComplexMap3(PublicKey5.hash);
-    const newVertexMap = new ComplexMap3(PublicKey5.hash);
+    const newStateMap = new ComplexMap4(PublicKey6.hash);
+    const newVertexMap = new ComplexMap4(PublicKey6.hash);
     for (const [subjectKey, subjectVertex] of path.state.entries()) {
       const newState = this._stateHandler.createState(subjectVertex.credential, subjectVertex.assertion);
       const prevState = this._subjectToState.get(subjectKey);
@@ -1149,13 +1166,13 @@ var CredentialGraph = class {
         [forkPoint.head.id]: []
       },
       stateOverrides: forkPoint.stateOverrides,
-      credentials: new ComplexSet2(PublicKey5.hash, forkPoint.credentials),
-      forkIssuers: new ComplexSet2(PublicKey5.hash, forkPoint.forkIssuers),
-      forkChangedSubjects: new ComplexSet2(PublicKey5.hash, forkPoint.forkChangedSubjects),
+      credentials: new ComplexSet2(PublicKey6.hash, forkPoint.credentials),
+      forkIssuers: new ComplexSet2(PublicKey6.hash, forkPoint.forkIssuers),
+      forkChangedSubjects: new ComplexSet2(PublicKey6.hash, forkPoint.forkChangedSubjects),
       state: forkPoint.state.mapValues((v) => v),
       head: paths[0].head
     };
-    const subjectToBranch = new ComplexMap3(PublicKey5.hash);
+    const subjectToBranch = new ComplexMap4(PublicKey6.hash);
     for (const path of paths) {
       log("processing a path", () => ({
         choices: toChosenPath(path),
@@ -1283,10 +1300,10 @@ var CredentialGraph = class {
     return {
       head: this._root,
       chosenPath: {},
-      forkIssuers: new ComplexSet2(PublicKey5.hash),
-      forkChangedSubjects: new ComplexSet2(PublicKey5.hash),
-      state: new ComplexMap3(PublicKey5.hash),
-      credentials: new ComplexSet2(PublicKey5.hash)
+      forkIssuers: new ComplexSet2(PublicKey6.hash),
+      forkChangedSubjects: new ComplexSet2(PublicKey6.hash),
+      state: new ComplexMap4(PublicKey6.hash),
+      credentials: new ComplexSet2(PublicKey6.hash)
     };
   }
 };
@@ -1302,7 +1319,7 @@ var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/
 var MemberStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._memberProfiles = new ComplexMap4(PublicKey6.hash);
+    this._memberProfiles = new ComplexMap5(PublicKey7.hash);
     this._hashgraph = new CredentialGraph(this);
     this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
   }
@@ -1444,6 +1461,12 @@ var MemberStateMachine = class {
 };
 
 // packages/core/halo/credentials/src/state-machine/space-state-machine.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
 var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 var SpaceStateMachine = class {
   constructor(_spaceKey) {
@@ -1452,8 +1475,8 @@ var SpaceStateMachine = class {
     this._feeds = new FeedStateMachine(this._spaceKey);
     this._invitations = new InvitationStateMachine();
     this._credentials = [];
-    this._credentialsById = new ComplexMap5(PublicKey7.hash);
-    this._processedCredentials = new ComplexSet3(PublicKey7.hash);
+    this._credentialsById = new ComplexMap6(PublicKey8.hash);
+    this._processedCredentials = new ComplexSet3(PublicKey8.hash);
     this._credentialProcessors = [];
     this.onCredentialProcessed = new Callback4();
     this.onMemberRoleChanged = this._members.onMemberRoleChanged;
@@ -1510,18 +1533,20 @@ var SpaceStateMachine = class {
   /**
   * @param credential Message to process.
   * @param fromFeed Key of the feed where this credential is recorded.
-  * @synchronized
   */
   async process(credential, { sourceFeed, skipVerification }) {
-    if (credential.id && this._processedCredentials.has(credential.id)) {
-      return true;
+    if (credential.id) {
+      if (this._processedCredentials.has(credential.id)) {
+        return true;
+      }
+      this._processedCredentials.add(credential.id);
     }
     if (!skipVerification) {
       const result = await verifyCredential(credential);
       if (result.kind !== "pass") {
         log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
           F: __dxlog_file6,
-          L: 153,
+          L: 156,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1534,7 +1559,7 @@ var SpaceStateMachine = class {
         if (this._genesisCredential) {
           log3.warn("Space already has a genesis credential.", void 0, {
             F: __dxlog_file6,
-            L: 162,
+            L: 165,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1543,7 +1568,7 @@ var SpaceStateMachine = class {
         if (!credential.issuer.equals(this._spaceKey)) {
           log3.warn("Space genesis credential must be issued by space.", void 0, {
             F: __dxlog_file6,
-            L: 166,
+            L: 169,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1552,7 +1577,7 @@ var SpaceStateMachine = class {
         if (!credential.subject.id.equals(this._spaceKey)) {
           log3.warn("Space genesis credential must be issued to space.", void 0, {
             F: __dxlog_file6,
-            L: 170,
+            L: 173,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1568,7 +1593,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file6,
-            L: 183,
+            L: 186,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1577,7 +1602,7 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file6,
-            L: 187,
+            L: 190,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1591,7 +1616,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file6,
-            L: 198,
+            L: 201,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1604,19 +1629,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
             F: __dxlog_file6,
-            L: 208,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        if (!this._canAdmitFeeds(credential.issuer)) {
-          log3.warn(`Space member is not authorized to admit feeds: ${credential.issuer}`, {
-            sourceFeed: sourceFeed.toHex(),
-            feed: credential.subject.id.toHex()
-          }, {
-            F: __dxlog_file6,
-            L: 212,
+            L: 211,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1630,7 +1643,7 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file6,
-            L: 226,
+            L: 222,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1655,9 +1668,6 @@ var SpaceStateMachine = class {
       }
     }
     await this.onCredentialProcessed.callIfSet(credential);
-    if (credential.id) {
-      this._processedCredentials.add(credential.id);
-    }
     return true;
   }
   getMemberRole(memberKey) {
@@ -1669,11 +1679,10 @@ var SpaceStateMachine = class {
   _canInviteNewMembers(key) {
     return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
   }
-  _canAdmitFeeds(key) {
-    const role = this._members.getRole(key);
-    return role === SpaceMember3.Role.EDITOR || role === SpaceMember3.Role.ADMIN || role === SpaceMember3.Role.OWNER;
-  }
 };
+_ts_decorate([
+  synchronized
+], SpaceStateMachine.prototype, "process", null);
 var CredentialConsumer = class {
   constructor(processor, _onOpen, _onClose) {
     this.processor = processor;
@@ -1681,7 +1690,7 @@ var CredentialConsumer = class {
     this._onClose = _onClose;
     this._ctx = new Context(void 0, {
       F: __dxlog_file6,
-      L: 280
+      L: 267
     });
     this._isReadyForLiveCredentials = false;
   }
@@ -1708,14 +1717,14 @@ var CredentialConsumer = class {
 // packages/core/halo/credentials/src/processor/device-state-machine.ts
 import { Trigger } from "@dxos/async";
 import { invariant as invariant6 } from "@dxos/invariant";
-import { PublicKey as PublicKey8 } from "@dxos/keys";
+import { PublicKey as PublicKey9 } from "@dxos/keys";
 import { log as log4 } from "@dxos/log";
-import { ComplexMap as ComplexMap6 } from "@dxos/util";
+import { ComplexMap as ComplexMap7 } from "@dxos/util";
 var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
 var DeviceStateMachine = class {
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new ComplexMap6(PublicKey8.hash);
+    this.authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
     this.deviceChainReady = new Trigger();
   }
   async processCredential(credential) {
@@ -1738,23 +1747,14 @@ var DeviceStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.AuthorizedDevice": {
-        invariant6(!this.authorizedDeviceKeys.has(assertion.deviceKey), "Device already added.", {
-          F: __dxlog_file7,
-          L: 51,
-          S: this,
-          A: [
-            "!this.authorizedDeviceKeys.has(assertion.deviceKey)",
-            "'Device already added.'"
-          ]
-        });
-        this.authorizedDeviceKeys.set(assertion.deviceKey, {});
+        this.authorizedDeviceKeys.set(assertion.deviceKey, this.authorizedDeviceKeys.get(assertion.deviceKey) ?? {});
         log4("added device", {
           localDeviceKey: this._params.deviceKey,
           deviceKey: assertion.deviceKey,
           size: this.authorizedDeviceKeys.size
         }, {
           F: __dxlog_file7,
-          L: 54,
+          L: 55,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1764,7 +1764,7 @@ var DeviceStateMachine = class {
       case "dxos.halo.credentials.DeviceProfile": {
         invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
           F: __dxlog_file7,
-          L: 64,
+          L: 65,
           S: this,
           A: [
             "this.authorizedDeviceKeys.has(credential.subject.id)",
@@ -1777,7 +1777,7 @@ var DeviceStateMachine = class {
             profile: assertion.profile
           }, {
             F: __dxlog_file7,
-            L: 67,
+            L: 68,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1848,6 +1848,7 @@ export {
   createCredentialSignerWithKey,
   createDelegatedSpaceInvitationCredential,
   createDeviceAuthorization,
+  createDidFromIdentityKey,
   credentialTypeFilter,
   defaultSecretProvider,
   defaultSecretValidator,