@dxos/credentials 0.8.3 → 0.8.4-main.03d5cd7b56

package/docs/README.md

@@ -84,20 +84,20 @@ dxos/mesh-protocol --> dxos/codec-protobuf
 
 ## Dependencies
 
-| Module | Direct |
-|---|---|
-| [`@dxos/async`](../../../../common/async/docs/README.md) | ✓ |
-| [`@dxos/codec-protobuf`](../../../../common/codec-protobuf/docs/README.md) | ✓ |
-| [`@dxos/context`](../../../../common/context/docs/README.md) |  |
-| [`@dxos/crypto`](../../../../common/crypto/docs/README.md) | ✓ |
-| [`@dxos/debug`](../../../../common/debug/docs/README.md) | ✓ |
-| [`@dxos/feed-store`](../../../../common/feed-store/docs/README.md) | ✓ |
-| [`@dxos/hypercore`](../../../../common/hypercore/docs/README.md) |  |
-| [`@dxos/keyring`](../../keyring/docs/README.md) | ✓ |
-| [`@dxos/keys`](../../../../common/keys/docs/README.md) | ✓ |
-| [`@dxos/log`](../../../../common/log/docs/README.md) | ✓ |
-| [`@dxos/mesh-protocol`](../../../mesh/mesh-protocol/docs/README.md) | ✓ |
-| [`@dxos/protocols`](../../../protocols/docs/README.md) | ✓ |
-| [`@dxos/random-access-storage`](../../../../common/random-access-storage/docs/README.md) |  |
-| [`@dxos/timeframe`](../../../../common/timeframe/docs/README.md) |  |
-| [`@dxos/util`](../../../../common/util/docs/README.md) | ✓ |
+| Module                                                                                   | Direct  |
+| ---------------------------------------------------------------------------------------- | ------- |
+| [`@dxos/async`](../../../../common/async/docs/README.md)                                 | ✓ |
+| [`@dxos/codec-protobuf`](../../../../common/codec-protobuf/docs/README.md)               | ✓ |
+| [`@dxos/context`](../../../../common/context/docs/README.md)                             |         |
+| [`@dxos/crypto`](../../../../common/crypto/docs/README.md)                               | ✓ |
+| [`@dxos/debug`](../../../../common/debug/docs/README.md)                                 | ✓ |
+| [`@dxos/feed-store`](../../../../common/feed-store/docs/README.md)                       | ✓ |
+| [`@dxos/hypercore`](../../../../common/hypercore/docs/README.md)                         |         |
+| [`@dxos/keyring`](../../keyring/docs/README.md)                                          | ✓ |
+| [`@dxos/keys`](../../../../common/keys/docs/README.md)                                   | ✓ |
+| [`@dxos/log`](../../../../common/log/docs/README.md)                                     | ✓ |
+| [`@dxos/mesh-protocol`](../../../mesh/mesh-protocol/docs/README.md)                      | ✓ |
+| [`@dxos/protocols`](../../../protocols/docs/README.md)                                   | ✓ |
+| [`@dxos/random-access-storage`](../../../../common/random-access-storage/docs/README.md) |         |
+| [`@dxos/timeframe`](../../../../common/timeframe/docs/README.md)                         |         |
+| [`@dxos/util`](../../../../common/util/docs/README.md)                                   | ✓ |

package/moon.yml

@@ -0,0 +1,12 @@
+layer: library
+language: typescript
+tags:
+  - ts-build
+  - ts-test
+  - pack
+tasks:
+  compile:
+    args:
+      - '--entryPoint=src/index.ts'
+      - '--injectGlobals'
+      - '--platform=neutral'

package/package.json

@@ -1,42 +1,39 @@
 {
   "name": "@dxos/credentials",
-  "version": "0.8.3",
+  "version": "0.8.4-main.03d5cd7b56",
   "description": "DXOS Credentials",
   "homepage": "https://github.com/dxos/dxos/tree/main/packages/core/halo/credentials#readme",
   "bugs": "https://github.com/dxos/dxos/issues",
-  "repository": "github:dxos/dxos",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dxos/dxos"
+  },
   "license": "MIT",
   "author": "info@dxos.org",
-  "sideEffects": true,
+  "sideEffects": false,
   "type": "module",
   "exports": {
     ".": {
+      "source": "./src/index.ts",
       "types": "./dist/types/src/index.d.ts",
-      "browser": "./dist/lib/browser/index.mjs",
-      "node": "./dist/lib/node-esm/index.mjs"
+      "default": "./dist/lib/neutral/index.mjs"
     }
   },
   "types": "dist/types/src/index.d.ts",
-  "typesVersions": {
-    "*": {}
-  },
   "dependencies": {
     "bip39": "^3.1.0",
-    "json-stable-stringify": "^1.0.1",
-    "@dxos/async": "0.8.3",
-    "@dxos/context": "0.8.3",
-    "@dxos/invariant": "0.8.3",
-    "@dxos/crypto": "0.8.3",
-    "@dxos/keys": "0.8.3",
-    "@dxos/keyring": "0.8.3",
-    "@dxos/log": "0.8.3",
-    "@dxos/node-std": "0.8.3",
-    "@dxos/protocols": "0.8.3",
-    "@dxos/timeframe": "0.8.3",
-    "@dxos/util": "0.8.3"
-  },
-  "devDependencies": {
-    "@types/json-stable-stringify": "^1.0.32"
+    "json-stable-stringify": "^1.3.0",
+    "@dxos/async": "0.8.4-main.03d5cd7b56",
+    "@dxos/crypto": "0.8.4-main.03d5cd7b56",
+    "@dxos/context": "0.8.4-main.03d5cd7b56",
+    "@dxos/keyring": "0.8.4-main.03d5cd7b56",
+    "@dxos/log": "0.8.4-main.03d5cd7b56",
+    "@dxos/node-std": "0.8.4-main.03d5cd7b56",
+    "@dxos/invariant": "0.8.4-main.03d5cd7b56",
+    "@dxos/keys": "0.8.4-main.03d5cd7b56",
+    "@dxos/protocols": "0.8.4-main.03d5cd7b56",
+    "@dxos/util": "0.8.4-main.03d5cd7b56",
+    "@dxos/timeframe": "0.8.4-main.03d5cd7b56"
   },
   "publishConfig": {
     "access": "public"

package/src/credentials/assertions.ts

@@ -3,7 +3,7 @@
 //
 
 import { type PublicKey } from '@dxos/keys';
-import { type TypedMessage, type TYPES } from '@dxos/protocols/proto';
+import { type TYPES, type TypedMessage } from '@dxos/protocols/proto';
 import { type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
 
 export const getCredentialAssertion = (credential: Credential): TypedMessage => credential.subject.assertion;

package/src/credentials/credential-factory.ts

@@ -11,14 +11,14 @@ import { type Chain, type Credential } from '@dxos/protocols/proto/dxos/halo/cre
 import { getCredentialProofPayload } from './signing';
 import { SIGNATURE_TYPE_ED25519, verifyChain } from './verifier';
 
-export type CreateCredentialSignerParams = {
+export type CreateCredentialSignerProps = {
   subject: PublicKey;
   assertion: TypedMessage;
   nonce?: Uint8Array;
   parentCredentialIds?: PublicKey[];
 };
 
-export type CreateCredentialParams = {
+export type CreateCredentialProps = {
   signer: Signer;
   issuer: PublicKey;
   signingKey?: PublicKey;
@@ -44,7 +44,7 @@ export const createCredential = async ({
   chain,
   nonce,
   parentCredentialIds,
-}: CreateCredentialParams): Promise<Credential> => {
+}: CreateCredentialProps): Promise<Credential> => {
   invariant(assertion['@type'], 'Invalid assertion.');
   invariant(!!signingKey === !!chain, 'Chain must be provided if and only if the signing key differs from the issuer.');
   if (chain) {
@@ -77,7 +77,7 @@ export const createCredential = async ({
     credential.proof!.chain = chain;
   }
 
-  credential.id = PublicKey.from(await subtleCrypto.digest('SHA-256', signedPayload));
+  credential.id = PublicKey.from(await subtleCrypto.digest('SHA-256', signedPayload as Uint8Array<ArrayBuffer>));
 
   return credential;
 };
@@ -93,7 +93,7 @@ export const createCredentialMessage = (credential: Credential) => {
 // TODO(burdon): Vs. Signer.
 export interface CredentialSigner {
   getIssuer(): PublicKey;
-  createCredential: (params: CreateCredentialSignerParams) => Promise<Credential>;
+  createCredential: (params: CreateCredentialSignerProps) => Promise<Credential>;
 }
 
 /**

package/src/credentials/credential-generator.ts

@@ -10,13 +10,14 @@ import {
   AdmittedFeed,
   type Credential,
   type DeviceProfileDocument,
+  MembershipPolicy,
   type ProfileDocument,
   SpaceMember,
 } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { Timeframe } from '@dxos/timeframe';
 
-import { createCredential, type CredentialSigner } from './credential-factory';
+import { type CredentialSigner, createCredential } from './credential-factory';
 
 // TODO(burdon): Normalize generate and functions below.
 //  Use throughout stack and in tests.
@@ -38,6 +39,7 @@ export class CredentialGenerator {
     spaceKey: PublicKey,
     controlKey: PublicKey,
     creatorProfile?: ProfileDocument,
+    membershipPolicy: MembershipPolicy = MembershipPolicy.INVITE,
   ): Promise<Credential[]> {
     return [
       await createCredential({
@@ -47,6 +49,7 @@ export class CredentialGenerator {
         assertion: {
           '@type': 'dxos.halo.credentials.SpaceGenesis',
           spaceKey,
+          membershipPolicy,
         },
       }),
 
@@ -221,6 +224,7 @@ export const createAdmissionCredentials = async (
   membershipChainHeads: PublicKey[] = [],
   profile?: ProfileDocument,
   invitationCredentialId?: PublicKey,
+  tags?: string[],
 ): Promise<FeedMessage.Payload[]> => {
   const credentials = await Promise.all([
     await signer.createCredential({
@@ -233,6 +237,7 @@ export const createAdmissionCredentials = async (
         profile,
         genesisFeedKey,
         invitationCredentialId,
+        tags: tags ?? [],
       },
     }),
   ]);

package/src/credentials/signing.ts

@@ -27,6 +27,18 @@ export const getCredentialProofPayload = (credential: Credential): Uint8Array =>
   }
   delete copy.id; // ID is not part of the signature payload.
 
+  // Normalize empty repeated fields in the assertion to avoid proto3 serialization asymmetry.
+  // Proto3 does not encode empty repeated fields, but the codec may restore them as [] after deserialization,
+  // causing a signature mismatch if the original signing payload did not include the field.
+  const assertion = (copy.subject as any)?.assertion;
+  if (assertion) {
+    for (const key of Object.keys(assertion)) {
+      if (Array.isArray(assertion[key]) && assertion[key].length === 0) {
+        delete assertion[key];
+      }
+    }
+  }
+
   return Buffer.from(canonicalStringify(copy));
 };
 

package/src/did.ts

@@ -3,7 +3,7 @@
 //
 
 import { subtleCrypto } from '@dxos/crypto';
-import { PublicKey, IdentityDid } from '@dxos/keys';
+import { IdentityDid, PublicKey } from '@dxos/keys';
 import { ComplexMap } from '@dxos/util';
 
 const IDENTITY_DIDS_CACHE = new ComplexMap<PublicKey, IdentityDid>(PublicKey.hash);
@@ -18,7 +18,7 @@ export const createDidFromIdentityKey = async (identityKey: PublicKey): Promise<
     return cachedValue;
   }
 
-  const digest = await subtleCrypto.digest('SHA-256', identityKey.asUint8Array());
+  const digest = await subtleCrypto.digest('SHA-256', identityKey.asUint8Array() as Uint8Array<ArrayBuffer>);
 
   const bytes = new Uint8Array(digest).slice(0, IdentityDid.byteLength);
   const identityDid = IdentityDid.encode(bytes);

package/src/presentations/json-encoding.test.ts

@@ -11,8 +11,8 @@ import { buf } from '@dxos/protocols/buf';
 import { PresentationSchema } from '@dxos/protocols/buf/dxos/halo/credentials_pb';
 import { schema } from '@dxos/protocols/proto';
 
-import { signPresentation } from './presentation';
 import { createCredential } from '../credentials';
+import { signPresentation } from './presentation';
 
 describe('json encoding', () => {
   test.skip('service access exercise by a device', async () => {

package/src/presentations/presentation.ts

@@ -6,8 +6,8 @@ import { type Signer } from '@dxos/crypto';
 import { type PublicKey } from '@dxos/keys';
 import { type Chain, type Presentation, type Proof } from '@dxos/protocols/proto/dxos/halo/credentials';
 
-import { getPresentationProofPayload } from './signing';
 import { SIGNATURE_TYPE_ED25519 } from '../credentials';
+import { getPresentationProofPayload } from './signing';
 
 // TODO(burdon): Rename createPresentation?
 export const signPresentation = async ({

package/src/presentations/verifier.test.ts

@@ -9,9 +9,9 @@ import { Keyring } from '@dxos/keyring';
 import { PublicKey } from '@dxos/keys';
 import { type Chain, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 
+import { createCredential } from '../credentials';
 import { signPresentation } from './presentation';
 import { verifyPresentation, verifyPresentationSignature } from './verifier';
-import { createCredential } from '../credentials';
 
 describe('presentation verifier', () => {
   describe('chain', () => {

package/src/presentations/verifier.ts

@@ -5,8 +5,8 @@
 import { verifySignature } from '@dxos/crypto';
 import { type Presentation, type Proof } from '@dxos/protocols/proto/dxos/halo/credentials';
 
-import { getPresentationProofPayload } from './signing';
 import { SIGNATURE_TYPE_ED25519, type VerificationResult, verifyChain, verifyCredential } from '../credentials';
+import { getPresentationProofPayload } from './signing';
 
 export const verifyPresentation = async (presentation: Presentation): Promise<VerificationResult> => {
   const errors: string[] = [];

package/src/processor/device-state-machine.ts

@@ -9,10 +9,10 @@ import { log } from '@dxos/log';
 import { type Chain, type Credential, type DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { ComplexMap } from '@dxos/util';
 
-import { type CredentialProcessor } from './credential-processor';
 import { getCredentialAssertion, isValidAuthorizedDeviceCredential } from '../credentials';
+import { type CredentialProcessor } from './credential-processor';
 
-export type DeviceStateMachineParams = {
+export type DeviceStateMachineProps = {
   identityKey: PublicKey;
   deviceKey: PublicKey;
   onUpdate?: () => void;
@@ -29,7 +29,7 @@ export class DeviceStateMachine implements CredentialProcessor {
 
   public deviceCredentialChain?: Chain;
 
-  constructor(private readonly _params: DeviceStateMachineParams) {}
+  constructor(private readonly _params: DeviceStateMachineProps) {}
 
   async processCredential(credential: Credential): Promise<void> {
     log('processing credential...', {

package/src/processor/index.ts

@@ -2,6 +2,6 @@
 // Copyright 2023 DXOS.org
 //
 
-export * from './credential-processor';
+export type * from './credential-processor';
 export * from './device-state-machine';
 export * from './profile-state-machine';

package/src/processor/profile-state-machine.ts

@@ -6,10 +6,10 @@ import { type PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { type Credential, type ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 
-import { type CredentialProcessor } from './credential-processor';
 import { getCredentialAssertion } from '../credentials';
+import { type CredentialProcessor } from './credential-processor';
 
-export type ProfileStateMachineParams = {
+export type ProfileStateMachineProps = {
   identityKey: PublicKey;
   onUpdate?: () => void;
 };
@@ -21,7 +21,7 @@ export class ProfileStateMachine implements CredentialProcessor {
   // TODO(burdon): Return values via getter.
   public profile?: ProfileDocument;
 
-  constructor(private readonly _params: ProfileStateMachineParams) {}
+  constructor(private readonly _params: ProfileStateMachineProps) {}
 
   async processCredential(credential: Credential): Promise<void> {
     const assertion = getCredentialAssertion(credential);

package/src/state-machine/invitation-state-machine.test.ts

@@ -7,16 +7,16 @@ import { beforeEach, describe, expect, test } from 'vitest';
 import { Keyring } from '@dxos/keyring';
 import { PublicKey } from '@dxos/keys';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
-import { SpaceMember, type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
+import { type Credential, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { range } from '@dxos/util';
 
-import { InvitationStateMachine } from './invitation-state-machine';
 import {
   createCredential,
   createCredentialSignerWithKey,
   createDelegatedSpaceInvitationCredential,
 } from '../credentials';
+import { InvitationStateMachine } from './invitation-state-machine';
 
 describe('InvitationStateMachine', () => {
   const keyring = new Keyring();

package/src/state-machine/member-state-machine.test.ts

@@ -9,8 +9,8 @@ import { PublicKey } from '@dxos/keys';
 import { SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { range } from '@dxos/util';
 
-import { MemberStateMachine } from './member-state-machine';
 import { createAdmissionCredentials, createCredentialSignerWithKey } from '../credentials';
+import { MemberStateMachine } from './member-state-machine';
 
 const keyring = new Keyring();
 

package/src/state-machine/member-state-machine.ts

@@ -5,7 +5,7 @@
 import { invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
-import { type Credential, SpaceMember, type ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
+import { type Credential, type ProfileDocument, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { ComplexMap } from '@dxos/util';
 
 import { getCredentialAssertion } from '../credentials';