@dxos/credentials 0.8.3 → 0.8.4-main.1c7ec43d41

package/dist/lib/{browser → neutral}/index.mjs

@@ -1,8 +1,8 @@
 import "@dxos/node-std/globals";
 
-// packages/core/halo/credentials/src/did.ts
+// src/did.ts
 import { subtleCrypto } from "@dxos/crypto";
-import { PublicKey, IdentityDid } from "@dxos/keys";
+import { IdentityDid, PublicKey } from "@dxos/keys";
 import { ComplexMap } from "@dxos/util";
 var IDENTITY_DIDS_CACHE = new ComplexMap(PublicKey.hash);
 var createDidFromIdentityKey = async (identityKey) => {
@@ -17,31 +17,23 @@ var createDidFromIdentityKey = async (identityKey) => {
   return identityDid;
 };
 
-// packages/core/halo/credentials/src/invitations.ts
+// src/invitations.ts
 var defaultSecretProvider = async () => Buffer.from("0000");
 var defaultSecretValidator = async (invitation, secret) => true;
 
-// packages/core/halo/credentials/src/seedphrase.ts
+// src/seedphrase.ts
 import { generateMnemonic, mnemonicToSeedSync } from "bip39";
 import { createKeyPair } from "@dxos/crypto";
 import { invariant } from "@dxos/invariant";
-var __dxlog_file = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/seedphrase.ts";
+var __dxlog_file = "/__w/dxos/dxos/packages/core/halo/credentials/src/seedphrase.ts";
 var generateSeedPhrase = () => generateMnemonic();
 var keyPairFromSeedPhrase = (seedPhrase) => {
-  invariant(seedPhrase, void 0, {
-    F: __dxlog_file,
-    L: 20,
-    S: void 0,
-    A: [
-      "seedPhrase",
-      ""
-    ]
-  });
+  invariant(seedPhrase, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file, L: 13, S: void 0, A: ["seedPhrase", ""] });
   const seed = mnemonicToSeedSync(seedPhrase);
   return createKeyPair(seed);
 };
 
-// packages/core/halo/credentials/src/passcode.ts
+// src/passcode.ts
 var generatePasscode = (length = 4) => {
   let passcode = "";
   for (let i = 0; i < length; i++) {
@@ -50,7 +42,7 @@ var generatePasscode = (length = 4) => {
   return passcode;
 };
 
-// packages/core/halo/credentials/src/credentials/signing.ts
+// src/credentials/signing.ts
 import stableStringify from "json-stable-stringify";
 import { PublicKey as PublicKey2 } from "@dxos/keys";
 import { Timeframe } from "@dxos/timeframe";
@@ -68,6 +60,14 @@ var getCredentialProofPayload = (credential) => {
     delete copy.parentCredentialIds;
   }
   delete copy.id;
+  const assertion = copy.subject?.assertion;
+  if (assertion) {
+    for (const key of Object.keys(assertion)) {
+      if (Array.isArray(assertion[key]) && assertion[key].length === 0) {
+        delete assertion[key];
+      }
+    }
+  }
   return Buffer.from(canonicalStringify(copy));
 };
 var canonicalStringify = (obj) => stableStringify(obj, {
@@ -114,7 +114,7 @@ var truncateKey = (key) => {
   return `${str.substring(0, 4)}...${str.substring(str.length - 4)}`;
 };
 
-// packages/core/halo/credentials/src/presentations/signing.ts
+// src/presentations/signing.ts
 var getPresentationProofPayload = (credentials, proof) => {
   const copy = {
     credentials: credentials.map((credential) => removeEmptyParentCredentialIds(credential)),
@@ -142,7 +142,7 @@ var removeEmptyParentCredentialIds = (credential) => {
   return copy;
 };
 
-// packages/core/halo/credentials/src/credentials/assertions.ts
+// src/credentials/assertions.ts
 var getCredentialAssertion = (credential) => credential.subject.assertion;
 var isValidAuthorizedDeviceCredential = (credential, identityKey, deviceKey) => {
   const assertion = getCredentialAssertion(credential);
@@ -151,12 +151,12 @@ var isValidAuthorizedDeviceCredential = (credential, identityKey, deviceKey) =>
 var checkCredentialType = (credential, type) => credential.subject.assertion["@type"] === type;
 var credentialTypeFilter = (type) => (credential) => checkCredentialType(credential, type);
 
-// packages/core/halo/credentials/src/credentials/credential-factory.ts
+// src/credentials/credential-factory.ts
 import { subtleCrypto as subtleCrypto2 } from "@dxos/crypto";
 import { invariant as invariant2 } from "@dxos/invariant";
 import { PublicKey as PublicKey3 } from "@dxos/keys";
 
-// packages/core/halo/credentials/src/credentials/verifier.ts
+// src/credentials/verifier.ts
 import { verifySignature } from "@dxos/crypto";
 var SIGNATURE_TYPE_ED25519 = "ED25519Signature";
 var verifyCredential = async (credential) => {
@@ -225,38 +225,14 @@ var verifyChain = async (chain, authority, subject) => {
   };
 };
 
-// packages/core/halo/credentials/src/credentials/credential-factory.ts
-var __dxlog_file2 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
+// src/credentials/credential-factory.ts
+var __dxlog_file2 = "/__w/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
 var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
-  invariant2(assertion["@type"], "Invalid assertion.", {
-    F: __dxlog_file2,
-    L: 48,
-    S: void 0,
-    A: [
-      "assertion['@type']",
-      "'Invalid assertion.'"
-    ]
-  });
-  invariant2(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
-    F: __dxlog_file2,
-    L: 49,
-    S: void 0,
-    A: [
-      "!!signingKey === !!chain",
-      "'Chain must be provided if and only if the signing key differs from the issuer.'"
-    ]
-  });
+  invariant2(assertion["@type"], "Invalid assertion.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 12, S: void 0, A: ["assertion['@type']", "'Invalid assertion.'"] });
+  invariant2(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 13, S: void 0, A: ["!!signingKey === !!chain", "'Chain must be provided if and only if the signing key differs from the issuer.'"] });
   if (chain) {
     const result = await verifyChain(chain, issuer, signingKey);
-    invariant2(result.kind === "pass", "Invalid chain.", {
-      F: __dxlog_file2,
-      L: 52,
-      S: void 0,
-      A: [
-        "result.kind === 'pass'",
-        "'Invalid chain.'"
-      ]
-    });
+    invariant2(result.kind === "pass", "Invalid chain.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 16, S: void 0, A: ["result.kind === 'pass'", "'Invalid chain.'"] });
   }
   const credential = {
     issuer,
@@ -313,10 +289,13 @@ var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
   })
 });
 
-// packages/core/halo/credentials/src/credentials/credential-generator.ts
-import { AdmittedFeed, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+// src/credentials/credential-generator.ts
+import { AdmittedFeed, MembershipPolicy, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe2 } from "@dxos/timeframe";
 var CredentialGenerator = class {
+  _signer;
+  _identityKey;
+  _deviceKey;
   constructor(_signer, _identityKey, _deviceKey) {
     this._signer = _signer;
     this._identityKey = _identityKey;
@@ -325,7 +304,7 @@ var CredentialGenerator = class {
   /**
   * Create genesis messages for new Space.
   */
-  async createSpaceGenesis(spaceKey, controlKey, creatorProfile) {
+  async createSpaceGenesis(spaceKey, controlKey, creatorProfile, membershipPolicy = MembershipPolicy.INVITE) {
     return [
       await createCredential({
         signer: this._signer,
@@ -333,7 +312,8 @@ var CredentialGenerator = class {
         subject: spaceKey,
         assertion: {
           "@type": "dxos.halo.credentials.SpaceGenesis",
-          spaceKey
+          spaceKey,
+          membershipPolicy
         }
       }),
       await createCredential({
@@ -460,7 +440,7 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId, tags) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
@@ -471,7 +451,8 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
         role,
         profile,
         genesisFeedKey,
-        invitationCredentialId
+        invitationCredentialId,
+        tags: tags ?? []
       }
     })
   ]);
@@ -516,7 +497,7 @@ var createCancelDelegatedSpaceInvitationCredential = async (signer, subject, inv
   };
 };
 
-// packages/core/halo/credentials/src/presentations/presentation.ts
+// src/presentations/presentation.ts
 var signPresentation = async ({ presentation, signer, signerKey, chain, nonce }) => {
   const proof = {
     type: SIGNATURE_TYPE_ED25519,
@@ -539,7 +520,7 @@ var signPresentation = async ({ presentation, signer, signerKey, chain, nonce })
   };
 };
 
-// packages/core/halo/credentials/src/presentations/verifier.ts
+// src/presentations/verifier.ts
 import { verifySignature as verifySignature2 } from "@dxos/crypto";
 var verifyPresentation = async (presentation) => {
   const errors = [];
@@ -623,24 +604,25 @@ var verifyPresentationSignature = async (presentation, proof) => {
   };
 };
 
-// packages/core/halo/credentials/src/state-machine/space-state-machine.ts
+// src/state-machine/space-state-machine.ts
 import { runInContextAsync, synchronized } from "@dxos/async";
 import { Context } from "@dxos/context";
 import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log3 } from "@dxos/log";
-import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { MembershipPolicy as MembershipPolicy2, SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Callback as Callback4, ComplexMap as ComplexMap6, ComplexSet as ComplexSet3 } from "@dxos/util";
 
-// packages/core/halo/credentials/src/state-machine/feed-state-machine.ts
+// src/state-machine/feed-state-machine.ts
 import { invariant as invariant3 } from "@dxos/invariant";
 import { PublicKey as PublicKey4 } from "@dxos/keys";
 import { Callback, ComplexMap as ComplexMap2 } from "@dxos/util";
-var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
+var __dxlog_file3 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
 var FeedStateMachine = class {
+  _spaceKey;
+  _feeds = new ComplexMap2(PublicKey4.hash);
+  onFeedAdmitted = new Callback();
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._feeds = new ComplexMap2(PublicKey4.hash);
-    this.onFeedAdmitted = new Callback();
   }
   get feeds() {
     return this._feeds;
@@ -653,24 +635,8 @@ var FeedStateMachine = class {
   */
   async process(credential, fromFeed) {
     const assertion = getCredentialAssertion(credential);
-    invariant3(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, {
-      F: __dxlog_file3,
-      L: 47,
-      S: this,
-      A: [
-        "assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'",
-        ""
-      ]
-    });
-    invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, {
-      F: __dxlog_file3,
-      L: 48,
-      S: this,
-      A: [
-        "assertion.spaceKey.equals(this._spaceKey)",
-        ""
-      ]
-    });
+    invariant3(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 28, S: this, A: ["assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'", ""] });
+    invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 29, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
     const info = {
       key: credential.subject.id,
       credential,
@@ -682,17 +648,15 @@ var FeedStateMachine = class {
   }
 };
 
-// packages/core/halo/credentials/src/state-machine/invitation-state-machine.ts
+// src/state-machine/invitation-state-machine.ts
 import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { Callback as Callback2, ComplexMap as ComplexMap3, ComplexSet } from "@dxos/util";
 var InvitationStateMachine = class {
-  constructor() {
-    this._invitations = new ComplexMap3(PublicKey5.hash);
-    this._redeemedInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
-    this._cancelledInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
-    this.onDelegatedInvitation = new Callback2();
-    this.onDelegatedInvitationRemoved = new Callback2();
-  }
+  _invitations = new ComplexMap3(PublicKey5.hash);
+  _redeemedInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
+  _cancelledInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
+  onDelegatedInvitation = new Callback2();
+  onDelegatedInvitationRemoved = new Callback2();
   get invitations() {
     return this._invitations;
   }
@@ -752,37 +716,54 @@ var InvitationStateMachine = class {
   }
 };
 
-// packages/core/halo/credentials/src/state-machine/member-state-machine.ts
+// src/state-machine/member-state-machine.ts
 import { invariant as invariant5 } from "@dxos/invariant";
 import { PublicKey as PublicKey7 } from "@dxos/keys";
 import { log as log2 } from "@dxos/log";
 import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { ComplexMap as ComplexMap5 } from "@dxos/util";
 
-// packages/core/halo/credentials/src/graph/credential-graph.ts
+// src/graph/credential-graph.ts
 import { invariant as invariant4 } from "@dxos/invariant";
 import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { log } from "@dxos/log";
 import { Callback as Callback3, ComplexMap as ComplexMap4, ComplexSet as ComplexSet2 } from "@dxos/util";
-var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
+var __dxlog_file4 = "/__w/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
 var CredentialGraph = class {
+  _stateHandler;
+  /**
+  * Local ids are used during traversals.
+  */
+  _vertexIdGenerator = 1;
+  /**
+  * All credentials without parent references are connected to the root.
+  */
+  _root = {
+    id: -1,
+    parents: [],
+    children: []
+  };
+  /**
+  * A credential which is not a parent of any other credential has the sentinel as a child.
+  * Sentinel is a virtual merge-point of all credentials.
+  */
+  _sentinel = {
+    id: -2,
+    parents: [],
+    children: []
+  };
+  /**
+  * Vertex references are used for fast credential inserts into the graph.
+  */
+  _vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
+  /**
+  * The current state of the graph.
+  */
+  _subjectToVertex = new ComplexMap4(PublicKey6.hash);
+  _subjectToState = new ComplexMap4(PublicKey6.hash);
+  onSubjectStateChanged = new Callback3();
   constructor(_stateHandler) {
     this._stateHandler = _stateHandler;
-    this._vertexIdGenerator = 1;
-    this._root = {
-      id: -1,
-      parents: [],
-      children: []
-    };
-    this._sentinel = {
-      id: -2,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
-    this._subjectToVertex = new ComplexMap4(PublicKey6.hash);
-    this._subjectToState = new ComplexMap4(PublicKey6.hash);
-    this.onSubjectStateChanged = new Callback3();
   }
   getSubjectState(subjectId) {
     return this._subjectToState.get(subjectId);
@@ -818,12 +799,7 @@ var CredentialGraph = class {
           log.error("credential skipped because of the unknown parent", {
             credential,
             parentId
-          }, {
-            F: __dxlog_file4,
-            L: 72,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 70, S: this });
           continue;
         }
         parentVertex.children.push(newVertex);
@@ -840,29 +816,13 @@ var CredentialGraph = class {
     if (sentinelIdx >= 0) {
       vertex.children.splice(sentinelIdx, 1);
       const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
-      invariant4(vertexInSentinelIdx >= 0, void 0, {
-        F: __dxlog_file4,
-        L: 90,
-        S: this,
-        A: [
-          "vertexInSentinelIdx >= 0",
-          ""
-        ]
-      });
+      invariant4(vertexInSentinelIdx >= 0, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 90, S: this, A: ["vertexInSentinelIdx >= 0", ""] });
       this._sentinel.parents.splice(vertexInSentinelIdx, 1);
     }
   }
   async _onVertexInserted(newVertex) {
     const { credential, assertion } = newVertex;
-    invariant4(credential, void 0, {
-      F: __dxlog_file4,
-      L: 97,
-      S: this,
-      A: [
-        "credential",
-        ""
-      ]
-    });
+    invariant4(credential, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 96, S: this, A: ["credential", ""] });
     let changedSubjects = [];
     const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
     if (isUpdateAppliedOnTopOfThePreviousState) {
@@ -899,21 +859,11 @@ var CredentialGraph = class {
       const path = paths.pop();
       log("visit vertex", {
         id: path.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 132,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 131, S: this });
       this._updatePathState(path);
       const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
       if (convergedPaths == null) {
-        log("waiting for other paths", void 0, {
-          F: __dxlog_file4,
-          L: 136,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        log("waiting for other paths", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 137, S: this });
         continue;
       }
       const mergeResult = this._mergePaths(convergedPaths);
@@ -937,12 +887,7 @@ var CredentialGraph = class {
           path: toChosenPath(p),
           head: p.head.id
         }))
-      }, {
-        F: __dxlog_file4,
-        L: 155,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 156, S: this });
     }
     return this._setCurrentState(lastPath);
   }
@@ -963,12 +908,7 @@ var CredentialGraph = class {
         path: toChosenPath(path),
         overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
       }))
-    }), {
-      F: __dxlog_file4,
-      L: 175,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 175, S: this });
     const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
     pendingPaths.set(convergedPaths[0].head.id, clearedPending);
   }
@@ -980,12 +920,7 @@ var CredentialGraph = class {
       return null;
     }
     if (path.head.id === this._sentinel.id && paths.length > 0) {
-      log("waiting for all the active paths to converge on the sentinel", void 0, {
-        F: __dxlog_file4,
-        L: 199,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      log("waiting for all the active paths to converge on the sentinel", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 194, S: this });
       return null;
     }
     pendingPaths.delete(path.head.id);
@@ -1010,12 +945,7 @@ var CredentialGraph = class {
       log("path state updated", () => ({
         subject: updatedSubject,
         newState: this._stateHandler.toLogString(path.head.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 223,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 217, S: this });
     }
   }
   _forkTraversal(paths, path) {
@@ -1025,12 +955,7 @@ var CredentialGraph = class {
       log("edge traversal", {
         from: path.head.id,
         to: choice.id
-      }, {
-        F: __dxlog_file4,
-        L: 234,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 227, S: this });
       const fork = {
         forkPoint: path,
         chosenPath: {
@@ -1123,15 +1048,7 @@ var CredentialGraph = class {
     return path;
   }
   _mergePaths(convergedPaths) {
-    invariant4(convergedPaths.length >= 1, void 0, {
-      F: __dxlog_file4,
-      L: 324,
-      S: this,
-      A: [
-        "convergedPaths.length >= 1",
-        ""
-      ]
-    });
+    invariant4(convergedPaths.length >= 1, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 320, S: this, A: ["convergedPaths.length >= 1", ""] });
     if (convergedPaths.length === 1) {
       return {
         type: "merged",
@@ -1143,22 +1060,9 @@ var CredentialGraph = class {
       forkPointId: forkPoint.head.id,
       pathCount: convergedPaths.length,
       forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
-    }), {
-      F: __dxlog_file4,
-      L: 329,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 328, S: this });
     const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
-    invariant4(forkPoint, void 0, {
-      F: __dxlog_file4,
-      L: 335,
-      S: this,
-      A: [
-        "forkPoint",
-        ""
-      ]
-    });
+    invariant4(forkPoint, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 334, S: this, A: ["forkPoint", ""] });
     const result = {
       forkPoint: forkPoint.forkPoint,
       chosenPath: {
@@ -1179,12 +1083,7 @@ var CredentialGraph = class {
         modified: path.forkChangedSubjects,
         forkIssuers: path.forkIssuers,
         state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }), {
-        F: __dxlog_file4,
-        L: 348,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 350, S: this });
       path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
       path.credentials.forEach((cred) => result.credentials.add(cred));
       result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
@@ -1204,12 +1103,7 @@ var CredentialGraph = class {
       log("set subject state", () => ({
         subject,
         state: this._stateHandler.toLogString(vertex.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 370,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 372, S: this });
       const otherPaths = paths.filter((p) => p !== branch);
       this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
     }
@@ -1248,12 +1142,7 @@ var CredentialGraph = class {
     if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
       log("merge point chosen to break the tie", {
         mergePointId: existing.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 408,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 412, S: this });
       return mergePointId === candidateVertex.id;
     }
     const candidateCredential = candidateVertex.credential;
@@ -1262,12 +1151,7 @@ var CredentialGraph = class {
       log("one of the credentials was overridden in another branch", {
         current: currentVertex.id,
         candidate: candidateVertex.id
-      }, {
-        F: __dxlog_file4,
-        L: 415,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 421, S: this });
       return candidate.credentials.has(currentCredential.id);
     }
     const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
@@ -1280,20 +1164,10 @@ var CredentialGraph = class {
           existing.forkIssuers.size,
           candidate.forkIssuers.size
         ]
-      }, {
-        F: __dxlog_file4,
-        L: 432,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 433, S: this });
       return candidate.forkIssuers.size > existing.forkIssuers.size;
     }
-    log("issuance date used to break the tie", void 0, {
-      F: __dxlog_file4,
-      L: 437,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    log("issuance date used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 441, S: this });
     return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
   }
   _createRootPath() {
@@ -1314,14 +1188,16 @@ var toChosenPath = (path) => {
   ]));
 };
 
-// packages/core/halo/credentials/src/state-machine/member-state-machine.ts
-var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
+// src/state-machine/member-state-machine.ts
+var __dxlog_file5 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
 var MemberStateMachine = class {
+  _spaceKey;
+  _ownerKey;
+  _memberProfiles = new ComplexMap5(PublicKey7.hash);
+  _hashgraph = new CredentialGraph(this);
+  onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._memberProfiles = new ComplexMap5(PublicKey7.hash);
-    this._hashgraph = new CredentialGraph(this);
-    this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
   }
   get creator() {
     return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
@@ -1343,15 +1219,7 @@ var MemberStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceMember": {
-        invariant5(assertion.spaceKey.equals(this._spaceKey), void 0, {
-          F: __dxlog_file5,
-          L: 66,
-          S: this,
-          A: [
-            "assertion.spaceKey.equals(this._spaceKey)",
-            ""
-          ]
-        });
+        invariant5(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 43, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
         if (this._ownerKey == null && credential.issuer === this._spaceKey) {
           this._ownerKey = credential.subject.id;
         }
@@ -1368,12 +1236,7 @@ var MemberStateMachine = class {
         } else {
           log2.warn("Member not found", {
             id: credential.subject.id
-          }, {
-            F: __dxlog_file5,
-            L: 81,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 59, S: this });
         }
         this._memberProfiles.set(credential.subject.id, assertion.profile);
         break;
@@ -1418,12 +1281,7 @@ var MemberStateMachine = class {
     const path1IssuerRole = this._getRole(scope1, update1.issuer);
     const path2IssuerRole = this._getRole(scope2, update2.issuer);
     if (path2IssuerRole === SpaceMember2.Role.OWNER !== (path1IssuerRole === SpaceMember2.Role.OWNER)) {
-      log2("owner decision used to break the tie", void 0, {
-        F: __dxlog_file5,
-        L: 139,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      log2("owner decision used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 107, S: this });
       return path1IssuerRole === SpaceMember2.Role.OWNER ? update1 : update2;
     }
     return null;
@@ -1447,12 +1305,7 @@ var MemberStateMachine = class {
           headId: scope.head?.id,
           roleOverride: this.toLogString(override.assertion),
           realRole: this.toLogString(scope.state.get(memberId)?.assertion)
-        }), {
-          F: __dxlog_file5,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }), { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 127, S: this });
         return override.assertion.role;
       }
     }
@@ -1460,29 +1313,37 @@ var MemberStateMachine = class {
   }
 };
 
-// packages/core/halo/credentials/src/state-machine/space-state-machine.ts
+// src/state-machine/space-state-machine.ts
+var __dxlog_file6 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 var SpaceStateMachine = class {
+  _spaceKey;
+  _members;
+  _feeds;
+  _invitations = new InvitationStateMachine();
+  _credentials = [];
+  _credentialsById = new ComplexMap6(PublicKey8.hash);
+  _processedCredentials = new ComplexSet3(PublicKey8.hash);
+  _genesisCredential;
+  _tags = [];
+  _membershipPolicy = MembershipPolicy2.INVITE;
+  _credentialProcessors = [];
+  onCredentialProcessed = new Callback4();
+  onMemberRoleChanged;
+  onFeedAdmitted;
+  onDelegatedInvitation = this._invitations.onDelegatedInvitation;
+  onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
     this._members = new MemberStateMachine(this._spaceKey);
     this._feeds = new FeedStateMachine(this._spaceKey);
-    this._invitations = new InvitationStateMachine();
-    this._credentials = [];
-    this._credentialsById = new ComplexMap6(PublicKey8.hash);
-    this._processedCredentials = new ComplexSet3(PublicKey8.hash);
-    this._credentialProcessors = [];
-    this.onCredentialProcessed = new Callback4();
     this.onMemberRoleChanged = this._members.onMemberRoleChanged;
     this.onFeedAdmitted = this._feeds.onFeedAdmitted;
-    this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
-    this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
   }
   get creator() {
     return this._members.creator;
@@ -1505,6 +1366,12 @@ var SpaceStateMachine = class {
   get genesisCredential() {
     return this._genesisCredential;
   }
+  get tags() {
+    return this._tags;
+  }
+  get membershipPolicy() {
+    return this._membershipPolicy;
+  }
   get invitations() {
     return this._invitations.invitations;
   }
@@ -1544,12 +1411,7 @@ var SpaceStateMachine = class {
     if (!skipVerification) {
       const result = await verifyCredential(credential);
       if (result.kind !== "pass") {
-        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
-          F: __dxlog_file6,
-          L: 156,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 116, S: this });
         return false;
       }
     }
@@ -1557,33 +1419,20 @@ var SpaceStateMachine = class {
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceGenesis": {
         if (this._genesisCredential) {
-          log3.warn("Space already has a genesis credential.", void 0, {
-            F: __dxlog_file6,
-            L: 165,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space already has a genesis credential.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 125, S: this });
           return false;
         }
         if (!credential.issuer.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued by space.", void 0, {
-            F: __dxlog_file6,
-            L: 169,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space genesis credential must be issued by space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 129, S: this });
           return false;
         }
         if (!credential.subject.id.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued to space.", void 0, {
-            F: __dxlog_file6,
-            L: 173,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space genesis credential must be issued to space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 133, S: this });
           return false;
         }
         this._genesisCredential = credential;
+        this._tags = assertion.tags ?? [];
+        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy2.INVITE;
         break;
       }
       case "dxos.halo.credentials.SpaceMember": {
@@ -1591,21 +1440,11 @@ var SpaceStateMachine = class {
           break;
         }
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 186,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 147, S: this });
           return false;
         }
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 190,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 151, S: this });
           return false;
         }
         await this._members.process(credential);
@@ -1614,12 +1453,7 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.MemberProfile": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 201,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 161, S: this });
           return false;
         }
         await this._members.process(credential);
@@ -1627,12 +1461,7 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.AdmittedFeed": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
-            F: __dxlog_file6,
-            L: 211,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 170, S: this });
           return false;
         }
         await this._feeds.process(credential, sourceFeed);
@@ -1641,12 +1470,7 @@ var SpaceStateMachine = class {
       case "dxos.halo.invitations.CancelDelegatedInvitation":
       case "dxos.halo.invitations.DelegateSpaceInvitation": {
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 222,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 181, S: this });
           return false;
         }
         await this._invitations.process(credential);
@@ -1677,6 +1501,9 @@ var SpaceStateMachine = class {
     return this._canInviteNewMembers(memberKey);
   }
   _canInviteNewMembers(key) {
+    if (this._membershipPolicy === MembershipPolicy2.LOCKED) {
+      return key.equals(this._spaceKey) && this._members.members.size === 0;
+    }
     return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
   }
 };
@@ -1684,15 +1511,21 @@ _ts_decorate([
   synchronized
 ], SpaceStateMachine.prototype, "process", null);
 var CredentialConsumer = class {
+  processor;
+  _onOpen;
+  _onClose;
+  _ctx = new Context(void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 229 });
+  /**
+  * @internal
+  * Processor is ready to process live credentials.
+  * NOTE: Setting this flag before all existing credentials are processed will cause them to be processed out of order.
+  * Set externally.
+  */
+  _isReadyForLiveCredentials = false;
   constructor(processor, _onOpen, _onClose) {
     this.processor = processor;
     this._onOpen = _onOpen;
     this._onClose = _onClose;
-    this._ctx = new Context(void 0, {
-      F: __dxlog_file6,
-      L: 267
-    });
-    this._isReadyForLiveCredentials = false;
   }
   /**
   * @internal
@@ -1714,30 +1547,28 @@ var CredentialConsumer = class {
   }
 };
 
-// packages/core/halo/credentials/src/processor/device-state-machine.ts
+// src/processor/device-state-machine.ts
 import { Trigger } from "@dxos/async";
 import { invariant as invariant6 } from "@dxos/invariant";
 import { PublicKey as PublicKey9 } from "@dxos/keys";
 import { log as log4 } from "@dxos/log";
 import { ComplexMap as ComplexMap7 } from "@dxos/util";
-var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
+var __dxlog_file7 = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
 var DeviceStateMachine = class {
+  _params;
+  // TODO(burdon): Return values via getter.
+  authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
+  deviceChainReady = new Trigger();
+  deviceCredentialChain;
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
-    this.deviceChainReady = new Trigger();
   }
   async processCredential(credential) {
     log4("processing credential...", {
       identityKey: this._params.identityKey,
       deviceKey: this._params.deviceKey,
       credential
-    }, {
-      F: __dxlog_file7,
-      L: 35,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 22, S: this });
     if (isValidAuthorizedDeviceCredential(credential, this._params.identityKey, this._params.deviceKey)) {
       this.deviceCredentialChain = {
         credential
@@ -1752,35 +1583,17 @@ var DeviceStateMachine = class {
           localDeviceKey: this._params.deviceKey,
           deviceKey: assertion.deviceKey,
           size: this.authorizedDeviceKeys.size
-        }, {
-          F: __dxlog_file7,
-          L: 55,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 41, S: this });
         this._params.onUpdate?.();
         break;
       }
       case "dxos.halo.credentials.DeviceProfile": {
-        invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
-          F: __dxlog_file7,
-          L: 65,
-          S: this,
-          A: [
-            "this.authorizedDeviceKeys.has(credential.subject.id)",
-            "'Device not found.'"
-          ]
-        });
+        invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 51, S: this, A: ["this.authorizedDeviceKeys.has(credential.subject.id)", "'Device not found.'"] });
         if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
           log4.trace("dxos.halo.device", {
             deviceKey: credential.subject.id,
             profile: assertion.profile
-          }, {
-            F: __dxlog_file7,
-            L: 68,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 53, S: this });
         }
         this.authorizedDeviceKeys.set(credential.subject.id, assertion.profile);
         this._params.onUpdate?.();
@@ -1790,10 +1603,13 @@ var DeviceStateMachine = class {
   }
 };
 
-// packages/core/halo/credentials/src/processor/profile-state-machine.ts
+// src/processor/profile-state-machine.ts
 import { log as log5 } from "@dxos/log";
-var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
+var __dxlog_file8 = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
 var ProfileStateMachine = class {
+  _params;
+  // TODO(burdon): Return values via getter.
+  profile;
   constructor(_params) {
     this._params = _params;
   }
@@ -1805,24 +1621,14 @@ var ProfileStateMachine = class {
           log5.warn("Invalid profile credential", {
             expectedIdentity: this._params.identityKey,
             credential
-          }, {
-            F: __dxlog_file8,
-            L: 34,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 21, S: this });
           return;
         }
         this.profile = assertion.profile;
         log5("updated profile", {
           identityKey: this._params.identityKey,
           profile: this.profile
-        }, {
-          F: __dxlog_file8,
-          L: 40,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 29, S: this });
         this._params.onUpdate?.();
         break;
       }