@dxos/credentials 0.8.3 → 0.8.4-main.28f8d3d

package/dist/lib/node/index.cjs

@@ -1,1894 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var node_exports = {};
-__export(node_exports, {
-  CredentialGenerator: () => CredentialGenerator,
-  DeviceStateMachine: () => DeviceStateMachine,
-  FeedStateMachine: () => FeedStateMachine,
-  InvitationStateMachine: () => InvitationStateMachine,
-  MemberStateMachine: () => MemberStateMachine,
-  ProfileStateMachine: () => ProfileStateMachine,
-  SIGNATURE_TYPE_ED25519: () => SIGNATURE_TYPE_ED25519,
-  SpaceStateMachine: () => SpaceStateMachine,
-  canonicalStringify: () => canonicalStringify,
-  checkCredentialType: () => checkCredentialType,
-  createAdmissionCredentials: () => createAdmissionCredentials,
-  createCancelDelegatedSpaceInvitationCredential: () => createCancelDelegatedSpaceInvitationCredential,
-  createCredential: () => createCredential,
-  createCredentialMessage: () => createCredentialMessage,
-  createCredentialSignerWithChain: () => createCredentialSignerWithChain,
-  createCredentialSignerWithKey: () => createCredentialSignerWithKey,
-  createDelegatedSpaceInvitationCredential: () => createDelegatedSpaceInvitationCredential,
-  createDeviceAuthorization: () => createDeviceAuthorization,
-  createDidFromIdentityKey: () => createDidFromIdentityKey,
-  credentialTypeFilter: () => credentialTypeFilter,
-  defaultSecretProvider: () => defaultSecretProvider,
-  defaultSecretValidator: () => defaultSecretValidator,
-  generatePasscode: () => generatePasscode,
-  generateSeedPhrase: () => generateSeedPhrase,
-  getCredentialAssertion: () => getCredentialAssertion,
-  getCredentialProofPayload: () => getCredentialProofPayload,
-  getPresentationProofPayload: () => getPresentationProofPayload,
-  isValidAuthorizedDeviceCredential: () => isValidAuthorizedDeviceCredential,
-  keyPairFromSeedPhrase: () => keyPairFromSeedPhrase,
-  signPresentation: () => signPresentation,
-  verifyChain: () => verifyChain,
-  verifyCredential: () => verifyCredential,
-  verifyCredentialSignature: () => verifyCredentialSignature,
-  verifyPresentation: () => verifyPresentation,
-  verifyPresentationChain: () => verifyPresentationChain,
-  verifyPresentationSignature: () => verifyPresentationSignature
-});
-module.exports = __toCommonJS(node_exports);
-var import_crypto = require("@dxos/crypto");
-var import_keys = require("@dxos/keys");
-var import_util = require("@dxos/util");
-var import_bip39 = require("bip39");
-var import_crypto2 = require("@dxos/crypto");
-var import_invariant = require("@dxos/invariant");
-var import_json_stable_stringify = __toESM(require("json-stable-stringify"));
-var import_keys2 = require("@dxos/keys");
-var import_timeframe = require("@dxos/timeframe");
-var import_util2 = require("@dxos/util");
-var import_crypto3 = require("@dxos/crypto");
-var import_invariant2 = require("@dxos/invariant");
-var import_keys3 = require("@dxos/keys");
-var import_crypto4 = require("@dxos/crypto");
-var import_credentials = require("@dxos/protocols/proto/dxos/halo/credentials");
-var import_timeframe2 = require("@dxos/timeframe");
-var import_crypto5 = require("@dxos/crypto");
-var import_async = require("@dxos/async");
-var import_context = require("@dxos/context");
-var import_keys4 = require("@dxos/keys");
-var import_log = require("@dxos/log");
-var import_credentials2 = require("@dxos/protocols/proto/dxos/halo/credentials");
-var import_util3 = require("@dxos/util");
-var import_invariant3 = require("@dxos/invariant");
-var import_keys5 = require("@dxos/keys");
-var import_util4 = require("@dxos/util");
-var import_keys6 = require("@dxos/keys");
-var import_util5 = require("@dxos/util");
-var import_invariant4 = require("@dxos/invariant");
-var import_keys7 = require("@dxos/keys");
-var import_log2 = require("@dxos/log");
-var import_credentials3 = require("@dxos/protocols/proto/dxos/halo/credentials");
-var import_util6 = require("@dxos/util");
-var import_invariant5 = require("@dxos/invariant");
-var import_keys8 = require("@dxos/keys");
-var import_log3 = require("@dxos/log");
-var import_util7 = require("@dxos/util");
-var import_async2 = require("@dxos/async");
-var import_invariant6 = require("@dxos/invariant");
-var import_keys9 = require("@dxos/keys");
-var import_log4 = require("@dxos/log");
-var import_util8 = require("@dxos/util");
-var import_log5 = require("@dxos/log");
-var IDENTITY_DIDS_CACHE = new import_util.ComplexMap(import_keys.PublicKey.hash);
-var createDidFromIdentityKey = async (identityKey) => {
-  const cachedValue = IDENTITY_DIDS_CACHE.get(identityKey);
-  if (cachedValue !== void 0) {
-    return cachedValue;
-  }
-  const digest = await import_crypto.subtleCrypto.digest("SHA-256", identityKey.asUint8Array());
-  const bytes = new Uint8Array(digest).slice(0, import_keys.IdentityDid.byteLength);
-  const identityDid = import_keys.IdentityDid.encode(bytes);
-  IDENTITY_DIDS_CACHE.set(identityKey, identityDid);
-  return identityDid;
-};
-var defaultSecretProvider = async () => Buffer.from("0000");
-var defaultSecretValidator = async (invitation, secret) => true;
-var __dxlog_file = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/seedphrase.ts";
-var generateSeedPhrase = () => (0, import_bip39.generateMnemonic)();
-var keyPairFromSeedPhrase = (seedPhrase) => {
-  (0, import_invariant.invariant)(seedPhrase, void 0, {
-    F: __dxlog_file,
-    L: 20,
-    S: void 0,
-    A: [
-      "seedPhrase",
-      ""
-    ]
-  });
-  const seed = (0, import_bip39.mnemonicToSeedSync)(seedPhrase);
-  return (0, import_crypto2.createKeyPair)(seed);
-};
-var generatePasscode = (length = 4) => {
-  let passcode = "";
-  for (let i = 0; i < length; i++) {
-    passcode += `${Math.floor(Math.random() * 10)}`;
-  }
-  return passcode;
-};
-var getCredentialProofPayload = (credential) => {
-  const copy = {
-    ...credential,
-    proof: {
-      ...credential.proof,
-      value: new Uint8Array(),
-      chain: void 0
-    }
-  };
-  if (copy.parentCredentialIds?.length === 0) {
-    delete copy.parentCredentialIds;
-  }
-  delete copy.id;
-  return Buffer.from(canonicalStringify(copy));
-};
-var canonicalStringify = (obj) => (0, import_json_stable_stringify.default)(obj, {
-  /* The point of signing and verifying is not that the internal, private state of the objects be
-  * identical, but that the public contents can be verified not to have been altered. For that reason,
-  * really private fields (indicated by '__') are not included in the signature.
-  * This gives a mechanism for attaching other attributes to an object without breaking the signature.
-  * We also skip @type.
-  */
-  // TODO(dmaretskyi): Should we actually skip the @type field?
-  replacer: function(key, value) {
-    if (key.toString().startsWith("__") || key.toString() === "@type") {
-      return void 0;
-    }
-    if (value === null) {
-      return void 0;
-    }
-    const original = this[key];
-    if (value) {
-      if (import_keys2.PublicKey.isPublicKey(value)) {
-        return value.toHex();
-      }
-      if (Buffer.isBuffer(value)) {
-        return value.toString("hex");
-      }
-      if (value instanceof Uint8Array) {
-        return (0, import_util2.arrayToBuffer)(value).toString("hex");
-      }
-      if (value.data && value.type === "Buffer") {
-        return Buffer.from(value).toString("hex");
-      }
-      if (original instanceof import_timeframe.Timeframe) {
-        return original.frames().reduce((frames, [key2, seq]) => {
-          frames[truncateKey(key2)] = seq;
-          return frames;
-        }, {});
-      }
-    }
-    return value;
-  }
-});
-var truncateKey = (key) => {
-  const str = key.toHex();
-  return `${str.substring(0, 4)}...${str.substring(str.length - 4)}`;
-};
-var getPresentationProofPayload = (credentials, proof) => {
-  const copy = {
-    credentials: credentials.map((credential) => removeEmptyParentCredentialIds(credential)),
-    proof: {
-      ...proof,
-      value: new Uint8Array(),
-      chain: void 0
-    }
-  };
-  return Buffer.from(canonicalStringify(copy));
-};
-var removeEmptyParentCredentialIds = (credential) => {
-  const copy = {
-    ...credential,
-    proof: credential.proof ? {
-      ...credential.proof,
-      chain: credential.proof.chain ? {
-        credential: removeEmptyParentCredentialIds(credential.proof.chain.credential)
-      } : void 0
-    } : void 0
-  };
-  if (copy.parentCredentialIds?.length === 0) {
-    delete copy.parentCredentialIds;
-  }
-  return copy;
-};
-var getCredentialAssertion = (credential) => credential.subject.assertion;
-var isValidAuthorizedDeviceCredential = (credential, identityKey, deviceKey) => {
-  const assertion = getCredentialAssertion(credential);
-  return credential.subject.id.equals(deviceKey) && credential.issuer.equals(identityKey) && assertion["@type"] === "dxos.halo.credentials.AuthorizedDevice" && assertion.identityKey.equals(identityKey) && assertion.deviceKey.equals(deviceKey);
-};
-var checkCredentialType = (credential, type) => credential.subject.assertion["@type"] === type;
-var credentialTypeFilter = (type) => (credential) => checkCredentialType(credential, type);
-var SIGNATURE_TYPE_ED25519 = "ED25519Signature";
-var verifyCredential = async (credential) => {
-  if (credential.parentCredentialIds?.length === 0) {
-    delete credential.parentCredentialIds;
-  }
-  if (!credential.issuer.equals(credential.proof.signer)) {
-    if (!credential.proof.chain) {
-      return {
-        kind: "fail",
-        errors: [
-          "Delegated credential is missing credential chain."
-        ]
-      };
-    }
-    const result2 = await verifyChain(credential.proof.chain, credential.issuer, credential.proof.signer);
-    if (result2.kind === "fail") {
-      return result2;
-    }
-  }
-  const result = await verifyCredentialSignature(credential);
-  if (result.kind === "fail") {
-    return result;
-  }
-  return {
-    kind: "pass"
-  };
-};
-var verifyCredentialSignature = async (credential) => {
-  if (credential.proof.type !== SIGNATURE_TYPE_ED25519) {
-    return {
-      kind: "fail",
-      errors: [
-        `Invalid signature type: ${credential.proof.type}`
-      ]
-    };
-  }
-  const signData = getCredentialProofPayload(credential);
-  if (!await (0, import_crypto4.verifySignature)(credential.proof.signer, signData, credential.proof.value)) {
-    return {
-      kind: "fail",
-      errors: [
-        "Invalid signature"
-      ]
-    };
-  }
-  return {
-    kind: "pass"
-  };
-};
-var verifyChain = async (chain, authority, subject) => {
-  const result = await verifyCredential(chain.credential);
-  if (result.kind === "fail") {
-    return result;
-  }
-  if (!isValidAuthorizedDeviceCredential(chain.credential, authority, subject)) {
-    return {
-      kind: "fail",
-      errors: [
-        `Invalid credential chain: invalid assertion for key: ${subject}`
-      ]
-    };
-  }
-  return {
-    kind: "pass"
-  };
-};
-var __dxlog_file2 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
-var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
-  (0, import_invariant2.invariant)(assertion["@type"], "Invalid assertion.", {
-    F: __dxlog_file2,
-    L: 48,
-    S: void 0,
-    A: [
-      "assertion['@type']",
-      "'Invalid assertion.'"
-    ]
-  });
-  (0, import_invariant2.invariant)(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
-    F: __dxlog_file2,
-    L: 49,
-    S: void 0,
-    A: [
-      "!!signingKey === !!chain",
-      "'Chain must be provided if and only if the signing key differs from the issuer.'"
-    ]
-  });
-  if (chain) {
-    const result = await verifyChain(chain, issuer, signingKey);
-    (0, import_invariant2.invariant)(result.kind === "pass", "Invalid chain.", {
-      F: __dxlog_file2,
-      L: 52,
-      S: void 0,
-      A: [
-        "result.kind === 'pass'",
-        "'Invalid chain.'"
-      ]
-    });
-  }
-  const credential = {
-    issuer,
-    issuanceDate: /* @__PURE__ */ new Date(),
-    subject: {
-      id: subject,
-      assertion
-    },
-    parentCredentialIds,
-    proof: {
-      type: SIGNATURE_TYPE_ED25519,
-      creationDate: /* @__PURE__ */ new Date(),
-      signer: signingKey ?? issuer,
-      value: new Uint8Array(),
-      nonce
-    }
-  };
-  const signedPayload = getCredentialProofPayload(credential);
-  credential.proof.value = await signer.sign(signingKey ?? issuer, signedPayload);
-  if (chain) {
-    credential.proof.chain = chain;
-  }
-  credential.id = import_keys3.PublicKey.from(await import_crypto3.subtleCrypto.digest("SHA-256", signedPayload));
-  return credential;
-};
-var createCredentialMessage = (credential) => {
-  return {
-    "@type": "dxos.echo.feed.CredentialsMessage",
-    credential
-  };
-};
-var createCredentialSignerWithKey = (signer, issuer) => ({
-  getIssuer: () => issuer,
-  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
-    signer,
-    issuer,
-    subject,
-    assertion,
-    nonce,
-    parentCredentialIds
-  })
-});
-var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
-  getIssuer: () => chain.credential.issuer,
-  createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
-    signer,
-    issuer: chain.credential.issuer,
-    signingKey,
-    chain,
-    subject,
-    assertion,
-    nonce,
-    parentCredentialIds
-  })
-});
-var CredentialGenerator = class {
-  constructor(_signer, _identityKey, _deviceKey) {
-    this._signer = _signer;
-    this._identityKey = _identityKey;
-    this._deviceKey = _deviceKey;
-  }
-  /**
-  * Create genesis messages for new Space.
-  */
-  async createSpaceGenesis(spaceKey, controlKey, creatorProfile) {
-    return [
-      await createCredential({
-        signer: this._signer,
-        issuer: spaceKey,
-        subject: spaceKey,
-        assertion: {
-          "@type": "dxos.halo.credentials.SpaceGenesis",
-          spaceKey
-        }
-      }),
-      await createCredential({
-        signer: this._signer,
-        issuer: spaceKey,
-        subject: this._identityKey,
-        assertion: {
-          "@type": "dxos.halo.credentials.SpaceMember",
-          spaceKey,
-          role: import_credentials.SpaceMember.Role.ADMIN,
-          profile: creatorProfile,
-          genesisFeedKey: controlKey
-        }
-      }),
-      await this.createFeedAdmission(spaceKey, controlKey, import_credentials.AdmittedFeed.Designation.CONTROL)
-    ];
-  }
-  /**
-  * Create invitation.
-  * Admit identity and control and data feeds.
-  */
-  // TODO(burdon): Reconcile with above (esp. Signer).
-  async createMemberInvitation(spaceKey, identityKey, deviceKey, controlKey, dataKey, genesisFeedKey) {
-    return [
-      await createCredential({
-        signer: this._signer,
-        issuer: this._identityKey,
-        subject: identityKey,
-        assertion: {
-          "@type": "dxos.halo.credentials.SpaceMember",
-          spaceKey,
-          role: import_credentials.SpaceMember.Role.EDITOR,
-          genesisFeedKey
-        }
-      }),
-      await this.createFeedAdmission(spaceKey, controlKey, import_credentials.AdmittedFeed.Designation.CONTROL),
-      await this.createFeedAdmission(spaceKey, dataKey, import_credentials.AdmittedFeed.Designation.DATA)
-    ];
-  }
-  /**
-  * Add device to space.
-  */
-  // TODO(burdon): Reconcile with below.
-  async createDeviceAuthorization(deviceKey) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: deviceKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.AuthorizedDevice",
-        identityKey: this._identityKey,
-        deviceKey
-      }
-    });
-  }
-  /**
-  * Add device metadata.
-  */
-  async createDeviceProfile(profile) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: this._deviceKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.DeviceProfile",
-        profile
-      }
-    });
-  }
-  /**
-  * Add feed to space.
-  */
-  async createFeedAdmission(spaceKey, feedKey, designation) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: feedKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.AdmittedFeed",
-        spaceKey,
-        identityKey: this._identityKey,
-        deviceKey: this._deviceKey,
-        designation
-      }
-    });
-  }
-  async createProfileCredential(profile) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: this._identityKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.IdentityProfile",
-        profile
-      }
-    });
-  }
-  async createEpochCredential(spaceKey) {
-    return createCredential({
-      signer: this._signer,
-      issuer: this._identityKey,
-      subject: spaceKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.Epoch",
-        number: 0,
-        timeframe: new import_timeframe2.Timeframe()
-      }
-    });
-  }
-};
-var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
-  const credentials = await Promise.all([
-    await signer.createCredential({
-      subject: deviceKey,
-      assertion: {
-        "@type": "dxos.halo.credentials.AuthorizedDevice",
-        identityKey,
-        deviceKey
-      }
-    })
-  ]);
-  return credentials.map((credential) => ({
-    "@type": "dxos.echo.feed.CredentialsMessage",
-    credential
-  }));
-};
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = import_credentials.SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
-  const credentials = await Promise.all([
-    await signer.createCredential({
-      subject: identityKey,
-      parentCredentialIds: membershipChainHeads,
-      assertion: {
-        "@type": "dxos.halo.credentials.SpaceMember",
-        spaceKey,
-        role,
-        profile,
-        genesisFeedKey,
-        invitationCredentialId
-      }
-    })
-  ]);
-  return credentials.map((credential) => ({
-    credential: {
-      credential
-    }
-  }));
-};
-var createDelegatedSpaceInvitationCredential = async (signer, subject, invitation) => {
-  const credential = await signer.createCredential({
-    subject,
-    assertion: {
-      "@type": "dxos.halo.invitations.DelegateSpaceInvitation",
-      invitationId: invitation.invitationId,
-      authMethod: invitation.authMethod,
-      swarmKey: invitation.swarmKey,
-      role: invitation.role,
-      guestKey: invitation.guestKey,
-      expiresOn: invitation.expiresOn,
-      multiUse: invitation.multiUse
-    }
-  });
-  return {
-    credential: {
-      credential
-    }
-  };
-};
-var createCancelDelegatedSpaceInvitationCredential = async (signer, subject, invitationCredentialId) => {
-  const credential = await signer.createCredential({
-    subject,
-    assertion: {
-      "@type": "dxos.halo.invitations.CancelDelegatedInvitation",
-      credentialId: invitationCredentialId
-    }
-  });
-  return {
-    credential: {
-      credential
-    }
-  };
-};
-var signPresentation = async ({ presentation, signer, signerKey, chain, nonce }) => {
-  const proof = {
-    type: SIGNATURE_TYPE_ED25519,
-    value: new Uint8Array(),
-    creationDate: /* @__PURE__ */ new Date(),
-    signer: signerKey,
-    nonce
-  };
-  const signedPayload = getPresentationProofPayload(presentation.credentials ?? [], proof);
-  proof.value = await signer.sign(signerKey, signedPayload);
-  if (chain) {
-    proof.chain = chain;
-  }
-  return {
-    credentials: presentation.credentials,
-    proofs: [
-      ...presentation.proofs ?? [],
-      proof
-    ]
-  };
-};
-var verifyPresentation = async (presentation) => {
-  const errors = [];
-  const credentialsVerifications = await Promise.all(presentation.credentials?.map((credential) => verifyCredential(credential)) ?? []);
-  for (const verification of credentialsVerifications) {
-    if (verification.kind === "fail") {
-      errors.push(...verification.errors);
-    }
-  }
-  const proofVerification = await Promise.all(presentation.proofs?.map(async (proof) => {
-    const chainVerification = await verifyPresentationChain(presentation, proof);
-    if (chainVerification.kind === "fail") {
-      return chainVerification;
-    }
-    const signatureVerification = await verifyPresentationSignature(presentation, proof);
-    if (signatureVerification.kind === "fail") {
-      return signatureVerification;
-    }
-    return {
-      kind: "pass"
-    };
-  }) ?? []);
-  for (const verification of proofVerification) {
-    if (verification.kind === "fail") {
-      errors.push(...verification.errors);
-    }
-  }
-  if (errors.length === 0) {
-    return {
-      kind: "pass"
-    };
-  }
-  {
-    return {
-      kind: "fail",
-      errors
-    };
-  }
-};
-var verifyPresentationChain = async (presentation, proof) => {
-  for (const credential of presentation.credentials ?? []) {
-    if (!credential.issuer.equals(proof.signer)) {
-      if (!proof.chain) {
-        return {
-          kind: "fail",
-          errors: [
-            "Delegated credential is missing credential chain."
-          ]
-        };
-      }
-      const chainVerification = await verifyChain(proof.chain, credential.subject.id, proof.signer);
-      if (chainVerification.kind === "fail") {
-        return chainVerification;
-      }
-    }
-  }
-  return {
-    kind: "pass"
-  };
-};
-var verifyPresentationSignature = async (presentation, proof) => {
-  if (proof.type !== SIGNATURE_TYPE_ED25519) {
-    return {
-      kind: "fail",
-      errors: [
-        `Invalid signature type: ${proof.type}`
-      ]
-    };
-  }
-  const signData = getPresentationProofPayload(presentation.credentials ?? [], proof);
-  if (!await (0, import_crypto5.verifySignature)(proof.signer, signData, proof.value)) {
-    return {
-      kind: "fail",
-      errors: [
-        "Invalid signature"
-      ]
-    };
-  }
-  return {
-    kind: "pass"
-  };
-};
-var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
-var FeedStateMachine = class {
-  constructor(_spaceKey) {
-    this._spaceKey = _spaceKey;
-    this._feeds = new import_util4.ComplexMap(import_keys5.PublicKey.hash);
-    this.onFeedAdmitted = new import_util4.Callback();
-  }
-  get feeds() {
-    return this._feeds;
-  }
-  /**
-  * Processes the AdmittedFeed credential.
-  * Assumes the credential is already pre-verified
-  * and the issuer has been authorized to issue credentials of this type.
-  * @param fromFeed Key of the feed where this credential is recorded.
-  */
-  async process(credential, fromFeed) {
-    const assertion = getCredentialAssertion(credential);
-    (0, import_invariant3.invariant)(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, {
-      F: __dxlog_file3,
-      L: 47,
-      S: this,
-      A: [
-        "assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'",
-        ""
-      ]
-    });
-    (0, import_invariant3.invariant)(assertion.spaceKey.equals(this._spaceKey), void 0, {
-      F: __dxlog_file3,
-      L: 48,
-      S: this,
-      A: [
-        "assertion.spaceKey.equals(this._spaceKey)",
-        ""
-      ]
-    });
-    const info = {
-      key: credential.subject.id,
-      credential,
-      assertion,
-      parent: fromFeed
-    };
-    this._feeds.set(credential.subject.id, info);
-    await this.onFeedAdmitted.callIfSet(info);
-  }
-};
-var InvitationStateMachine = class {
-  constructor() {
-    this._invitations = new import_util5.ComplexMap(import_keys6.PublicKey.hash);
-    this._redeemedInvitationCredentialIds = new import_util5.ComplexSet(import_keys6.PublicKey.hash);
-    this._cancelledInvitationCredentialIds = new import_util5.ComplexSet(import_keys6.PublicKey.hash);
-    this.onDelegatedInvitation = new import_util5.Callback();
-    this.onDelegatedInvitationRemoved = new import_util5.Callback();
-  }
-  get invitations() {
-    return this._invitations;
-  }
-  async process(credential) {
-    const credentialId = credential.id;
-    if (credentialId == null) {
-      return;
-    }
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.invitations.CancelDelegatedInvitation": {
-        this._cancelledInvitationCredentialIds.add(assertion.credentialId);
-        const existingInvitation = this._invitations.get(assertion.credentialId);
-        if (existingInvitation != null) {
-          this._invitations.delete(assertion.credentialId);
-          await this.onDelegatedInvitationRemoved.callIfSet({
-            credentialId: assertion.credentialId,
-            invitation: existingInvitation
-          });
-        }
-        break;
-      }
-      case "dxos.halo.invitations.DelegateSpaceInvitation": {
-        if (credential.id) {
-          const isExpired = assertion.expiresOn && assertion.expiresOn.getTime() < Date.now();
-          const wasUsed = this._redeemedInvitationCredentialIds.has(credential.id) && !assertion.multiUse;
-          const wasCancelled = this._cancelledInvitationCredentialIds.has(credential.id);
-          if (isExpired || wasCancelled || wasUsed) {
-            return;
-          }
-          const invitation = {
-            ...assertion
-          };
-          this._invitations.set(credential.id, invitation);
-          await this.onDelegatedInvitation.callIfSet({
-            credentialId: credential.id,
-            invitation
-          });
-        }
-        break;
-      }
-      case "dxos.halo.credentials.SpaceMember": {
-        if (assertion.invitationCredentialId != null) {
-          this._redeemedInvitationCredentialIds.add(assertion.invitationCredentialId);
-          const existingInvitation = this._invitations.get(assertion.invitationCredentialId);
-          if (existingInvitation != null && !existingInvitation.multiUse) {
-            this._invitations.delete(assertion.invitationCredentialId);
-            await this.onDelegatedInvitationRemoved.callIfSet({
-              credentialId: assertion.invitationCredentialId,
-              invitation: existingInvitation
-            });
-          }
-        }
-        break;
-      }
-    }
-  }
-};
-var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
-var CredentialGraph = class {
-  constructor(_stateHandler) {
-    this._stateHandler = _stateHandler;
-    this._vertexIdGenerator = 1;
-    this._root = {
-      id: -1,
-      parents: [],
-      children: []
-    };
-    this._sentinel = {
-      id: -2,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId = new import_util7.ComplexMap(import_keys8.PublicKey.hash);
-    this._subjectToVertex = new import_util7.ComplexMap(import_keys8.PublicKey.hash);
-    this._subjectToState = new import_util7.ComplexMap(import_keys8.PublicKey.hash);
-    this.onSubjectStateChanged = new import_util7.Callback();
-  }
-  getSubjectState(subjectId) {
-    return this._subjectToState.get(subjectId);
-  }
-  getState() {
-    return this._subjectToState;
-  }
-  getLeafIds() {
-    return this._sentinel.parents.map((v) => v.credential.id);
-  }
-  getGlobalStateScope() {
-    return {
-      state: this._subjectToVertex
-    };
-  }
-  addVertex(credential, assertion) {
-    const newVertex = {
-      id: this._vertexIdGenerator++,
-      credential,
-      assertion,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId.set(credential.id, newVertex);
-    const parentIds = credential.parentCredentialIds ?? [];
-    if (parentIds.length === 0) {
-      this._root.children.push(newVertex);
-      newVertex.parents.push(this._root);
-    } else {
-      for (const parentId of parentIds) {
-        const parentVertex = this._vertexByCredentialId.get(parentId);
-        if (parentVertex == null) {
-          import_log3.log.error("credential skipped because of the unknown parent", {
-            credential,
-            parentId
-          }, {
-            F: __dxlog_file4,
-            L: 72,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          continue;
-        }
-        parentVertex.children.push(newVertex);
-        newVertex.parents.push(parentVertex);
-        this._removeSentinelConnection(parentVertex);
-      }
-    }
-    newVertex.children.push(this._sentinel);
-    this._sentinel.parents.push(newVertex);
-    return this._onVertexInserted(newVertex);
-  }
-  _removeSentinelConnection(vertex) {
-    const sentinelIdx = vertex.children.indexOf(this._sentinel);
-    if (sentinelIdx >= 0) {
-      vertex.children.splice(sentinelIdx, 1);
-      const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
-      (0, import_invariant5.invariant)(vertexInSentinelIdx >= 0, void 0, {
-        F: __dxlog_file4,
-        L: 90,
-        S: this,
-        A: [
-          "vertexInSentinelIdx >= 0",
-          ""
-        ]
-      });
-      this._sentinel.parents.splice(vertexInSentinelIdx, 1);
-    }
-  }
-  async _onVertexInserted(newVertex) {
-    const { credential, assertion } = newVertex;
-    (0, import_invariant5.invariant)(credential, void 0, {
-      F: __dxlog_file4,
-      L: 97,
-      S: this,
-      A: [
-        "credential",
-        ""
-      ]
-    });
-    let changedSubjects = [];
-    const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
-    if (isUpdateAppliedOnTopOfThePreviousState) {
-      const subjectId = credential.subject.id;
-      if (this._stateHandler.isUpdateAllowed(this.getGlobalStateScope(), credential, assertion)) {
-        const newSubjectState = this._stateHandler.createState(credential, newVertex.assertion);
-        const prevSubjectState = this._subjectToState.get(subjectId);
-        this._subjectToState.set(subjectId, newSubjectState);
-        this._subjectToVertex.set(subjectId, newVertex);
-        if (this._stateHandler.hasStateChanged(newSubjectState, prevSubjectState)) {
-          changedSubjects.push(newSubjectState);
-        }
-      }
-    } else {
-      changedSubjects = this._recomputeState();
-    }
-    if (changedSubjects.length > 0) {
-      await this.onSubjectStateChanged.callIfSet(changedSubjects);
-    }
-  }
-  /**
-  * DFS the graph from root to sentinel pausing on merge points (nodes with multiple parents).
-  * Continue after all paths leading to a merge point converge by merging their states.
-  * In case of a concurrent update paths are replayed taking into account the state set
-  * by the winning branch.
-  */
-  _recomputeState() {
-    const pendingPaths = /* @__PURE__ */ new Map();
-    const paths = [
-      this._createRootPath()
-    ];
-    let lastPath = null;
-    while (lastPath == null) {
-      const path = paths.pop();
-      (0, import_log3.log)("visit vertex", {
-        id: path.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 132,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      this._updatePathState(path);
-      const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
-      if (convergedPaths == null) {
-        (0, import_log3.log)("waiting for other paths", void 0, {
-          F: __dxlog_file4,
-          L: 136,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        continue;
-      }
-      const mergeResult = this._mergePaths(convergedPaths);
-      if (mergeResult.type === "replay_required") {
-        this._replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths);
-        continue;
-      }
-      const merged = mergeResult.path;
-      if (merged.head.children.length === 0) {
-        lastPath = merged;
-      } else if (merged.head.children.length === 1) {
-        merged.head = merged.head.children[0];
-        paths.push(merged);
-      } else {
-        this._forkTraversal(paths, merged);
-      }
-    }
-    if (paths.length > 0) {
-      import_log3.log.error("traversal finished while there were active paths", {
-        paths: paths.map((p) => ({
-          path: toChosenPath(p),
-          head: p.head.id
-        }))
-      }, {
-        F: __dxlog_file4,
-        L: 155,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    }
-    return this._setCurrentState(lastPath);
-  }
-  _replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths) {
-    paths.push(...mergeResult.replay.map((path) => {
-      const stateOverrides = path.stateOverrides ?? new import_util7.ComplexMap(import_keys8.PublicKey.hash);
-      mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));
-      return {
-        ...mergeResult.from,
-        chosenPath: path.chosenPath,
-        stateOverrides
-      };
-    }));
-    (0, import_log3.log)("replay paths", () => ({
-      count: paths.length,
-      paths: paths.map((path) => ({
-        from: mergeResult.from.head.id,
-        path: toChosenPath(path),
-        overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }))
-    }), {
-      F: __dxlog_file4,
-      L: 175,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
-    pendingPaths.set(convergedPaths[0].head.id, clearedPending);
-  }
-  _handleMergePoint(paths, pendingPaths, path) {
-    const pendingList = pendingPaths.get(path.head.id) ?? [];
-    pendingPaths.set(path.head.id, pendingList);
-    pendingList.push(path);
-    if (pendingList.length < path.head.parents.length) {
-      return null;
-    }
-    if (path.head.id === this._sentinel.id && paths.length > 0) {
-      (0, import_log3.log)("waiting for all the active paths to converge on the sentinel", void 0, {
-        F: __dxlog_file4,
-        L: 199,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return null;
-    }
-    pendingPaths.delete(path.head.id);
-    return pendingList;
-  }
-  _updatePathState(path) {
-    const headCredential = path.head.credential;
-    if (headCredential == null) {
-      return;
-    }
-    const updatedSubject = headCredential.subject.id;
-    path.credentials.add(headCredential.id);
-    let isUpdateAllowed = this._stateHandler.isUpdateAllowed(path, headCredential, path.head.assertion);
-    if (!isUpdateAllowed && path.head.parents[0]?.id === this._root.id) {
-      const globalState = this.getGlobalStateScope();
-      isUpdateAllowed = this._stateHandler.isUpdateAllowed(globalState, headCredential, path.head.assertion);
-    }
-    if (isUpdateAllowed) {
-      path.forkChangedSubjects.add(updatedSubject);
-      path.forkIssuers.add(headCredential.issuer);
-      path.state.set(updatedSubject, path.head);
-      (0, import_log3.log)("path state updated", () => ({
-        subject: updatedSubject,
-        newState: this._stateHandler.toLogString(path.head.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 223,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-    }
-  }
-  _forkTraversal(paths, path) {
-    const replayChoice = path.chosenPath?.[path.head.id];
-    const choices = replayChoice ?? path.head.children;
-    for (const choice of choices) {
-      (0, import_log3.log)("edge traversal", {
-        from: path.head.id,
-        to: choice.id
-      }, {
-        F: __dxlog_file4,
-        L: 234,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      const fork = {
-        forkPoint: path,
-        chosenPath: {
-          ...path.chosenPath,
-          [path.head.id]: [
-            choice
-          ]
-        },
-        head: choice,
-        credentials: new import_util7.ComplexSet(import_keys8.PublicKey.hash, path.credentials),
-        state: new import_util7.ComplexMap(import_keys8.PublicKey.hash, [
-          ...path.state.entries()
-        ]),
-        forkIssuers: new import_util7.ComplexSet(import_keys8.PublicKey.hash),
-        forkChangedSubjects: new import_util7.ComplexSet(import_keys8.PublicKey.hash),
-        stateOverrides: path.stateOverrides
-      };
-      paths.push(fork);
-    }
-  }
-  /**
-  * Updates the current graph state.
-  * @returns changed states.
-  */
-  _setCurrentState(path) {
-    const changedSubjects = [];
-    const newStateMap = new import_util7.ComplexMap(import_keys8.PublicKey.hash);
-    const newVertexMap = new import_util7.ComplexMap(import_keys8.PublicKey.hash);
-    for (const [subjectKey, subjectVertex] of path.state.entries()) {
-      const newState = this._stateHandler.createState(subjectVertex.credential, subjectVertex.assertion);
-      const prevState = this._subjectToState.get(subjectKey);
-      newStateMap.set(subjectKey, newState);
-      newVertexMap.set(subjectKey, subjectVertex);
-      if (this._stateHandler.hasStateChanged(newState, prevState)) {
-        changedSubjects.push(newState);
-      }
-    }
-    this._subjectToState = newStateMap;
-    this._subjectToVertex = newVertexMap;
-    return changedSubjects;
-  }
-  /*
-  * Walk up all the fork points and return the first one present in all the paths.
-  * We use local id to determine vertex position in the graph, because nodes can't
-  * be inserted in the middle (between a parent and a child) and ids are monotonically increasing.
-  */
-  _leastCommonAncestor(paths) {
-    const uniqueForkPoints = paths.reduce((acc, path) => {
-      let it = path.forkPoint;
-      while (it) {
-        acc.set(it.head.id, it);
-        it = it.forkPoint;
-      }
-      return acc;
-    }, /* @__PURE__ */ new Map());
-    let maxId = this._root.id;
-    let maxState = null;
-    for (const [id, state] of uniqueForkPoints.entries()) {
-      const headCredential = state.head.credential;
-      if (headCredential != null) {
-        const isPointInEveryPath = paths.every((p) => p.credentials.has(headCredential.id));
-        if (isPointInEveryPath && id > maxId) {
-          maxId = id;
-          maxState = state;
-        }
-      }
-    }
-    return maxState ?? this._createRootPath();
-  }
-  /**
-  * We might be merging paths where some of them had fork points after the initial forking.
-  * We need all the paths to point to the least common fork point and contain all the changes
-  * that happened after it.
-  */
-  _moveUpToForkPoint(forkPoint, path) {
-    const isForkPointInPath = path.chosenPath[forkPoint.head.id] == null || path.forkPoint == null;
-    if (isForkPointInPath) {
-      return path;
-    }
-    if (forkPoint.head.id === path.forkPoint?.head.id) {
-      return path;
-    }
-    let it = path.forkPoint;
-    while (it.head.id !== forkPoint.head.id) {
-      it.forkIssuers.forEach((iss) => path.forkIssuers.add(iss));
-      it.forkChangedSubjects.forEach((m) => path.forkChangedSubjects.add(m));
-      it = it.forkPoint;
-      path.forkPoint = it;
-    }
-    return path;
-  }
-  _mergePaths(convergedPaths) {
-    (0, import_invariant5.invariant)(convergedPaths.length >= 1, void 0, {
-      F: __dxlog_file4,
-      L: 324,
-      S: this,
-      A: [
-        "convergedPaths.length >= 1",
-        ""
-      ]
-    });
-    if (convergedPaths.length === 1) {
-      return {
-        type: "merged",
-        path: convergedPaths[0]
-      };
-    }
-    const forkPoint = this._leastCommonAncestor(convergedPaths);
-    (0, import_log3.log)("merging paths", () => ({
-      forkPointId: forkPoint.head.id,
-      pathCount: convergedPaths.length,
-      forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
-    }), {
-      F: __dxlog_file4,
-      L: 329,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
-    (0, import_invariant5.invariant)(forkPoint, void 0, {
-      F: __dxlog_file4,
-      L: 335,
-      S: this,
-      A: [
-        "forkPoint",
-        ""
-      ]
-    });
-    const result = {
-      forkPoint: forkPoint.forkPoint,
-      chosenPath: {
-        ...forkPoint.chosenPath,
-        [forkPoint.head.id]: []
-      },
-      stateOverrides: forkPoint.stateOverrides,
-      credentials: new import_util7.ComplexSet(import_keys8.PublicKey.hash, forkPoint.credentials),
-      forkIssuers: new import_util7.ComplexSet(import_keys8.PublicKey.hash, forkPoint.forkIssuers),
-      forkChangedSubjects: new import_util7.ComplexSet(import_keys8.PublicKey.hash, forkPoint.forkChangedSubjects),
-      state: forkPoint.state.mapValues((v) => v),
-      head: paths[0].head
-    };
-    const subjectToBranch = new import_util7.ComplexMap(import_keys8.PublicKey.hash);
-    for (const path of paths) {
-      (0, import_log3.log)("processing a path", () => ({
-        choices: toChosenPath(path),
-        modified: path.forkChangedSubjects,
-        forkIssuers: path.forkIssuers,
-        state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }), {
-        F: __dxlog_file4,
-        L: 348,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
-      path.credentials.forEach((cred) => result.credentials.add(cred));
-      result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
-      for (const modifiedSubject of path.forkChangedSubjects) {
-        const existingBranch = subjectToBranch.get(modifiedSubject);
-        if (existingBranch == null || this._shouldOverrideCredential(existingBranch, path, modifiedSubject)) {
-          subjectToBranch.set(modifiedSubject, path);
-        }
-      }
-    }
-    const replayPaths = /* @__PURE__ */ new Set();
-    const addReplayPath = replayPaths.add.bind(replayPaths);
-    for (const [subject, branch] of subjectToBranch.entries()) {
-      result.forkChangedSubjects.add(subject);
-      const vertex = branch.state.get(subject);
-      result.state.set(subject, vertex);
-      (0, import_log3.log)("set subject state", () => ({
-        subject,
-        state: this._stateHandler.toLogString(vertex.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 370,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      const otherPaths = paths.filter((p) => p !== branch);
-      this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
-    }
-    if (replayPaths.size > 0) {
-      return {
-        type: "replay_required",
-        replay: [
-          ...replayPaths.values()
-        ],
-        from: forkPoint,
-        stateOverrides: subjectToBranch.mapValues((v, key) => v.state.get(key))
-      };
-    }
-    return {
-      type: "merged",
-      path: result
-    };
-  }
-  /**
-  * A candidate credential is preferred over the existing credential if:
-  *  1. It is the merge-point, because it's the last credential that was issued in awareness of all
-  *  the previously existing ones.
-  *  2. A path where candidate was set contains existing credential in it, which means that the candidate
-  *  was issued after the existing credential by a legitimate issuer.
-  *  3. A state-specific logic (_stateHandler) is able to justify using the candidate credential.
-  *  4. The path where candidate was set has more issuers than the existing path (longer branch).
-  *  5. The issuance time of the candidate is after the issuance time of the existing credential (LWW).
-  */
-  _shouldOverrideCredential(existing, candidate, modifiedSubject) {
-    const candidateVertex = candidate.state.get(modifiedSubject);
-    const currentVertex = existing.state.get(modifiedSubject);
-    if (candidateVertex.id === currentVertex.id) {
-      return false;
-    }
-    const mergePointId = existing.head.id;
-    if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
-      (0, import_log3.log)("merge point chosen to break the tie", {
-        mergePointId: existing.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 408,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return mergePointId === candidateVertex.id;
-    }
-    const candidateCredential = candidateVertex.credential;
-    const currentCredential = currentVertex.credential;
-    if (existing.credentials.has(candidateCredential.id) !== candidate.credentials.has(currentCredential.id)) {
-      (0, import_log3.log)("one of the credentials was overridden in another branch", {
-        current: currentVertex.id,
-        candidate: candidateVertex.id
-      }, {
-        F: __dxlog_file4,
-        L: 415,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return candidate.credentials.has(currentCredential.id);
-    }
-    const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
-    if (winningCredential != null) {
-      return winningCredential === candidateCredential;
-    }
-    if (candidate.forkIssuers.size !== existing.forkIssuers.size) {
-      (0, import_log3.log)("longer issuers branch used to break the tie", {
-        issuerCount: [
-          existing.forkIssuers.size,
-          candidate.forkIssuers.size
-        ]
-      }, {
-        F: __dxlog_file4,
-        L: 432,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return candidate.forkIssuers.size > existing.forkIssuers.size;
-    }
-    (0, import_log3.log)("issuance date used to break the tie", void 0, {
-      F: __dxlog_file4,
-      L: 437,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
-  }
-  _createRootPath() {
-    return {
-      head: this._root,
-      chosenPath: {},
-      forkIssuers: new import_util7.ComplexSet(import_keys8.PublicKey.hash),
-      forkChangedSubjects: new import_util7.ComplexSet(import_keys8.PublicKey.hash),
-      state: new import_util7.ComplexMap(import_keys8.PublicKey.hash),
-      credentials: new import_util7.ComplexSet(import_keys8.PublicKey.hash)
-    };
-  }
-};
-var toChosenPath = (path) => {
-  return Object.fromEntries(Object.entries(path.chosenPath).map(([k, vs]) => [
-    k,
-    vs.map((v) => v.id)
-  ]));
-};
-var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
-var MemberStateMachine = class {
-  constructor(_spaceKey) {
-    this._spaceKey = _spaceKey;
-    this._memberProfiles = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
-    this._hashgraph = new CredentialGraph(this);
-    this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
-  }
-  get creator() {
-    return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
-  }
-  get members() {
-    return this._hashgraph.getState();
-  }
-  get membershipChainHeads() {
-    return this._hashgraph.getLeafIds();
-  }
-  getRole(member) {
-    return this._getRole(this._hashgraph.getGlobalStateScope(), member);
-  }
-  /**
-  * Processes the SpaceMember credential.
-  * Assumes the credential is already pre-verified and the issuer has been authorized to issue credentials of this type.
-  */
-  async process(credential) {
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.credentials.SpaceMember": {
-        (0, import_invariant4.invariant)(assertion.spaceKey.equals(this._spaceKey), void 0, {
-          F: __dxlog_file5,
-          L: 66,
-          S: this,
-          A: [
-            "assertion.spaceKey.equals(this._spaceKey)",
-            ""
-          ]
-        });
-        if (this._ownerKey == null && credential.issuer === this._spaceKey) {
-          this._ownerKey = credential.subject.id;
-        }
-        if (assertion.profile != null) {
-          this._memberProfiles.set(credential.subject.id, assertion.profile);
-        }
-        await this._hashgraph.addVertex(credential, assertion);
-        break;
-      }
-      case "dxos.halo.credentials.MemberProfile": {
-        const member = this._hashgraph.getSubjectState(credential.subject.id);
-        if (member) {
-          member.profile = assertion.profile;
-        } else {
-          import_log2.log.warn("Member not found", {
-            id: credential.subject.id
-          }, {
-            F: __dxlog_file5,
-            L: 81,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-        }
-        this._memberProfiles.set(credential.subject.id, assertion.profile);
-        break;
-      }
-      default:
-        throw new Error("Invalid assertion type");
-    }
-  }
-  createState(credential, assertion) {
-    const memberKey = credential.subject.id;
-    return {
-      key: memberKey,
-      role: assertion.role,
-      credential,
-      assertion,
-      profile: this._memberProfiles.get(memberKey)
-    };
-  }
-  isUpdateAllowed(scope, credential, assertion) {
-    if (assertion.role === import_credentials3.SpaceMember.Role.OWNER) {
-      return credential.issuer.equals(this._spaceKey);
-    }
-    const issuer = credential.issuer;
-    const isChangingOwnRole = issuer.equals(credential.subject.id);
-    if (isChangingOwnRole) {
-      return false;
-    }
-    if (issuer.equals(assertion.spaceKey)) {
-      return true;
-    }
-    const issuerRole = this._getRole(scope, issuer);
-    return issuerRole === import_credentials3.SpaceMember.Role.ADMIN || issuerRole === import_credentials3.SpaceMember.Role.OWNER;
-  }
-  getConflictingPaths(paths, update) {
-    if (update.assertion.role !== import_credentials3.SpaceMember.Role.REMOVED && update.assertion.role !== import_credentials3.SpaceMember.Role.EDITOR) {
-      return [];
-    }
-    const memberId = update.credential.subject.id;
-    return paths.filter((p) => p.forkIssuers.has(memberId));
-  }
-  tryPickWinningUpdate(scope1, update1, scope2, update2) {
-    const path1IssuerRole = this._getRole(scope1, update1.issuer);
-    const path2IssuerRole = this._getRole(scope2, update2.issuer);
-    if (path2IssuerRole === import_credentials3.SpaceMember.Role.OWNER !== (path1IssuerRole === import_credentials3.SpaceMember.Role.OWNER)) {
-      (0, import_log2.log)("owner decision used to break the tie", void 0, {
-        F: __dxlog_file5,
-        L: 139,
-        S: this,
-        C: (f, a) => f(...a)
-      });
-      return path1IssuerRole === import_credentials3.SpaceMember.Role.OWNER ? update1 : update2;
-    }
-    return null;
-  }
-  toLogString(assertion) {
-    const role = assertion?.role ?? import_credentials3.SpaceMember.Role.REMOVED;
-    return Object.entries(import_credentials3.SpaceMember.Role).find(([_, value]) => value === role)[0];
-  }
-  hasStateChanged(s1, s2) {
-    return s1?.role !== s2?.role;
-  }
-  _getRole(scope, memberId) {
-    if (this._ownerKey?.equals(memberId)) {
-      return import_credentials3.SpaceMember.Role.OWNER;
-    }
-    const realRole = scope.state.get(memberId)?.assertion?.role ?? import_credentials3.SpaceMember.Role.REMOVED;
-    if (scope.stateOverrides != null) {
-      const override = scope.stateOverrides.get(memberId);
-      if (override != null) {
-        (0, import_log2.log)("member role overridden in path", () => ({
-          headId: scope.head?.id,
-          roleOverride: this.toLogString(override.assertion),
-          realRole: this.toLogString(scope.state.get(memberId)?.assertion)
-        }), {
-          F: __dxlog_file5,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        return override.assertion.role;
-      }
-    }
-    return realRole;
-  }
-};
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
-var SpaceStateMachine = class {
-  constructor(_spaceKey) {
-    this._spaceKey = _spaceKey;
-    this._members = new MemberStateMachine(this._spaceKey);
-    this._feeds = new FeedStateMachine(this._spaceKey);
-    this._invitations = new InvitationStateMachine();
-    this._credentials = [];
-    this._credentialsById = new import_util3.ComplexMap(import_keys4.PublicKey.hash);
-    this._processedCredentials = new import_util3.ComplexSet(import_keys4.PublicKey.hash);
-    this._credentialProcessors = [];
-    this.onCredentialProcessed = new import_util3.Callback();
-    this.onMemberRoleChanged = this._members.onMemberRoleChanged;
-    this.onFeedAdmitted = this._feeds.onFeedAdmitted;
-    this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
-    this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
-  }
-  get creator() {
-    return this._members.creator;
-  }
-  get members() {
-    return this._members.members;
-  }
-  get membershipChainHeads() {
-    return this._members.membershipChainHeads;
-  }
-  get feeds() {
-    return this._feeds.feeds;
-  }
-  get credentials() {
-    return this._credentials.map((entry) => entry.credential);
-  }
-  get credentialEntries() {
-    return this._credentials;
-  }
-  get genesisCredential() {
-    return this._genesisCredential;
-  }
-  get invitations() {
-    return this._invitations.invitations;
-  }
-  async addCredentialProcessor(processor) {
-    if (this._credentialProcessors.find((p) => p.processor === processor)) {
-      throw new Error("Credential processor already added.");
-    }
-    const consumer = new CredentialConsumer(processor, async () => {
-      for (const credential of this.credentials) {
-        await consumer._process(credential);
-      }
-      consumer._isReadyForLiveCredentials = true;
-    }, async () => {
-      this._credentialProcessors = this._credentialProcessors.filter((p) => p !== consumer);
-    });
-    this._credentialProcessors.push(consumer);
-    await consumer.open();
-  }
-  async removeCredentialProcessor(processor) {
-    const consumer = this._credentialProcessors.find((p) => p.processor === processor);
-    await consumer?.close();
-  }
-  getCredentialsOfType(type) {
-    return this.credentials.filter((credential) => getCredentialAssertion(credential)["@type"] === type);
-  }
-  /**
-  * @param credential Message to process.
-  * @param fromFeed Key of the feed where this credential is recorded.
-  */
-  async process(credential, { sourceFeed, skipVerification }) {
-    if (credential.id) {
-      if (this._processedCredentials.has(credential.id)) {
-        return true;
-      }
-      this._processedCredentials.add(credential.id);
-    }
-    if (!skipVerification) {
-      const result = await verifyCredential(credential);
-      if (result.kind !== "pass") {
-        import_log.log.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
-          F: __dxlog_file6,
-          L: 156,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        return false;
-      }
-    }
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.credentials.SpaceGenesis": {
-        if (this._genesisCredential) {
-          import_log.log.warn("Space already has a genesis credential.", void 0, {
-            F: __dxlog_file6,
-            L: 165,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        if (!credential.issuer.equals(this._spaceKey)) {
-          import_log.log.warn("Space genesis credential must be issued by space.", void 0, {
-            F: __dxlog_file6,
-            L: 169,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        if (!credential.subject.id.equals(this._spaceKey)) {
-          import_log.log.warn("Space genesis credential must be issued to space.", void 0, {
-            F: __dxlog_file6,
-            L: 173,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        this._genesisCredential = credential;
-        break;
-      }
-      case "dxos.halo.credentials.SpaceMember": {
-        if (!assertion.spaceKey.equals(this._spaceKey)) {
-          break;
-        }
-        if (!this._genesisCredential) {
-          import_log.log.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 186,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        if (!this._canInviteNewMembers(credential.issuer)) {
-          import_log.log.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 190,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        await this._members.process(credential);
-        await this._invitations.process(credential);
-        break;
-      }
-      case "dxos.halo.credentials.MemberProfile": {
-        if (!this._genesisCredential) {
-          import_log.log.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 201,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        await this._members.process(credential);
-        break;
-      }
-      case "dxos.halo.credentials.AdmittedFeed": {
-        if (!this._genesisCredential) {
-          import_log.log.warn("Space must have a genesis credential before admitting feeds.", void 0, {
-            F: __dxlog_file6,
-            L: 211,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        await this._feeds.process(credential, sourceFeed);
-        break;
-      }
-      case "dxos.halo.invitations.CancelDelegatedInvitation":
-      case "dxos.halo.invitations.DelegateSpaceInvitation": {
-        if (!this._canInviteNewMembers(credential.issuer)) {
-          import_log.log.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 222,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return false;
-        }
-        await this._invitations.process(credential);
-        break;
-      }
-    }
-    const newEntry = {
-      credential,
-      sourceFeed,
-      revoked: false
-    };
-    this._credentials.push(newEntry);
-    if (credential.id) {
-      this._credentialsById.set(credential.id, newEntry);
-    }
-    for (const processor of this._credentialProcessors) {
-      if (processor._isReadyForLiveCredentials) {
-        await processor._process(credential);
-      }
-    }
-    await this.onCredentialProcessed.callIfSet(credential);
-    return true;
-  }
-  getMemberRole(memberKey) {
-    return this._members.getRole(memberKey);
-  }
-  hasMembershipManagementPermission(memberKey) {
-    return this._canInviteNewMembers(memberKey);
-  }
-  _canInviteNewMembers(key) {
-    return key.equals(this._spaceKey) || this._members.getRole(key) === import_credentials2.SpaceMember.Role.ADMIN || this._members.getRole(key) === import_credentials2.SpaceMember.Role.OWNER;
-  }
-};
-_ts_decorate([
-  import_async.synchronized
-], SpaceStateMachine.prototype, "process", null);
-var CredentialConsumer = class {
-  constructor(processor, _onOpen, _onClose) {
-    this.processor = processor;
-    this._onOpen = _onOpen;
-    this._onClose = _onClose;
-    this._ctx = new import_context.Context(void 0, {
-      F: __dxlog_file6,
-      L: 267
-    });
-    this._isReadyForLiveCredentials = false;
-  }
-  /**
-  * @internal
-  */
-  async _process(credential) {
-    await (0, import_async.runInContextAsync)(this._ctx, async () => {
-      await this.processor.processCredential(credential);
-    });
-  }
-  async open() {
-    if (this._ctx.disposed) {
-      throw new Error("CredentialProcessor is disposed");
-    }
-    await this._onOpen();
-  }
-  async close() {
-    await this._ctx.dispose();
-    await this._onClose();
-  }
-};
-var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
-var DeviceStateMachine = class {
-  constructor(_params) {
-    this._params = _params;
-    this.authorizedDeviceKeys = new import_util8.ComplexMap(import_keys9.PublicKey.hash);
-    this.deviceChainReady = new import_async2.Trigger();
-  }
-  async processCredential(credential) {
-    (0, import_log4.log)("processing credential...", {
-      identityKey: this._params.identityKey,
-      deviceKey: this._params.deviceKey,
-      credential
-    }, {
-      F: __dxlog_file7,
-      L: 35,
-      S: this,
-      C: (f, a) => f(...a)
-    });
-    if (isValidAuthorizedDeviceCredential(credential, this._params.identityKey, this._params.deviceKey)) {
-      this.deviceCredentialChain = {
-        credential
-      };
-      this.deviceChainReady.wake();
-    }
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.credentials.AuthorizedDevice": {
-        this.authorizedDeviceKeys.set(assertion.deviceKey, this.authorizedDeviceKeys.get(assertion.deviceKey) ?? {});
-        (0, import_log4.log)("added device", {
-          localDeviceKey: this._params.deviceKey,
-          deviceKey: assertion.deviceKey,
-          size: this.authorizedDeviceKeys.size
-        }, {
-          F: __dxlog_file7,
-          L: 55,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        this._params.onUpdate?.();
-        break;
-      }
-      case "dxos.halo.credentials.DeviceProfile": {
-        (0, import_invariant6.invariant)(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
-          F: __dxlog_file7,
-          L: 65,
-          S: this,
-          A: [
-            "this.authorizedDeviceKeys.has(credential.subject.id)",
-            "'Device not found.'"
-          ]
-        });
-        if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
-          import_log4.log.trace("dxos.halo.device", {
-            deviceKey: credential.subject.id,
-            profile: assertion.profile
-          }, {
-            F: __dxlog_file7,
-            L: 68,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-        }
-        this.authorizedDeviceKeys.set(credential.subject.id, assertion.profile);
-        this._params.onUpdate?.();
-        break;
-      }
-    }
-  }
-};
-var __dxlog_file8 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
-var ProfileStateMachine = class {
-  constructor(_params) {
-    this._params = _params;
-  }
-  async processCredential(credential) {
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion["@type"]) {
-      case "dxos.halo.credentials.IdentityProfile": {
-        if (!credential.issuer.equals(this._params.identityKey) || !credential.subject.id.equals(this._params.identityKey)) {
-          import_log5.log.warn("Invalid profile credential", {
-            expectedIdentity: this._params.identityKey,
-            credential
-          }, {
-            F: __dxlog_file8,
-            L: 34,
-            S: this,
-            C: (f, a) => f(...a)
-          });
-          return;
-        }
-        this.profile = assertion.profile;
-        (0, import_log5.log)("updated profile", {
-          identityKey: this._params.identityKey,
-          profile: this.profile
-        }, {
-          F: __dxlog_file8,
-          L: 40,
-          S: this,
-          C: (f, a) => f(...a)
-        });
-        this._params.onUpdate?.();
-        break;
-      }
-    }
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  CredentialGenerator,
-  DeviceStateMachine,
-  FeedStateMachine,
-  InvitationStateMachine,
-  MemberStateMachine,
-  ProfileStateMachine,
-  SIGNATURE_TYPE_ED25519,
-  SpaceStateMachine,
-  canonicalStringify,
-  checkCredentialType,
-  createAdmissionCredentials,
-  createCancelDelegatedSpaceInvitationCredential,
-  createCredential,
-  createCredentialMessage,
-  createCredentialSignerWithChain,
-  createCredentialSignerWithKey,
-  createDelegatedSpaceInvitationCredential,
-  createDeviceAuthorization,
-  createDidFromIdentityKey,
-  credentialTypeFilter,
-  defaultSecretProvider,
-  defaultSecretValidator,
-  generatePasscode,
-  generateSeedPhrase,
-  getCredentialAssertion,
-  getCredentialProofPayload,
-  getPresentationProofPayload,
-  isValidAuthorizedDeviceCredential,
-  keyPairFromSeedPhrase,
-  signPresentation,
-  verifyChain,
-  verifyCredential,
-  verifyCredentialSignature,
-  verifyPresentation,
-  verifyPresentationChain,
-  verifyPresentationSignature
-});
-//# sourceMappingURL=index.cjs.map