@dxos/credentials 0.8.4-main.ae835ea → 0.8.4-main.bc2380dfbc

package/docs/README.md

@@ -84,20 +84,20 @@ dxos/mesh-protocol --> dxos/codec-protobuf
 
 ## Dependencies
 
-| Module | Direct |
-|---|---|
-| [`@dxos/async`](../../../../common/async/docs/README.md) | ✓ |
-| [`@dxos/codec-protobuf`](../../../../common/codec-protobuf/docs/README.md) | ✓ |
-| [`@dxos/context`](../../../../common/context/docs/README.md) |  |
-| [`@dxos/crypto`](../../../../common/crypto/docs/README.md) | ✓ |
-| [`@dxos/debug`](../../../../common/debug/docs/README.md) | ✓ |
-| [`@dxos/feed-store`](../../../../common/feed-store/docs/README.md) | ✓ |
-| [`@dxos/hypercore`](../../../../common/hypercore/docs/README.md) |  |
-| [`@dxos/keyring`](../../keyring/docs/README.md) | ✓ |
-| [`@dxos/keys`](../../../../common/keys/docs/README.md) | ✓ |
-| [`@dxos/log`](../../../../common/log/docs/README.md) | ✓ |
-| [`@dxos/mesh-protocol`](../../../mesh/mesh-protocol/docs/README.md) | ✓ |
-| [`@dxos/protocols`](../../../protocols/docs/README.md) | ✓ |
-| [`@dxos/random-access-storage`](../../../../common/random-access-storage/docs/README.md) |  |
-| [`@dxos/timeframe`](../../../../common/timeframe/docs/README.md) |  |
-| [`@dxos/util`](../../../../common/util/docs/README.md) | ✓ |
+| Module                                                                                   | Direct  |
+| ---------------------------------------------------------------------------------------- | ------- |
+| [`@dxos/async`](../../../../common/async/docs/README.md)                                 | ✓ |
+| [`@dxos/codec-protobuf`](../../../../common/codec-protobuf/docs/README.md)               | ✓ |
+| [`@dxos/context`](../../../../common/context/docs/README.md)                             |         |
+| [`@dxos/crypto`](../../../../common/crypto/docs/README.md)                               | ✓ |
+| [`@dxos/debug`](../../../../common/debug/docs/README.md)                                 | ✓ |
+| [`@dxos/feed-store`](../../../../common/feed-store/docs/README.md)                       | ✓ |
+| [`@dxos/hypercore`](../../../../common/hypercore/docs/README.md)                         |         |
+| [`@dxos/keyring`](../../keyring/docs/README.md)                                          | ✓ |
+| [`@dxos/keys`](../../../../common/keys/docs/README.md)                                   | ✓ |
+| [`@dxos/log`](../../../../common/log/docs/README.md)                                     | ✓ |
+| [`@dxos/mesh-protocol`](../../../mesh/mesh-protocol/docs/README.md)                      | ✓ |
+| [`@dxos/protocols`](../../../protocols/docs/README.md)                                   | ✓ |
+| [`@dxos/random-access-storage`](../../../../common/random-access-storage/docs/README.md) |         |
+| [`@dxos/timeframe`](../../../../common/timeframe/docs/README.md)                         |         |
+| [`@dxos/util`](../../../../common/util/docs/README.md)                                   | ✓ |

package/moon.yml

@@ -1,4 +1,4 @@
-type: library
+layer: library
 language: typescript
 tags:
   - ts-build
@@ -9,3 +9,4 @@ tasks:
     args:
       - '--entryPoint=src/index.ts'
       - '--injectGlobals'
+      - '--platform=neutral'

package/package.json

@@ -1,40 +1,39 @@
 {
   "name": "@dxos/credentials",
-  "version": "0.8.4-main.ae835ea",
+  "version": "0.8.4-main.bc2380dfbc",
   "description": "DXOS Credentials",
   "homepage": "https://github.com/dxos/dxos/tree/main/packages/core/halo/credentials#readme",
   "bugs": "https://github.com/dxos/dxos/issues",
-  "repository": "github:dxos/dxos",
-  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dxos/dxos"
+  },
+  "license": "FSL-1.1-Apache-2.0",
   "author": "info@dxos.org",
-  "sideEffects": true,
+  "sideEffects": false,
   "type": "module",
   "exports": {
     ".": {
       "source": "./src/index.ts",
       "types": "./dist/types/src/index.d.ts",
-      "browser": "./dist/lib/browser/index.mjs",
-      "node": "./dist/lib/node-esm/index.mjs"
+      "default": "./dist/lib/neutral/index.mjs"
     }
   },
   "types": "dist/types/src/index.d.ts",
-  "typesVersions": {
-    "*": {}
-  },
   "dependencies": {
     "bip39": "^3.1.0",
     "json-stable-stringify": "^1.3.0",
-    "@dxos/async": "0.8.4-main.ae835ea",
-    "@dxos/context": "0.8.4-main.ae835ea",
-    "@dxos/crypto": "0.8.4-main.ae835ea",
-    "@dxos/invariant": "0.8.4-main.ae835ea",
-    "@dxos/keys": "0.8.4-main.ae835ea",
-    "@dxos/log": "0.8.4-main.ae835ea",
-    "@dxos/keyring": "0.8.4-main.ae835ea",
-    "@dxos/node-std": "0.8.4-main.ae835ea",
-    "@dxos/protocols": "0.8.4-main.ae835ea",
-    "@dxos/timeframe": "0.8.4-main.ae835ea",
-    "@dxos/util": "0.8.4-main.ae835ea"
+    "@dxos/async": "0.8.4-main.bc2380dfbc",
+    "@dxos/crypto": "0.8.4-main.bc2380dfbc",
+    "@dxos/context": "0.8.4-main.bc2380dfbc",
+    "@dxos/keyring": "0.8.4-main.bc2380dfbc",
+    "@dxos/invariant": "0.8.4-main.bc2380dfbc",
+    "@dxos/keys": "0.8.4-main.bc2380dfbc",
+    "@dxos/log": "0.8.4-main.bc2380dfbc",
+    "@dxos/node-std": "0.8.4-main.bc2380dfbc",
+    "@dxos/timeframe": "0.8.4-main.bc2380dfbc",
+    "@dxos/util": "0.8.4-main.bc2380dfbc",
+    "@dxos/protocols": "0.8.4-main.bc2380dfbc"
   },
   "publishConfig": {
     "access": "public"

package/src/credentials/credential-factory.ts

@@ -11,14 +11,14 @@ import { type Chain, type Credential } from '@dxos/protocols/proto/dxos/halo/cre
 import { getCredentialProofPayload } from './signing';
 import { SIGNATURE_TYPE_ED25519, verifyChain } from './verifier';
 
-export type CreateCredentialSignerParams = {
+export type CreateCredentialSignerProps = {
   subject: PublicKey;
   assertion: TypedMessage;
   nonce?: Uint8Array;
   parentCredentialIds?: PublicKey[];
 };
 
-export type CreateCredentialParams = {
+export type CreateCredentialProps = {
   signer: Signer;
   issuer: PublicKey;
   signingKey?: PublicKey;
@@ -44,7 +44,7 @@ export const createCredential = async ({
   chain,
   nonce,
   parentCredentialIds,
-}: CreateCredentialParams): Promise<Credential> => {
+}: CreateCredentialProps): Promise<Credential> => {
   invariant(assertion['@type'], 'Invalid assertion.');
   invariant(!!signingKey === !!chain, 'Chain must be provided if and only if the signing key differs from the issuer.');
   if (chain) {
@@ -93,7 +93,7 @@ export const createCredentialMessage = (credential: Credential) => {
 // TODO(burdon): Vs. Signer.
 export interface CredentialSigner {
   getIssuer(): PublicKey;
-  createCredential: (params: CreateCredentialSignerParams) => Promise<Credential>;
+  createCredential: (params: CreateCredentialSignerProps) => Promise<Credential>;
 }
 
 /**

package/src/credentials/credential-generator.ts

@@ -10,6 +10,7 @@ import {
   AdmittedFeed,
   type Credential,
   type DeviceProfileDocument,
+  MembershipPolicy,
   type ProfileDocument,
   SpaceMember,
 } from '@dxos/protocols/proto/dxos/halo/credentials';
@@ -38,6 +39,7 @@ export class CredentialGenerator {
     spaceKey: PublicKey,
     controlKey: PublicKey,
     creatorProfile?: ProfileDocument,
+    membershipPolicy: MembershipPolicy = MembershipPolicy.INVITE,
   ): Promise<Credential[]> {
     return [
       await createCredential({
@@ -47,6 +49,7 @@ export class CredentialGenerator {
         assertion: {
           '@type': 'dxos.halo.credentials.SpaceGenesis',
           spaceKey,
+          membershipPolicy,
         },
       }),
 
@@ -221,6 +224,7 @@ export const createAdmissionCredentials = async (
   membershipChainHeads: PublicKey[] = [],
   profile?: ProfileDocument,
   invitationCredentialId?: PublicKey,
+  tags?: string[],
 ): Promise<FeedMessage.Payload[]> => {
   const credentials = await Promise.all([
     await signer.createCredential({
@@ -233,6 +237,7 @@ export const createAdmissionCredentials = async (
         profile,
         genesisFeedKey,
         invitationCredentialId,
+        tags: tags ?? [],
       },
     }),
   ]);

package/src/credentials/signing.ts

@@ -27,6 +27,18 @@ export const getCredentialProofPayload = (credential: Credential): Uint8Array =>
   }
   delete copy.id; // ID is not part of the signature payload.
 
+  // Normalize empty repeated fields in the assertion to avoid proto3 serialization asymmetry.
+  // Proto3 does not encode empty repeated fields, but the codec may restore them as [] after deserialization,
+  // causing a signature mismatch if the original signing payload did not include the field.
+  const assertion = (copy.subject as any)?.assertion;
+  if (assertion) {
+    for (const key of Object.keys(assertion)) {
+      if (Array.isArray(assertion[key]) && assertion[key].length === 0) {
+        delete assertion[key];
+      }
+    }
+  }
+
   return Buffer.from(canonicalStringify(copy));
 };
 

package/src/presentations/json-encoding.test.ts

@@ -3,7 +3,6 @@
 //
 
 import { inspect } from 'util';
-
 import { describe, test } from 'vitest';
 
 import { randomBytes } from '@dxos/crypto';
@@ -13,7 +12,6 @@ import { PresentationSchema } from '@dxos/protocols/buf/dxos/halo/credentials_pb
 import { schema } from '@dxos/protocols/proto';
 
 import { createCredential } from '../credentials';
-
 import { signPresentation } from './presentation';
 
 describe('json encoding', () => {

package/src/presentations/presentation.ts

@@ -7,7 +7,6 @@ import { type PublicKey } from '@dxos/keys';
 import { type Chain, type Presentation, type Proof } from '@dxos/protocols/proto/dxos/halo/credentials';
 
 import { SIGNATURE_TYPE_ED25519 } from '../credentials';
-
 import { getPresentationProofPayload } from './signing';
 
 // TODO(burdon): Rename createPresentation?

package/src/presentations/verifier.test.ts

@@ -10,7 +10,6 @@ import { PublicKey } from '@dxos/keys';
 import { type Chain, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 
 import { createCredential } from '../credentials';
-
 import { signPresentation } from './presentation';
 import { verifyPresentation, verifyPresentationSignature } from './verifier';
 

package/src/presentations/verifier.ts

@@ -6,7 +6,6 @@ import { verifySignature } from '@dxos/crypto';
 import { type Presentation, type Proof } from '@dxos/protocols/proto/dxos/halo/credentials';
 
 import { SIGNATURE_TYPE_ED25519, type VerificationResult, verifyChain, verifyCredential } from '../credentials';
-
 import { getPresentationProofPayload } from './signing';
 
 export const verifyPresentation = async (presentation: Presentation): Promise<VerificationResult> => {

package/src/processor/device-state-machine.ts

@@ -10,10 +10,9 @@ import { type Chain, type Credential, type DeviceProfileDocument } from '@dxos/p
 import { ComplexMap } from '@dxos/util';
 
 import { getCredentialAssertion, isValidAuthorizedDeviceCredential } from '../credentials';
-
 import { type CredentialProcessor } from './credential-processor';
 
-export type DeviceStateMachineParams = {
+export type DeviceStateMachineProps = {
   identityKey: PublicKey;
   deviceKey: PublicKey;
   onUpdate?: () => void;
@@ -30,7 +29,7 @@ export class DeviceStateMachine implements CredentialProcessor {
 
   public deviceCredentialChain?: Chain;
 
-  constructor(private readonly _params: DeviceStateMachineParams) {}
+  constructor(private readonly _params: DeviceStateMachineProps) {}
 
   async processCredential(credential: Credential): Promise<void> {
     log('processing credential...', {

package/src/processor/profile-state-machine.ts

@@ -7,10 +7,9 @@ import { log } from '@dxos/log';
 import { type Credential, type ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 
 import { getCredentialAssertion } from '../credentials';
-
 import { type CredentialProcessor } from './credential-processor';
 
-export type ProfileStateMachineParams = {
+export type ProfileStateMachineProps = {
   identityKey: PublicKey;
   onUpdate?: () => void;
 };
@@ -22,7 +21,7 @@ export class ProfileStateMachine implements CredentialProcessor {
   // TODO(burdon): Return values via getter.
   public profile?: ProfileDocument;
 
-  constructor(private readonly _params: ProfileStateMachineParams) {}
+  constructor(private readonly _params: ProfileStateMachineProps) {}
 
   async processCredential(credential: Credential): Promise<void> {
     const assertion = getCredentialAssertion(credential);

package/src/state-machine/invitation-state-machine.test.ts

@@ -16,7 +16,6 @@ import {
   createCredentialSignerWithKey,
   createDelegatedSpaceInvitationCredential,
 } from '../credentials';
-
 import { InvitationStateMachine } from './invitation-state-machine';
 
 describe('InvitationStateMachine', () => {

package/src/state-machine/member-state-machine.test.ts

@@ -10,7 +10,6 @@ import { SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { range } from '@dxos/util';
 
 import { createAdmissionCredentials, createCredentialSignerWithKey } from '../credentials';
-
 import { MemberStateMachine } from './member-state-machine';
 
 const keyring = new Keyring();

package/src/state-machine/space-state-machine.test.ts

@@ -6,10 +6,9 @@ import { describe, expect, test } from 'vitest';
 
 import { Keyring } from '@dxos/keyring';
 import { type PublicKey } from '@dxos/keys';
-import { AdmittedFeed, type Chain, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
+import { AdmittedFeed, type Chain, MembershipPolicy, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 
 import { createCredential, verifyCredential } from '../credentials';
-
 import { SpaceStateMachine } from './space-state-machine';
 
 describe('SpaceStateMachine', () => {
@@ -30,6 +29,7 @@ describe('SpaceStateMachine', () => {
           assertion: {
             '@type': 'dxos.halo.credentials.SpaceGenesis',
             spaceKey: space,
+            membershipPolicy: MembershipPolicy.INVITE,
           },
           signer: keyring,
         }),
@@ -130,6 +130,7 @@ describe('SpaceStateMachine', () => {
           assertion: {
             '@type': 'dxos.halo.credentials.SpaceGenesis',
             spaceKey: space,
+            membershipPolicy: MembershipPolicy.INVITE,
           },
           signer: keyring,
         }),
@@ -211,6 +212,60 @@ describe('SpaceStateMachine', () => {
     expect(spaceState.credentials).toHaveLength(3);
   });
 
+  test('space genesis with tags', async () => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const identity = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    expect(spaceState.tags).toEqual([]);
+
+    expect(
+      await spaceState.process(
+        await createCredential({
+          issuer: space,
+          subject: space,
+          assertion: {
+            '@type': 'dxos.halo.credentials.SpaceGenesis',
+            spaceKey: space,
+            tags: ['personal', 'test'],
+            membershipPolicy: MembershipPolicy.INVITE,
+          },
+          signer: keyring,
+        }),
+        { sourceFeed: feed },
+      ),
+    ).toEqual(true);
+
+    expect(spaceState.tags).toEqual(['personal', 'test']);
+  });
+
+  test('space genesis without tags returns empty array', async () => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.INVITE,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    expect(spaceState.tags).toEqual([]);
+  });
+
   test('storing device credentials and building a chain', async () => {
     const keyring = new Keyring();
     const haloSpace = await keyring.createKey();
@@ -230,6 +285,7 @@ describe('SpaceStateMachine', () => {
           assertion: {
             '@type': 'dxos.halo.credentials.SpaceGenesis',
             spaceKey: haloSpace,
+            membershipPolicy: MembershipPolicy.INVITE,
           },
           signer: keyring,
         }),
@@ -339,4 +395,189 @@ describe('SpaceStateMachine', () => {
 
     expect(await verifyCredential(credential)).toEqual({ kind: 'pass' });
   });
+
+  test('space genesis with membership policy', async () => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.LOCKED,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    expect(spaceState.membershipPolicy).toEqual(MembershipPolicy.LOCKED);
+  });
+
+  test('space genesis without membership policy defaults to INVITE', async () => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    // MembershipPolicy.INVITE is the proto zero-value default.
+    // Existing spaces without the field will have this value.
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.INVITE,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    expect(spaceState.membershipPolicy).toEqual(MembershipPolicy.INVITE);
+  });
+
+  test('locked space rejects new members', async ({ expect }) => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const identity = await keyring.createKey();
+    const identity2 = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.LOCKED,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: identity,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceMember',
+          spaceKey: space,
+          role: SpaceMember.Role.OWNER,
+          genesisFeedKey: feed,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    // Attempt to add a second member — should be rejected.
+    expect(
+      await spaceState.process(
+        await createCredential({
+          issuer: space,
+          subject: identity2,
+          assertion: {
+            '@type': 'dxos.halo.credentials.SpaceMember',
+            spaceKey: space,
+            role: SpaceMember.Role.EDITOR,
+            genesisFeedKey: feed,
+          },
+          signer: keyring,
+        }),
+        { sourceFeed: feed },
+      ),
+    ).toEqual(false);
+
+    expect(spaceState.members.size).toEqual(1);
+  });
+
+  test('locked space allows admitted feeds for existing members', async ({ expect }) => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const identity = await keyring.createKey();
+    const device = await keyring.createKey();
+    const feed = await keyring.createKey();
+    const newFeed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.LOCKED,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: identity,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceMember',
+          spaceKey: space,
+          role: SpaceMember.Role.OWNER,
+          genesisFeedKey: feed,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    const chain: Chain = {
+      credential: await createCredential({
+        assertion: {
+          '@type': 'dxos.halo.credentials.AuthorizedDevice',
+          deviceKey: device,
+          identityKey: identity,
+        },
+        subject: device,
+        issuer: identity,
+        signer: keyring,
+      }),
+    };
+
+    // AdmittedFeed should still work on locked space.
+    expect(
+      await spaceState.process(
+        await createCredential({
+          issuer: identity,
+          subject: newFeed,
+          assertion: {
+            '@type': 'dxos.halo.credentials.AdmittedFeed',
+            spaceKey: space,
+            identityKey: identity,
+            deviceKey: device,
+            designation: AdmittedFeed.Designation.CONTROL,
+          },
+          signer: keyring,
+          signingKey: device,
+          chain,
+        }),
+        { sourceFeed: feed },
+      ),
+    ).toEqual(true);
+
+    expect(spaceState.feeds.size).toEqual(1);
+  });
 });

package/src/state-machine/space-state-machine.ts

@@ -7,13 +7,12 @@ import { Context } from '@dxos/context';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { type TypedMessage } from '@dxos/protocols/proto';
-import { type Credential, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
+import { type Credential, MembershipPolicy, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { type AsyncCallback, Callback, ComplexMap, ComplexSet } from '@dxos/util';
 
 import { getCredentialAssertion, verifyCredential } from '../credentials';
 import { type CredentialProcessor } from '../processor/credential-processor';
-
 import { type FeedInfo, FeedStateMachine } from './feed-state-machine';
 import { InvitationStateMachine } from './invitation-state-machine';
 import { type MemberInfo, MemberStateMachine } from './member-state-machine';
@@ -24,6 +23,8 @@ export interface SpaceState {
   readonly feeds: ReadonlyMap<PublicKey, FeedInfo>;
   readonly credentials: Credential[];
   readonly genesisCredential: Credential | undefined;
+  readonly tags: string[];
+  readonly membershipPolicy: MembershipPolicy;
   readonly creator: MemberInfo | undefined;
   readonly invitations: ReadonlyMap<PublicKey, DelegateSpaceInvitation>;
 
@@ -61,6 +62,8 @@ export class SpaceStateMachine implements SpaceState {
   private readonly _processedCredentials = new ComplexSet<PublicKey>(PublicKey.hash);
 
   private _genesisCredential: Credential | undefined;
+  private _tags: string[] = [];
+  private _membershipPolicy: MembershipPolicy = MembershipPolicy.INVITE;
   private _credentialProcessors: CredentialConsumer<any>[] = [];
 
   readonly onCredentialProcessed = new Callback<AsyncCallback<Credential>>();
@@ -104,6 +107,14 @@ export class SpaceStateMachine implements SpaceState {
     return this._genesisCredential;
   }
 
+  get tags(): string[] {
+    return this._tags;
+  }
+
+  get membershipPolicy(): MembershipPolicy {
+    return this._membershipPolicy;
+  }
+
   get invitations(): ReadonlyMap<PublicKey, DelegateSpaceInvitation> {
     return this._invitations.invitations;
   }
@@ -180,6 +191,8 @@ export class SpaceStateMachine implements SpaceState {
           return false;
         }
         this._genesisCredential = credential;
+        this._tags = assertion.tags ?? [];
+        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy.INVITE;
         break;
       }
 
@@ -260,6 +273,11 @@ export class SpaceStateMachine implements SpaceState {
   }
 
   private _canInviteNewMembers(key: PublicKey): boolean {
+    if (this._membershipPolicy === MembershipPolicy.LOCKED) {
+      // When locked, only the space key can add the initial owner during genesis.
+      // Once a member exists, no new members can be added.
+      return key.equals(this._spaceKey) && this._members.members.size === 0;
+    }
     return (
       key.equals(this._spaceKey) ||
       this._members.getRole(key) === SpaceMember.Role.ADMIN ||