@dxos/credentials 0.8.4-main.dedc0f3 → 0.8.4-main.dfabb4ec29

package/dist/lib/{browser → neutral}/index.mjs

@@ -28,15 +28,7 @@ import { invariant } from "@dxos/invariant";
 var __dxlog_file = "/__w/dxos/dxos/packages/core/halo/credentials/src/seedphrase.ts";
 var generateSeedPhrase = () => generateMnemonic();
 var keyPairFromSeedPhrase = (seedPhrase) => {
-  invariant(seedPhrase, void 0, {
-    F: __dxlog_file,
-    L: 20,
-    S: void 0,
-    A: [
-      "seedPhrase",
-      ""
-    ]
-  });
+  invariant(seedPhrase, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file, L: 13, S: void 0, A: ["seedPhrase", ""] });
   const seed = mnemonicToSeedSync(seedPhrase);
   return createKeyPair(seed);
 };
@@ -68,6 +60,14 @@ var getCredentialProofPayload = (credential) => {
     delete copy.parentCredentialIds;
   }
   delete copy.id;
+  const assertion = copy.subject?.assertion;
+  if (assertion) {
+    for (const key of Object.keys(assertion)) {
+      if (Array.isArray(assertion[key]) && assertion[key].length === 0) {
+        delete assertion[key];
+      }
+    }
+  }
   return Buffer.from(canonicalStringify(copy));
 };
 var canonicalStringify = (obj) => stableStringify(obj, {
@@ -228,35 +228,11 @@ var verifyChain = async (chain, authority, subject) => {
 // src/credentials/credential-factory.ts
 var __dxlog_file2 = "/__w/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
 var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
-  invariant2(assertion["@type"], "Invalid assertion.", {
-    F: __dxlog_file2,
-    L: 48,
-    S: void 0,
-    A: [
-      "assertion['@type']",
-      "'Invalid assertion.'"
-    ]
-  });
-  invariant2(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
-    F: __dxlog_file2,
-    L: 49,
-    S: void 0,
-    A: [
-      "!!signingKey === !!chain",
-      "'Chain must be provided if and only if the signing key differs from the issuer.'"
-    ]
-  });
+  invariant2(assertion["@type"], "Invalid assertion.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 12, S: void 0, A: ["assertion['@type']", "'Invalid assertion.'"] });
+  invariant2(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 13, S: void 0, A: ["!!signingKey === !!chain", "'Chain must be provided if and only if the signing key differs from the issuer.'"] });
   if (chain) {
     const result = await verifyChain(chain, issuer, signingKey);
-    invariant2(result.kind === "pass", "Invalid chain.", {
-      F: __dxlog_file2,
-      L: 52,
-      S: void 0,
-      A: [
-        "result.kind === 'pass'",
-        "'Invalid chain.'"
-      ]
-    });
+    invariant2(result.kind === "pass", "Invalid chain.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 16, S: void 0, A: ["result.kind === 'pass'", "'Invalid chain.'"] });
   }
   const credential = {
     issuer,
@@ -314,26 +290,21 @@ var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
 });
 
 // src/credentials/credential-generator.ts
-import { AdmittedFeed, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { AdmittedFeed, MembershipPolicy, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe2 } from "@dxos/timeframe";
-function _define_property(obj, key, value) {
-  if (key in obj) {
-    Object.defineProperty(obj, key, {
-      value,
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  } else {
-    obj[key] = value;
-  }
-  return obj;
-}
 var CredentialGenerator = class {
+  _signer;
+  _identityKey;
+  _deviceKey;
+  constructor(_signer, _identityKey, _deviceKey) {
+    this._signer = _signer;
+    this._identityKey = _identityKey;
+    this._deviceKey = _deviceKey;
+  }
   /**
   * Create genesis messages for new Space.
   */
-  async createSpaceGenesis(spaceKey, controlKey, creatorProfile) {
+  async createSpaceGenesis(spaceKey, controlKey, creatorProfile, membershipPolicy = MembershipPolicy.INVITE) {
     return [
       await createCredential({
         signer: this._signer,
@@ -341,7 +312,8 @@ var CredentialGenerator = class {
         subject: spaceKey,
         assertion: {
           "@type": "dxos.halo.credentials.SpaceGenesis",
-          spaceKey
+          spaceKey,
+          membershipPolicy
         }
       }),
       await createCredential({
@@ -451,14 +423,6 @@ var CredentialGenerator = class {
       }
     });
   }
-  constructor(_signer, _identityKey, _deviceKey) {
-    _define_property(this, "_signer", void 0);
-    _define_property(this, "_identityKey", void 0);
-    _define_property(this, "_deviceKey", void 0);
-    this._signer = _signer;
-    this._identityKey = _identityKey;
-    this._deviceKey = _deviceKey;
-  }
 };
 var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
   const credentials = await Promise.all([
@@ -476,7 +440,7 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId, tags) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
@@ -487,7 +451,8 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
         role,
         profile,
         genesisFeedKey,
-        invitationCredentialId
+        invitationCredentialId,
+        tags: tags ?? []
       }
     })
   ]);
@@ -644,28 +609,21 @@ import { runInContextAsync, synchronized } from "@dxos/async";
 import { Context } from "@dxos/context";
 import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log3 } from "@dxos/log";
-import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { MembershipPolicy as MembershipPolicy2, SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Callback as Callback4, ComplexMap as ComplexMap6, ComplexSet as ComplexSet3 } from "@dxos/util";
 
 // src/state-machine/feed-state-machine.ts
 import { invariant as invariant3 } from "@dxos/invariant";
 import { PublicKey as PublicKey4 } from "@dxos/keys";
 import { Callback, ComplexMap as ComplexMap2 } from "@dxos/util";
-function _define_property2(obj, key, value) {
-  if (key in obj) {
-    Object.defineProperty(obj, key, {
-      value,
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  } else {
-    obj[key] = value;
-  }
-  return obj;
-}
 var __dxlog_file3 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
 var FeedStateMachine = class {
+  _spaceKey;
+  _feeds = new ComplexMap2(PublicKey4.hash);
+  onFeedAdmitted = new Callback();
+  constructor(_spaceKey) {
+    this._spaceKey = _spaceKey;
+  }
   get feeds() {
     return this._feeds;
   }
@@ -677,24 +635,8 @@ var FeedStateMachine = class {
   */
   async process(credential, fromFeed) {
     const assertion = getCredentialAssertion(credential);
-    invariant3(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, {
-      F: __dxlog_file3,
-      L: 47,
-      S: this,
-      A: [
-        "assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'",
-        ""
-      ]
-    });
-    invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, {
-      F: __dxlog_file3,
-      L: 48,
-      S: this,
-      A: [
-        "assertion.spaceKey.equals(this._spaceKey)",
-        ""
-      ]
-    });
+    invariant3(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 28, S: this, A: ["assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'", ""] });
+    invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 29, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
     const info = {
       key: credential.subject.id,
       credential,
@@ -704,33 +646,17 @@ var FeedStateMachine = class {
     this._feeds.set(credential.subject.id, info);
     await this.onFeedAdmitted.callIfSet(info);
   }
-  constructor(_spaceKey) {
-    _define_property2(this, "_spaceKey", void 0);
-    _define_property2(this, "_feeds", void 0);
-    _define_property2(this, "onFeedAdmitted", void 0);
-    this._spaceKey = _spaceKey;
-    this._feeds = new ComplexMap2(PublicKey4.hash);
-    this.onFeedAdmitted = new Callback();
-  }
 };
 
 // src/state-machine/invitation-state-machine.ts
 import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { Callback as Callback2, ComplexMap as ComplexMap3, ComplexSet } from "@dxos/util";
-function _define_property3(obj, key, value) {
-  if (key in obj) {
-    Object.defineProperty(obj, key, {
-      value,
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  } else {
-    obj[key] = value;
-  }
-  return obj;
-}
 var InvitationStateMachine = class {
+  _invitations = new ComplexMap3(PublicKey5.hash);
+  _redeemedInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
+  _cancelledInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
+  onDelegatedInvitation = new Callback2();
+  onDelegatedInvitationRemoved = new Callback2();
   get invitations() {
     return this._invitations;
   }
@@ -788,13 +714,6 @@ var InvitationStateMachine = class {
       }
     }
   }
-  constructor() {
-    _define_property3(this, "_invitations", new ComplexMap3(PublicKey5.hash));
-    _define_property3(this, "_redeemedInvitationCredentialIds", new ComplexSet(PublicKey5.hash));
-    _define_property3(this, "_cancelledInvitationCredentialIds", new ComplexSet(PublicKey5.hash));
-    _define_property3(this, "onDelegatedInvitation", new Callback2());
-    _define_property3(this, "onDelegatedInvitationRemoved", new Callback2());
-  }
 };
 
 // src/state-machine/member-state-machine.ts
@@ -809,21 +728,43 @@ import { invariant as invariant4 } from "@dxos/invariant";
 import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { log } from "@dxos/log";
 import { Callback as Callback3, ComplexMap as ComplexMap4, ComplexSet as ComplexSet2 } from "@dxos/util";
-function _define_property4(obj, key, value) {
-  if (key in obj) {
-    Object.defineProperty(obj, key, {
-      value,
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  } else {
-    obj[key] = value;
-  }
-  return obj;
-}
 var __dxlog_file4 = "/__w/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
 var CredentialGraph = class {
+  _stateHandler;
+  /**
+  * Local ids are used during traversals.
+  */
+  _vertexIdGenerator = 1;
+  /**
+  * All credentials without parent references are connected to the root.
+  */
+  _root = {
+    id: -1,
+    parents: [],
+    children: []
+  };
+  /**
+  * A credential which is not a parent of any other credential has the sentinel as a child.
+  * Sentinel is a virtual merge-point of all credentials.
+  */
+  _sentinel = {
+    id: -2,
+    parents: [],
+    children: []
+  };
+  /**
+  * Vertex references are used for fast credential inserts into the graph.
+  */
+  _vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
+  /**
+  * The current state of the graph.
+  */
+  _subjectToVertex = new ComplexMap4(PublicKey6.hash);
+  _subjectToState = new ComplexMap4(PublicKey6.hash);
+  onSubjectStateChanged = new Callback3();
+  constructor(_stateHandler) {
+    this._stateHandler = _stateHandler;
+  }
   getSubjectState(subjectId) {
     return this._subjectToState.get(subjectId);
   }
@@ -858,12 +799,7 @@ var CredentialGraph = class {
           log.error("credential skipped because of the unknown parent", {
             credential,
             parentId
-          }, {
-            F: __dxlog_file4,
-            L: 72,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 70, S: this });
           continue;
         }
         parentVertex.children.push(newVertex);
@@ -880,29 +816,13 @@ var CredentialGraph = class {
     if (sentinelIdx >= 0) {
       vertex.children.splice(sentinelIdx, 1);
       const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
-      invariant4(vertexInSentinelIdx >= 0, void 0, {
-        F: __dxlog_file4,
-        L: 90,
-        S: this,
-        A: [
-          "vertexInSentinelIdx >= 0",
-          ""
-        ]
-      });
+      invariant4(vertexInSentinelIdx >= 0, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 90, S: this, A: ["vertexInSentinelIdx >= 0", ""] });
       this._sentinel.parents.splice(vertexInSentinelIdx, 1);
     }
   }
   async _onVertexInserted(newVertex) {
     const { credential, assertion } = newVertex;
-    invariant4(credential, void 0, {
-      F: __dxlog_file4,
-      L: 97,
-      S: this,
-      A: [
-        "credential",
-        ""
-      ]
-    });
+    invariant4(credential, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 96, S: this, A: ["credential", ""] });
     let changedSubjects = [];
     const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
     if (isUpdateAppliedOnTopOfThePreviousState) {
@@ -939,21 +859,11 @@ var CredentialGraph = class {
       const path = paths.pop();
       log("visit vertex", {
         id: path.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 132,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 131, S: this });
       this._updatePathState(path);
       const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
       if (convergedPaths == null) {
-        log("waiting for other paths", void 0, {
-          F: __dxlog_file4,
-          L: 136,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        log("waiting for other paths", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 137, S: this });
         continue;
       }
       const mergeResult = this._mergePaths(convergedPaths);
@@ -977,12 +887,7 @@ var CredentialGraph = class {
           path: toChosenPath(p),
           head: p.head.id
         }))
-      }, {
-        F: __dxlog_file4,
-        L: 155,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 156, S: this });
     }
     return this._setCurrentState(lastPath);
   }
@@ -1003,12 +908,7 @@ var CredentialGraph = class {
         path: toChosenPath(path),
         overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
       }))
-    }), {
-      F: __dxlog_file4,
-      L: 175,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 175, S: this });
     const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
     pendingPaths.set(convergedPaths[0].head.id, clearedPending);
   }
@@ -1020,12 +920,7 @@ var CredentialGraph = class {
       return null;
     }
     if (path.head.id === this._sentinel.id && paths.length > 0) {
-      log("waiting for all the active paths to converge on the sentinel", void 0, {
-        F: __dxlog_file4,
-        L: 199,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      log("waiting for all the active paths to converge on the sentinel", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 194, S: this });
       return null;
     }
     pendingPaths.delete(path.head.id);
@@ -1050,12 +945,7 @@ var CredentialGraph = class {
       log("path state updated", () => ({
         subject: updatedSubject,
         newState: this._stateHandler.toLogString(path.head.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 223,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 217, S: this });
     }
   }
   _forkTraversal(paths, path) {
@@ -1065,12 +955,7 @@ var CredentialGraph = class {
       log("edge traversal", {
         from: path.head.id,
         to: choice.id
-      }, {
-        F: __dxlog_file4,
-        L: 234,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 227, S: this });
       const fork = {
         forkPoint: path,
         chosenPath: {
@@ -1163,15 +1048,7 @@ var CredentialGraph = class {
     return path;
   }
   _mergePaths(convergedPaths) {
-    invariant4(convergedPaths.length >= 1, void 0, {
-      F: __dxlog_file4,
-      L: 324,
-      S: this,
-      A: [
-        "convergedPaths.length >= 1",
-        ""
-      ]
-    });
+    invariant4(convergedPaths.length >= 1, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 320, S: this, A: ["convergedPaths.length >= 1", ""] });
     if (convergedPaths.length === 1) {
       return {
         type: "merged",
@@ -1183,22 +1060,9 @@ var CredentialGraph = class {
       forkPointId: forkPoint.head.id,
       pathCount: convergedPaths.length,
       forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
-    }), {
-      F: __dxlog_file4,
-      L: 329,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 328, S: this });
     const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
-    invariant4(forkPoint, void 0, {
-      F: __dxlog_file4,
-      L: 335,
-      S: this,
-      A: [
-        "forkPoint",
-        ""
-      ]
-    });
+    invariant4(forkPoint, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 334, S: this, A: ["forkPoint", ""] });
     const result = {
       forkPoint: forkPoint.forkPoint,
       chosenPath: {
@@ -1219,12 +1083,7 @@ var CredentialGraph = class {
         modified: path.forkChangedSubjects,
         forkIssuers: path.forkIssuers,
         state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }), {
-        F: __dxlog_file4,
-        L: 348,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 350, S: this });
       path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
       path.credentials.forEach((cred) => result.credentials.add(cred));
       result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
@@ -1244,12 +1103,7 @@ var CredentialGraph = class {
       log("set subject state", () => ({
         subject,
         state: this._stateHandler.toLogString(vertex.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 370,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 372, S: this });
       const otherPaths = paths.filter((p) => p !== branch);
       this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
     }
@@ -1288,12 +1142,7 @@ var CredentialGraph = class {
     if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
       log("merge point chosen to break the tie", {
         mergePointId: existing.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 408,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 412, S: this });
       return mergePointId === candidateVertex.id;
     }
     const candidateCredential = candidateVertex.credential;
@@ -1302,12 +1151,7 @@ var CredentialGraph = class {
       log("one of the credentials was overridden in another branch", {
         current: currentVertex.id,
         candidate: candidateVertex.id
-      }, {
-        F: __dxlog_file4,
-        L: 415,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 421, S: this });
       return candidate.credentials.has(currentCredential.id);
     }
     const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
@@ -1320,20 +1164,10 @@ var CredentialGraph = class {
           existing.forkIssuers.size,
           candidate.forkIssuers.size
         ]
-      }, {
-        F: __dxlog_file4,
-        L: 432,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 433, S: this });
       return candidate.forkIssuers.size > existing.forkIssuers.size;
     }
-    log("issuance date used to break the tie", void 0, {
-      F: __dxlog_file4,
-      L: 437,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    log("issuance date used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 441, S: this });
     return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
   }
   _createRootPath() {
@@ -1346,32 +1180,6 @@ var CredentialGraph = class {
       credentials: new ComplexSet2(PublicKey6.hash)
     };
   }
-  constructor(_stateHandler) {
-    _define_property4(this, "_stateHandler", void 0);
-    _define_property4(this, "_vertexIdGenerator", void 0);
-    _define_property4(this, "_root", void 0);
-    _define_property4(this, "_sentinel", void 0);
-    _define_property4(this, "_vertexByCredentialId", void 0);
-    _define_property4(this, "_subjectToVertex", void 0);
-    _define_property4(this, "_subjectToState", void 0);
-    _define_property4(this, "onSubjectStateChanged", void 0);
-    this._stateHandler = _stateHandler;
-    this._vertexIdGenerator = 1;
-    this._root = {
-      id: -1,
-      parents: [],
-      children: []
-    };
-    this._sentinel = {
-      id: -2,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
-    this._subjectToVertex = new ComplexMap4(PublicKey6.hash);
-    this._subjectToState = new ComplexMap4(PublicKey6.hash);
-    this.onSubjectStateChanged = new Callback3();
-  }
 };
 var toChosenPath = (path) => {
   return Object.fromEntries(Object.entries(path.chosenPath).map(([k, vs]) => [
@@ -1381,21 +1189,16 @@ var toChosenPath = (path) => {
 };
 
 // src/state-machine/member-state-machine.ts
-function _define_property5(obj, key, value) {
-  if (key in obj) {
-    Object.defineProperty(obj, key, {
-      value,
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  } else {
-    obj[key] = value;
-  }
-  return obj;
-}
 var __dxlog_file5 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
 var MemberStateMachine = class {
+  _spaceKey;
+  _ownerKey;
+  _memberProfiles = new ComplexMap5(PublicKey7.hash);
+  _hashgraph = new CredentialGraph(this);
+  onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
+  constructor(_spaceKey) {
+    this._spaceKey = _spaceKey;
+  }
   get creator() {
     return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
   }
@@ -1416,15 +1219,7 @@ var MemberStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceMember": {
-        invariant5(assertion.spaceKey.equals(this._spaceKey), void 0, {
-          F: __dxlog_file5,
-          L: 66,
-          S: this,
-          A: [
-            "assertion.spaceKey.equals(this._spaceKey)",
-            ""
-          ]
-        });
+        invariant5(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 43, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
         if (this._ownerKey == null && credential.issuer === this._spaceKey) {
           this._ownerKey = credential.subject.id;
         }
@@ -1441,12 +1236,7 @@ var MemberStateMachine = class {
         } else {
           log2.warn("Member not found", {
             id: credential.subject.id
-          }, {
-            F: __dxlog_file5,
-            L: 81,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 59, S: this });
         }
         this._memberProfiles.set(credential.subject.id, assertion.profile);
         break;
@@ -1491,12 +1281,7 @@ var MemberStateMachine = class {
     const path1IssuerRole = this._getRole(scope1, update1.issuer);
     const path2IssuerRole = this._getRole(scope2, update2.issuer);
     if (path2IssuerRole === SpaceMember2.Role.OWNER !== (path1IssuerRole === SpaceMember2.Role.OWNER)) {
-      log2("owner decision used to break the tie", void 0, {
-        F: __dxlog_file5,
-        L: 139,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      log2("owner decision used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 107, S: this });
       return path1IssuerRole === SpaceMember2.Role.OWNER ? update1 : update2;
     }
     return null;
@@ -1520,52 +1305,46 @@ var MemberStateMachine = class {
           headId: scope.head?.id,
           roleOverride: this.toLogString(override.assertion),
           realRole: this.toLogString(scope.state.get(memberId)?.assertion)
-        }), {
-          F: __dxlog_file5,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }), { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 127, S: this });
         return override.assertion.role;
       }
     }
     return realRole;
   }
-  constructor(_spaceKey) {
-    _define_property5(this, "_spaceKey", void 0);
-    _define_property5(this, "_ownerKey", void 0);
-    _define_property5(this, "_memberProfiles", void 0);
-    _define_property5(this, "_hashgraph", void 0);
-    _define_property5(this, "onMemberRoleChanged", void 0);
-    this._spaceKey = _spaceKey;
-    this._memberProfiles = new ComplexMap5(PublicKey7.hash);
-    this._hashgraph = new CredentialGraph(this);
-    this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
-  }
 };
 
 // src/state-machine/space-state-machine.ts
-function _define_property6(obj, key, value) {
-  if (key in obj) {
-    Object.defineProperty(obj, key, {
-      value,
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  } else {
-    obj[key] = value;
-  }
-  return obj;
-}
+var __dxlog_file6 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file6 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 var SpaceStateMachine = class {
+  _spaceKey;
+  _members;
+  _feeds;
+  _invitations = new InvitationStateMachine();
+  _credentials = [];
+  _credentialsById = new ComplexMap6(PublicKey8.hash);
+  _processedCredentials = new ComplexSet3(PublicKey8.hash);
+  _genesisCredential;
+  _tags = [];
+  _membershipPolicy = MembershipPolicy2.INVITE;
+  _credentialProcessors = [];
+  onCredentialProcessed = new Callback4();
+  onMemberRoleChanged;
+  onFeedAdmitted;
+  onDelegatedInvitation = this._invitations.onDelegatedInvitation;
+  onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
+  constructor(_spaceKey) {
+    this._spaceKey = _spaceKey;
+    this._members = new MemberStateMachine(this._spaceKey);
+    this._feeds = new FeedStateMachine(this._spaceKey);
+    this.onMemberRoleChanged = this._members.onMemberRoleChanged;
+    this.onFeedAdmitted = this._feeds.onFeedAdmitted;
+  }
   get creator() {
     return this._members.creator;
   }
@@ -1587,6 +1366,12 @@ var SpaceStateMachine = class {
   get genesisCredential() {
     return this._genesisCredential;
   }
+  get tags() {
+    return this._tags;
+  }
+  get membershipPolicy() {
+    return this._membershipPolicy;
+  }
   get invitations() {
     return this._invitations.invitations;
   }
@@ -1626,12 +1411,7 @@ var SpaceStateMachine = class {
     if (!skipVerification) {
       const result = await verifyCredential(credential);
       if (result.kind !== "pass") {
-        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
-          F: __dxlog_file6,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 116, S: this });
         return false;
       }
     }
@@ -1639,33 +1419,20 @@ var SpaceStateMachine = class {
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceGenesis": {
         if (this._genesisCredential) {
-          log3.warn("Space already has a genesis credential.", void 0, {
-            F: __dxlog_file6,
-            L: 171,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space already has a genesis credential.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 125, S: this });
           return false;
         }
         if (!credential.issuer.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued by space.", void 0, {
-            F: __dxlog_file6,
-            L: 175,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space genesis credential must be issued by space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 129, S: this });
           return false;
         }
         if (!credential.subject.id.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued to space.", void 0, {
-            F: __dxlog_file6,
-            L: 179,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space genesis credential must be issued to space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 133, S: this });
           return false;
         }
         this._genesisCredential = credential;
+        this._tags = assertion.tags ?? [];
+        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy2.INVITE;
         break;
       }
       case "dxos.halo.credentials.SpaceMember": {
@@ -1673,21 +1440,11 @@ var SpaceStateMachine = class {
           break;
         }
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 192,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 147, S: this });
           return false;
         }
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 196,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 151, S: this });
           return false;
         }
         await this._members.process(credential);
@@ -1696,12 +1453,7 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.MemberProfile": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 207,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 161, S: this });
           return false;
         }
         await this._members.process(credential);
@@ -1709,12 +1461,7 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.AdmittedFeed": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
-            F: __dxlog_file6,
-            L: 217,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 170, S: this });
           return false;
         }
         await this._feeds.process(credential, sourceFeed);
@@ -1723,12 +1470,7 @@ var SpaceStateMachine = class {
       case "dxos.halo.invitations.CancelDelegatedInvitation":
       case "dxos.halo.invitations.DelegateSpaceInvitation": {
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 228,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 181, S: this });
           return false;
         }
         await this._invitations.process(credential);
@@ -1759,42 +1501,32 @@ var SpaceStateMachine = class {
     return this._canInviteNewMembers(memberKey);
   }
   _canInviteNewMembers(key) {
+    if (this._membershipPolicy === MembershipPolicy2.LOCKED) {
+      return key.equals(this._spaceKey) && this._members.members.size === 0;
+    }
     return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
   }
-  constructor(_spaceKey) {
-    _define_property6(this, "_spaceKey", void 0);
-    _define_property6(this, "_members", void 0);
-    _define_property6(this, "_feeds", void 0);
-    _define_property6(this, "_invitations", void 0);
-    _define_property6(this, "_credentials", void 0);
-    _define_property6(this, "_credentialsById", void 0);
-    _define_property6(this, "_processedCredentials", void 0);
-    _define_property6(this, "_genesisCredential", void 0);
-    _define_property6(this, "_credentialProcessors", void 0);
-    _define_property6(this, "onCredentialProcessed", void 0);
-    _define_property6(this, "onMemberRoleChanged", void 0);
-    _define_property6(this, "onFeedAdmitted", void 0);
-    _define_property6(this, "onDelegatedInvitation", void 0);
-    _define_property6(this, "onDelegatedInvitationRemoved", void 0);
-    this._spaceKey = _spaceKey;
-    this._invitations = new InvitationStateMachine();
-    this._credentials = [];
-    this._credentialsById = new ComplexMap6(PublicKey8.hash);
-    this._processedCredentials = new ComplexSet3(PublicKey8.hash);
-    this._credentialProcessors = [];
-    this.onCredentialProcessed = new Callback4();
-    this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
-    this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
-    this._members = new MemberStateMachine(this._spaceKey);
-    this._feeds = new FeedStateMachine(this._spaceKey);
-    this.onMemberRoleChanged = this._members.onMemberRoleChanged;
-    this.onFeedAdmitted = this._feeds.onFeedAdmitted;
-  }
 };
 _ts_decorate([
   synchronized
 ], SpaceStateMachine.prototype, "process", null);
 var CredentialConsumer = class {
+  processor;
+  _onOpen;
+  _onClose;
+  _ctx = new Context(void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 229 });
+  /**
+  * @internal
+  * Processor is ready to process live credentials.
+  * NOTE: Setting this flag before all existing credentials are processed will cause them to be processed out of order.
+  * Set externally.
+  */
+  _isReadyForLiveCredentials = false;
+  constructor(processor, _onOpen, _onClose) {
+    this.processor = processor;
+    this._onOpen = _onOpen;
+    this._onClose = _onClose;
+  }
   /**
   * @internal
   */
@@ -1813,21 +1545,6 @@ var CredentialConsumer = class {
     await this._ctx.dispose();
     await this._onClose();
   }
-  constructor(processor, _onOpen, _onClose) {
-    _define_property6(this, "processor", void 0);
-    _define_property6(this, "_onOpen", void 0);
-    _define_property6(this, "_onClose", void 0);
-    _define_property6(this, "_ctx", void 0);
-    _define_property6(this, "_isReadyForLiveCredentials", void 0);
-    this.processor = processor;
-    this._onOpen = _onOpen;
-    this._onClose = _onClose;
-    this._ctx = new Context(void 0, {
-      F: __dxlog_file6,
-      L: 273
-    });
-    this._isReadyForLiveCredentials = false;
-  }
 };
 
 // src/processor/device-state-machine.ts
@@ -1836,32 +1553,22 @@ import { invariant as invariant6 } from "@dxos/invariant";
 import { PublicKey as PublicKey9 } from "@dxos/keys";
 import { log as log4 } from "@dxos/log";
 import { ComplexMap as ComplexMap7 } from "@dxos/util";
-function _define_property7(obj, key, value) {
-  if (key in obj) {
-    Object.defineProperty(obj, key, {
-      value,
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  } else {
-    obj[key] = value;
-  }
-  return obj;
-}
 var __dxlog_file7 = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
 var DeviceStateMachine = class {
+  _params;
+  // TODO(burdon): Return values via getter.
+  authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
+  deviceChainReady = new Trigger();
+  deviceCredentialChain;
+  constructor(_params) {
+    this._params = _params;
+  }
   async processCredential(credential) {
     log4("processing credential...", {
       identityKey: this._params.identityKey,
       deviceKey: this._params.deviceKey,
       credential
-    }, {
-      F: __dxlog_file7,
-      L: 36,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 22, S: this });
     if (isValidAuthorizedDeviceCredential(credential, this._params.identityKey, this._params.deviceKey)) {
       this.deviceCredentialChain = {
         credential
@@ -1876,35 +1583,17 @@ var DeviceStateMachine = class {
           localDeviceKey: this._params.deviceKey,
           deviceKey: assertion.deviceKey,
           size: this.authorizedDeviceKeys.size
-        }, {
-          F: __dxlog_file7,
-          L: 56,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 41, S: this });
         this._params.onUpdate?.();
         break;
       }
       case "dxos.halo.credentials.DeviceProfile": {
-        invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
-          F: __dxlog_file7,
-          L: 66,
-          S: this,
-          A: [
-            "this.authorizedDeviceKeys.has(credential.subject.id)",
-            "'Device not found.'"
-          ]
-        });
+        invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 51, S: this, A: ["this.authorizedDeviceKeys.has(credential.subject.id)", "'Device not found.'"] });
         if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
           log4.trace("dxos.halo.device", {
             deviceKey: credential.subject.id,
             profile: assertion.profile
-          }, {
-            F: __dxlog_file7,
-            L: 69,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 53, S: this });
         }
         this.authorizedDeviceKeys.set(credential.subject.id, assertion.profile);
         this._params.onUpdate?.();
@@ -1912,34 +1601,18 @@ var DeviceStateMachine = class {
       }
     }
   }
-  constructor(_params) {
-    _define_property7(this, "_params", void 0);
-    _define_property7(this, "authorizedDeviceKeys", void 0);
-    _define_property7(this, "deviceChainReady", void 0);
-    _define_property7(this, "deviceCredentialChain", void 0);
-    this._params = _params;
-    this.authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
-    this.deviceChainReady = new Trigger();
-  }
 };
 
 // src/processor/profile-state-machine.ts
 import { log as log5 } from "@dxos/log";
-function _define_property8(obj, key, value) {
-  if (key in obj) {
-    Object.defineProperty(obj, key, {
-      value,
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  } else {
-    obj[key] = value;
-  }
-  return obj;
-}
 var __dxlog_file8 = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
 var ProfileStateMachine = class {
+  _params;
+  // TODO(burdon): Return values via getter.
+  profile;
+  constructor(_params) {
+    this._params = _params;
+  }
   async processCredential(credential) {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
@@ -1948,34 +1621,19 @@ var ProfileStateMachine = class {
           log5.warn("Invalid profile credential", {
             expectedIdentity: this._params.identityKey,
             credential
-          }, {
-            F: __dxlog_file8,
-            L: 35,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 21, S: this });
           return;
         }
         this.profile = assertion.profile;
         log5("updated profile", {
           identityKey: this._params.identityKey,
           profile: this.profile
-        }, {
-          F: __dxlog_file8,
-          L: 41,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 29, S: this });
         this._params.onUpdate?.();
         break;
       }
     }
   }
-  constructor(_params) {
-    _define_property8(this, "_params", void 0);
-    _define_property8(this, "profile", void 0);
-    this._params = _params;
-  }
 };
 export {
   CredentialGenerator,