@dxos/credentials 0.8.4-main.f5c0578 → 0.8.4-main.fcfe5033a5

package/dist/lib/{browser → neutral}/index.mjs

@@ -68,6 +68,14 @@ var getCredentialProofPayload = (credential) => {
     delete copy.parentCredentialIds;
   }
   delete copy.id;
+  const assertion = copy.subject?.assertion;
+  if (assertion) {
+    for (const key of Object.keys(assertion)) {
+      if (Array.isArray(assertion[key]) && assertion[key].length === 0) {
+        delete assertion[key];
+      }
+    }
+  }
   return Buffer.from(canonicalStringify(copy));
 };
 var canonicalStringify = (obj) => stableStringify(obj, {
@@ -314,7 +322,7 @@ var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
 });
 
 // src/credentials/credential-generator.ts
-import { AdmittedFeed, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { AdmittedFeed, MembershipPolicy, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe2 } from "@dxos/timeframe";
 var CredentialGenerator = class {
   _signer;
@@ -328,7 +336,7 @@ var CredentialGenerator = class {
   /**
   * Create genesis messages for new Space.
   */
-  async createSpaceGenesis(spaceKey, controlKey, creatorProfile) {
+  async createSpaceGenesis(spaceKey, controlKey, creatorProfile, membershipPolicy = MembershipPolicy.INVITE) {
     return [
       await createCredential({
         signer: this._signer,
@@ -336,7 +344,8 @@ var CredentialGenerator = class {
         subject: spaceKey,
         assertion: {
           "@type": "dxos.halo.credentials.SpaceGenesis",
-          spaceKey
+          spaceKey,
+          membershipPolicy
         }
       }),
       await createCredential({
@@ -463,7 +472,7 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId, tags) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
@@ -474,7 +483,8 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
         role,
         profile,
         genesisFeedKey,
-        invitationCredentialId
+        invitationCredentialId,
+        tags: tags ?? []
       }
     })
   ]);
@@ -631,7 +641,7 @@ import { runInContextAsync, synchronized } from "@dxos/async";
 import { Context } from "@dxos/context";
 import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log3 } from "@dxos/log";
-import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { MembershipPolicy as MembershipPolicy2, SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Callback as Callback4, ComplexMap as ComplexMap6, ComplexSet as ComplexSet3 } from "@dxos/util";
 
 // src/state-machine/feed-state-machine.ts
@@ -641,12 +651,10 @@ import { Callback, ComplexMap as ComplexMap2 } from "@dxos/util";
 var __dxlog_file3 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
 var FeedStateMachine = class {
   _spaceKey;
-  _feeds;
-  onFeedAdmitted;
+  _feeds = new ComplexMap2(PublicKey4.hash);
+  onFeedAdmitted = new Callback();
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._feeds = new ComplexMap2(PublicKey4.hash);
-    this.onFeedAdmitted = new Callback();
   }
   get feeds() {
     return this._feeds;
@@ -774,43 +782,36 @@ var CredentialGraph = class {
   /**
   * Local ids are used during traversals.
   */
-  _vertexIdGenerator;
+  _vertexIdGenerator = 1;
   /**
   * All credentials without parent references are connected to the root.
   */
-  _root;
+  _root = {
+    id: -1,
+    parents: [],
+    children: []
+  };
   /**
   * A credential which is not a parent of any other credential has the sentinel as a child.
   * Sentinel is a virtual merge-point of all credentials.
   */
-  _sentinel;
+  _sentinel = {
+    id: -2,
+    parents: [],
+    children: []
+  };
   /**
   * Vertex references are used for fast credential inserts into the graph.
   */
-  _vertexByCredentialId;
+  _vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
   /**
   * The current state of the graph.
   */
-  _subjectToVertex;
-  _subjectToState;
-  onSubjectStateChanged;
+  _subjectToVertex = new ComplexMap4(PublicKey6.hash);
+  _subjectToState = new ComplexMap4(PublicKey6.hash);
+  onSubjectStateChanged = new Callback3();
   constructor(_stateHandler) {
     this._stateHandler = _stateHandler;
-    this._vertexIdGenerator = 1;
-    this._root = {
-      id: -1,
-      parents: [],
-      children: []
-    };
-    this._sentinel = {
-      id: -2,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
-    this._subjectToVertex = new ComplexMap4(PublicKey6.hash);
-    this._subjectToState = new ComplexMap4(PublicKey6.hash);
-    this.onSubjectStateChanged = new Callback3();
   }
   getSubjectState(subjectId) {
     return this._subjectToState.get(subjectId);
@@ -1347,14 +1348,11 @@ var __dxlog_file5 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-mac
 var MemberStateMachine = class {
   _spaceKey;
   _ownerKey;
-  _memberProfiles;
-  _hashgraph;
-  onMemberRoleChanged;
+  _memberProfiles = new ComplexMap5(PublicKey7.hash);
+  _hashgraph = new CredentialGraph(this);
+  onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._memberProfiles = new ComplexMap5(PublicKey7.hash);
-    this._hashgraph = new CredentialGraph(this);
-    this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
   }
   get creator() {
     return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
@@ -1505,27 +1503,21 @@ var SpaceStateMachine = class {
   _spaceKey;
   _members;
   _feeds;
-  _invitations;
-  _credentials;
-  _credentialsById;
-  _processedCredentials;
+  _invitations = new InvitationStateMachine();
+  _credentials = [];
+  _credentialsById = new ComplexMap6(PublicKey8.hash);
+  _processedCredentials = new ComplexSet3(PublicKey8.hash);
   _genesisCredential;
-  _credentialProcessors;
-  onCredentialProcessed;
+  _tags = [];
+  _membershipPolicy = MembershipPolicy2.INVITE;
+  _credentialProcessors = [];
+  onCredentialProcessed = new Callback4();
   onMemberRoleChanged;
   onFeedAdmitted;
-  onDelegatedInvitation;
-  onDelegatedInvitationRemoved;
+  onDelegatedInvitation = this._invitations.onDelegatedInvitation;
+  onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._invitations = new InvitationStateMachine();
-    this._credentials = [];
-    this._credentialsById = new ComplexMap6(PublicKey8.hash);
-    this._processedCredentials = new ComplexSet3(PublicKey8.hash);
-    this._credentialProcessors = [];
-    this.onCredentialProcessed = new Callback4();
-    this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
-    this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
     this._members = new MemberStateMachine(this._spaceKey);
     this._feeds = new FeedStateMachine(this._spaceKey);
     this.onMemberRoleChanged = this._members.onMemberRoleChanged;
@@ -1552,6 +1544,12 @@ var SpaceStateMachine = class {
   get genesisCredential() {
     return this._genesisCredential;
   }
+  get tags() {
+    return this._tags;
+  }
+  get membershipPolicy() {
+    return this._membershipPolicy;
+  }
   get invitations() {
     return this._invitations.invitations;
   }
@@ -1593,7 +1591,7 @@ var SpaceStateMachine = class {
       if (result.kind !== "pass") {
         log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
           F: __dxlog_file6,
-          L: 162,
+          L: 173,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1606,7 +1604,7 @@ var SpaceStateMachine = class {
         if (this._genesisCredential) {
           log3.warn("Space already has a genesis credential.", void 0, {
             F: __dxlog_file6,
-            L: 171,
+            L: 182,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1615,7 +1613,7 @@ var SpaceStateMachine = class {
         if (!credential.issuer.equals(this._spaceKey)) {
           log3.warn("Space genesis credential must be issued by space.", void 0, {
             F: __dxlog_file6,
-            L: 175,
+            L: 186,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1624,13 +1622,15 @@ var SpaceStateMachine = class {
         if (!credential.subject.id.equals(this._spaceKey)) {
           log3.warn("Space genesis credential must be issued to space.", void 0, {
             F: __dxlog_file6,
-            L: 179,
+            L: 190,
             S: this,
             C: (f, a) => f(...a)
           });
           return false;
         }
         this._genesisCredential = credential;
+        this._tags = assertion.tags ?? [];
+        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy2.INVITE;
         break;
       }
       case "dxos.halo.credentials.SpaceMember": {
@@ -1640,7 +1640,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file6,
-            L: 192,
+            L: 205,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1649,7 +1649,7 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file6,
-            L: 196,
+            L: 209,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1663,7 +1663,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file6,
-            L: 207,
+            L: 220,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1676,7 +1676,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
             F: __dxlog_file6,
-            L: 217,
+            L: 230,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1690,7 +1690,7 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file6,
-            L: 228,
+            L: 241,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1724,6 +1724,9 @@ var SpaceStateMachine = class {
     return this._canInviteNewMembers(memberKey);
   }
   _canInviteNewMembers(key) {
+    if (this._membershipPolicy === MembershipPolicy2.LOCKED) {
+      return key.equals(this._spaceKey) && this._members.members.size === 0;
+    }
     return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
   }
 };
@@ -1734,23 +1737,21 @@ var CredentialConsumer = class {
   processor;
   _onOpen;
   _onClose;
-  _ctx;
+  _ctx = new Context(void 0, {
+    F: __dxlog_file6,
+    L: 291
+  });
   /**
   * @internal
   * Processor is ready to process live credentials.
   * NOTE: Setting this flag before all existing credentials are processed will cause them to be processed out of order.
   * Set externally.
   */
-  _isReadyForLiveCredentials;
+  _isReadyForLiveCredentials = false;
   constructor(processor, _onOpen, _onClose) {
     this.processor = processor;
     this._onOpen = _onOpen;
     this._onClose = _onClose;
-    this._ctx = new Context(void 0, {
-      F: __dxlog_file6,
-      L: 273
-    });
-    this._isReadyForLiveCredentials = false;
   }
   /**
   * @internal
@@ -1782,13 +1783,11 @@ var __dxlog_file7 = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor
 var DeviceStateMachine = class {
   _params;
   // TODO(burdon): Return values via getter.
-  authorizedDeviceKeys;
-  deviceChainReady;
+  authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
+  deviceChainReady = new Trigger();
   deviceCredentialChain;
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
-    this.deviceChainReady = new Trigger();
   }
   async processCredential(credential) {
     log4("processing credential...", {
@@ -1797,7 +1796,7 @@ var DeviceStateMachine = class {
       credential
     }, {
       F: __dxlog_file7,
-      L: 36,
+      L: 35,
       S: this,
       C: (f, a) => f(...a)
     });
@@ -1817,7 +1816,7 @@ var DeviceStateMachine = class {
           size: this.authorizedDeviceKeys.size
         }, {
           F: __dxlog_file7,
-          L: 56,
+          L: 55,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1827,7 +1826,7 @@ var DeviceStateMachine = class {
       case "dxos.halo.credentials.DeviceProfile": {
         invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
           F: __dxlog_file7,
-          L: 66,
+          L: 65,
           S: this,
           A: [
             "this.authorizedDeviceKeys.has(credential.subject.id)",
@@ -1840,7 +1839,7 @@ var DeviceStateMachine = class {
             profile: assertion.profile
           }, {
             F: __dxlog_file7,
-            L: 69,
+            L: 68,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1873,7 +1872,7 @@ var ProfileStateMachine = class {
             credential
           }, {
             F: __dxlog_file8,
-            L: 35,
+            L: 34,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1885,7 +1884,7 @@ var ProfileStateMachine = class {
           profile: this.profile
         }, {
           F: __dxlog_file8,
-          L: 41,
+          L: 40,
           S: this,
           C: (f, a) => f(...a)
         });