@dxos/credentials 0.8.4-main.fd6878d → 0.8.4-staging.60fe92afc8

package/dist/lib/{browser → neutral}/index.mjs

@@ -28,15 +28,7 @@ import { invariant } from "@dxos/invariant";
 var __dxlog_file = "/__w/dxos/dxos/packages/core/halo/credentials/src/seedphrase.ts";
 var generateSeedPhrase = () => generateMnemonic();
 var keyPairFromSeedPhrase = (seedPhrase) => {
-  invariant(seedPhrase, void 0, {
-    F: __dxlog_file,
-    L: 20,
-    S: void 0,
-    A: [
-      "seedPhrase",
-      ""
-    ]
-  });
+  invariant(seedPhrase, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file, L: 13, S: void 0, A: ["seedPhrase", ""] });
   const seed = mnemonicToSeedSync(seedPhrase);
   return createKeyPair(seed);
 };
@@ -68,6 +60,22 @@ var getCredentialProofPayload = (credential) => {
     delete copy.parentCredentialIds;
   }
   delete copy.id;
+  const originalAssertion = copy.subject?.assertion;
+  if (originalAssertion) {
+    const normalizedAssertion = {
+      ...originalAssertion
+    };
+    for (const key of Object.keys(normalizedAssertion)) {
+      const val = normalizedAssertion[key];
+      if (val === void 0 || val === null || val === 0 || val === "" || val === false || Array.isArray(val) && val.length === 0) {
+        delete normalizedAssertion[key];
+      }
+    }
+    copy.subject = {
+      ...copy.subject,
+      assertion: normalizedAssertion
+    };
+  }
   return Buffer.from(canonicalStringify(copy));
 };
 var canonicalStringify = (obj) => stableStringify(obj, {
@@ -228,35 +236,11 @@ var verifyChain = async (chain, authority, subject) => {
 // src/credentials/credential-factory.ts
 var __dxlog_file2 = "/__w/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
 var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
-  invariant2(assertion["@type"], "Invalid assertion.", {
-    F: __dxlog_file2,
-    L: 48,
-    S: void 0,
-    A: [
-      "assertion['@type']",
-      "'Invalid assertion.'"
-    ]
-  });
-  invariant2(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
-    F: __dxlog_file2,
-    L: 49,
-    S: void 0,
-    A: [
-      "!!signingKey === !!chain",
-      "'Chain must be provided if and only if the signing key differs from the issuer.'"
-    ]
-  });
+  invariant2(assertion["@type"], "Invalid assertion.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 12, S: void 0, A: ["assertion['@type']", "'Invalid assertion.'"] });
+  invariant2(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 13, S: void 0, A: ["!!signingKey === !!chain", "'Chain must be provided if and only if the signing key differs from the issuer.'"] });
   if (chain) {
     const result = await verifyChain(chain, issuer, signingKey);
-    invariant2(result.kind === "pass", "Invalid chain.", {
-      F: __dxlog_file2,
-      L: 52,
-      S: void 0,
-      A: [
-        "result.kind === 'pass'",
-        "'Invalid chain.'"
-      ]
-    });
+    invariant2(result.kind === "pass", "Invalid chain.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 16, S: void 0, A: ["result.kind === 'pass'", "'Invalid chain.'"] });
   }
   const credential = {
     issuer,
@@ -314,7 +298,7 @@ var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
 });
 
 // src/credentials/credential-generator.ts
-import { AdmittedFeed, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { AdmittedFeed, MembershipPolicy, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe2 } from "@dxos/timeframe";
 var CredentialGenerator = class {
   _signer;
@@ -328,7 +312,7 @@ var CredentialGenerator = class {
   /**
   * Create genesis messages for new Space.
   */
-  async createSpaceGenesis(spaceKey, controlKey, creatorProfile) {
+  async createSpaceGenesis(spaceKey, controlKey, creatorProfile, membershipPolicy = MembershipPolicy.INVITE) {
     return [
       await createCredential({
         signer: this._signer,
@@ -336,7 +320,8 @@ var CredentialGenerator = class {
         subject: spaceKey,
         assertion: {
           "@type": "dxos.halo.credentials.SpaceGenesis",
-          spaceKey
+          spaceKey,
+          membershipPolicy
         }
       }),
       await createCredential({
@@ -463,7 +448,7 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId, tags) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
@@ -474,7 +459,8 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
         role,
         profile,
         genesisFeedKey,
-        invitationCredentialId
+        invitationCredentialId,
+        tags: tags ?? []
       }
     })
   ]);
@@ -631,7 +617,7 @@ import { runInContextAsync, synchronized } from "@dxos/async";
 import { Context } from "@dxos/context";
 import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log3 } from "@dxos/log";
-import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { MembershipPolicy as MembershipPolicy2, SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Callback as Callback4, ComplexMap as ComplexMap6, ComplexSet as ComplexSet3 } from "@dxos/util";
 
 // src/state-machine/feed-state-machine.ts
@@ -641,12 +627,10 @@ import { Callback, ComplexMap as ComplexMap2 } from "@dxos/util";
 var __dxlog_file3 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
 var FeedStateMachine = class {
   _spaceKey;
-  _feeds;
-  onFeedAdmitted;
+  _feeds = new ComplexMap2(PublicKey4.hash);
+  onFeedAdmitted = new Callback();
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._feeds = new ComplexMap2(PublicKey4.hash);
-    this.onFeedAdmitted = new Callback();
   }
   get feeds() {
     return this._feeds;
@@ -659,24 +643,8 @@ var FeedStateMachine = class {
   */
   async process(credential, fromFeed) {
     const assertion = getCredentialAssertion(credential);
-    invariant3(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, {
-      F: __dxlog_file3,
-      L: 47,
-      S: this,
-      A: [
-        "assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'",
-        ""
-      ]
-    });
-    invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, {
-      F: __dxlog_file3,
-      L: 48,
-      S: this,
-      A: [
-        "assertion.spaceKey.equals(this._spaceKey)",
-        ""
-      ]
-    });
+    invariant3(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 28, S: this, A: ["assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'", ""] });
+    invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 29, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
     const info = {
       key: credential.subject.id,
       credential,
@@ -774,43 +742,36 @@ var CredentialGraph = class {
   /**
   * Local ids are used during traversals.
   */
-  _vertexIdGenerator;
+  _vertexIdGenerator = 1;
   /**
   * All credentials without parent references are connected to the root.
   */
-  _root;
+  _root = {
+    id: -1,
+    parents: [],
+    children: []
+  };
   /**
   * A credential which is not a parent of any other credential has the sentinel as a child.
   * Sentinel is a virtual merge-point of all credentials.
   */
-  _sentinel;
+  _sentinel = {
+    id: -2,
+    parents: [],
+    children: []
+  };
   /**
   * Vertex references are used for fast credential inserts into the graph.
   */
-  _vertexByCredentialId;
+  _vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
   /**
   * The current state of the graph.
   */
-  _subjectToVertex;
-  _subjectToState;
-  onSubjectStateChanged;
+  _subjectToVertex = new ComplexMap4(PublicKey6.hash);
+  _subjectToState = new ComplexMap4(PublicKey6.hash);
+  onSubjectStateChanged = new Callback3();
   constructor(_stateHandler) {
     this._stateHandler = _stateHandler;
-    this._vertexIdGenerator = 1;
-    this._root = {
-      id: -1,
-      parents: [],
-      children: []
-    };
-    this._sentinel = {
-      id: -2,
-      parents: [],
-      children: []
-    };
-    this._vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
-    this._subjectToVertex = new ComplexMap4(PublicKey6.hash);
-    this._subjectToState = new ComplexMap4(PublicKey6.hash);
-    this.onSubjectStateChanged = new Callback3();
   }
   getSubjectState(subjectId) {
     return this._subjectToState.get(subjectId);
@@ -846,12 +807,7 @@ var CredentialGraph = class {
           log.error("credential skipped because of the unknown parent", {
             credential,
             parentId
-          }, {
-            F: __dxlog_file4,
-            L: 72,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 70, S: this });
           continue;
         }
         parentVertex.children.push(newVertex);
@@ -868,29 +824,13 @@ var CredentialGraph = class {
     if (sentinelIdx >= 0) {
       vertex.children.splice(sentinelIdx, 1);
       const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
-      invariant4(vertexInSentinelIdx >= 0, void 0, {
-        F: __dxlog_file4,
-        L: 90,
-        S: this,
-        A: [
-          "vertexInSentinelIdx >= 0",
-          ""
-        ]
-      });
+      invariant4(vertexInSentinelIdx >= 0, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 90, S: this, A: ["vertexInSentinelIdx >= 0", ""] });
       this._sentinel.parents.splice(vertexInSentinelIdx, 1);
     }
   }
   async _onVertexInserted(newVertex) {
     const { credential, assertion } = newVertex;
-    invariant4(credential, void 0, {
-      F: __dxlog_file4,
-      L: 97,
-      S: this,
-      A: [
-        "credential",
-        ""
-      ]
-    });
+    invariant4(credential, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 96, S: this, A: ["credential", ""] });
     let changedSubjects = [];
     const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
     if (isUpdateAppliedOnTopOfThePreviousState) {
@@ -927,21 +867,11 @@ var CredentialGraph = class {
       const path = paths.pop();
       log("visit vertex", {
         id: path.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 132,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 131, S: this });
       this._updatePathState(path);
       const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
       if (convergedPaths == null) {
-        log("waiting for other paths", void 0, {
-          F: __dxlog_file4,
-          L: 136,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        log("waiting for other paths", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 137, S: this });
         continue;
       }
       const mergeResult = this._mergePaths(convergedPaths);
@@ -965,12 +895,7 @@ var CredentialGraph = class {
           path: toChosenPath(p),
           head: p.head.id
         }))
-      }, {
-        F: __dxlog_file4,
-        L: 155,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 156, S: this });
     }
     return this._setCurrentState(lastPath);
   }
@@ -991,12 +916,7 @@ var CredentialGraph = class {
         path: toChosenPath(path),
         overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
       }))
-    }), {
-      F: __dxlog_file4,
-      L: 175,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 175, S: this });
     const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
     pendingPaths.set(convergedPaths[0].head.id, clearedPending);
   }
@@ -1008,12 +928,7 @@ var CredentialGraph = class {
       return null;
     }
     if (path.head.id === this._sentinel.id && paths.length > 0) {
-      log("waiting for all the active paths to converge on the sentinel", void 0, {
-        F: __dxlog_file4,
-        L: 199,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      log("waiting for all the active paths to converge on the sentinel", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 194, S: this });
       return null;
     }
     pendingPaths.delete(path.head.id);
@@ -1038,12 +953,7 @@ var CredentialGraph = class {
       log("path state updated", () => ({
         subject: updatedSubject,
         newState: this._stateHandler.toLogString(path.head.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 223,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 217, S: this });
     }
   }
   _forkTraversal(paths, path) {
@@ -1053,12 +963,7 @@ var CredentialGraph = class {
       log("edge traversal", {
         from: path.head.id,
         to: choice.id
-      }, {
-        F: __dxlog_file4,
-        L: 234,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 227, S: this });
       const fork = {
         forkPoint: path,
         chosenPath: {
@@ -1151,15 +1056,7 @@ var CredentialGraph = class {
     return path;
   }
   _mergePaths(convergedPaths) {
-    invariant4(convergedPaths.length >= 1, void 0, {
-      F: __dxlog_file4,
-      L: 324,
-      S: this,
-      A: [
-        "convergedPaths.length >= 1",
-        ""
-      ]
-    });
+    invariant4(convergedPaths.length >= 1, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 320, S: this, A: ["convergedPaths.length >= 1", ""] });
     if (convergedPaths.length === 1) {
       return {
         type: "merged",
@@ -1171,22 +1068,9 @@ var CredentialGraph = class {
       forkPointId: forkPoint.head.id,
       pathCount: convergedPaths.length,
       forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
-    }), {
-      F: __dxlog_file4,
-      L: 329,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 328, S: this });
     const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
-    invariant4(forkPoint, void 0, {
-      F: __dxlog_file4,
-      L: 335,
-      S: this,
-      A: [
-        "forkPoint",
-        ""
-      ]
-    });
+    invariant4(forkPoint, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 334, S: this, A: ["forkPoint", ""] });
     const result = {
       forkPoint: forkPoint.forkPoint,
       chosenPath: {
@@ -1207,12 +1091,7 @@ var CredentialGraph = class {
         modified: path.forkChangedSubjects,
         forkIssuers: path.forkIssuers,
         state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }), {
-        F: __dxlog_file4,
-        L: 348,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 350, S: this });
       path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
       path.credentials.forEach((cred) => result.credentials.add(cred));
       result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
@@ -1232,12 +1111,7 @@ var CredentialGraph = class {
       log("set subject state", () => ({
         subject,
         state: this._stateHandler.toLogString(vertex.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 370,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 372, S: this });
       const otherPaths = paths.filter((p) => p !== branch);
       this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
     }
@@ -1276,12 +1150,7 @@ var CredentialGraph = class {
     if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
       log("merge point chosen to break the tie", {
         mergePointId: existing.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 408,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 412, S: this });
       return mergePointId === candidateVertex.id;
     }
     const candidateCredential = candidateVertex.credential;
@@ -1290,12 +1159,7 @@ var CredentialGraph = class {
       log("one of the credentials was overridden in another branch", {
         current: currentVertex.id,
         candidate: candidateVertex.id
-      }, {
-        F: __dxlog_file4,
-        L: 415,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 421, S: this });
       return candidate.credentials.has(currentCredential.id);
     }
     const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
@@ -1308,20 +1172,10 @@ var CredentialGraph = class {
           existing.forkIssuers.size,
           candidate.forkIssuers.size
         ]
-      }, {
-        F: __dxlog_file4,
-        L: 432,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 433, S: this });
       return candidate.forkIssuers.size > existing.forkIssuers.size;
     }
-    log("issuance date used to break the tie", void 0, {
-      F: __dxlog_file4,
-      L: 437,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    log("issuance date used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 441, S: this });
     return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
   }
   _createRootPath() {
@@ -1347,14 +1201,11 @@ var __dxlog_file5 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-mac
 var MemberStateMachine = class {
   _spaceKey;
   _ownerKey;
-  _memberProfiles;
-  _hashgraph;
-  onMemberRoleChanged;
+  _memberProfiles = new ComplexMap5(PublicKey7.hash);
+  _hashgraph = new CredentialGraph(this);
+  onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._memberProfiles = new ComplexMap5(PublicKey7.hash);
-    this._hashgraph = new CredentialGraph(this);
-    this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
   }
   get creator() {
     return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
@@ -1376,15 +1227,7 @@ var MemberStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceMember": {
-        invariant5(assertion.spaceKey.equals(this._spaceKey), void 0, {
-          F: __dxlog_file5,
-          L: 66,
-          S: this,
-          A: [
-            "assertion.spaceKey.equals(this._spaceKey)",
-            ""
-          ]
-        });
+        invariant5(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 43, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
         if (this._ownerKey == null && credential.issuer === this._spaceKey) {
           this._ownerKey = credential.subject.id;
         }
@@ -1401,12 +1244,7 @@ var MemberStateMachine = class {
         } else {
           log2.warn("Member not found", {
             id: credential.subject.id
-          }, {
-            F: __dxlog_file5,
-            L: 81,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 59, S: this });
         }
         this._memberProfiles.set(credential.subject.id, assertion.profile);
         break;
@@ -1451,12 +1289,7 @@ var MemberStateMachine = class {
     const path1IssuerRole = this._getRole(scope1, update1.issuer);
     const path2IssuerRole = this._getRole(scope2, update2.issuer);
     if (path2IssuerRole === SpaceMember2.Role.OWNER !== (path1IssuerRole === SpaceMember2.Role.OWNER)) {
-      log2("owner decision used to break the tie", void 0, {
-        F: __dxlog_file5,
-        L: 139,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      log2("owner decision used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 107, S: this });
       return path1IssuerRole === SpaceMember2.Role.OWNER ? update1 : update2;
     }
     return null;
@@ -1480,12 +1313,7 @@ var MemberStateMachine = class {
           headId: scope.head?.id,
           roleOverride: this.toLogString(override.assertion),
           realRole: this.toLogString(scope.state.get(memberId)?.assertion)
-        }), {
-          F: __dxlog_file5,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }), { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 127, S: this });
         return override.assertion.role;
       }
     }
@@ -1494,38 +1322,32 @@ var MemberStateMachine = class {
 };
 
 // src/state-machine/space-state-machine.ts
+var __dxlog_file6 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file6 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 var SpaceStateMachine = class {
   _spaceKey;
   _members;
   _feeds;
-  _invitations;
-  _credentials;
-  _credentialsById;
-  _processedCredentials;
+  _invitations = new InvitationStateMachine();
+  _credentials = [];
+  _credentialsById = new ComplexMap6(PublicKey8.hash);
+  _processedCredentials = new ComplexSet3(PublicKey8.hash);
   _genesisCredential;
-  _credentialProcessors;
-  onCredentialProcessed;
+  _tags = [];
+  _membershipPolicy = MembershipPolicy2.INVITE;
+  _credentialProcessors = [];
+  onCredentialProcessed = new Callback4();
   onMemberRoleChanged;
   onFeedAdmitted;
-  onDelegatedInvitation;
-  onDelegatedInvitationRemoved;
+  onDelegatedInvitation = this._invitations.onDelegatedInvitation;
+  onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._invitations = new InvitationStateMachine();
-    this._credentials = [];
-    this._credentialsById = new ComplexMap6(PublicKey8.hash);
-    this._processedCredentials = new ComplexSet3(PublicKey8.hash);
-    this._credentialProcessors = [];
-    this.onCredentialProcessed = new Callback4();
-    this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
-    this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
     this._members = new MemberStateMachine(this._spaceKey);
     this._feeds = new FeedStateMachine(this._spaceKey);
     this.onMemberRoleChanged = this._members.onMemberRoleChanged;
@@ -1552,6 +1374,12 @@ var SpaceStateMachine = class {
   get genesisCredential() {
     return this._genesisCredential;
   }
+  get tags() {
+    return this._tags;
+  }
+  get membershipPolicy() {
+    return this._membershipPolicy;
+  }
   get invitations() {
     return this._invitations.invitations;
   }
@@ -1591,12 +1419,7 @@ var SpaceStateMachine = class {
     if (!skipVerification) {
       const result = await verifyCredential(credential);
       if (result.kind !== "pass") {
-        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
-          F: __dxlog_file6,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 116, S: this });
         return false;
       }
     }
@@ -1604,33 +1427,20 @@ var SpaceStateMachine = class {
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceGenesis": {
         if (this._genesisCredential) {
-          log3.warn("Space already has a genesis credential.", void 0, {
-            F: __dxlog_file6,
-            L: 171,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space already has a genesis credential.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 125, S: this });
           return false;
         }
         if (!credential.issuer.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued by space.", void 0, {
-            F: __dxlog_file6,
-            L: 175,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space genesis credential must be issued by space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 129, S: this });
           return false;
         }
         if (!credential.subject.id.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued to space.", void 0, {
-            F: __dxlog_file6,
-            L: 179,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space genesis credential must be issued to space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 133, S: this });
           return false;
         }
         this._genesisCredential = credential;
+        this._tags = assertion.tags ?? [];
+        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy2.INVITE;
         break;
       }
       case "dxos.halo.credentials.SpaceMember": {
@@ -1638,21 +1448,11 @@ var SpaceStateMachine = class {
           break;
         }
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 192,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 147, S: this });
           return false;
         }
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 196,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 151, S: this });
           return false;
         }
         await this._members.process(credential);
@@ -1661,12 +1461,7 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.MemberProfile": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 207,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 161, S: this });
           return false;
         }
         await this._members.process(credential);
@@ -1674,12 +1469,7 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.AdmittedFeed": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
-            F: __dxlog_file6,
-            L: 217,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 170, S: this });
           return false;
         }
         await this._feeds.process(credential, sourceFeed);
@@ -1688,12 +1478,7 @@ var SpaceStateMachine = class {
       case "dxos.halo.invitations.CancelDelegatedInvitation":
       case "dxos.halo.invitations.DelegateSpaceInvitation": {
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 228,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 181, S: this });
           return false;
         }
         await this._invitations.process(credential);
@@ -1724,6 +1509,9 @@ var SpaceStateMachine = class {
     return this._canInviteNewMembers(memberKey);
   }
   _canInviteNewMembers(key) {
+    if (this._membershipPolicy === MembershipPolicy2.LOCKED) {
+      return key.equals(this._spaceKey) && this._members.members.size === 0;
+    }
     return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
   }
 };
@@ -1734,23 +1522,18 @@ var CredentialConsumer = class {
   processor;
   _onOpen;
   _onClose;
-  _ctx;
+  _ctx = new Context(void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 229 });
   /**
   * @internal
   * Processor is ready to process live credentials.
   * NOTE: Setting this flag before all existing credentials are processed will cause them to be processed out of order.
   * Set externally.
   */
-  _isReadyForLiveCredentials;
+  _isReadyForLiveCredentials = false;
   constructor(processor, _onOpen, _onClose) {
     this.processor = processor;
     this._onOpen = _onOpen;
     this._onClose = _onClose;
-    this._ctx = new Context(void 0, {
-      F: __dxlog_file6,
-      L: 273
-    });
-    this._isReadyForLiveCredentials = false;
   }
   /**
   * @internal
@@ -1782,25 +1565,18 @@ var __dxlog_file7 = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor
 var DeviceStateMachine = class {
   _params;
   // TODO(burdon): Return values via getter.
-  authorizedDeviceKeys;
-  deviceChainReady;
+  authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
+  deviceChainReady = new Trigger();
   deviceCredentialChain;
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
-    this.deviceChainReady = new Trigger();
   }
   async processCredential(credential) {
     log4("processing credential...", {
       identityKey: this._params.identityKey,
       deviceKey: this._params.deviceKey,
       credential
-    }, {
-      F: __dxlog_file7,
-      L: 36,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 22, S: this });
     if (isValidAuthorizedDeviceCredential(credential, this._params.identityKey, this._params.deviceKey)) {
       this.deviceCredentialChain = {
         credential
@@ -1815,35 +1591,17 @@ var DeviceStateMachine = class {
           localDeviceKey: this._params.deviceKey,
           deviceKey: assertion.deviceKey,
           size: this.authorizedDeviceKeys.size
-        }, {
-          F: __dxlog_file7,
-          L: 56,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 41, S: this });
         this._params.onUpdate?.();
         break;
       }
       case "dxos.halo.credentials.DeviceProfile": {
-        invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
-          F: __dxlog_file7,
-          L: 66,
-          S: this,
-          A: [
-            "this.authorizedDeviceKeys.has(credential.subject.id)",
-            "'Device not found.'"
-          ]
-        });
+        invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 51, S: this, A: ["this.authorizedDeviceKeys.has(credential.subject.id)", "'Device not found.'"] });
         if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
           log4.trace("dxos.halo.device", {
             deviceKey: credential.subject.id,
             profile: assertion.profile
-          }, {
-            F: __dxlog_file7,
-            L: 69,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 53, S: this });
         }
         this.authorizedDeviceKeys.set(credential.subject.id, assertion.profile);
         this._params.onUpdate?.();
@@ -1871,24 +1629,14 @@ var ProfileStateMachine = class {
           log5.warn("Invalid profile credential", {
             expectedIdentity: this._params.identityKey,
             credential
-          }, {
-            F: __dxlog_file8,
-            L: 35,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 21, S: this });
           return;
         }
         this.profile = assertion.profile;
         log5("updated profile", {
           identityKey: this._params.identityKey,
           profile: this.profile
-        }, {
-          F: __dxlog_file8,
-          L: 41,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 29, S: this });
         this._params.onUpdate?.();
         break;
       }