@dxos/credentials 0.8.4-main.fffef41 → 0.9.0

package/dist/lib/{browser → neutral}/index.mjs

@@ -28,15 +28,7 @@ import { invariant } from "@dxos/invariant";
 var __dxlog_file = "/__w/dxos/dxos/packages/core/halo/credentials/src/seedphrase.ts";
 var generateSeedPhrase = () => generateMnemonic();
 var keyPairFromSeedPhrase = (seedPhrase) => {
-  invariant(seedPhrase, void 0, {
-    F: __dxlog_file,
-    L: 20,
-    S: void 0,
-    A: [
-      "seedPhrase",
-      ""
-    ]
-  });
+  invariant(seedPhrase, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file, L: 13, S: void 0, A: ["seedPhrase", ""] });
   const seed = mnemonicToSeedSync(seedPhrase);
   return createKeyPair(seed);
 };
@@ -68,6 +60,22 @@ var getCredentialProofPayload = (credential) => {
     delete copy.parentCredentialIds;
   }
   delete copy.id;
+  const originalAssertion = copy.subject?.assertion;
+  if (originalAssertion) {
+    const normalizedAssertion = {
+      ...originalAssertion
+    };
+    for (const key of Object.keys(normalizedAssertion)) {
+      const val = normalizedAssertion[key];
+      if (val === void 0 || val === null || val === 0 || val === "" || val === false || Array.isArray(val) && val.length === 0) {
+        delete normalizedAssertion[key];
+      }
+    }
+    copy.subject = {
+      ...copy.subject,
+      assertion: normalizedAssertion
+    };
+  }
   return Buffer.from(canonicalStringify(copy));
 };
 var canonicalStringify = (obj) => stableStringify(obj, {
@@ -228,35 +236,11 @@ var verifyChain = async (chain, authority, subject) => {
 // src/credentials/credential-factory.ts
 var __dxlog_file2 = "/__w/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
 var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
-  invariant2(assertion["@type"], "Invalid assertion.", {
-    F: __dxlog_file2,
-    L: 48,
-    S: void 0,
-    A: [
-      "assertion['@type']",
-      "'Invalid assertion.'"
-    ]
-  });
-  invariant2(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
-    F: __dxlog_file2,
-    L: 49,
-    S: void 0,
-    A: [
-      "!!signingKey === !!chain",
-      "'Chain must be provided if and only if the signing key differs from the issuer.'"
-    ]
-  });
+  invariant2(assertion["@type"], "Invalid assertion.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 12, S: void 0, A: ["assertion['@type']", "'Invalid assertion.'"] });
+  invariant2(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 13, S: void 0, A: ["!!signingKey === !!chain", "'Chain must be provided if and only if the signing key differs from the issuer.'"] });
   if (chain) {
     const result = await verifyChain(chain, issuer, signingKey);
-    invariant2(result.kind === "pass", "Invalid chain.", {
-      F: __dxlog_file2,
-      L: 52,
-      S: void 0,
-      A: [
-        "result.kind === 'pass'",
-        "'Invalid chain.'"
-      ]
-    });
+    invariant2(result.kind === "pass", "Invalid chain.", { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 16, S: void 0, A: ["result.kind === 'pass'", "'Invalid chain.'"] });
   }
   const credential = {
     issuer,
@@ -314,7 +298,7 @@ var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
 });
 
 // src/credentials/credential-generator.ts
-import { AdmittedFeed, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { AdmittedFeed, MembershipPolicy, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Timeframe as Timeframe2 } from "@dxos/timeframe";
 var CredentialGenerator = class {
   _signer;
@@ -328,7 +312,7 @@ var CredentialGenerator = class {
   /**
   * Create genesis messages for new Space.
   */
-  async createSpaceGenesis(spaceKey, controlKey, creatorProfile) {
+  async createSpaceGenesis(spaceKey, controlKey, creatorProfile, membershipPolicy = MembershipPolicy.INVITE) {
     return [
       await createCredential({
         signer: this._signer,
@@ -336,7 +320,8 @@ var CredentialGenerator = class {
         subject: spaceKey,
         assertion: {
           "@type": "dxos.halo.credentials.SpaceGenesis",
-          spaceKey
+          spaceKey,
+          membershipPolicy
         }
       }),
       await createCredential({
@@ -463,7 +448,7 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId, tags) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
@@ -474,7 +459,8 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
         role,
         profile,
         genesisFeedKey,
-        invitationCredentialId
+        invitationCredentialId,
+        tags: tags ?? []
       }
     })
   ]);
@@ -631,7 +617,7 @@ import { runInContextAsync, synchronized } from "@dxos/async";
 import { Context } from "@dxos/context";
 import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log3 } from "@dxos/log";
-import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { MembershipPolicy as MembershipPolicy2, SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
 import { Callback as Callback4, ComplexMap as ComplexMap6, ComplexSet as ComplexSet3 } from "@dxos/util";
 
 // src/state-machine/feed-state-machine.ts
@@ -657,24 +643,8 @@ var FeedStateMachine = class {
   */
   async process(credential, fromFeed) {
     const assertion = getCredentialAssertion(credential);
-    invariant3(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, {
-      F: __dxlog_file3,
-      L: 47,
-      S: this,
-      A: [
-        "assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'",
-        ""
-      ]
-    });
-    invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, {
-      F: __dxlog_file3,
-      L: 48,
-      S: this,
-      A: [
-        "assertion.spaceKey.equals(this._spaceKey)",
-        ""
-      ]
-    });
+    invariant3(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 28, S: this, A: ["assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'", ""] });
+    invariant3(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 29, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
     const info = {
       key: credential.subject.id,
       credential,
@@ -837,12 +807,7 @@ var CredentialGraph = class {
           log.error("credential skipped because of the unknown parent", {
             credential,
             parentId
-          }, {
-            F: __dxlog_file4,
-            L: 72,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 70, S: this });
           continue;
         }
         parentVertex.children.push(newVertex);
@@ -859,29 +824,13 @@ var CredentialGraph = class {
     if (sentinelIdx >= 0) {
       vertex.children.splice(sentinelIdx, 1);
       const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
-      invariant4(vertexInSentinelIdx >= 0, void 0, {
-        F: __dxlog_file4,
-        L: 90,
-        S: this,
-        A: [
-          "vertexInSentinelIdx >= 0",
-          ""
-        ]
-      });
+      invariant4(vertexInSentinelIdx >= 0, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 90, S: this, A: ["vertexInSentinelIdx >= 0", ""] });
       this._sentinel.parents.splice(vertexInSentinelIdx, 1);
     }
   }
   async _onVertexInserted(newVertex) {
     const { credential, assertion } = newVertex;
-    invariant4(credential, void 0, {
-      F: __dxlog_file4,
-      L: 97,
-      S: this,
-      A: [
-        "credential",
-        ""
-      ]
-    });
+    invariant4(credential, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 96, S: this, A: ["credential", ""] });
     let changedSubjects = [];
     const isUpdateAppliedOnTopOfThePreviousState = this._sentinel.parents.length === 1;
     if (isUpdateAppliedOnTopOfThePreviousState) {
@@ -918,21 +867,11 @@ var CredentialGraph = class {
       const path = paths.pop();
       log("visit vertex", {
         id: path.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 132,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 131, S: this });
       this._updatePathState(path);
       const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
       if (convergedPaths == null) {
-        log("waiting for other paths", void 0, {
-          F: __dxlog_file4,
-          L: 136,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        log("waiting for other paths", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 137, S: this });
         continue;
       }
       const mergeResult = this._mergePaths(convergedPaths);
@@ -956,12 +895,7 @@ var CredentialGraph = class {
           path: toChosenPath(p),
           head: p.head.id
         }))
-      }, {
-        F: __dxlog_file4,
-        L: 155,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 156, S: this });
     }
     return this._setCurrentState(lastPath);
   }
@@ -982,12 +916,7 @@ var CredentialGraph = class {
         path: toChosenPath(path),
         overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
       }))
-    }), {
-      F: __dxlog_file4,
-      L: 175,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 175, S: this });
     const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
     pendingPaths.set(convergedPaths[0].head.id, clearedPending);
   }
@@ -999,12 +928,7 @@ var CredentialGraph = class {
       return null;
     }
     if (path.head.id === this._sentinel.id && paths.length > 0) {
-      log("waiting for all the active paths to converge on the sentinel", void 0, {
-        F: __dxlog_file4,
-        L: 199,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      log("waiting for all the active paths to converge on the sentinel", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 194, S: this });
       return null;
     }
     pendingPaths.delete(path.head.id);
@@ -1029,12 +953,7 @@ var CredentialGraph = class {
       log("path state updated", () => ({
         subject: updatedSubject,
         newState: this._stateHandler.toLogString(path.head.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 223,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 217, S: this });
     }
   }
   _forkTraversal(paths, path) {
@@ -1044,12 +963,7 @@ var CredentialGraph = class {
       log("edge traversal", {
         from: path.head.id,
         to: choice.id
-      }, {
-        F: __dxlog_file4,
-        L: 234,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 227, S: this });
       const fork = {
         forkPoint: path,
         chosenPath: {
@@ -1142,15 +1056,7 @@ var CredentialGraph = class {
     return path;
   }
   _mergePaths(convergedPaths) {
-    invariant4(convergedPaths.length >= 1, void 0, {
-      F: __dxlog_file4,
-      L: 324,
-      S: this,
-      A: [
-        "convergedPaths.length >= 1",
-        ""
-      ]
-    });
+    invariant4(convergedPaths.length >= 1, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 320, S: this, A: ["convergedPaths.length >= 1", ""] });
     if (convergedPaths.length === 1) {
       return {
         type: "merged",
@@ -1162,22 +1068,9 @@ var CredentialGraph = class {
       forkPointId: forkPoint.head.id,
       pathCount: convergedPaths.length,
       forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
-    }), {
-      F: __dxlog_file4,
-      L: 329,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 328, S: this });
     const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
-    invariant4(forkPoint, void 0, {
-      F: __dxlog_file4,
-      L: 335,
-      S: this,
-      A: [
-        "forkPoint",
-        ""
-      ]
-    });
+    invariant4(forkPoint, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 334, S: this, A: ["forkPoint", ""] });
     const result = {
       forkPoint: forkPoint.forkPoint,
       chosenPath: {
@@ -1198,12 +1091,7 @@ var CredentialGraph = class {
         modified: path.forkChangedSubjects,
         forkIssuers: path.forkIssuers,
         state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
-      }), {
-        F: __dxlog_file4,
-        L: 348,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 350, S: this });
       path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
       path.credentials.forEach((cred) => result.credentials.add(cred));
       result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
@@ -1223,12 +1111,7 @@ var CredentialGraph = class {
       log("set subject state", () => ({
         subject,
         state: this._stateHandler.toLogString(vertex.assertion)
-      }), {
-        F: __dxlog_file4,
-        L: 370,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }), { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 372, S: this });
       const otherPaths = paths.filter((p) => p !== branch);
       this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
     }
@@ -1267,12 +1150,7 @@ var CredentialGraph = class {
     if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
       log("merge point chosen to break the tie", {
         mergePointId: existing.head.id
-      }, {
-        F: __dxlog_file4,
-        L: 408,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 412, S: this });
       return mergePointId === candidateVertex.id;
     }
     const candidateCredential = candidateVertex.credential;
@@ -1281,12 +1159,7 @@ var CredentialGraph = class {
       log("one of the credentials was overridden in another branch", {
         current: currentVertex.id,
         candidate: candidateVertex.id
-      }, {
-        F: __dxlog_file4,
-        L: 415,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 421, S: this });
       return candidate.credentials.has(currentCredential.id);
     }
     const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
@@ -1299,20 +1172,10 @@ var CredentialGraph = class {
           existing.forkIssuers.size,
           candidate.forkIssuers.size
         ]
-      }, {
-        F: __dxlog_file4,
-        L: 432,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      }, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 433, S: this });
       return candidate.forkIssuers.size > existing.forkIssuers.size;
     }
-    log("issuance date used to break the tie", void 0, {
-      F: __dxlog_file4,
-      L: 437,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    log("issuance date used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file4, L: 441, S: this });
     return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
   }
   _createRootPath() {
@@ -1364,15 +1227,7 @@ var MemberStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceMember": {
-        invariant5(assertion.spaceKey.equals(this._spaceKey), void 0, {
-          F: __dxlog_file5,
-          L: 66,
-          S: this,
-          A: [
-            "assertion.spaceKey.equals(this._spaceKey)",
-            ""
-          ]
-        });
+        invariant5(assertion.spaceKey.equals(this._spaceKey), void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 43, S: this, A: ["assertion.spaceKey.equals(this._spaceKey)", ""] });
         if (this._ownerKey == null && credential.issuer === this._spaceKey) {
           this._ownerKey = credential.subject.id;
         }
@@ -1389,12 +1244,7 @@ var MemberStateMachine = class {
         } else {
           log2.warn("Member not found", {
             id: credential.subject.id
-          }, {
-            F: __dxlog_file5,
-            L: 81,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 59, S: this });
         }
         this._memberProfiles.set(credential.subject.id, assertion.profile);
         break;
@@ -1439,12 +1289,7 @@ var MemberStateMachine = class {
     const path1IssuerRole = this._getRole(scope1, update1.issuer);
     const path2IssuerRole = this._getRole(scope2, update2.issuer);
     if (path2IssuerRole === SpaceMember2.Role.OWNER !== (path1IssuerRole === SpaceMember2.Role.OWNER)) {
-      log2("owner decision used to break the tie", void 0, {
-        F: __dxlog_file5,
-        L: 139,
-        S: this,
-        C: (f, a) => f(...a)
-      });
+      log2("owner decision used to break the tie", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 107, S: this });
       return path1IssuerRole === SpaceMember2.Role.OWNER ? update1 : update2;
     }
     return null;
@@ -1468,12 +1313,7 @@ var MemberStateMachine = class {
           headId: scope.head?.id,
           roleOverride: this.toLogString(override.assertion),
           realRole: this.toLogString(scope.state.get(memberId)?.assertion)
-        }), {
-          F: __dxlog_file5,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }), { "~LogMeta": "~LogMeta", F: __dxlog_file5, L: 127, S: this });
         return override.assertion.role;
       }
     }
@@ -1482,13 +1322,13 @@ var MemberStateMachine = class {
 };
 
 // src/state-machine/space-state-machine.ts
+var __dxlog_file6 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-var __dxlog_file6 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 var SpaceStateMachine = class {
   _spaceKey;
   _members;
@@ -1498,6 +1338,8 @@ var SpaceStateMachine = class {
   _credentialsById = new ComplexMap6(PublicKey8.hash);
   _processedCredentials = new ComplexSet3(PublicKey8.hash);
   _genesisCredential;
+  _tags = [];
+  _membershipPolicy = MembershipPolicy2.INVITE;
   _credentialProcessors = [];
   onCredentialProcessed = new Callback4();
   onMemberRoleChanged;
@@ -1532,6 +1374,12 @@ var SpaceStateMachine = class {
   get genesisCredential() {
     return this._genesisCredential;
   }
+  get tags() {
+    return this._tags;
+  }
+  get membershipPolicy() {
+    return this._membershipPolicy;
+  }
   get invitations() {
     return this._invitations.invitations;
   }
@@ -1571,12 +1419,7 @@ var SpaceStateMachine = class {
     if (!skipVerification) {
       const result = await verifyCredential(credential);
       if (result.kind !== "pass") {
-        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
-          F: __dxlog_file6,
-          L: 162,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 116, S: this });
         return false;
       }
     }
@@ -1584,33 +1427,20 @@ var SpaceStateMachine = class {
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.SpaceGenesis": {
         if (this._genesisCredential) {
-          log3.warn("Space already has a genesis credential.", void 0, {
-            F: __dxlog_file6,
-            L: 171,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space already has a genesis credential.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 125, S: this });
           return false;
         }
         if (!credential.issuer.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued by space.", void 0, {
-            F: __dxlog_file6,
-            L: 175,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space genesis credential must be issued by space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 129, S: this });
           return false;
         }
         if (!credential.subject.id.equals(this._spaceKey)) {
-          log3.warn("Space genesis credential must be issued to space.", void 0, {
-            F: __dxlog_file6,
-            L: 179,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space genesis credential must be issued to space.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 133, S: this });
           return false;
         }
         this._genesisCredential = credential;
+        this._tags = assertion.tags ?? [];
+        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy2.INVITE;
         break;
       }
       case "dxos.halo.credentials.SpaceMember": {
@@ -1618,21 +1448,11 @@ var SpaceStateMachine = class {
           break;
         }
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 192,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 147, S: this });
           return false;
         }
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 196,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 151, S: this });
           return false;
         }
         await this._members.process(credential);
@@ -1641,12 +1461,7 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.MemberProfile": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before adding members.", void 0, {
-            F: __dxlog_file6,
-            L: 207,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before adding members.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 161, S: this });
           return false;
         }
         await this._members.process(credential);
@@ -1654,12 +1469,7 @@ var SpaceStateMachine = class {
       }
       case "dxos.halo.credentials.AdmittedFeed": {
         if (!this._genesisCredential) {
-          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
-            F: __dxlog_file6,
-            L: 217,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn("Space must have a genesis credential before admitting feeds.", void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 170, S: this });
           return false;
         }
         await this._feeds.process(credential, sourceFeed);
@@ -1668,12 +1478,7 @@ var SpaceStateMachine = class {
       case "dxos.halo.invitations.CancelDelegatedInvitation":
       case "dxos.halo.invitations.DelegateSpaceInvitation": {
         if (!this._canInviteNewMembers(credential.issuer)) {
-          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
-            F: __dxlog_file6,
-            L: 228,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 181, S: this });
           return false;
         }
         await this._invitations.process(credential);
@@ -1704,6 +1509,9 @@ var SpaceStateMachine = class {
     return this._canInviteNewMembers(memberKey);
   }
   _canInviteNewMembers(key) {
+    if (this._membershipPolicy === MembershipPolicy2.LOCKED) {
+      return key.equals(this._spaceKey) && this._members.members.size === 0;
+    }
     return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
   }
 };
@@ -1714,10 +1522,7 @@ var CredentialConsumer = class {
   processor;
   _onOpen;
   _onClose;
-  _ctx = new Context(void 0, {
-    F: __dxlog_file6,
-    L: 273
-  });
+  _ctx = new Context(void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file6, L: 229 });
   /**
   * @internal
   * Processor is ready to process live credentials.
@@ -1771,12 +1576,7 @@ var DeviceStateMachine = class {
       identityKey: this._params.identityKey,
       deviceKey: this._params.deviceKey,
       credential
-    }, {
-      F: __dxlog_file7,
-      L: 36,
-      S: this,
-      C: (f, a) => f(...a)
-    });
+    }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 22, S: this });
     if (isValidAuthorizedDeviceCredential(credential, this._params.identityKey, this._params.deviceKey)) {
       this.deviceCredentialChain = {
         credential
@@ -1791,35 +1591,17 @@ var DeviceStateMachine = class {
           localDeviceKey: this._params.deviceKey,
           deviceKey: assertion.deviceKey,
           size: this.authorizedDeviceKeys.size
-        }, {
-          F: __dxlog_file7,
-          L: 56,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 41, S: this });
         this._params.onUpdate?.();
         break;
       }
       case "dxos.halo.credentials.DeviceProfile": {
-        invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
-          F: __dxlog_file7,
-          L: 66,
-          S: this,
-          A: [
-            "this.authorizedDeviceKeys.has(credential.subject.id)",
-            "'Device not found.'"
-          ]
-        });
+        invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 51, S: this, A: ["this.authorizedDeviceKeys.has(credential.subject.id)", "'Device not found.'"] });
         if (assertion && credential.subject.id.equals(this._params.deviceKey)) {
           log4.trace("dxos.halo.device", {
             deviceKey: credential.subject.id,
             profile: assertion.profile
-          }, {
-            F: __dxlog_file7,
-            L: 69,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file7, L: 53, S: this });
         }
         this.authorizedDeviceKeys.set(credential.subject.id, assertion.profile);
         this._params.onUpdate?.();
@@ -1847,24 +1629,14 @@ var ProfileStateMachine = class {
           log5.warn("Invalid profile credential", {
             expectedIdentity: this._params.identityKey,
             credential
-          }, {
-            F: __dxlog_file8,
-            L: 35,
-            S: this,
-            C: (f, a) => f(...a)
-          });
+          }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 21, S: this });
           return;
         }
         this.profile = assertion.profile;
         log5("updated profile", {
           identityKey: this._params.identityKey,
           profile: this.profile
-        }, {
-          F: __dxlog_file8,
-          L: 41,
-          S: this,
-          C: (f, a) => f(...a)
-        });
+        }, { "~LogMeta": "~LogMeta", F: __dxlog_file8, L: 29, S: this });
         this._params.onUpdate?.();
         break;
       }