@ibgib/core-gib 0.1.61 → 0.1.63

package/dist/keystone/keystone-service-v1.respec.mjs

@@ -1,14 +1,16 @@
-import { respecfully, iReckon, firstOfAll, ifWeMight } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+import { respecfully, iReckon, ifWe, firstOfAll, firstOfEach } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
 const maam = `[${import.meta.url}]`, sir = maam;
 import { clone, hash, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { GLOBAL_LOG_A_LOT } from '../core-constants.mjs';
 import { KeystoneStrategyFactory } from './strategy/keystone-strategy-factory.mjs';
 import { createRevocationPoolConfig, createStandardPoolConfig } from './keystone-config-builder.mjs';
-import { POOL_ID_DEFAULT, POOL_ID_REVOKE, KEYSTONE_VERB_REVOKE, KEYSTONE_VERB_MANAGE } from './keystone-constants.mjs';
-import { KeystoneService_V1 } from './keystone-service-v1.mjs';
-import { selectChallengeIds, validateChallengePool } from './keystone-helpers.mjs';
+import { POOL_ID_DEFAULT, POOL_ID_REVOKE, KEYSTONE_VERB_REVOKE, KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE, KEYSTONE_VERB_SYNC } from './keystone-constants.mjs';
+import { KeystoneService_V1, } from './keystone-service-v1.mjs';
+import { selectChallengeIds, validateChallengePool, validateKeystoneIb, validateKeystoneTransition, validateGenesisKeystone } from './keystone-helpers.mjs';
 import { KeystoneProfileBuilder } from './policy/keystone-profile-builder.mjs';
+import { getTjpAddr } from '../common/other/ibgib-helper.mjs';
+import { deriveDelegateSecret } from './strategy/hash-reveal-v1/hash-reveal-v1.mjs';
 const logalot = GLOBAL_LOG_A_LOT;
 /**
  * A simple in-memory map acting as a Space.
@@ -28,18 +30,57 @@ class MockIbGibSpace {
         const data = this.store.get(addr);
         return data ? JSON.parse(JSON.stringify(data)) : null;
     }
+    async argy({ argData, ibGibs }) {
+        return {
+            ib: 'arg^gib',
+            gib: 'arg_gib',
+            data: argData,
+            ibGibs,
+        };
+    }
     async witness(arg) {
         const cmd = arg.data?.cmd;
+        const cmdModifiers = arg.data?.cmdModifiers || [];
         if (cmd === 'get') {
             const addrs = arg.data.ibGibAddrs || [];
-            const ibGibs = [];
-            for (const addr of addrs) {
-                const x = await this.get({ addr });
-                if (x) {
-                    ibGibs.push(x);
+            if (cmdModifiers.includes('latest') && cmdModifiers.includes('addrs')) {
+                const latestAddrsMap = {};
+                for (const queryAddr of addrs) {
+                    const queryTjpGib = queryAddr.includes('.') ? queryAddr.split('.')[1] : queryAddr.split('^')[1];
+                    let latestAddr = queryAddr;
+                    let maxN = -1;
+                    for (const [addr, ibGib] of this.store.entries()) {
+                        const tjpGib = addr.includes('.') ? addr.split('.')[1] : addr.split('^')[1];
+                        if (tjpGib === queryTjpGib) {
+                            const n = ibGib.data?.n ?? 0;
+                            if (n > maxN) {
+                                maxN = n;
+                                latestAddr = addr;
+                            }
+                        }
+                    }
+                    latestAddrsMap[queryAddr] = latestAddr;
                 }
+                return {
+                    data: {
+                        success: true,
+                        latestAddrsMap,
+                    }
+                };
+            }
+            else {
+                const ibGibs = [];
+                for (const addr of addrs) {
+                    const x = await this.get({ addr });
+                    if (x) {
+                        ibGibs.push(x);
+                    }
+                }
+                return {
+                    data: { success: true },
+                    ibGibs,
+                };
             }
-            return { ibGibs };
         }
         return undefined;
     }
@@ -70,6 +111,14 @@ class MockMetaspaceService {
         const target = args.space || this.space;
         return target.put(args);
     }
+    async get(args) {
+        const target = args.space || this.space;
+        const x = await target.get({ addr: args.addr });
+        return {
+            success: !!x,
+            ibGibs: x ? [x] : [],
+        };
+    }
     /**
      * Tracks the latest version of an ibGib timeline.
      */
@@ -111,20 +160,20 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
         });
     });
     await respecfully(sir, 'Derivation Logic', async () => {
-        await ifWeMight(sir, 'derivePoolSecret with same inputs returns same output', async () => {
+        await ifWe(sir, 'derivePoolSecret with same inputs returns same output', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const secretA = await strategy.derivePoolSecret({ masterSecret });
             const secretB = await strategy.derivePoolSecret({ masterSecret });
             iReckon(sir, secretA).asTo('secret consistency').willEqual(secretB);
             iReckon(sir, secretA).asTo('secret length').isGonnaBeTruthy();
         });
-        await ifWeMight(sir, 'derivePoolSecret with different master secret returns different output', async () => {
+        await ifWe(sir, 'derivePoolSecret with different master secret returns different output', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const secretA = await strategy.derivePoolSecret({ masterSecret });
             const secretB = await strategy.derivePoolSecret({ masterSecret: masterSecret + "_diff" });
             iReckon(sir, secretA).asTo('secrets differ').not.willEqual(secretB);
         });
-        await ifWeMight(sir, 'derivePoolSecret with different salt returns different output', async () => {
+        await ifWe(sir, 'derivePoolSecret with different salt returns different output', async () => {
             // Modify salt in a copy of config
             const configB = { ...config, salt: "OtherPool" };
             const strategyA = KeystoneStrategyFactory.create({ config });
@@ -133,9 +182,17 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
             const secretB = await strategyB.derivePoolSecret({ masterSecret });
             iReckon(sir, secretA).asTo('salt affects secret').not.willEqual(secretB);
         });
+        await ifWe(sir, 'deriveDelegateSecret derives a consistent secret using KDF', async () => {
+            const secretA = await deriveDelegateSecret({ masterSecret });
+            const secretB = await deriveDelegateSecret({ masterSecret });
+            iReckon(sir, secretA).asTo('consistency').willEqual(secretB);
+            iReckon(sir, secretA).asTo('truthy').isGonnaBeTruthy();
+            const secretC = await deriveDelegateSecret({ masterSecret: masterSecret + '_other' });
+            iReckon(sir, secretA).asTo('differ').not.willEqual(secretC);
+        });
     });
     await respecfully(sir, 'Challenge/Solution Logic', async () => {
-        await ifWeMight(sir, 'generateSolution -> generateChallenge -> validateSolution loop works', async () => {
+        await ifWe(sir, 'generateSolution -> generateChallenge -> validateSolution loop works', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const poolSecret = await strategy.derivePoolSecret({ masterSecret });
             const challengeId = "a3ff7843552870fc28bef2b"; // arbitrary random challengeId
@@ -150,7 +207,7 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
             const isValid = await strategy.validateSolution({ solution, challenge });
             iReckon(sir, isValid).asTo('valid pair should pass').isGonnaBeTrue();
         });
-        await ifWeMight(sir, 'validateSolution fails for mismatched values', async () => {
+        await ifWe(sir, 'validateSolution fails for mismatched values', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const poolSecret = await strategy.derivePoolSecret({ masterSecret });
             const challengeId = "8c994f3ed598f150e25513"; // arbitrary random challengeId
@@ -162,7 +219,7 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
             const isValid = await strategy.validateSolution({ solution: badSolution, challenge });
             iReckon(sir, isValid).asTo('tampered solution should fail').isGonnaBeFalse();
         });
-        await ifWeMight(sir, 'validateSolution fails for mismatched challenge hashes', async () => {
+        await ifWe(sir, 'validateSolution fails for mismatched challenge hashes', async () => {
             const strategy = KeystoneStrategyFactory.create({ config });
             const poolSecret = await strategy.derivePoolSecret({ masterSecret });
             // Generate pair A
@@ -193,7 +250,7 @@ await respecfully(sir, 'Suite B: Service Lifecycle', async () => {
         mockMetaspace = new MockMetaspaceService(mockSpace);
     });
     await respecfully(sir, 'Genesis', async () => {
-        await ifWeMight(sir, 'creates a valid genesis frame and persists it', async () => {
+        await ifWe(sir, 'creates a valid genesis frame and persists it', async () => {
             const salt = (await getUUID()).substring(0, 16);
             const config = createStandardPoolConfig({
                 id: POOL_ID_DEFAULT,
@@ -219,7 +276,7 @@ await respecfully(sir, 'Suite B: Service Lifecycle', async () => {
         });
     });
     await respecfully(sir, 'Signing (Evolution)', async () => {
-        await ifWeMight(sir, 'evolves the keystone with a valid proof', async () => {
+        await ifWe(sir, 'evolves the keystone with a valid proof', async () => {
             const claim = {
                 target: "comment 123^gib",
                 verb: "post"
@@ -244,7 +301,7 @@ await respecfully(sir, 'Suite B: Service Lifecycle', async () => {
         });
     });
     await respecfully(sir, 'Validation', async () => {
-        await ifWeMight(sir, 'validates the genesis->signed transition', async () => {
+        await ifWe(sir, 'validates the genesis->signed transition', async () => {
             const errors = await service.validate({
                 prevIbGib: genesisKeystone,
                 currentIbGib: signedKeystone,
@@ -285,7 +342,7 @@ await respecfully(sir, 'Suite C: Security Vectors', async () => {
         });
     });
     await respecfully(sir, 'Wrong Secret (Forgery)', async () => {
-        await ifWeMight(sir, 'prevents creation of forged frames', async () => {
+        await ifWe(sir, 'prevents creation of forged frames', async () => {
             const claim = { target: "comment 123^gib", verb: "post" };
             let errorCaught = false;
             let errorMsg = "";
@@ -311,7 +368,7 @@ await respecfully(sir, 'Suite C: Security Vectors', async () => {
         });
     });
     await respecfully(sir, 'Policy Violation (Restricted Verbs)', async () => {
-        await ifWeMight(sir, 'throws error if signing forbidden verb with restricted pool', async () => {
+        await ifWe(sir, 'throws error if signing forbidden verb with restricted pool', async () => {
             // Create a specific restricted pool config manually
             const restrictedPoolId = "read_only_pool";
             const restrictedConfig = createStandardPoolConfig({
@@ -379,7 +436,7 @@ await respecfully(sir, 'Suite D: Revocation', async () => {
     });
     await respecfully(sir, 'Revoke Lifecycle', async () => {
         let revokedKeystone;
-        await ifWeMight(sir, 'successfully creates a revocation frame', async () => {
+        await ifWe(sir, 'successfully creates a revocation frame', async () => {
             revokedKeystone = await service.revoke({
                 latestKeystone: genesisKeystone,
                 masterSecret,
@@ -394,7 +451,7 @@ await respecfully(sir, 'Suite D: Revocation', async () => {
             iReckon(sir, data.revocationInfo.reason).willEqual("Key compromised");
             iReckon(sir, data.revocationInfo.proof.claim.verb).willEqual(KEYSTONE_VERB_REVOKE);
         });
-        await ifWeMight(sir, 'validates the revocation frame', async () => {
+        await ifWe(sir, 'validates the revocation frame', async () => {
             const errors = await service.validate({
                 prevIbGib: genesisKeystone,
                 currentIbGib: revokedKeystone,
@@ -403,7 +460,7 @@ await respecfully(sir, 'Suite D: Revocation', async () => {
             });
             iReckon(sir, errors.length).asTo('no validation errors').willEqual(0);
         });
-        await ifWeMight(sir, 'consumed the revocation pool (Scorched Earth)', async () => {
+        await ifWe(sir, 'consumed the revocation pool (Scorched Earth)', async () => {
             const data = revokedKeystone.data;
             const revokePool = data.challengePools.find(p => p.id === POOL_ID_REVOKE);
             // The pool should exist...
@@ -465,7 +522,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
         });
     });
     await respecfully(sir, 'Happy Path', async () => {
-        await ifWeMight(sir, 'authorizes and adds a foreign pool', async () => {
+        await ifWe(sir, 'authorizes and adds a foreign pool', async () => {
             const bobPool = await createForeignPool("pool_bob", ["post"]);
             const updatedKeystone = await service.addPools({
                 latestKeystone: aliceKeystone,
@@ -497,7 +554,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
         });
     });
     await respecfully(sir, 'Permissions & Logic', async () => {
-        await ifWeMight(sir, 'fails if no pool allows "manage" verb', async () => {
+        await ifWe(sir, 'fails if no pool allows "manage" verb', async () => {
             // 1. Create a restricted keystone
             let id = "read_only";
             const restrictedConfig = createStandardPoolConfig({ id, salt: id });
@@ -526,7 +583,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
             }
             iReckon(sir, errorCaught).asTo('permission denied').isGonnaBeTrue();
         });
-        await ifWeMight(sir, 'fails on ID collision', async () => {
+        await ifWe(sir, 'fails on ID collision', async () => {
             // Try to add "pool_bob" again (it was added in Happy Path)
             const duplicatePool = await createForeignPool("pool_bob");
             let errorCaught = false;
@@ -601,7 +658,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
         });
     });
     await respecfully(sir, 'Happy Path', async () => {
-        await ifWeMight(sir, 'authorizes and adds a foreign pool', async () => {
+        await ifWe(sir, 'authorizes and adds a foreign pool', async () => {
             const bobPool = await createForeignPool("pool_bob", ["post"]);
             const updatedKeystone = await service.addPools({
                 latestKeystone: aliceKeystone,
@@ -633,7 +690,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
         });
     });
     await respecfully(sir, 'Permissions & Logic', async () => {
-        await ifWeMight(sir, 'fails if no pool allows "manage" verb', async () => {
+        await ifWe(sir, 'fails if no pool allows "manage" verb', async () => {
             // 1. Create a restricted keystone (read-only)
             let id = "read_only";
             const restrictedConfig = createStandardPoolConfig({ id, salt: id });
@@ -662,7 +719,7 @@ await respecfully(sir, 'Suite E: Structural Evolution (addPools)', async () => {
             }
             iReckon(sir, errorCaught).asTo('permission denied').isGonnaBeTrue();
         });
-        await ifWeMight(sir, 'fails on ID collision', async () => {
+        await ifWe(sir, 'fails on ID collision', async () => {
             // Try to add "pool_bob" again (it was added in Happy Path)
             const duplicatePool = await createForeignPool("pool_bob");
             let errorCaught = false;
@@ -714,7 +771,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
     });
     await respecfully(sir, 'Proof Granularity & Math', async () => {
-        await ifWeMight(sir, 'generates exactly the expected number of solutions', async () => {
+        await ifWe(sir, 'generates exactly the expected number of solutions', async () => {
             signedKeystone = await service.sign({
                 latestKeystone: genesisKeystone,
                 masterSecret: aliceSecret,
@@ -728,7 +785,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             // 2 Sequential + 2 Random = 4
             iReckon(sir, solutions.length).asTo('solution count').willEqual(4);
         });
-        await ifWeMight(sir, 'verifies the math manually (White-box Crypto Check)', async () => {
+        await ifWe(sir, 'verifies the math manually (White-box Crypto Check)', async () => {
             const proof = signedKeystone.data.proofs[0];
             const poolSnapshot = genesisKeystone.data.challengePools.find(p => p.id === poolId);
             // We iterate every solution in the proof and MANUALLY verify the hash relationship
@@ -751,7 +808,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
                 iReckon(sir, calculatedHash).asTo(`Manual hash verification for ${solution.challengeId}`).willEqual(challenge.hash);
             }
         });
-        await ifWeMight(sir, 'verifies FIFO logic (Deterministic Selection)', async () => {
+        await ifWe(sir, 'verifies FIFO logic (Deterministic Selection)', async () => {
             const proof = signedKeystone.data.proofs[0];
             const poolSnapshot = genesisKeystone.data.challengePools.find(p => p.id === poolId);
             // The first N keys in the pool should be the FIFO targets.
@@ -765,7 +822,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             iReckon(sir, hasFirst).asTo(`Solution includes 1st FIFO ID (${expectedFifoIds[0]})`).isGonnaBeTrue();
             iReckon(sir, hasSecond).asTo(`Solution includes 2nd FIFO ID (${expectedFifoIds[1]})`).isGonnaBeTrue();
         });
-        await ifWeMight(sir, 'verifies Next-Gen Hash-Based Target Binding Selection', async () => {
+        await ifWe(sir, 'verifies Next-Gen Hash-Based Target Binding Selection', async () => {
             const bindingConfig = createStandardPoolConfig({
                 id: "binding_pool",
                 salt: "binding_salt",
@@ -807,7 +864,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
                 iReckon(sir, proofIds.includes(id)).asTo(`proof includes selected ID ${id}`).isGonnaBeTrue();
             }
         });
-        await ifWeMight(sir, 'fails validation if total requested challenges >= size', async () => {
+        await ifWe(sir, 'fails validation if total requested challenges >= size', async () => {
             const invalidConfig = createStandardPoolConfig({
                 id: "invalid_pool",
                 salt: "invalid_salt",
@@ -823,7 +880,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
     });
     await respecfully(sir, 'DTO & Serialization', async () => {
-        await ifWeMight(sir, 'survives a clone/JSON-cycle without corruption', async () => {
+        await ifWe(sir, 'survives a clone/JSON-cycle without corruption', async () => {
             // 1. Create a DTO (simulate network transmission/storage)
             // 'clone' does a JSON stringify/parse under the hood (usually) or structured clone.
             const dto = clone(signedKeystone);
@@ -839,7 +896,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             });
             iReckon(sir, errors.length).asTo('DTO validation errors').willEqual(0);
         });
-        await ifWeMight(sir, 'ensures data contains no functions or circular refs', async () => {
+        await ifWe(sir, 'ensures data contains no functions or circular refs', async () => {
             // A crude but effective test: ensure JSON.stringify doesn't throw
             // and the result is equal to the object (if we parsed it back).
             const jsonStr = JSON.stringify(signedKeystone);
@@ -858,7 +915,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
     });
     await respecfully(sir, 'KeystoneProfileBuilder and Modular Schemas', async () => {
-        await ifWeMight(sir, 'compiles configs successfully with medium profile', async () => {
+        await ifWe(sir, 'compiles configs successfully with medium profile', async () => {
             const builder = KeystoneProfileBuilder.buildKeystone('medium')
                 .withUsername('alice')
                 .withEmail('alice@example.com')
@@ -877,7 +934,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             iReckon(sir, details.description).asTo('description').willEqual('Alice test keystone');
             iReckon(sir, details.extraInfo).asTo('extraInfo').willEqual('abc');
         });
-        await ifWeMight(sir, 'supports customized overrides', async () => {
+        await ifWe(sir, 'supports customized overrides', async () => {
             const builder = KeystoneProfileBuilder.buildKeystone('test')
                 .customizePool('sync', {
                 behavior: {
@@ -892,7 +949,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
     });
     await respecfully(sir, 'Keystone Metadata Validation', async () => {
-        await ifWeMight(sir, 'validates correct username and description', async () => {
+        await ifWe(sir, 'validates correct username and description', async () => {
             const service = new KeystoneService_V1();
             const space = new MockIbGibSpace();
             const metaspace = new MockMetaspaceService(space);
@@ -913,7 +970,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             const errors = await service.validateGenesisKeystone({ keystoneIbGib });
             iReckon(sir, errors.length).asTo('errors count').willEqual(0);
         });
-        await ifWeMight(sir, 'fails validation for invalid username length or character', async () => {
+        await ifWe(sir, 'fails validation for invalid username length or character', async () => {
             const service = new KeystoneService_V1();
             const space = new MockIbGibSpace();
             const metaspace = new MockMetaspaceService(space);
@@ -933,7 +990,7 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             iReckon(sir, errors.length).asTo('errors count').willEqual(1);
             iReckon(sir, errors[0]).includes('invalid username');
         });
-        await ifWeMight(sir, 'fails validation for invalid description characters', async () => {
+        await ifWe(sir, 'fails validation for invalid description characters', async () => {
             const service = new KeystoneService_V1();
             const space = new MockIbGibSpace();
             const metaspace = new MockMetaspaceService(space);
@@ -956,4 +1013,302 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
     });
 });
+// ===========================================================================
+// SUITE E: DELEGATION (Register/Unregister)
+// ===========================================================================
+await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () => {
+    const service = new KeystoneService_V1();
+    const parentSecret = "ParentMasterSecret_123";
+    const delegateSecret = "DelegateMasterSecret_456";
+    let mockSpace;
+    let mockMetaspace;
+    let parentKeystone;
+    let delegateKeystone;
+    firstOfEach(sir, async () => {
+        mockSpace = new MockIbGibSpace();
+        mockMetaspace = new MockMetaspaceService(mockSpace);
+        const salt = (await getUUID()).substring(0, 16);
+        const defaultConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt });
+        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: salt + "_manage" });
+        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE];
+        // 1. Create Parent Keystone (with manage pool)
+        parentKeystone = await service.genesis({
+            masterSecret: parentSecret,
+            configs: [defaultConfig, manageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // 2. Create Delegate Keystone
+        const delegateConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: salt + "_delegate" });
+        delegateKeystone = await service.genesis({
+            masterSecret: delegateSecret,
+            configs: [delegateConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+    });
+    await ifWe(sir, 'registers a delegate keystone and evolves parent using manage pool', async () => {
+        // Register the delegate
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
+        });
+        iReckon(sir, evolvedParent).asTo('evolved parent exists').isGonnaBeTruthy();
+        iReckon(sir, evolvedParent.data?.delegates).asTo('delegates map exists').isGonnaBeTruthy();
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) {
+            throw new Error(`(UNEXPECTED) delegateTjpAddr falsy? (E: 312e986ce4b2ed6c084c03e8f45fa826)`);
+        }
+        const delegateInfo = evolvedParent.data?.delegates?.[delegateTjpAddr];
+        iReckon(sir, delegateInfo).asTo('delegate info registered').isGonnaBeTruthy();
+        iReckon(sir, delegateInfo?.delegateTjpAddr).asTo('delegate tjp matches').willEqual(delegateTjpAddr);
+    });
+    await ifWe(sir, 'gets correct delegate status via parent TJP address', async () => {
+        const parentTjpAddr = getTjpAddr({ ibGib: parentKeystone });
+        if (!parentTjpAddr) {
+            throw new Error(`(UNEXPECTED) parentTjpAddr falsy? (E: b7ce2835ccd951d8c99257328be3b826)`);
+        }
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) {
+            throw new Error(`(UNEXPECTED) delegateTjpAddr falsy? (E: 3e4878ea19dd8034e827466a8bf09526)`);
+        }
+        // Before registration
+        const statusBefore = await service.getDelegateStatus({
+            parentTjpAddr: parentTjpAddr,
+            delegateTjpAddr: delegateTjpAddr,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, statusBefore.registered).asTo('initially unregistered').isGonnaBeFalse();
+        // Register
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
+        });
+        // After registration
+        const statusAfter = await service.getDelegateStatus({
+            parentTjpAddr: parentTjpAddr,
+            delegateTjpAddr: delegateTjpAddr,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, statusAfter.registered).asTo('registered status').isGonnaBeTrue();
+        iReckon(sir, statusAfter.delegateInfo?.delegateTjpAddr).asTo('status tjp matches').willEqual(delegateTjpAddr);
+    });
+    await ifWe(sir, 'unregisters a registered delegate keystone', async () => {
+        // Register first
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
+        });
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) {
+            throw new Error(`(UNEXPECTED) delegateTjpAddr falsy? (E: 486b486a8c984a52b8d2b22418c20d26)`);
+        }
+        // Unregister
+        const finalParent = await service.unregisterDelegate({
+            parentKeystone: evolvedParent,
+            delegateTjpAddr,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, finalParent).asTo('final evolved parent exists').isGonnaBeTruthy();
+        const info = finalParent.data?.delegates?.[delegateTjpAddr];
+        iReckon(sir, info).asTo('delegate info removed').isGonnaBeUndefined();
+    });
+    await ifWe(sir, 'throws if parent does not have a manage pool', async () => {
+        // Create a parent WITHOUT a manage pool
+        const salt = (await getUUID()).substring(0, 16);
+        const defaultConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt });
+        const restrictedParent = await service.genesis({
+            masterSecret: parentSecret,
+            configs: [defaultConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        let errorCaught = false;
+        try {
+            await service.registerDelegate({
+                parentKeystone: restrictedParent,
+                delegateKeystone,
+                masterSecret: parentSecret,
+                metaspace: mockMetaspace,
+                space: mockSpace,
+                allowedVerbs: [KEYSTONE_VERB_SYNC],
+            });
+        }
+        catch (e) {
+            errorCaught = true;
+            iReckon(sir, e.message).includes('Manage pool is required');
+        }
+        iReckon(sir, errorCaught).asTo('delegation rejected').isGonnaBeTrue();
+    });
+});
+await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
+    const service = new KeystoneService_V1();
+    const parentSecret = "ParentMasterSecret_SuiteG";
+    const delegateSecret = "DelegateMasterSecret_SuiteG";
+    let mockSpace;
+    let mockMetaspace;
+    let parentKeystone;
+    let delegateKeystone;
+    firstOfEach(sir, async () => {
+        mockSpace = new MockIbGibSpace();
+        mockMetaspace = new MockMetaspaceService(mockSpace);
+        const salt1 = (await getUUID()).substring(0, 16);
+        const salt2 = (await getUUID()).substring(0, 16);
+        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: salt2 });
+        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE];
+        const configs = [
+            createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: salt1 }),
+            manageConfig
+        ];
+        parentKeystone = await service.genesis({
+            masterSecret: parentSecret,
+            configs,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        delegateKeystone = await service.genesis({
+            masterSecret: delegateSecret,
+            configs: [createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: salt1 })],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+    });
+    await ifWe(sir, 'validateKeystoneIb returns true for valid keystone ib and false for others', async () => {
+        iReckon(sir, await validateKeystoneIb({ ib: 'keystone' })).isGonnaBeTrue();
+        iReckon(sir, await validateKeystoneIb({ ib: 'keystone user info' })).isGonnaBeTrue();
+        iReckon(sir, await validateKeystoneIb({ ib: 'invalidAtom' })).isGonnaBeFalse();
+        iReckon(sir, await validateKeystoneIb({ ib: 'not_keystone sub_atom' })).isGonnaBeFalse();
+    });
+    await ifWe(sir, 'validateGenesisKeystone fails validation if ib is invalid', async () => {
+        const invalidGenesis = {
+            ...parentKeystone,
+            ib: 'not_a_keystone^' + parentKeystone.gib,
+        };
+        const errors = await validateGenesisKeystone({ keystoneIbGib: invalidGenesis });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors[0]).includes('invalid keystone ib');
+    });
+    await ifWe(sir, 'validateKeystoneTransition passes for valid delegate registration', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
+        });
+        const errors = await validateKeystoneTransition({
+            currentIbGib: evolvedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length).willEqual(0);
+    });
+    await ifWe(sir, 'validateKeystoneTransition fails if delegates map is mutated without manage proof', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
+        });
+        const tamperedParent = JSON.parse(JSON.stringify(evolvedParent));
+        // Remove the manage verb proof by converting it to sign
+        for (const proof of tamperedParent.data.proofs) {
+            if (proof.claim) {
+                proof.claim.verb = 'sign';
+            }
+        }
+        const errors = await validateKeystoneTransition({
+            currentIbGib: tamperedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors.some(e => e.includes('Policy Violation: Delegates map was mutated'))).isGonnaBeTrue();
+    });
+    await ifWe(sir, 'validateKeystoneTransition fails if delegate key does not match delegateTjpAddr', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
+        });
+        const tamperedParent = JSON.parse(JSON.stringify(evolvedParent));
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) {
+            throw new Error(`delegateTjpAddr falsy?`);
+        }
+        const info = tamperedParent.data.delegates[delegateTjpAddr];
+        delete tamperedParent.data.delegates[delegateTjpAddr];
+        tamperedParent.data.delegates['mismatched_key'] = info;
+        const errors = await validateKeystoneTransition({
+            currentIbGib: tamperedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors.some(e => e.includes('does not match delegateTjpAddr'))).isGonnaBeTrue();
+    });
+    await ifWe(sir, 'validateKeystoneTransition fails if delegate addresses have invalid keystone ib', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
+        });
+        const tamperedParent = JSON.parse(JSON.stringify(evolvedParent));
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) {
+            throw new Error(`delegateTjpAddr falsy?`);
+        }
+        tamperedParent.data.delegates[delegateTjpAddr].delegateAddr = 'invalid_ib^12345';
+        const errors = await validateKeystoneTransition({
+            currentIbGib: tamperedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors.some(e => e.includes('not a valid keystone address'))).isGonnaBeTrue();
+    });
+    await ifWe(sir, 'validateKeystoneTransition fails if thisAddr is not in the parent timeline history', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
+        });
+        const tamperedParent = JSON.parse(JSON.stringify(evolvedParent));
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) {
+            throw new Error(`delegateTjpAddr falsy?`);
+        }
+        tamperedParent.data.delegates[delegateTjpAddr].thisAddr = 'keystone^randomgib';
+        const errors = await validateKeystoneTransition({
+            currentIbGib: tamperedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors.some(e => e.includes('not a valid historical address in the parent keystone timeline'))).isGonnaBeTrue();
+    });
+});
 //# sourceMappingURL=keystone-service-v1.respec.mjs.map