@ibgib/core-gib 0.1.63 → 0.1.65

package/dist/keystone/keystone-constants.d.mts

@@ -81,6 +81,7 @@ export declare function isKeystoneVerb(value: string): value is KeystoneVerb;
  */
 export declare const POOL_ID_REVOKE = "revoke";
 export declare const POOL_ID_MANAGE = "manage";
+export declare const POOL_ID_CUSTODIAN_MANAGE = "custodian-manage";
 export declare const POOL_ID_DEFAULT = "default";
 /**
  * Pool ID for the session keystone's transport connect pool.

package/dist/keystone/keystone-constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-constants.d.mts","sourceRoot":"","sources":["../../src/keystone/keystone-constants.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAGhF,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AACtD,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAC7D,eAAO,MAAM,wBAAwB,QAA4B,CAAC;AAClE,eAAO,MAAM,2BAA2B,QAAqD,CAAC;AAC9F;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;GAEG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C;;GAEG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C;;GAEG;AACH,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAC/C,MAAM,MAAM,YAAY,GAClB,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB,GAC3B,OAAO,kBAAkB,GACzB,OAAO,kBAAkB,GACzB,OAAO,qBAAqB,CAAC;AAEnC;;GAEG;AACH,eAAO,MAAM,YAAY;IACrB;;;OAGG;;IAEH;;;;;;;;;;OAUG;;IAEH;;OAEG;;IAEH;;;OAGG;;IAEH;;;OAGG;;CAEoC,CAAC;AAC5C,eAAO,MAAM,0BAA0B,uDAA8B,CAAC;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,YAAY,CAEnE;AAGD;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAuB,CAAC;AACnD,eAAO,MAAM,cAAc,WAAuB,CAAC;AACnD,eAAO,MAAM,eAAe,YAAY,CAAC;AACzC;;;;GAIG;AACH,eAAO,MAAM,eAAe,YAAwB,CAAC;AACrD;;;;GAIG;AACH,eAAO,MAAM,YAAY,SAAqB,CAAC;AAC/C;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,kCAAkC,IAAI,CAAC;AACpD,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,+BAA+B,IAAI,CAAC;AACjD,eAAO,MAAM,0CAA0C,UAAkC,CAAC;AAC1F,eAAO,MAAM,sCAAsC,eAAwB,CAAC;AAC5E,eAAO,MAAM,mCAAmC,IAAI,CAAC;AAErD,eAAO,MAAM,yCAAyC,OAAO,CAAC;AAC9D,eAAO,MAAM,+CAA+C,IAAI,CAAC;AACjE,eAAO,MAAM,2CAA2C,IAAI,CAAC;AAC7D,eAAO,MAAM,4CAA4C,KAAK,CAAC;AAC/D,eAAO,MAAM,uDAAuD,eAAuC,CAAC;AAC5G,eAAO,MAAM,mDAAmD,eAAwB,CAAC;AACzF,eAAO,MAAM,gDAAgD,KAAK,CAAC;AACnE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC"}
+{"version":3,"file":"keystone-constants.d.mts","sourceRoot":"","sources":["../../src/keystone/keystone-constants.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAGhF,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AACtD,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAC7D,eAAO,MAAM,wBAAwB,QAA4B,CAAC;AAClE,eAAO,MAAM,2BAA2B,QAAqD,CAAC;AAC9F;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;GAEG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C;;GAEG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C;;GAEG;AACH,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAC/C,MAAM,MAAM,YAAY,GAClB,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB,GAC3B,OAAO,kBAAkB,GACzB,OAAO,kBAAkB,GACzB,OAAO,qBAAqB,CAAC;AAEnC;;GAEG;AACH,eAAO,MAAM,YAAY;IACrB;;;OAGG;;IAEH;;;;;;;;;;OAUG;;IAEH;;OAEG;;IAEH;;;OAGG;;IAEH;;;OAGG;;CAEoC,CAAC;AAC5C,eAAO,MAAM,0BAA0B,uDAA8B,CAAC;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,YAAY,CAEnE;AAGD;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAuB,CAAC;AACnD,eAAO,MAAM,cAAc,WAAuB,CAAC;AACnD,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAC3D,eAAO,MAAM,eAAe,YAAY,CAAC;AACzC;;;;GAIG;AACH,eAAO,MAAM,eAAe,YAAwB,CAAC;AACrD;;;;GAIG;AACH,eAAO,MAAM,YAAY,SAAqB,CAAC;AAC/C;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,kCAAkC,IAAI,CAAC;AACpD,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,+BAA+B,IAAI,CAAC;AACjD,eAAO,MAAM,0CAA0C,UAAkC,CAAC;AAC1F,eAAO,MAAM,sCAAsC,eAAwB,CAAC;AAC5E,eAAO,MAAM,mCAAmC,IAAI,CAAC;AAErD,eAAO,MAAM,yCAAyC,OAAO,CAAC;AAC9D,eAAO,MAAM,+CAA+C,IAAI,CAAC;AACjE,eAAO,MAAM,2CAA2C,IAAI,CAAC;AAC7D,eAAO,MAAM,4CAA4C,KAAK,CAAC;AAC/D,eAAO,MAAM,uDAAuD,eAAuC,CAAC;AAC5G,eAAO,MAAM,mDAAmD,eAAwB,CAAC;AACzF,eAAO,MAAM,gDAAgD,KAAK,CAAC;AACnE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC"}

package/dist/keystone/keystone-constants.mjs

@@ -84,6 +84,7 @@ export function isKeystoneVerb(value) {
  */
 export const POOL_ID_REVOKE = KEYSTONE_VERB_REVOKE;
 export const POOL_ID_MANAGE = KEYSTONE_VERB_MANAGE;
+export const POOL_ID_CUSTODIAN_MANAGE = "custodian-manage";
 export const POOL_ID_DEFAULT = "default";
 /**
  * Pool ID for the session keystone's transport connect pool.

package/dist/keystone/keystone-constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-constants.mjs","sourceRoot":"","sources":["../../src/keystone/keystone-constants.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AACxC,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAAG,kDAAkD,CAAC;AAC9F;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAC7C;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAC7C;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAQ/C;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IACxB;;;OAGG;IACH,MAAM,EAAE,oBAAoB;IAC5B;;;;;;;;;;OAUG;IACH,MAAM,EAAE,oBAAoB;IAC5B;;OAEG;IACH,IAAI,EAAE,kBAAkB;IACxB;;;OAGG;IACH,IAAI,EAAE,kBAAkB;IACxB;;;OAGG;IACH,OAAO,EAAE,qBAAqB;CACS,CAAC;AAC5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACtE,MAAM,UAAU,cAAc,CAAC,KAAa;IACxC,OAAO,0BAA0B,CAAC,QAAQ,CAAC,KAAqB,CAAC,CAAC;AACtE,CAAC;AACD,+BAA+B;AAE/B;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AACzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AACrD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE/C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AACpD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,0CAA0C,GAAG,yBAAyB,CAAC,KAAK,CAAC;AAC1F,MAAM,CAAC,MAAM,sCAAsC,GAAG,aAAa,CAAC,OAAO,CAAC;AAC5E,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC;AAErD,MAAM,CAAC,MAAM,yCAAyC,GAAG,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,4CAA4C,GAAG,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,uDAAuD,GAAG,yBAAyB,CAAC,UAAU,CAAC;AAC5G,MAAM,CAAC,MAAM,mDAAmD,GAAG,aAAa,CAAC,OAAO,CAAC;AACzF,MAAM,CAAC,MAAM,gDAAgD,GAAG,EAAE,CAAC;AACnE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC"}
+{"version":3,"file":"keystone-constants.mjs","sourceRoot":"","sources":["../../src/keystone/keystone-constants.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AACxC,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAAG,kDAAkD,CAAC;AAC9F;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAC7C;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAC7C;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAQ/C;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IACxB;;;OAGG;IACH,MAAM,EAAE,oBAAoB;IAC5B;;;;;;;;;;OAUG;IACH,MAAM,EAAE,oBAAoB;IAC5B;;OAEG;IACH,IAAI,EAAE,kBAAkB;IACxB;;;OAGG;IACH,IAAI,EAAE,kBAAkB;IACxB;;;OAGG;IACH,OAAO,EAAE,qBAAqB;CACS,CAAC;AAC5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACtE,MAAM,UAAU,cAAc,CAAC,KAAa;IACxC,OAAO,0BAA0B,CAAC,QAAQ,CAAC,KAAqB,CAAC,CAAC;AACtE,CAAC;AACD,+BAA+B;AAE/B;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AACzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AACrD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE/C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AACpD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,0CAA0C,GAAG,yBAAyB,CAAC,KAAK,CAAC;AAC1F,MAAM,CAAC,MAAM,sCAAsC,GAAG,aAAa,CAAC,OAAO,CAAC;AAC5E,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC;AAErD,MAAM,CAAC,MAAM,yCAAyC,GAAG,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,4CAA4C,GAAG,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,uDAAuD,GAAG,yBAAyB,CAAC,UAAU,CAAC;AAC5G,MAAM,CAAC,MAAM,mDAAmD,GAAG,aAAa,CAAC,OAAO,CAAC;AACzF,MAAM,CAAC,MAAM,gDAAgD,GAAG,EAAE,CAAC;AACnE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC"}

package/dist/keystone/keystone-helpers.d.mts

@@ -90,7 +90,7 @@ export declare function generateOpaqueChallengeId({ salt, timestamp, index }: {
  *
  * @returns The new array of KeystoneChallengePools (including the modified one).
  */
-export declare function applyReplenishmentStrategy({ prevPools, targetPoolId, consumedIds, masterSecret, strategy, config, }: {
+export declare function applyReplenishmentStrategy({ prevPools, targetPoolId, consumedIds, masterSecret, strategy, config, verb, }: {
     prevPools: KeystoneChallengePool[];
     targetPoolId: string;
     consumedIds: string[];
@@ -100,6 +100,7 @@ export declare function applyReplenishmentStrategy({ prevPools, targetPoolId, co
      */
     strategy: any;
     config: KeystonePoolConfig;
+    verb?: string;
 }): Promise<KeystoneChallengePool[]>;
 /**
  * High-level orchestration helper.
@@ -214,4 +215,29 @@ export declare function getIdentity_throwIfUndefined({ addr, metaspace, space, }
     metaspace: MetaspaceService;
     space: IbGibSpaceAny;
 }): Promise<KeystoneIbGib_V1>;
+/**
+ * Pure helper to generate challenges map for a pool configuration using a masterSecret.
+ */
+export declare function generatePoolChallenges({ config, masterSecret }: {
+    config: KeystonePoolConfig;
+    masterSecret: string;
+}): Promise<{
+    [challengeId: string]: any;
+}>;
+/**
+ * Pure helper to rotate a pool to a new masterSecret.
+ * Takes the previous pool config, generates a new salt, and builds a new pool with refreshed challenges.
+ */
+export declare function rotatePoolChallenges({ prevPool, newMasterSecret }: {
+    prevPool: KeystoneChallengePool;
+    newMasterSecret: string;
+}): Promise<KeystoneChallengePool>;
+/**
+ * Pure helper to verify if a candidate signing secret (passphrase) is correct for a specific challenge pool.
+ * Does not mutate any state.
+ */
+export declare function verifyPoolSecret({ pool, signingSecret }: {
+    pool: KeystoneChallengePool;
+    signingSecret: string;
+}): Promise<boolean>;
 //# sourceMappingURL=keystone-helpers.d.mts.map

package/dist/keystone/keystone-helpers.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-helpers.d.mts","sourceRoot":"","sources":["../../src/keystone/keystone-helpers.mts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,SAAS,EAAmB,MAAM,8BAA8B,CAAC;AAS9E,OAAO,EACH,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EACvE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAEtD,aAAa,EAIb,oBAAoB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAMnE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAIjE;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,EAChC,YAAY,GACf,EAAE;IACC,YAAY,EAAE,eAAe,CAAC;CACjC,GAAG,OAAO,CAAC,EAAE,CAAC,CAkBd;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,EAClC,EAAE,GACL,EAAE;IACC,EAAE,EAAE,EAAE,CAAC;CACV,GAAG,OAAO,CAAC,aAAa,CAAC,CAqBzB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,EACrC,EAAE,GACL,EAAE;IACC,EAAE,EAAE,EAAE,CAAC;CACV,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnB;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAAC,EAC/C,IAAI,EACJ,oBAAoB,EACpB,UAAU,EACb,EAAE;IACC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6E/B;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAC9B,KAAK,EACL,MAAM,EACN,UAAU,EACV,IAAI,GACP,EAAE;IACC,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC;IACtD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,qBAAqB,CA8CxB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EACrC,IAAI,EACJ,UAAU,EACV,oBAAoB,GACvB,EAAE;IACC,IAAI,EAAE,qBAAqB,CAAC;IAC5B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACnC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA+BpB;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,EAC5C,IAAI,EACJ,SAAS,EACT,KAAK,EACR,EAAE;IACC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,EAC7C,SAAS,EACT,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,MAAM,GACT,EAAE;IACC,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,QAAQ,EAAE,GAAG,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;CAC9B,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAqDnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EACpC,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,oBAAoB,GACvB,EAAE;IACC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACnC,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CA0CxE;AAED,wBAAsB,sCAAsC,CAAC,EAAE,IAAI,EAAE,EAAE;IACnE,IAAI,EAAE,qBAAqB,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgDpB;AAED,wBAAsB,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE;IAClD,IAAI,EAAE,qBAAqB,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoDpB;AAGD,wBAAgB,wBAAwB,CAAC,EACrC,IAAI,EACP,EAAE;IACC,IAAI,EAAE,eAAe,CAAC;CACzB,GAAG,MAAM,EAAE,CAsBX;AAGD,wBAAsB,uBAAuB,CAAC,EAC1C,aAAa,EAChB,EAAE;IACC,aAAa,EAAE,gBAAgB,CAAC;CACnC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgDpB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAC/B,aAAa,EACb,aAAa,GAChB,EAAE;IACC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CACxD,GAAG,OAAO,CAoBV;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,EACpC,aAAa,EACb,SAAS,EACT,EAAE,EACF,MAAM,GACT,EAAE;IACC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACpD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqChB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,EAC7C,YAAY,EACZ,SAAS,GACZ,EAAE;IACC,YAAY,EAAE,gBAAgB,CAAC;IAC/B,SAAS,EAAE,gBAAgB,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA6FpB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,EACzC,KAAK,EACL,IAAI,EACJ,MAAM,GACT,EAAE;IACC,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4DhB;AAED,wBAAsB,gCAAgC,CAAC,EACnD,SAAS,EACT,OAAO,EACP,SAAS,EACT,KAAK,GACR,EAAE;IACC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAA;IACxB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0D5B;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,EAC1C,IAAI,EACJ,SAAS,EACT,KAAK,GACR,EAAE;IACC,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,aAAa,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkD5B;AAED,wBAAsB,qBAAqB,CAAC,EACxC,aAAa,EACb,eAAe,EACf,SAAS,EACT,uCAAuC,EACvC,KAAK,GACR,EAAE;IACC,aAAa,EAAE,gBAAgB,CAAC;IAChC;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,uCAAuC,EAAE,OAAO,CAAC;IACjD,KAAK,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiIpB;AAED,wBAAsB,WAAW,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,KAAK,GACR,EAAE;IACC,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAoBxC;AACD,wBAAsB,4BAA4B,CAAC,EAC/C,IAAI,EACJ,SAAS,EACT,KAAK,GACR,EAAE;IACC,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B"}
+{"version":3,"file":"keystone-helpers.d.mts","sourceRoot":"","sources":["../../src/keystone/keystone-helpers.mts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,SAAS,EAAmB,MAAM,8BAA8B,CAAC;AAS9E,OAAO,EACH,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EACvE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAEtD,aAAa,EAIb,oBAAoB,EAMvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAMnE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAIjE;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,EAChC,YAAY,GACf,EAAE;IACC,YAAY,EAAE,eAAe,CAAC;CACjC,GAAG,OAAO,CAAC,EAAE,CAAC,CAkBd;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,EAClC,EAAE,GACL,EAAE;IACC,EAAE,EAAE,EAAE,CAAC;CACV,GAAG,OAAO,CAAC,aAAa,CAAC,CAqBzB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,EACrC,EAAE,GACL,EAAE;IACC,EAAE,EAAE,EAAE,CAAC;CACV,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnB;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAAC,EAC/C,IAAI,EACJ,oBAAoB,EACpB,UAAU,EACb,EAAE;IACC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6E/B;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAC9B,KAAK,EACL,MAAM,EACN,UAAU,EACV,IAAI,GACP,EAAE;IACC,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC;IACtD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,qBAAqB,CA8CxB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EACrC,IAAI,EACJ,UAAU,EACV,oBAAoB,GACvB,EAAE;IACC,IAAI,EAAE,qBAAqB,CAAC;IAC5B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACnC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA+BpB;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,EAC5C,IAAI,EACJ,SAAS,EACT,KAAK,EACR,EAAE;IACC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,EAC7C,SAAS,EACT,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,MAAM,EACN,IAAI,GACP,EAAE;IACC,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,QAAQ,EAAE,GAAG,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAiDnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EACpC,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,oBAAoB,GACvB,EAAE;IACC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACnC,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CAkDxE;AAED,wBAAsB,sCAAsC,CAAC,EAAE,IAAI,EAAE,EAAE;IACnE,IAAI,EAAE,qBAAqB,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgDpB;AAED,wBAAsB,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE;IAClD,IAAI,EAAE,qBAAqB,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoDpB;AAGD,wBAAgB,wBAAwB,CAAC,EACrC,IAAI,EACP,EAAE;IACC,IAAI,EAAE,eAAe,CAAC;CACzB,GAAG,MAAM,EAAE,CAsBX;AAGD,wBAAsB,uBAAuB,CAAC,EAC1C,aAAa,EAChB,EAAE;IACC,aAAa,EAAE,gBAAgB,CAAC;CACnC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgDpB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAC/B,aAAa,EACb,aAAa,GAChB,EAAE;IACC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CACxD,GAAG,OAAO,CAoBV;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,EACpC,aAAa,EACb,SAAS,EACT,EAAE,EACF,MAAM,GACT,EAAE;IACC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACpD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqChB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,EAC7C,YAAY,EACZ,SAAS,GACZ,EAAE;IACC,YAAY,EAAE,gBAAgB,CAAC;IAC/B,SAAS,EAAE,gBAAgB,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqRpB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,EACzC,KAAK,EACL,IAAI,EACJ,MAAM,GACT,EAAE;IACC,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4DhB;AAED,wBAAsB,gCAAgC,CAAC,EACnD,SAAS,EACT,OAAO,EACP,SAAS,EACT,KAAK,GACR,EAAE;IACC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAA;IACxB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0D5B;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,EAC1C,IAAI,EACJ,SAAS,EACT,KAAK,GACR,EAAE;IACC,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,aAAa,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkD5B;AAED,wBAAsB,qBAAqB,CAAC,EACxC,aAAa,EACb,eAAe,EACf,SAAS,EACT,uCAAuC,EACvC,KAAK,GACR,EAAE;IACC,aAAa,EAAE,gBAAgB,CAAC;IAChC;;;OAGG;IACH,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,uCAAuC,EAAE,OAAO,CAAC;IACjD,KAAK,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiIpB;AAED,wBAAsB,WAAW,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,KAAK,GACR,EAAE;IACC,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAoBxC;AACD,wBAAsB,4BAA4B,CAAC,EAC/C,IAAI,EACJ,SAAS,EACT,KAAK,GACR,EAAE;IACC,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;CACxB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,EACzC,MAAM,EACN,YAAY,EACf,EAAE;IACC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,CAAC,CAqB1C;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,EACvC,QAAQ,EACR,eAAe,EAClB,EAAE;IACC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsBjC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,EACnC,IAAI,EACJ,aAAa,EAChB,EAAE;IACC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBnB"}

package/dist/keystone/keystone-helpers.mjs

@@ -1,12 +1,12 @@
-import { extractErrorMsg, hash, HashAlgorithm, pretty } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { extractErrorMsg, hash, HashAlgorithm, pretty, getUUID } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 import { getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
 import { validateIbGibIntrinsically } from "@ibgib/ts-gib/dist/V1/validate-helper.mjs";
 import { mut8 } from "@ibgib/ts-gib/dist/V1/transforms/mut8.mjs";
 import { Factory_V1 } from "@ibgib/ts-gib/dist/V1/factory.mjs";
 import { getGib } from "@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs";
 import { GLOBAL_LOG_A_LOT } from "../core-constants.mjs";
-import { KEYSTONE_ATOM, KEYSTONE_HASH_MAX_ROUNDS, KEYSTONE_POOL_ID_REGEXP, KEYSTONE_SALT_REGEXP, KEYSTONE_USERNAME_REGEXP, KEYSTONE_DESCRIPTION_REGEXP, KEYSTONE_VERB_MANAGE } from "./keystone-constants.mjs";
-import { KeystoneReplenishStrategy, KEYSTONE_REPLENISH_STRATEGY_VALID_VALUES, KeystoneChallengeType, KEYSTONE_CHALLENGE_TYPE_VALID_VALUES, } from "./keystone-types.mjs";
+import { KEYSTONE_ATOM, KEYSTONE_HASH_MAX_ROUNDS, KEYSTONE_POOL_ID_REGEXP, KEYSTONE_SALT_REGEXP, KEYSTONE_USERNAME_REGEXP, KEYSTONE_DESCRIPTION_REGEXP, KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE } from "./keystone-constants.mjs";
+import { KeystoneReplenishStrategy, KEYSTONE_REPLENISH_STRATEGY_VALID_VALUES, KeystoneChallengeType, KEYSTONE_CHALLENGE_TYPE_VALID_VALUES } from "./keystone-types.mjs";
 import { KeystoneStrategyFactory } from "./strategy/keystone-strategy-factory.mjs";
 import { getDependencyGraph } from "../common/other/graph-helper.mjs";
 import { getIbGibsFromCache_fallbackToSpaces, getTimelinesGroupedByTjp, splitPerTjpAndOrDna } from "../common/other/ibgib-helper.mjs";
@@ -255,7 +255,7 @@ export async function generateOpaqueChallengeId({ salt, timestamp, index }) {
  *
  * @returns The new array of KeystoneChallengePools (including the modified one).
  */
-export async function applyReplenishmentStrategy({ prevPools, targetPoolId, consumedIds, masterSecret, strategy, config, }) {
+export async function applyReplenishmentStrategy({ prevPools, targetPoolId, consumedIds, masterSecret, strategy, config, verb, }) {
     const lc = `[applyReplenishmentStrategy]`;
     try {
         const newPools = JSON.parse(JSON.stringify(prevPools));
@@ -266,7 +266,10 @@ export async function applyReplenishmentStrategy({ prevPools, targetPoolId, cons
         const pool = newPools[targetIdx];
         const poolSecret = await strategy.derivePoolSecret({ masterSecret });
         const timestamp = Date.now().toString();
-        const strategyType = config.behavior.replenish;
+        let strategyType = config.behavior.replenish;
+        if (verb === KEYSTONE_VERB_REVOKE) {
+            strategyType = KeystoneReplenishStrategy.deleteAll;
+        }
         if (strategyType === KeystoneReplenishStrategy.topUp) {
             // Remove consumed
             consumedIds.forEach(id => delete pool.challenges[id]);
@@ -282,16 +285,10 @@ export async function applyReplenishmentStrategy({ prevPools, targetPoolId, cons
             }
         }
         else if (strategyType === KeystoneReplenishStrategy.replaceAll) {
-            pool.challenges = {};
-            for (let i = 0; i < config.behavior.size; i++) {
-                const newId = await generateOpaqueChallengeId({
-                    salt: config.salt, timestamp, index: i
-                });
-                const solution = await strategy.generateSolution({
-                    poolSecret, poolId: pool.id, challengeId: newId
-                });
-                pool.challenges[newId] = await strategy.generateChallenge({ solution });
-            }
+            pool.challenges = await generatePoolChallenges({
+                config,
+                masterSecret
+            });
         }
         else if (strategyType === KeystoneReplenishStrategy.consume) {
             consumedIds.forEach(id => delete pool.challenges[id]);
@@ -331,6 +328,11 @@ export async function solveAndReplenish({ targetPoolId, prevPools, masterSecret,
         }
         const strategy = KeystoneStrategyFactory.create({ config: pool.config });
         const poolSecret = await strategy.derivePoolSecret({ masterSecret });
+        // Verify secret correctness before solving
+        const isSecretCorrect = await verifyPoolSecret({ pool, signingSecret: masterSecret });
+        if (!isSecretCorrect) {
+            throw new Error(`Crypto Violation: Invalid signing secret for pool: ${pool.id} (E: 8a4c2b1d3e5f6a7b8c9d0e1f2a3b4c5f)`);
+        }
         const solutions = [];
         // 1. Solve
         for (const id of challengeIds) {
@@ -352,7 +354,8 @@ export async function solveAndReplenish({ targetPoolId, prevPools, masterSecret,
             consumedIds: challengeIds,
             masterSecret,
             strategy,
-            config: pool.config
+            config: pool.config,
+            verb: claim.verb
         });
         return { proof, nextPools };
     }
@@ -676,6 +679,176 @@ export async function validateKeystoneTransition({ currentIbGib, prevIbGib, }) {
                 errors.push(`Revocation target mismatch. Expected ${expectedTarget}, got ${target}`);
             }
         }
+        // Claim details verification (transition validation)
+        const signingPoolIds = new Set(currData.proofs.map(p => p.solutions?.[0]?.poolId).filter(Boolean));
+        for (const proof of currData.proofs) {
+            const claim = proof.claim;
+            if (claim?.details) {
+                const details = claim.details;
+                const type = details.type;
+                const info = details.info;
+                if (type === 'add-pool') {
+                    // Cast info to ClaimDetails_AddPool
+                    const addInfo = info;
+                    if (!addInfo || !Array.isArray(addInfo.add) || addInfo.add.length === 0) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: 1fa2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+                    // Verify that the set of pools in current equals previous plus the added pools
+                    const prevIds = new Set(prevData.challengePools.map(p => p.id));
+                    const currIds = new Set(currData.challengePools.map(p => p.id));
+                    // All added pools must be in current
+                    for (const id of addInfo.add) {
+                        if (!currIds.has(id)) {
+                            errors.push(`ClaimDetails_AddPool lists pool ${id} but it is missing in the evolved keystone. (E: 2fa2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (prevIds.has(id)) {
+                            errors.push(`ClaimDetails_AddPool attempts to add existing pool ${id}. (E: 3fa2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+                    // Verify size
+                    if (currData.challengePools.length !== prevData.challengePools.length + addInfo.add.length) {
+                        errors.push(`Structural mismatch: expected ${prevData.challengePools.length + addInfo.add.length} pools, found ${currData.challengePools.length}. (E: 4fa2a8cb28c9b60e68994511a5825)`);
+                    }
+                    // Verify all previous pools are unmodified
+                    for (const prevPool of prevData.challengePools) {
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool) {
+                            errors.push(`Existing pool ${prevPool.id} was removed during add-pool transition. (E: 5fa2a8cb28c9b60e68994511a5825)`);
+                            continue;
+                        }
+                        // Verify configuration did not change
+                        if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                            errors.push(`Existing pool config ${prevPool.id} was mutated during add-pool transition. (E: 6fa2a8cb28c9b60e68994511a5825)`);
+                        }
+                        // Verify challenges did not change, unless this was the signing pool used to authorize the transition
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            errors.push(`Existing pool challenges ${prevPool.id} were mutated during add-pool transition. (E: 7fa2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+                }
+                else if (type === 'replace-pool') {
+                    const replaceInfo = info;
+                    if (!replaceInfo || typeof replaceInfo.replace !== 'string' || !replaceInfo.replace) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: 8fa2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+                    const targetId = replaceInfo.replace;
+                    // Verify that the set of pool IDs in current equals previous
+                    const prevIds = prevData.challengePools.map(p => p.id).sort();
+                    const currIds = currData.challengePools.map(p => p.id).sort();
+                    if (JSON.stringify(prevIds) !== JSON.stringify(currIds)) {
+                        errors.push(`replace-pool transition mutated the pool IDs set. (E: 9fa2a8cb28c9b60e68994511a5825)`);
+                    }
+                    // Assert target pool was replaced (challenges modified)
+                    const prevTarget = prevData.challengePools.find(p => p.id === targetId);
+                    const currTarget = currData.challengePools.find(p => p.id === targetId);
+                    if (!prevTarget || !currTarget) {
+                        errors.push(`Replaced pool ${targetId} not found in keystone challenge pools. (E: afa2a8cb28c9b60e68994511a5825)`);
+                    }
+                    // Verify all other pools are completely unmodified
+                    for (const prevPool of prevData.challengePools) {
+                        if (prevPool.id === targetId)
+                            continue;
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool)
+                            continue;
+                        if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                            errors.push(`Unrelated pool config ${prevPool.id} was mutated during replace-pool. (E: bfa2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            errors.push(`Unrelated pool challenges ${prevPool.id} were mutated during replace-pool. (E: cfa2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+                }
+                else if (type === 'remove-pool') {
+                    const removeInfo = info;
+                    if (!removeInfo || !Array.isArray(removeInfo.remove) || removeInfo.remove.length === 0) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: b7a2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+                    const removeSet = new Set(removeInfo.remove);
+                    // Verify that the set of pool IDs in current equals previous minus the removed pools
+                    const prevIds = new Set(prevData.challengePools.map(p => p.id));
+                    const currIds = new Set(currData.challengePools.map(p => p.id));
+                    for (const id of removeInfo.remove) {
+                        if (!prevIds.has(id)) {
+                            errors.push(`ClaimDetails_RemovePool lists pool ${id} but it is missing in the previous keystone. (E: c7a2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (currIds.has(id)) {
+                            errors.push(`ClaimDetails_RemovePool lists pool ${id} but it is still present in the evolved keystone. (E: d7a2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+                    // Verify size
+                    if (currData.challengePools.length !== prevData.challengePools.length - removeInfo.remove.length) {
+                        errors.push(`Structural mismatch: expected ${prevData.challengePools.length - removeInfo.remove.length} pools, found ${currData.challengePools.length}. (E: e7a2a8cb28c9b60e68994511a5825)`);
+                    }
+                    // Verify all remaining pools are unmodified
+                    for (const prevPool of prevData.challengePools) {
+                        if (removeSet.has(prevPool.id))
+                            continue;
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool) {
+                            errors.push(`Pool ${prevPool.id} was unexpectedly removed. (E: f7a2a8cb28c9b60e68994511a5825)`);
+                            continue;
+                        }
+                        if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                            errors.push(`Remaining pool config ${prevPool.id} was mutated during remove-pool. (E: 07a2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            errors.push(`Remaining pool challenges ${prevPool.id} were mutated during remove-pool. (E: 17a2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+                }
+                else if (type === 'change-password') {
+                    const changeInfo = info;
+                    if (!changeInfo || !Array.isArray(changeInfo.change) || changeInfo.change.length === 0) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: dfa2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+                    // Verify that the set of pool IDs is unmodified
+                    const prevIds = prevData.challengePools.map(p => p.id).sort();
+                    const currIds = currData.challengePools.map(p => p.id).sort();
+                    if (JSON.stringify(prevIds) !== JSON.stringify(currIds)) {
+                        errors.push(`change-password transition mutated the pool IDs set. (E: efa2a8cb28c9b60e68994511a5825)`);
+                    }
+                    const rotatedIds = new Set(changeInfo.change);
+                    for (const prevPool of prevData.challengePools) {
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool)
+                            continue;
+                        if (rotatedIds.has(prevPool.id)) {
+                            // Check: rotated pool must not be foreign!
+                            if (prevPool.isForeign) {
+                                errors.push(`Security Violation: Password rotation attempted on foreign pool ${prevPool.id}. (E: ffa2a8cb28c9b60e68994511a5825)`);
+                            }
+                            // Config must be identical except for the salt
+                            const prevConfCopy = { ...prevPool.config, salt: '' };
+                            const currConfCopy = { ...currPool.config, salt: '' };
+                            if (JSON.stringify(prevConfCopy) !== JSON.stringify(currConfCopy)) {
+                                errors.push(`Pool config metadata for rotated pool ${prevPool.id} was mutated. (E: 00b2a8cb28c9b60e68994511a5825)`);
+                            }
+                            // Salt must be different
+                            if (prevPool.config.salt === currPool.config.salt) {
+                                errors.push(`Pool salt for rotated pool ${prevPool.id} was not rotated. (E: 01b2a8cb28c9b60e68994511a5825)`);
+                            }
+                        }
+                        else {
+                            // Non-rotated pools must be completely unmodified
+                            if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                                errors.push(`Unrelated pool config ${prevPool.id} was mutated during change-password. (E: 02b2a8cb28c9b60e68994511a5825)`);
+                            }
+                            if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                                errors.push(`Unrelated pool challenges ${prevPool.id} were mutated during change-password. (E: 03b2a8cb28c9b60e68994511a5825)`);
+                            }
+                        }
+                    }
+                }
+                else {
+                    errors.push(`Unknown claim details type: ${type}`);
+                }
+            }
+        }
         return errors;
     }
     catch (error) {
@@ -1058,4 +1231,76 @@ export async function getIdentity_throwIfUndefined({ addr, metaspace, space, })
     }
     return identityIbGib;
 }
+/**
+ * Pure helper to generate challenges map for a pool configuration using a masterSecret.
+ */
+export async function generatePoolChallenges({ config, masterSecret }) {
+    const strategy = KeystoneStrategyFactory.create({ config });
+    const poolSecret = await strategy.derivePoolSecret({ masterSecret });
+    const challenges = {};
+    const targetSize = config.behavior.size;
+    const timestamp = Date.now().toString();
+    for (let i = 0; i < targetSize; i++) {
+        const challengeId = await generateOpaqueChallengeId({
+            salt: config.salt,
+            timestamp,
+            index: i
+        });
+        const solution = await strategy.generateSolution({
+            poolSecret,
+            poolId: config.id,
+            challengeId
+        });
+        challenges[challengeId] = await strategy.generateChallenge({ solution });
+    }
+    return challenges;
+}
+/**
+ * Pure helper to rotate a pool to a new masterSecret.
+ * Takes the previous pool config, generates a new salt, and builds a new pool with refreshed challenges.
+ */
+export async function rotatePoolChallenges({ prevPool, newMasterSecret }) {
+    const prevConfig = prevPool.config;
+    const newSalt = (await getUUID()).substring(0, 16);
+    // Copy the config exactly, updating only the salt
+    const newConfig = {
+        ...prevConfig,
+        salt: newSalt
+    };
+    const newChallenges = await generatePoolChallenges({
+        config: newConfig,
+        masterSecret: newMasterSecret
+    });
+    return {
+        id: prevPool.id,
+        config: newConfig,
+        challenges: newChallenges,
+        ...(prevPool.isForeign !== undefined ? { isForeign: prevPool.isForeign } : {}),
+        ...(prevPool.metadata ? { metadata: prevPool.metadata } : {})
+    };
+}
+/**
+ * Pure helper to verify if a candidate signing secret (passphrase) is correct for a specific challenge pool.
+ * Does not mutate any state.
+ */
+export async function verifyPoolSecret({ pool, signingSecret }) {
+    const challengeIds = Object.keys(pool.challenges);
+    if (challengeIds.length === 0)
+        return false;
+    try {
+        const firstId = challengeIds[0];
+        const challenge = pool.challenges[firstId];
+        const strategy = KeystoneStrategyFactory.create({ config: pool.config });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: signingSecret });
+        const solution = await strategy.generateSolution({
+            poolSecret,
+            poolId: pool.id,
+            challengeId: firstId
+        });
+        return await strategy.validateSolution({ solution, challenge });
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=keystone-helpers.mjs.map