@ibgib/node-gib 0.0.14 → 0.0.17

package/dist/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.mjs

@@ -0,0 +1,192 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-genesis.handler
+ *
+ * POST /api/identity/custodian/genesis
+ *
+ * Single-turn passwordless onboarding & custodian genesis endpoint.
+ * Returns the primary identity keystone (or primaryTjpAddr) along with a fresh,
+ * single-turn `CustodianRequirements` payload containing `authCode` and single-use `nonce`.
+ */
+import * as fs from 'node:fs/promises';
+import { extractErrorMsg, hash, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getTjpAddr } from '@ibgib/core-gib/dist/common/other/ibgib-helper.mjs';
+import { getDependencyGraph } from '@ibgib/core-gib/dist/common/other/graph-helper.mjs';
+import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { validateEmail } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
+import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { API_PATH_REGEXES } from '../../../path-constants.mjs';
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
+import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
+import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
+import { generateCustodianRequirements } from '../../../../identity/sso/custodian-auth-helpers.mjs';
+import { getPendingStagingDir, getPendingTjpHash, verifyPendingCode } from '../../../../email/verify/email-verify-helpers.mjs';
+const logalot = GLOBAL_LOG_A_LOT || true;
+/**
+ * POST /api/identity/custodian/genesis
+ */
+export class KeystoneCustodianGenesisHandler extends ServeGibHandlerBase {
+    lc = `[${KeystoneCustodianGenesisHandler.name}]`;
+    method = 'POST';
+    regex = API_PATH_REGEXES.KEYSTONE_CUSTODIAN_GENESIS;
+    async handleRouteImpl(reqCtx) {
+        const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
+        try {
+            if (logalot) {
+                console.log(`${lc} starting... (I: a123456789abcdef0123456789b0001)`);
+            }
+            if (reqCtx.method !== 'POST') {
+                return this.error(405, 'Method Not Allowed');
+            }
+            if (!reqCtx.body) {
+                return this.error(400, 'Request body is empty (E: b123456789abcdef0123456789b0002)');
+            }
+            let body;
+            try {
+                body = JSON.parse(reqCtx.body);
+            }
+            catch {
+                return this.error(400, 'Request body must be valid JSON (E: c123456789abcdef0123456789b0003)');
+            }
+            const { email, username, code } = body;
+            if (!email || !validateEmail(email)) {
+                return this.error(400, 'Invalid email address format (E: d123456789abcdef0123456789b0004)');
+            }
+            const normEmail = normalizeEmail(email);
+            const indexService = getIdentityIndexService();
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const existing = await indexService.lookupIdentityByEmail({ email: normEmail });
+            const effectivePrimaryTjpAddr = existing ? existing.primaryTjpAddr : `pending:${normEmail}`;
+            // Verify 6-digit OTP code if provided or if staging record exists
+            if (code || !existing) {
+                if (!code || typeof code !== 'string' || code.trim().length !== 6) {
+                    return this.error(400, '6-digit verification code is required (E: e123456789abcdef0123456789b0009)');
+                }
+                const tjpHash = await getPendingTjpHash(effectivePrimaryTjpAddr);
+                const pendingInfo = reqCtx.dataDir && tjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash }) : undefined;
+                if (!pendingInfo || pendingInfo.isExpired) {
+                    return this.error(400, 'Verification record missing or expired. Please request a new verification code. (E: f123456789abcdef0123456789b0010)');
+                }
+                const codeVerifyResult = await verifyPendingCode({
+                    pendingDir: pendingInfo.pendingDir,
+                    code,
+                });
+                if (!codeVerifyResult.valid) {
+                    return this.error(400, codeVerifyResult.error || 'Invalid verification code (E: g123456789abcdef0123456789b0011)');
+                }
+            }
+            let primaryTjpAddr;
+            let primaryKeystone;
+            let isNewIdentity = false;
+            if (existing) {
+                // Identity already exists — retrieve primary identity info
+                primaryTjpAddr = existing.primaryTjpAddr;
+                console.log(`${lc} Found existing identity for ${normEmail}: ${primaryTjpAddr} (I: e123456789abcdef0123456789b0005)`);
+                // Bootstrap domain space to fetch primary keystone frame
+                const metaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const space = await metaspace.getLocalUserSpace({ lock: false });
+                if (space) {
+                    const latestAddr = await metaspace.getLatestAddr({ addr: primaryTjpAddr, space }) ?? primaryTjpAddr;
+                    const getRes = await metaspace.get({ addrs: [latestAddr], space });
+                    primaryKeystone = getRes.ibGibs?.[0];
+                }
+            }
+            else {
+                // New custodian identity creation
+                isNewIdentity = true;
+                console.log(`${lc} Creating new custodian primary identity for ${normEmail} (I: f123456789abcdef0123456789b0006)`);
+                const defaultUsername = username || normEmail.split('@')[0];
+                const primaryBuilder = KeystoneProfileBuilder.buildKeystone('sync')
+                    .withUsername(defaultUsername)
+                    .withDescription(`Full Custodian Primary Identity for ${normEmail}`)
+                    .withDetails({
+                    emails: [normEmail],
+                    custodyMode: 'full',
+                });
+                const configs = await primaryBuilder.compileConfigs();
+                const primarySecret = await hash({ s: `${serverSecret}_custodian_${normEmail}` });
+                // Bootstrap temporary domain metaspace to perform genesis
+                const tempMetaspace = await bootstrapDomainMetaspace(`temp^${await getUUID()}`, reqCtx.dataDir);
+                const tempSpace = await tempMetaspace.getLocalUserSpace({ lock: false });
+                if (!tempSpace) {
+                    throw new Error(`Failed to create temp domain space for new primary identity (E: 123456789abcdef0123456789b0007)`);
+                }
+                const keystoneService = new KeystoneService_V1();
+                primaryKeystone = await keystoneService.genesis({
+                    masterSecret: primarySecret,
+                    emails: [normEmail],
+                    frameDetails: primaryBuilder.getFrameDetails(),
+                    configs,
+                    metaspace: tempMetaspace,
+                    space: tempSpace,
+                    isPrimary: true
+                });
+                primaryTjpAddr = getTjpAddr({ ibGib: primaryKeystone, defaultIfNone: 'incomingAddr' });
+                // Bootstrap permanent domain space for primaryTjpAddr and persist primary keystone
+                const metaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const space = await metaspace.getLocalUserSpace({ lock: false });
+                if (!space) {
+                    throw new Error(`Failed to create domain space for new primary identity ${primaryTjpAddr} (E: 123456789abcdef0123456789b0008)`);
+                }
+                await metaspace.put({ ibGibs: [primaryKeystone], space });
+                await metaspace.registerNewIbGib({ ibGib: primaryKeystone, space });
+                // Register in identity reverse index
+                await indexService.registerEmailIndex({
+                    email: normEmail,
+                    primaryTjpAddr
+                });
+                // Clean up pending staging directory if present
+                const tjpHash = await getPendingTjpHash(effectivePrimaryTjpAddr);
+                const pendingInfo = reqCtx.dataDir && tjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash }) : undefined;
+                if (pendingInfo?.pendingDir) {
+                    try {
+                        await fs.rm(pendingInfo.pendingDir, { recursive: true, force: true });
+                    }
+                    catch { }
+                }
+            }
+            // Generate single-turn CustodianRequirements for client delegate registration
+            const custodianReqs = await generateCustodianRequirements({
+                primaryTjpAddr,
+                serverSecret
+            });
+            // Extract complete primary keystone dependency graph
+            let primaryGraph;
+            if (primaryKeystone) {
+                const domainMetaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const domainSpace = await domainMetaspace.getLocalUserSpace({ lock: false });
+                if (domainSpace) {
+                    primaryGraph = await getDependencyGraph({
+                        ibGib: primaryKeystone,
+                        space: domainSpace,
+                        live: false
+                    });
+                }
+            }
+            const responseBody = {
+                success: true,
+                isNewIdentity,
+                primaryTjpAddr,
+                primaryKeystone,
+                primaryGraph,
+                custodianReqs,
+                message: isNewIdentity ? 'Custodian primary identity created.' : 'Custodian identity located.'
+            };
+            return this.ok(responseBody, isNewIdentity ? 201 : 200);
+        }
+        catch (error) {
+            const emsg = extractErrorMsg(error);
+            console.error(`${lc} ${emsg}`);
+            return this.error(500, emsg);
+        }
+        finally {
+            if (logalot) {
+                console.log(`${lc} complete.`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=keystone-custodian-genesis.handler.mjs.map

package/dist/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-custodian-genesis.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAExF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mEAAmE,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,oDAAoD,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AAEpG,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AAE/H,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAkBzC;;GAEG;AACH,MAAM,OAAO,+BAAgC,SAAQ,mBAAyC;IACvE,EAAE,GAAW,IAAI,+BAA+B,CAAC,IAAI,GAAG,CAAC;IACzD,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,0BAA0B,CAAC;IAE7D,KAAK,CAAC,eAAe,CAC3B,MAA4C;QAE5C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;YAAC,CAAC;YAEvF,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,4DAA4D,CAAC,CAAC;YACzF,CAAC;YAED,IAAI,IAAiC,CAAC;YACtC,IAAI,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,sEAAsE,CAAC,CAAC;YACnG,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YACvC,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,mEAAmE,CAAC,CAAC;YAChG,CAAC;YAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,SAAS,CAAC,kBAAkB,CAAC;YAElD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAChF,MAAM,uBAAuB,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,SAAS,EAAE,CAAC;YAE5F,kEAAkE;YAClE,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,4EAA4E,CAAC,CAAC;gBACzG,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;gBACjE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE7H,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;oBACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,sHAAsH,CAAC,CAAC;gBACnJ,CAAC;gBAED,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,CAAC;oBAC7C,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,IAAI;iBACP,CAAC,CAAC;gBAEH,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;oBAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,IAAI,gEAAgE,CAAC,CAAC;gBACvH,CAAC;YACL,CAAC;YAED,IAAI,cAAsB,CAAC;YAC3B,IAAI,eAAgC,CAAC;YACrC,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,IAAI,QAAQ,EAAE,CAAC;gBACX,2DAA2D;gBAC3D,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,SAAS,KAAK,cAAc,uCAAuC,CAAC,CAAC;gBAEtH,yDAAyD;gBACzD,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjE,IAAI,KAAK,EAAE,CAAC;oBACR,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,IAAI,cAAc,CAAC;oBACpG,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBACnE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,kCAAkC;gBAClC,aAAa,GAAG,IAAI,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gDAAgD,SAAS,uCAAuC,CAAC,CAAC;gBAEnH,MAAM,eAAe,GAAG,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,MAAM,cAAc,GAAG,sBAAsB,CAAC,aAAa,CAAC,MAAM,CAAC;qBAC9D,YAAY,CAAC,eAAe,CAAC;qBAC7B,eAAe,CAAC,uCAAuC,SAAS,EAAE,CAAC;qBACnE,WAAW,CAAC;oBACT,MAAM,EAAE,CAAC,SAAS,CAAC;oBACnB,WAAW,EAAE,MAAM;iBACtB,CAAC,CAAC;gBAEP,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,cAAc,SAAS,EAAE,EAAE,CAAC,CAAC;gBAElF,0DAA0D;gBAC1D,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,QAAQ,MAAM,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChG,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;gBACvH,CAAC;gBAED,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBACjD,eAAe,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC;oBAC5C,YAAY,EAAE,aAAa;oBAC3B,MAAM,EAAE,CAAC,SAAS,CAAC;oBACnB,YAAY,EAAE,cAAc,CAAC,eAAe,EAAE;oBAC9C,OAAO;oBACP,SAAS,EAAE,aAAa;oBACxB,KAAK,EAAE,SAAS;oBAChB,SAAS,EAAE,IAAI;iBAClB,CAAC,CAAC;gBAEH,cAAc,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,CAAE,CAAC;gBAExF,mFAAmF;gBACnF,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CAAC,0DAA0D,cAAc,sCAAsC,CAAC,CAAC;gBACpI,CAAC;gBAED,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1D,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEpE,qCAAqC;gBACrC,MAAM,YAAY,CAAC,kBAAkB,CAAC;oBAClC,KAAK,EAAE,SAAS;oBAChB,cAAc;iBACjB,CAAC,CAAC;gBAEH,gDAAgD;gBAChD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;gBACjE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7H,IAAI,WAAW,EAAE,UAAU,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBAAC,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,CAAC;gBAC5F,CAAC;YACL,CAAC;YAED,8EAA8E;YAC9E,MAAM,aAAa,GAAG,MAAM,6BAA6B,CAAC;gBACtD,cAAc;gBACd,YAAY;aACf,CAAC,CAAC;YAEH,qDAAqD;YACrD,IAAI,YAAwC,CAAC;YAC7C,IAAI,eAAe,EAAE,CAAC;gBAClB,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7E,IAAI,WAAW,EAAE,CAAC;oBACd,YAAY,GAAG,MAAM,kBAAkB,CAAC;wBACpC,KAAK,EAAE,eAAe;wBACtB,KAAK,EAAE,WAAW;wBAClB,IAAI,EAAE,KAAK;qBACd,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,MAAM,YAAY,GAAiC;gBAC/C,OAAO,EAAE,IAAI;gBACb,aAAa;gBACb,cAAc;gBACd,eAAe;gBACf,YAAY;gBACZ,aAAa;gBACb,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,6BAA6B;aACjG,CAAC;YAEF,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.d.mts

@@ -0,0 +1,33 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler
+ *
+ * POST /api/identity/custodian/register-delegate
+ *
+ * Validates a client delegate keystone containing single-turn `custodianReqs`,
+ * enforces single-use nonce reservation, verifies cryptographic `authCode`,
+ * evolves the server-held primary identity keystone to link the delegate,
+ * and returns the updated `evolvedPrimaryKeystone`.
+ */
+import { FlatIbGibGraph } from '@ibgib/core-gib/dist/common/other/graph-types.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
+export interface CustodianRegisterDelegateRequestBody {
+    delegateKeystone: any;
+}
+export interface CustodianRegisterDelegateResponseBody {
+    success: boolean;
+    primaryTjpAddr: string;
+    evolvedPrimaryKeystone: any;
+    primaryGraph?: FlatIbGibGraph;
+    message?: string;
+}
+/**
+ * POST /api/identity/custodian/register-delegate
+ */
+export declare class KeystoneCustodianRegisterDelegateHandler extends ServeGibHandlerBase<undefined, undefined> {
+    protected lc: string;
+    protected method: ServeGibHttpMethod;
+    protected regex: RegExp;
+    protected handleRouteImpl(reqCtx: RequestContext<undefined, undefined>): Promise<ResponseResult | undefined>;
+}
+//# sourceMappingURL=keystone-custodian-register-delegate.handler.d.mts.map

package/dist/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-custodian-register-delegate.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAMnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AASxF,MAAM,WAAW,oCAAoC;IACjD,gBAAgB,EAAE,GAAG,CAAC;CACzB;AAED,MAAM,WAAW,qCAAqC;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,GAAG,CAAC;IAC5B,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,wCAAyC,SAAQ,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;IACnG,UAAmB,EAAE,EAAE,MAAM,CAAwD;IACrF,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAAyD;IAEjF,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAyJrC;CACJ"}

package/dist/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.mjs

@@ -0,0 +1,173 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler
+ *
+ * POST /api/identity/custodian/register-delegate
+ *
+ * Validates a client delegate keystone containing single-turn `custodianReqs`,
+ * enforces single-use nonce reservation, verifies cryptographic `authCode`,
+ * evolves the server-held primary identity keystone to link the delegate,
+ * and returns the updated `evolvedPrimaryKeystone`.
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { extractErrorMsg, hash } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { validateIbGibIntrinsically } from '@ibgib/ts-gib/dist/V1/validate-helper.mjs';
+import { getDependencyGraph } from '@ibgib/core-gib/dist/common/other/graph-helper.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { API_PATH_REGEXES } from '../../../path-constants.mjs';
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
+import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
+import { getAuthCustodianIndex, verifyCustodianRequirements } from '../../../../identity/sso/custodian-auth-helpers.mjs';
+const logalot = GLOBAL_LOG_A_LOT || true;
+/**
+ * POST /api/identity/custodian/register-delegate
+ */
+export class KeystoneCustodianRegisterDelegateHandler extends ServeGibHandlerBase {
+    lc = `[${KeystoneCustodianRegisterDelegateHandler.name}]`;
+    method = 'POST';
+    regex = API_PATH_REGEXES.KEYSTONE_CUSTODIAN_REGISTER_DELEGATE;
+    async handleRouteImpl(reqCtx) {
+        const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
+        let authFilePathToClean;
+        try {
+            if (logalot) {
+                console.log(`${lc} starting... (I: a23456789abcdef0123456789c0001)`);
+            }
+            if (reqCtx.method !== 'POST') {
+                return this.error(405, 'Method Not Allowed');
+            }
+            if (!reqCtx.body) {
+                return this.error(400, 'Request body is empty (E: b23456789abcdef0123456789c0002)');
+            }
+            let body;
+            try {
+                body = JSON.parse(reqCtx.body);
+            }
+            catch {
+                return this.error(400, 'Request body must be valid JSON (E: c23456789abcdef0123456789c0003)');
+            }
+            const { delegateKeystone } = body;
+            if (!delegateKeystone) {
+                return this.error(400, 'Request body must contain delegateKeystone (E: d23456789abcdef0123456789c0004)');
+            }
+            // 1. Intrinsic hash validation on delegate keystone
+            const intrinsicErrors = await validateIbGibIntrinsically({ ibGib: delegateKeystone });
+            if (intrinsicErrors && intrinsicErrors.length > 0) {
+                return this.error(422, 'Intrinsic validation failed for delegateKeystone', { errors: intrinsicErrors });
+            }
+            // 2. Structural keystone validation
+            const keystoneService = new KeystoneService_V1();
+            const genesisErrors = await keystoneService.validateGenesisKeystone({ keystoneIbGib: delegateKeystone });
+            if (genesisErrors && genesisErrors.length > 0) {
+                return this.error(422, 'Delegate keystone structure validation failed', { errors: genesisErrors });
+            }
+            // 3. Extract and check custodianReqs from frameDetails
+            const frameDetails = delegateKeystone.data?.frameDetails || delegateKeystone.data;
+            const custodianReqs = frameDetails?.custodianReqs;
+            if (!custodianReqs) {
+                return this.error(400, 'Missing custodianReqs payload in delegate keystone frameDetails (E: e23456789abcdef0123456789c0005)');
+            }
+            const delegatePrimaryTjpAddr = frameDetails?.primaryTjpAddr;
+            if (delegatePrimaryTjpAddr && delegatePrimaryTjpAddr !== custodianReqs.primaryTjpAddr) {
+                return this.error(400, 'Primary TJP address mismatch between delegate frameDetails and custodianReqs (E: f23456789abcdef0123456789c0006)');
+            }
+            // 4. Verify cryptographic signature & expiration of custodianReqs
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const verifyRes = await verifyCustodianRequirements({ custodianReqs, serverSecret });
+            if (!verifyRes.valid) {
+                return this.error(401, verifyRes.error || 'Invalid custodian requirements payload');
+            }
+            // 5. Atomic Single-Turn Nonce Reservation Check (`{ flag: 'wx' }`)
+            const authCustodianIndex = await getAuthCustodianIndex({ custodianReqs });
+            const dataDir = reqCtx.dataDir || process.env.DATA_DIR || 'data';
+            const authDir = path.join(dataDir, 'identity_index', 'auth_custodian');
+            await fs.mkdir(authDir, { recursive: true });
+            authFilePathToClean = path.join(authDir, `${authCustodianIndex}.json`);
+            try {
+                await fs.writeFile(authFilePathToClean, JSON.stringify({
+                    usedAt: Date.now(),
+                    primaryTjpAddr: custodianReqs.primaryTjpAddr,
+                    nonce: custodianReqs.nonce
+                }), { flag: 'wx' });
+            }
+            catch (fileErr) {
+                if (fileErr.code === 'EEXIST') {
+                    return this.error(409, 'Custodian requirements payload has already been used. Nonce single-turn reservation violation.');
+                }
+                throw fileErr;
+            }
+            // 6. Evolve Server-Held Primary Identity Keystone
+            const metaspace = await bootstrapDomainMetaspace(custodianReqs.primaryTjpAddr, reqCtx.dataDir);
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) {
+                return this.error(500, `Could not load domain space for primary identity ${custodianReqs.primaryTjpAddr}`);
+            }
+            const latestPrimaryAddr = await metaspace.getLatestAddr({ addr: custodianReqs.primaryTjpAddr, space }) ?? custodianReqs.primaryTjpAddr;
+            const getRes = await metaspace.get({ addrs: [latestPrimaryAddr], space });
+            const parentKeystone = getRes.ibGibs?.[0];
+            if (!parentKeystone) {
+                return this.error(404, `Primary identity keystone not found for address ${custodianReqs.primaryTjpAddr}`);
+            }
+            // Derive server's primary custodian secret
+            const primaryEmail = parentKeystone.data?.emails?.[0]
+                || parentKeystone.data?.frameDetails?.emails?.[0]
+                || frameDetails?.email
+                || '';
+            if (!primaryEmail) {
+                return this.error(500, `Could not determine primary email for identity ${custodianReqs.primaryTjpAddr}`);
+            }
+            const primarySecret = await hash({ s: `${serverSecret}_custodian_${primaryEmail}` });
+            // Execute primary keystone evolution linking the new delegate
+            const evolvedPrimaryKeystone = await keystoneService.registerDelegate({
+                parentKeystone,
+                delegateKeystone,
+                masterSecret: primarySecret,
+                metaspace,
+                space,
+                allowedVerbs: custodianReqs.allowedVerbs || [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+                deviceName: frameDetails?.deviceTag || 'client-delegate'
+            });
+            // Persist delegate keystone in domain space
+            await metaspace.put({ ibGibs: [delegateKeystone], space });
+            await metaspace.registerNewIbGib({ ibGib: delegateKeystone, space });
+            // Extract complete primary keystone dependency graph
+            const primaryGraph = await getDependencyGraph({
+                ibGib: evolvedPrimaryKeystone,
+                space,
+                live: false
+            });
+            const responseBody = {
+                success: true,
+                primaryTjpAddr: custodianReqs.primaryTjpAddr,
+                evolvedPrimaryKeystone,
+                primaryGraph,
+                message: 'Custodian delegate keystone registered and primary identity evolved successfully.'
+            };
+            return this.ok(responseBody, 200);
+        }
+        catch (error) {
+            const emsg = extractErrorMsg(error);
+            console.error(`${lc} ${emsg}`);
+            return this.error(500, emsg);
+        }
+        finally {
+            // Clean up single-turn reservation file after processing
+            if (authFilePathToClean) {
+                try {
+                    await fs.unlink(authFilePathToClean);
+                }
+                catch {
+                    // Ignore unlinking errors if already cleaned up
+                }
+            }
+            if (logalot) {
+                console.log(`${lc} complete.`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=keystone-custodian-register-delegate.handler.mjs.map

package/dist/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-custodian-register-delegate.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAExF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAEjH,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AAGzH,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAczC;;GAEG;AACH,MAAM,OAAO,wCAAyC,SAAQ,mBAAyC;IAChF,EAAE,GAAW,IAAI,wCAAwC,CAAC,IAAI,GAAG,CAAC;IAClE,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,oCAAoC,CAAC;IAEvE,KAAK,CAAC,eAAe,CAC3B,MAA4C;QAE5C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,mBAAuC,CAAC;QAE5C,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAC;YAAC,CAAC;YAEtF,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,2DAA2D,CAAC,CAAC;YACxF,CAAC;YAED,IAAI,IAA0C,CAAC;YAC/C,IAAI,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qEAAqE,CAAC,CAAC;YAClG,CAAC;YAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,gFAAgF,CAAC,CAAC;YAC7G,CAAC;YAED,oDAAoD;YACpD,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACtF,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,kDAAkD,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5G,CAAC;YAED,oCAAoC;YACpC,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACjD,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACzG,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+CAA+C,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACvG,CAAC;YAED,uDAAuD;YACvD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,EAAE,YAAY,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAClF,MAAM,aAAa,GAAsC,YAAY,EAAE,aAAa,CAAC;YACrF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qGAAqG,CAAC,CAAC;YAClI,CAAC;YAED,MAAM,sBAAsB,GAAuB,YAAY,EAAE,cAAc,CAAC;YAChF,IAAI,sBAAsB,IAAI,sBAAsB,KAAK,aAAa,CAAC,cAAc,EAAE,CAAC;gBACpF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,kHAAkH,CAAC,CAAC;YAC/I,CAAC;YAED,kEAAkE;YAClE,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,SAAS,CAAC,kBAAkB,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;YACrF,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,IAAI,wCAAwC,CAAC,CAAC;YACxF,CAAC;YAED,mEAAmE;YACnE,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;YACvE,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE7C,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,kBAAkB,OAAO,CAAC,CAAC;YACvE,IAAI,CAAC;gBACD,MAAM,EAAE,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnD,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE;oBAClB,cAAc,EAAE,aAAa,CAAC,cAAc;oBAC5C,KAAK,EAAE,aAAa,CAAC,KAAK;iBAC7B,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,OAAY,EAAE,CAAC;gBACpB,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,gGAAgG,CAAC,CAAC;gBAC7H,CAAC;gBACD,MAAM,OAAO,CAAC;YAClB,CAAC;YAED,kDAAkD;YAClD,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,aAAa,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/F,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oDAAoD,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;YAC/G,CAAC;YAED,MAAM,iBAAiB,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,IAAI,aAAa,CAAC,cAAc,CAAC;YACvI,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAiC,CAAC;YAE1E,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,mDAAmD,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;YAC9G,CAAC;YAED,2CAA2C;YAC3C,MAAM,YAAY,GAAW,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;mBACtD,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;mBAC9C,YAAY,EAAE,KAAK;mBACnB,EAAE,CAAC;YAEV,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,kDAAkD,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,cAAc,YAAY,EAAE,EAAE,CAAC,CAAC;YAErF,8DAA8D;YAC9D,MAAM,sBAAsB,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC;gBAClE,cAAc;gBACd,gBAAgB;gBAChB,YAAY,EAAE,aAAa;gBAC3B,SAAS;gBACT,KAAK;gBACL,YAAY,EAAE,aAAa,CAAC,YAAY,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;gBACvF,UAAU,EAAE,YAAY,EAAE,SAAS,IAAI,iBAAiB;aAC3D,CAAC,CAAC;YAEH,4CAA4C;YAC5C,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3D,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;YAErE,qDAAqD;YACrD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC;gBAC1C,KAAK,EAAE,sBAAsB;gBAC7B,KAAK;gBACL,IAAI,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,MAAM,YAAY,GAA0C;gBACxD,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,aAAa,CAAC,cAAc;gBAC5C,sBAAsB;gBACtB,YAAY;gBACZ,OAAO,EAAE,mFAAmF;aAC/F,CAAC;YAEF,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACP,yDAAyD;YACzD,IAAI,mBAAmB,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACD,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACL,gDAAgD;gBACpD,CAAC;YACL,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/handlers/api/keystone/keystone-check-email.handler.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-check-email.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-check-email.handler.mts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxF;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,mBAAmB,CAAC,SAAS,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;IAC7F,UAAmB,EAAE,EAAE,MAAM,CAAyC;IACtE,UAAmB,MAAM,EAAE,kBAAkB,CAAS;IACtD,UAAmB,KAAK,SAAyC;IAEjE,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GACtD,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAgCrC;CACJ"}
+{"version":3,"file":"keystone-check-email.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-check-email.handler.mts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxF;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,mBAAmB,CAAC,SAAS,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;IAC7F,UAAmB,EAAE,EAAE,MAAM,CAAyC;IACtE,UAAmB,MAAM,EAAE,kBAAkB,CAAS;IACtD,UAAmB,KAAK,SAAyC;IAEjE,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GACtD,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAgCrC;CACJ"}

package/dist/serve-gib/handlers/api/keystone/keystone-check-email.handler.mjs

@@ -5,9 +5,8 @@
  *
  * Checks whether an email address is already registered in the server identity index.
  */
-import * as path from 'node:path';
 import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
-import { IdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
 import { ServeGibHandlerBase } from '../../handler-base.mjs';
 import { API_PATH_REGEXES } from '../../../path-constants.mjs';
 /**
@@ -28,7 +27,7 @@ export class KeystoneCheckEmailHandler extends ServeGibHandlerBase {
                 console.error(`${lc} Check-email request missing email query parameter.`);
                 return this.error(400, 'Query param email is required');
             }
-            const indexService = new IdentityIndexService({ baseDir: path.join(reqCtx.dataDir, 'index') });
+            const indexService = getIdentityIndexService();
             const record = await indexService.getEmailIndex({ email });
             if (record) {
                 console.log(`${lc} Email '${email}' is already registered.`);

package/dist/serve-gib/handlers/api/keystone/keystone-check-email.handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-check-email.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-check-email.handler.mts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAE1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,mBAAkD;IAC1E,EAAE,GAAW,IAAI,yBAAyB,CAAC,IAAI,GAAG,CAAC;IACnD,MAAM,GAAuB,KAAK,CAAC;IACnC,KAAK,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;IAEvD,KAAK,CAAC,eAAe,CAC3B,MAAqD;QAErD,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,qFAAqF;YACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;YACvD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC,CAAC;gBAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAE3D,IAAI,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,0BAA0B,CAAC,CAAC;gBAC7D,OAAO,IAAI,CAAC,EAAE,CAAC;oBACX,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,mCAAmC;iBAC/C,CAAC,CAAC;YACP,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,iBAAiB,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC,EAAE,CAAC;gBACX,SAAS,EAAE,IAAI;aAClB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"keystone-check-email.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-check-email.handler.mts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,mBAAkD;IAC1E,EAAE,GAAW,IAAI,yBAAyB,CAAC,IAAI,GAAG,CAAC;IACnD,MAAM,GAAuB,KAAK,CAAC;IACnC,KAAK,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;IAEvD,KAAK,CAAC,eAAe,CAC3B,MAAqD;QAErD,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,qFAAqF;YACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;YACvD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC,CAAC;gBAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAE3D,IAAI,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,0BAA0B,CAAC,CAAC;gBAC7D,OAAO,IAAI,CAAC,EAAE,CAAC;oBACX,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,mCAAmC;iBAC/C,CAAC,CAAC;YACP,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,iBAAiB,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC,EAAE,CAAC;gBACX,SAAS,EAAE,IAAI;aAClB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/handlers/api/keystone/keystone-evolve.handler.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-evolve.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-evolve.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AAKpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAE1E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAItF,UAAU,YAAa,SAAQ,gBAAgB;IAC3C,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,UAAU,UAAU;IAChB,uCAAuC;IACvC,aAAa,EAAE,gBAAgB,CAAC;IAChC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnC,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,qBAAa,qBAAsB,SAAQ,gCAAgC,CAAC,YAAY,EAAE,UAAU,CAAC;IACjG,UAAmB,EAAE,EAAE,MAAM,CAAqC;IAClE,UAAmB,MAAM,EAAE,KAAK,CAAS;IACzC,UAAmB,KAAK,SAAoC;IAE5D,UAAyB,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAarH;IAED,UAAyB,mBAAmB,CAAC,EAAE,WAAW,EAAE,EAAE;QAAE,WAAW,EAAE,GAAG,CAAC;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEtG;IAED,UAAyB,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CA8EtG;CACJ"}
+{"version":3,"file":"keystone-evolve.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-evolve.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AAOpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAE1E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAItF,UAAU,YAAa,SAAQ,gBAAgB;IAC3C,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,UAAU,UAAU;IAChB,uCAAuC;IACvC,aAAa,EAAE,gBAAgB,CAAC;IAChC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnC,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,qBAAa,qBAAsB,SAAQ,gCAAgC,CAAC,YAAY,EAAE,UAAU,CAAC;IACjG,UAAmB,EAAE,EAAE,MAAM,CAAqC;IAClE,UAAmB,MAAM,EAAE,KAAK,CAAS;IACzC,UAAmB,KAAK,SAAoC;IAE5D,UAAyB,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAarH;IAED,UAAyB,mBAAmB,CAAC,EAAE,WAAW,EAAE,EAAE;QAAE,WAAW,EAAE,GAAG,CAAC;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEtG;IAED,UAAyB,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAmHtG;CACJ"}

package/dist/serve-gib/handlers/api/keystone/keystone-evolve.handler.mjs

@@ -12,12 +12,14 @@
 import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { validateAndRegisterEvolveKeystone } from '@ibgib/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs';
-import { loadSsoServerConfig } from '@ibgib/web-gib/dist/identity/sso/sso-config-helper.mjs';
-import { SsoCustodianService } from '@ibgib/web-gib/dist/identity/sso/sso-custodian-service.mjs';
+import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
+import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+import { savePendingStagingKeystone, dispatchVerificationCode } from '../../../../email/verify/email-verify-helpers.mjs';
 import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
 import { API_PATH_REGEXES } from '../../../path-constants.mjs';
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase {
     lc = `[${KeystoneEvolveHandler.name}]`;
     method = 'PUT';
@@ -72,6 +74,39 @@ export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase {
             if (!space) {
                 return this.error(500, 'No local user space found (E: a1144e5d6cd9641fb82d6b359f131126)');
             }
+            // Check for any new unverified email addresses attached to the evolved keystone
+            const incomingEmails = keystoneIbGib.data?.emails ?? keystoneIbGib.data?.frameDetails?.emails ?? [];
+            if (incomingEmails.length > 0) {
+                const unverifiedEmails = [];
+                for (const email of incomingEmails) {
+                    const record = await getIdentityIndexService().lookupIdentityByEmail({ email });
+                    if (!record || record.primaryTjpAddr !== domainAddr) {
+                        unverifiedEmails.push(email);
+                    }
+                }
+                if (unverifiedEmails.length > 0) {
+                    console.log(`${lc} Evolved keystone contains unverified email(s): ${unverifiedEmails.join(', ')}. Staging evolution in quarantine area.`);
+                    const saveRes = await savePendingStagingKeystone({
+                        keystone: keystoneIbGib,
+                        emails: unverifiedEmails,
+                        primaryTjpAddr: domainAddr,
+                        dataDir: reqCtx.dataDir
+                    });
+                    // Immediately dispatch 6-digit verification code email for first unverified email
+                    const primaryEmail = unverifiedEmails[0];
+                    await dispatchVerificationCode({
+                        email: primaryEmail,
+                        primaryTjpAddr: domainAddr,
+                        pendingDir: saveRes.pendingDir,
+                    });
+                    return this.ok({
+                        success: true,
+                        pending: true,
+                        addr: domainAddr,
+                        message: 'Evolved keystone quarantined in pending staging area. 6-digit verification code sent to your email.'
+                    }, 202);
+                }
+            }
             // Delegate all intrinsic checks, transition rules, pool restrictions, and registration/persistence to core-gib helper
             await validateAndRegisterEvolveKeystone({
                 domainAddr,

package/dist/serve-gib/handlers/api/keystone/keystone-evolve.handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-evolve.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-evolve.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,sHAAsH,CAAC;AAEzK,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/D,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAqBzC,MAAM,OAAO,qBAAsB,SAAQ,gCAA0D;IAC9E,EAAE,GAAW,IAAI,qBAAqB,CAAC,IAAI,GAAG,CAAC;IAC/C,MAAM,GAAU,KAAK,CAAC;IACtB,KAAK,GAAG,gBAAgB,CAAC,eAAe,CAAC;IAEzC,KAAK,CAAC,eAAe,CAAC,MAAyC;QAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YAClE,OAAO;gBACH,UAAU;gBACV,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;aACjD,CAAC;QACN,CAAC;aAAM,CAAC;YACJ,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAyB;QAC/E,OAAO,EAAE,CAAC,CAAC,qDAAqD;IACpE,CAAC;IAEkB,KAAK,CAAC,eAAe,CAAC,MAAoC;QACzE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,mBAAmB,CAAC;QACzC,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAAC,CAAC;YAElD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAAC,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;YAAC,CAAC;YAE/E,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;YAEvD,IAAI,MAAkB,CAAC;YACvB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,0FAA0F,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,EAAE,aAAa,EAAE,qBAAqB,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;YAC7D,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,wFAAwF,CAAC,CAAC;YACrH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,iEAAiE,CAAC,CAAC;YAC9F,CAAC;YAED,sHAAsH;YACtH,MAAM,iCAAiC,CAAC;gBACpC,UAAU;gBACV,aAAa;gBACb,qBAAqB;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACR,CAAC,CAAC;YAEH,qDAAqD;YACrD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;YACrD,IAAI,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;gBACzC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACtC,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjD,qCAAqC;oBACrC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;oBACrC,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;oBAElD,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;wBACrC,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;4BACzC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;4BAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,6CAA6C,MAAM,6CAA6C,UAAU,EAAE,CAAC,CAAC;4BAE/H,yCAAyC;4BACzC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;4BAChD,IAAI,KAAK,EAAE,CAAC;gCACR,IAAI,CAAC;oCACD,MAAM,SAAS,CAAC,WAAW,CAAC,UAAiB,EAAE,KAAK,CAAC,CAAC;gCAC1D,CAAC;gCAAC,OAAO,CAAC,EAAE,CAAC;oCACT,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,wCAAwC,UAAU,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gCACnG,CAAC;4BACL,CAAC;iCAAM,CAAC;gCACJ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,kEAAkE,UAAU,EAAE,CAAC,CAAC;4BACrG,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,IAAI,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,4DAA4D;aACxE,CAAC,CAAC;QAEP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yCAAyC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"keystone-evolve.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-evolve.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,sHAAsH,CAAC;AAEzK,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAEzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/D,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAqBjC,MAAM,OAAO,qBAAsB,SAAQ,gCAA0D;IAC9E,EAAE,GAAW,IAAI,qBAAqB,CAAC,IAAI,GAAG,CAAC;IAC/C,MAAM,GAAU,KAAK,CAAC;IACtB,KAAK,GAAG,gBAAgB,CAAC,eAAe,CAAC;IAEzC,KAAK,CAAC,eAAe,CAAC,MAAyC;QAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YAClE,OAAO;gBACH,UAAU;gBACV,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;aACjD,CAAC;QACN,CAAC;aAAM,CAAC;YACJ,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAyB;QAC/E,OAAO,EAAE,CAAC,CAAC,qDAAqD;IACpE,CAAC;IAEkB,KAAK,CAAC,eAAe,CAAC,MAAoC;QACzE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,mBAAmB,CAAC;QACzC,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAAC,CAAC;YAElD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAAC,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;YAAC,CAAC;YAE/E,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;YAEvD,IAAI,MAAkB,CAAC;YACvB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,0FAA0F,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,EAAE,aAAa,EAAE,qBAAqB,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;YAC7D,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,wFAAwF,CAAC,CAAC;YACrH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,iEAAiE,CAAC,CAAC;YAC9F,CAAC;YAED,gFAAgF;YAChF,MAAM,cAAc,GAAa,aAAa,CAAC,IAAI,EAAE,MAAM,IAAI,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC;YAC9G,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,gBAAgB,GAAa,EAAE,CAAC;gBACtC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;wBAClD,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACjC,CAAC;gBACL,CAAC;gBAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,mDAAmD,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;oBAC1I,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;wBAC7C,QAAQ,EAAE,aAAa;wBACvB,MAAM,EAAE,gBAAgB;wBACxB,cAAc,EAAE,UAAU;wBAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;qBAC1B,CAAC,CAAC;oBAEH,kFAAkF;oBAClF,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;oBACzC,MAAM,wBAAwB,CAAC;wBAC3B,KAAK,EAAE,YAAY;wBACnB,cAAc,EAAE,UAAU;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;qBACjC,CAAC,CAAC;oBAEH,OAAO,IAAI,CAAC,EAAE,CAAC;wBACX,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,UAAU;wBAChB,OAAO,EAAE,qGAAqG;qBACjH,EAAE,GAAG,CAAC,CAAC;gBACZ,CAAC;YACL,CAAC;YAED,sHAAsH;YACtH,MAAM,iCAAiC,CAAC;gBACpC,UAAU;gBACV,aAAa;gBACb,qBAAqB;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;aACR,CAAC,CAAC;YAEH,qDAAqD;YACrD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;YACrD,IAAI,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;gBACzC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACtC,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjD,qCAAqC;oBACrC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;oBACrC,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;oBAElD,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;wBACrC,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;4BACzC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;4BAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,6CAA6C,MAAM,6CAA6C,UAAU,EAAE,CAAC,CAAC;4BAE/H,yCAAyC;4BACzC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;4BAChD,IAAI,KAAK,EAAE,CAAC;gCACR,IAAI,CAAC;oCACD,MAAM,SAAS,CAAC,WAAW,CAAC,UAAiB,EAAE,KAAK,CAAC,CAAC;gCAC1D,CAAC;gCAAC,OAAO,CAAC,EAAE,CAAC;oCACT,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,wCAAwC,UAAU,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gCACnG,CAAC;4BACL,CAAC;iCAAM,CAAC;gCACJ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,kEAAkE,UAAU,EAAE,CAAC,CAAC;4BACrG,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,IAAI,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,4DAA4D;aACxE,CAAC,CAAC;QAEP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yCAAyC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/handlers/api/keystone/keystone-genesis.handler.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-genesis.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-genesis.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAaH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAUxF;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;IACjF,UAAmB,EAAE,EAAE,MAAM,CAAsC;IACnE,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAAqC;IAE7D,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAuGrC;CACJ"}
+{"version":3,"file":"keystone-genesis.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/keystone-genesis.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAYH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AASxF;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;IACjF,UAAmB,EAAE,EAAE,MAAM,CAAsC;IACnE,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAAqC;IAE7D,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAgIrC;CACJ"}