@ibgib/node-gib 0.0.14 → 0.0.17

package/dist/serve-gib/handlers/api/keystone/sso-login.handler.mjs

@@ -1,13 +1,25 @@
-import { createHmac } from 'node:crypto';
-import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
-import { loadSsoServerConfig } from '@ibgib/web-gib/dist/identity/sso/sso-config-helper.mjs';
-import { SsoCustodianService } from '@ibgib/web-gib/dist/identity/sso/sso-custodian-service.mjs';
-import { KEYSTONE_VERB_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
-import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs';
+/**
+ * @module serve-gib/handlers/api/keystone/sso-login.handler
+ *
+ * POST /api/identity/sso/login
+ *
+ * Handles OAuth2 SSO code exchange (Google, GitHub, etc.).
+ * Retrieves verified email, looks up or provisions the custodian primary identity keystone,
+ * generates a fresh single-turn `CustodianRequirements` payload, and returns it to the client.
+ */
+import { extractErrorMsg, hash, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getTjpAddr } from '@ibgib/core-gib/dist/common/other/ibgib-helper.mjs';
+import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
-import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
 import { API_PATH_REGEXES } from '../../../path-constants.mjs';
-const logalot = GLOBAL_LOG_A_LOT || true;
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
+import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
+import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
+import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+import { generateCustodianRequirements } from '../../../../identity/sso/custodian-auth-helpers.mjs';
+const logalot = GLOBAL_LOG_A_LOT;
 let custodian;
 function getCustodian() {
     if (!custodian) {
@@ -16,139 +28,124 @@ function getCustodian() {
     }
     return custodian;
 }
-function signSessionToken(payload, secret) {
-    const header = { alg: 'HS256', typ: 'JWT' };
-    const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
-    const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
-    const data = `${headerB64}.${payloadB64}`;
-    const signature = createHmac('sha256', secret).update(data).digest('base64url');
-    return `${data}.${signature}`;
-}
 /**
  * POST /api/identity/sso/login
- *
- * Exposes login endpoint for SSO authentication. Verifies provider identity, asserts
- * that the deterministic server-delegate keystone is registered in the parent keystone,
- * and yields a secure HttpOnly session token.
  */
-export class SsoLoginHandler extends ServeGibHandlerWithMetaspaceBase {
+export class SsoLoginHandler extends ServeGibHandlerBase {
     lc = `[${SsoLoginHandler.name}]`;
     method = 'POST';
     regex = API_PATH_REGEXES.IDENTITY_SSO_LOGIN;
-    async parseParamsImpl(reqCtx) {
-        let parsed;
-        try {
-            parsed = JSON.parse(reqCtx.body);
-        }
-        catch {
-            return undefined;
-        }
-        const parentTjpAddr = parsed?.parentTjpAddr;
-        if (!parentTjpAddr) {
-            return undefined;
-        }
-        return {
-            parentTjpAddr,
-            domainInfo: this.getDomainInfo({ domainAddr: parentTjpAddr })
-        };
+    async parseParamsImpl() {
+        return undefined;
     }
-    async validateQueryParams({ queryParams }) {
+    async validateQueryParams() {
         return [];
     }
     async handleRouteImpl(reqCtx) {
         const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
         try {
             if (logalot) {
-                console.log(`${lc} starting...`);
+                console.log(`${lc} starting... (I: 9b5d2a3c4e5f67890a1b2c3d4e5f6789)`);
             }
-            if (!reqCtx.params) {
-                return this.error(400, 'Invalid parameters: parentTjpAddr missing');
+            if (reqCtx.method !== 'POST') {
+                return this.error(405, 'Method Not Allowed');
             }
-            if (!reqCtx.metaspace) {
-                return this.error(500, 'Metaspace not initialized');
+            if (!reqCtx.body) {
+                return this.error(400, 'Request body is empty (E: 0a1b2c3d4e5f67890a1b2c3d4e5f6789)');
             }
             let parsed;
             try {
                 parsed = JSON.parse(reqCtx.body);
             }
             catch {
-                return this.error(400, 'Request body must be valid JSON');
-            }
-            const { code, providerId, parentTjpAddr, userNonce, redirectUri } = parsed;
-            if (!code || !providerId || !parentTjpAddr || !userNonce || !redirectUri) {
-                return this.error(400, 'Body missing required parameters (code, providerId, parentTjpAddr, userNonce, redirectUri)');
+                return this.error(400, 'Request body must be valid JSON (E: 1a1b2c3d4e5f67890a1b2c3d4e5f6789)');
             }
-            const space = await reqCtx.metaspace.getLocalUserSpace({ lock: false });
-            if (!space) {
-                return this.error(500, 'No local user space found in domain metaspace');
+            const { code, providerId, redirectUri } = parsed;
+            if (!code || !providerId || !redirectUri) {
+                return this.error(400, 'Body missing required parameters (code, providerId, redirectUri) (E: 2b2c3d4e5f678901b2c3d4e5f6789012)');
             }
-            // 1. Authenticate with provider and retrieve user info
+            // 1. Authenticate code with provider and retrieve normalized user info
             const service = getCustodian();
             const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
-            // 2. Derive custodian secret using providerKey and userNonce
-            const custodianSecret = await service.deriveServerDelegateSecret(userInfo.providerKey, userNonce);
-            // 3. Fetch latest parent keystone from metaspace
-            const latestParentAddr = await reqCtx.metaspace.getLatestAddr({ addr: parentTjpAddr, space });
-            if (!latestParentAddr) {
-                return this.error(404, `Parent identity keystone not found for address: ${parentTjpAddr}`);
-            }
-            const resGet = await reqCtx.metaspace.get({ addr: latestParentAddr, space });
-            const parentKeystone = resGet.ibGibs?.[0];
-            if (!parentKeystone) {
-                return this.error(404, `Parent identity keystone not found in space for address: ${latestParentAddr}`);
-            }
-            // 4. Resolve the custodian pool from the parent keystone using dynamic poolId
-            const targetPoolId = `custodian-manage-${providerId}`;
-            const custodianPool = parentKeystone.data?.challengePools?.find((p) => p.id === targetPoolId);
-            if (!custodianPool) {
-                return this.error(401, `Unauthorized: Custodian pool '${targetPoolId}' is not registered in the parent identity keystone.`);
+            if (!userInfo || !userInfo.email) {
+                return this.error(400, `No email address returned from SSO provider ${providerId} (E: 3c3d4e5f67890123c4d5e6f789012345)`);
             }
-            // 5. Assert allowed verbs contain KEYSTONE_VERB_MANAGE
-            const allowedVerbs = custodianPool.config.allowedVerbs || [];
-            if (!allowedVerbs.includes(KEYSTONE_VERB_MANAGE)) {
-                return this.error(401, `Unauthorized: Custodian pool does not have the required manage permission.`);
+            const email = userInfo.email.trim().toLowerCase();
+            const username = userInfo.name || email.split('@')[0];
+            // 2. Check if primary identity exists for this email
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const primarySecret = await hash({ s: `${serverSecret}_custodian_${email}` });
+            const indexService = getIdentityIndexService();
+            const existingLookup = await indexService.lookupIdentityByEmail({ email });
+            let primaryTjpAddr;
+            let primaryKeystone;
+            let isNewIdentity = false;
+            if (existingLookup && existingLookup.primaryTjpAddr) {
+                // Existing identity
+                primaryTjpAddr = existingLookup.primaryTjpAddr;
+                const domainMetaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const space = await domainMetaspace.getLocalUserSpace({ lock: false });
+                const latestPrimaryAddr = await domainMetaspace.getLatestAddr({ addr: primaryTjpAddr, space: space }) ?? primaryTjpAddr;
+                const getRes = await domainMetaspace.get({ addrs: [latestPrimaryAddr], space: space });
+                primaryKeystone = getRes.ibGibs?.[0];
             }
-            // 6. Cryptographically verify the custodian secret against the pool's challenges
-            const strategy = KeystoneStrategyFactory.create({ config: custodianPool.config });
-            const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
-            for (const [id, challenge] of Object.entries(custodianPool.challenges)) {
-                const solution = await strategy.generateSolution({
-                    poolSecret,
-                    poolId: custodianPool.id,
-                    challengeId: id
+            else {
+                // First-time custodian identity creation
+                isNewIdentity = true;
+                const tempId = await getUUID();
+                const tempDomainMetaspace = await bootstrapDomainMetaspace(`temp^${tempId}`, reqCtx.dataDir);
+                const tempSpace = await tempDomainMetaspace.getLocalUserSpace({ lock: false });
+                const primaryBuilder = KeystoneProfileBuilder.buildKeystone('domain')
+                    .withUsername(username)
+                    .withEmails([email])
+                    .withDetails({
+                    client: 'space-gib-server',
+                    role: 'custodian-primary',
+                    custodianProvider: providerId,
+                });
+                const configs = await primaryBuilder.compileConfigs();
+                const keystoneService = new KeystoneService_V1();
+                primaryKeystone = await keystoneService.genesis({
+                    masterSecret: primarySecret,
+                    emails: [email],
+                    frameDetails: primaryBuilder.getFrameDetails(),
+                    configs,
+                    metaspace: tempDomainMetaspace,
+                    space: tempSpace,
+                    isPrimary: true
+                });
+                primaryTjpAddr = getTjpAddr({ ibGib: primaryKeystone, defaultIfNone: 'incomingAddr' });
+                // Persist into permanent domain space & register index
+                const permanentMetaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const permanentSpace = await permanentMetaspace.getLocalUserSpace({ lock: false });
+                await permanentMetaspace.put({ ibGibs: [primaryKeystone], space: permanentSpace });
+                await permanentMetaspace.registerNewIbGib({ ibGib: primaryKeystone, space: permanentSpace });
+                await indexService.registerEmailIndex({
+                    email,
+                    primaryTjpAddr
                 });
-                const hashValue = await strategy.generateChallenge({ solution });
-                if (hashValue.hash !== challenge.hash) {
-                    return this.error(401, 'Unauthorized: Cryptographic verification of custodian pool challenges failed.');
-                }
             }
-            // 7. Issue secure HttpOnly session cookie
-            const sessionPayload = {
-                parentTjpAddr,
-                providerKey: userInfo.providerKey,
-                exp: Math.floor(Date.now() / 1000) + 24 * 3600 // 24-hour expiration
-            };
-            const config = loadSsoServerConfig();
-            const sessionToken = signSessionToken(sessionPayload, config.sessionSecret);
-            const headers = {
-                'Set-Cookie': `space_gib_session=${sessionToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`
-            };
-            console.log(`${lc} login successful for parent: ${parentTjpAddr}, custodian providerKey: ${userInfo.providerKey}`);
-            return {
-                status: 200,
-                headers,
-                body: {
-                    success: true,
-                    parentTjpAddr,
-                    custodianPoolId: custodianPool.id
-                },
-                isJson: true
+            // 3. Generate single-turn custodian requirements payload
+            const custodianReqs = await generateCustodianRequirements({
+                primaryTjpAddr,
+                serverSecret
+            });
+            const responseBody = {
+                success: true,
+                isNewIdentity,
+                primaryTjpAddr,
+                primaryKeystone,
+                custodianReqs,
+                userInfo,
+                message: isNewIdentity ? 'Created new custodian identity via SSO' : 'Looked up existing custodian identity via SSO'
             };
+            return this.ok(responseBody, 200);
         }
         catch (error) {
             const emsg = extractErrorMsg(error);
-            console.error(`${lc} Login failed: ${emsg}`);
-            return this.error(500, `Login failed: ${emsg}`);
+            console.error(`${lc} SSO login failed: ${emsg} (E: 4d5e6f7890123456e7f8901234567890)`);
+            return this.error(500, `SSO login failed: ${emsg}`);
         }
         finally {
             if (logalot) {

package/dist/serve-gib/handlers/api/keystone/sso-login.handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sso-login.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/sso-login.handler.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEjG,OAAO,EAA4B,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AACtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/D,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAEzC,IAAI,SAA0C,CAAC;AAC/C,SAAS,YAAY;IACjB,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAY,EAAE,MAAc;IAClD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChF,OAAO,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;AAClC,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,gCAAkD;IAChE,EAAE,GAAW,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,kBAAkB,CAAC;IAE5C,KAAK,CAAC,eAAe,CAAC,MAAwC;QAC7E,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,CAAC;QAC5C,IAAI,CAAC,aAAa,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QACzC,OAAO;YACH,aAAa;YACb,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;SAChE,CAAC;IACN,CAAC;IAEkB,KAAK,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAwB;QAC9E,OAAO,EAAE,CAAC;IACd,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,MAAmC;QAC/D,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAAC,CAAC;YAElD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;YACxD,CAAC;YAED,IAAI,MAAiB,CAAC;YACtB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;YAC3E,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,4FAA4F,CAAC,CAAC;YACzH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;YAC5E,CAAC;YAED,uDAAuD;YACvD,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAE/E,6DAA6D;YAC7D,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAElG,iDAAiD;YACjD,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,mDAAmD,aAAa,EAAE,CAAC,CAAC;YAC/F,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,4DAA4D,gBAAgB,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,8EAA8E;YAC9E,MAAM,YAAY,GAAG,oBAAoB,UAAU,EAAE,CAAC;YACtD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YACnG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,iCAAiC,YAAY,sDAAsD,CAAC,CAAC;YAChI,CAAC;YAED,uDAAuD;YACvD,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;YAC7D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,4EAA4E,CAAC,CAAC;YACzG,CAAC;YAED,iFAAiF;YACjF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;YAClF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;YAEtF,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC;oBAC7C,UAAU;oBACV,MAAM,EAAE,aAAa,CAAC,EAAE;oBACxB,WAAW,EAAE,EAAE;iBAClB,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjE,IAAI,SAAS,CAAC,IAAI,KAAM,SAAiB,CAAC,IAAI,EAAE,CAAC;oBAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+EAA+E,CAAC,CAAC;gBAC5G,CAAC;YACL,CAAC;YAED,0CAA0C;YAC1C,MAAM,cAAc,GAAG;gBACnB,aAAa;gBACb,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,qBAAqB;aACvE,CAAC;YAEF,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,YAAY,GAAG,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAE5E,MAAM,OAAO,GAAG;gBACZ,YAAY,EAAE,qBAAqB,YAAY,oDAAoD;aACtG,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,aAAa,4BAA4B,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YAEnH,OAAO;gBACH,MAAM,EAAE,GAAG;gBACX,OAAO;gBACP,IAAI,EAAE;oBACF,OAAO,EAAE,IAAI;oBACb,aAAa;oBACb,eAAe,EAAE,aAAa,CAAC,EAAE;iBACpC;gBACD,MAAM,EAAE,IAAI;aACf,CAAC;QAEN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"sso-login.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/sso-login.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mEAAmE,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AAEpG,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC,IAAI,SAA0C,CAAC;AAC/C,SAAS,YAAY;IACjB,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAkBD;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,mBAAyC;IACvD,EAAE,GAAW,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,kBAAkB,CAAC;IAE5C,KAAK,CAAC,eAAe;QACpC,OAAO,SAAS,CAAC;IACrB,CAAC;IAEkB,KAAK,CAAC,mBAAmB;QACxC,OAAO,EAAE,CAAC;IACd,CAAC;IAES,KAAK,CAAC,eAAe,CAC3B,MAA4C;QAE5C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;YAC1F,CAAC;YAED,IAAI,MAAoB,CAAC;YACzB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uEAAuE,CAAC,CAAC;YACpG,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,wGAAwG,CAAC,CAAC;YACrI,CAAC;YAED,uEAAuE;YACvE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAE/E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+CAA+C,UAAU,wCAAwC,CAAC,CAAC;YAC9H,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtD,qDAAqD;YACrD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,SAAS,CAAC,kBAAkB,CAAC;YAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,cAAc,KAAK,EAAE,EAAE,CAAC,CAAC;YAE9E,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAE3E,IAAI,cAAsB,CAAC;YAC3B,IAAI,eAAoB,CAAC;YACzB,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,IAAI,cAAc,IAAI,cAAc,CAAC,cAAc,EAAE,CAAC;gBAClD,oBAAoB;gBACpB,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC;gBAC/C,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEvE,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,IAAI,cAAc,CAAC;gBACzH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,CAAC;gBACxF,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACJ,yCAAyC;gBACzC,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC/B,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CAAC,QAAQ,MAAM,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7F,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC;qBAChE,YAAY,CAAC,QAAQ,CAAC;qBACtB,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC;qBACnB,WAAW,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,IAAI,EAAE,mBAAmB;oBACzB,iBAAiB,EAAE,UAAU;iBAChC,CAAC,CAAC;gBAEP,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBACjD,eAAe,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC;oBAC5C,YAAY,EAAE,aAAa;oBAC3B,MAAM,EAAE,CAAC,KAAK,CAAC;oBACf,YAAY,EAAE,cAAc,CAAC,eAAe,EAAE;oBAC9C,OAAO;oBACP,SAAS,EAAE,mBAAmB;oBAC9B,KAAK,EAAE,SAAU;oBACjB,SAAS,EAAE,IAAI;iBAClB,CAAC,CAAC;gBAEH,cAAc,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,CAAE,CAAC;gBAExF,uDAAuD;gBACvD,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC1F,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEnF,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,cAAe,EAAE,CAAC,CAAC;gBACpF,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAe,EAAE,CAAC,CAAC;gBAE9F,MAAM,YAAY,CAAC,kBAAkB,CAAC;oBAClC,KAAK;oBACL,cAAc;iBACjB,CAAC,CAAC;YACP,CAAC;YAED,yDAAyD;YACzD,MAAM,aAAa,GAAG,MAAM,6BAA6B,CAAC;gBACtD,cAAc;gBACd,YAAY;aACf,CAAC,CAAC;YAEH,MAAM,YAAY,GAAyB;gBACvC,OAAO,EAAE,IAAI;gBACb,aAAa;gBACb,cAAc;gBACd,eAAe;gBACf,aAAa;gBACb,QAAQ;gBACR,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,+CAA+C;aACtH,CAAC;YAEF,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,IAAI,wCAAwC,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/identity-index/identity-index-constants.d.mts

@@ -1,4 +1,5 @@
 export declare const DEFAULT_IDENTITY_INDEX_DIR_NAME = "identity_index";
-export declare const DEFAULT_EMAIL_HASHES_SUBDIR = "email_hashes";
-export declare const DEFAULT_IDENTITY_INDEX_SALT = "ibgib_identity_salt_default_v1";
+export declare const DEFAULT_EMAIL_HASHES_SUBDIR: string;
+export declare const DEFAULT_EMAIL_PENDING_SUBDIR: string;
+export declare const DEFAULT_IDENTITY_INDEX_SALT = "emailindex";
 //# sourceMappingURL=identity-index-constants.d.mts.map

package/dist/serve-gib/identity-index/identity-index-constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-constants.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-constants.mts"],"names":[],"mappings":"AAAA,eAAO,MAAM,+BAA+B,mBAAmB,CAAC;AAChE,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAC1D,eAAO,MAAM,2BAA2B,mCAAmC,CAAC"}
+{"version":3,"file":"identity-index-constants.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-constants.mts"],"names":[],"mappings":"AAEA,eAAO,MAAM,+BAA+B,mBAAmB,CAAC;AAChE,eAAO,MAAM,2BAA2B,QAA+B,CAAC;AACxE,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,2BAA2B,eAAe,CAAC"}

package/dist/serve-gib/identity-index/identity-index-constants.mjs

@@ -1,4 +1,6 @@
+import * as path from 'path';
 export const DEFAULT_IDENTITY_INDEX_DIR_NAME = 'identity_index';
-export const DEFAULT_EMAIL_HASHES_SUBDIR = 'email_hashes';
-export const DEFAULT_IDENTITY_INDEX_SALT = 'ibgib_identity_salt_default_v1';
+export const DEFAULT_EMAIL_HASHES_SUBDIR = path.join('email', 'hashes');
+export const DEFAULT_EMAIL_PENDING_SUBDIR = path.join('email', 'pending');
+export const DEFAULT_IDENTITY_INDEX_SALT = 'emailindex';
 //# sourceMappingURL=identity-index-constants.mjs.map

package/dist/serve-gib/identity-index/identity-index-constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-constants.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-constants.mts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;AAChE,MAAM,CAAC,MAAM,2BAA2B,GAAG,cAAc,CAAC;AAC1D,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC"}
+{"version":3,"file":"identity-index-constants.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAAC;AAChE,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC"}

package/dist/serve-gib/identity-index/identity-index-helpers.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-helpers.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-helpers.mts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,EAAE,CAiBjE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,EACvC,KAAK,EACL,IAAqE,GACxE,EAAE;IACC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAChC,OAAO,EACP,SAAS,GACZ,EAAE;IACC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAe7D"}
+{"version":3,"file":"identity-index-helpers.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-helpers.mts"],"names":[],"mappings":"AASA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,EAAE,CAiBjE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,EACvC,KAAK,EACL,IAAqE,GACxE,EAAE;IACC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAChC,OAAO,EACP,SAAS,GACZ,EAAE;IACC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAyB7D"}

package/dist/serve-gib/identity-index/identity-index-helpers.mjs

@@ -1,7 +1,9 @@
 import * as path from 'path';
-import { hash } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { extractErrorMsg, hash } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { KEYSTONE_EMAIL_REGEXP } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { GLOBAL_LOG_A_LOT } from '../server-constants.mjs';
 import { DEFAULT_EMAIL_HASHES_SUBDIR, DEFAULT_IDENTITY_INDEX_SALT } from './identity-index-constants.mjs';
+const logalot = GLOBAL_LOG_A_LOT || true;
 /**
  * Validates an email address against length constraints and KEYSTONE_EMAIL_REGEXP.
  * Returns an array of error message strings (empty `[]` if valid).
@@ -54,16 +56,31 @@ export async function getIdentityEmailHash({ email, salt = process.env.IDENTITY_
  * Truncated filename: `12345....json` (strips the leading 6 characters that form the 3 subfolder pairs).
  */
 export function getShardedIndexPath({ baseDir, emailHash, }) {
-    if (!emailHash || emailHash.length < 7) {
-        throw new Error(`Invalid email hash string '${emailHash}'. Must be at least 7 characters. (E: 7aeb7885a7f1b4576899db283516d826)`);
+    const lc = `[${getShardedIndexPath.name}]`;
+    try {
+        if (logalot) {
+            console.log(`${lc} starting... (I: 3029e6a0fbf8b72988d694e8a0d53c26)`);
+        }
+        if (!emailHash || emailHash.length < 7) {
+            throw new Error(`Invalid email hash string '${emailHash}'. Must be at least 7 characters. (E: 7aeb7885a7f1b4576899db283516d826)`);
+        }
+        const f1 = emailHash.slice(0, 2);
+        const f2 = emailHash.slice(2, 4);
+        const f3 = emailHash.slice(4, 6);
+        const remainingHash = emailHash.slice(6);
+        const filename = `${remainingHash}.json`;
+        const folderPath = path.join(baseDir, DEFAULT_EMAIL_HASHES_SUBDIR, f1, f2, f3);
+        const filePath = path.join(folderPath, filename);
+        return { folderPath, filePath, filename };
+    }
+    catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+    finally {
+        if (logalot) {
+            console.log(`${lc} complete.`);
+        }
     }
-    const f1 = emailHash.slice(0, 2);
-    const f2 = emailHash.slice(2, 4);
-    const f3 = emailHash.slice(4, 6);
-    const remainingHash = emailHash.slice(6);
-    const filename = `${remainingHash}.json`;
-    const folderPath = path.join(baseDir, DEFAULT_EMAIL_HASHES_SUBDIR, f1, f2, f3);
-    const filePath = path.join(folderPath, filename);
-    return { folderPath, filePath, filename };
 }
 //# sourceMappingURL=identity-index-helpers.mjs.map

package/dist/serve-gib/identity-index/identity-index-helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-helpers.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-helpers.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,iDAAiD,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE1G;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,KAAK,EAAkB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,gCAAgC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACvD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACvC,KAAK,EACL,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,2BAA2B,GAIxE;IACG,MAAM,gBAAgB,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAChC,OAAO,EACP,SAAS,GAIZ;IACG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,yEAAyE,CAAC,CAAC;IACtI,CAAC;IAED,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,aAAa,OAAO,CAAC;IAEzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,2BAA2B,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEjD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"identity-index-helpers.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-helpers.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAE7F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE1G,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,KAAK,EAAkB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,gCAAgC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACvD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACvC,KAAK,EACL,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,2BAA2B,GAIxE;IACG,MAAM,gBAAgB,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAChC,OAAO,EACP,SAAS,GAIZ;IACG,MAAM,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC;IAC3C,IAAI,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;QAAC,CAAC;QAExF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,yEAAyE,CAAC,CAAC;QACtI,CAAC;QAED,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,aAAa,OAAO,CAAC;QAEzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,2BAA2B,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEjD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IAChB,CAAC;YAAS,CAAC;QACP,IAAI,OAAO,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAAC,CAAC;IACpD,CAAC;AACL,CAAC"}

package/dist/serve-gib/identity-index/identity-index-service.d.mts

@@ -4,18 +4,31 @@ import { IdentityIndexRecord, IdentityIndexServiceOptions, RegisterEmailIndexRes
  * Service managing atomic, sharded identity index files for backwards email -> primary identity tjpAddr lookups.
  */
 export declare class IdentityIndexService {
+    private lc;
     private baseDir;
     private salt;
-    constructor({ baseDir, salt }: IdentityIndexServiceOptions);
+    constructor(options?: IdentityIndexServiceOptions);
     /**
      * Registers an email to a primary identity tjpAddr.
      * Uses atomic OS file creation (`flag: 'wx'`) to guarantee single-server ACID uniqueness.
      * Throws `duplicate_identity_409` error if email is already registered.
      */
-    registerEmailIndex({ email, tjpAddr, }: {
+    registerEmailIndex({ email, tjpAddr, primaryTjpAddr, }: {
         email: string;
-        tjpAddr: IbGibAddr;
+        tjpAddr?: IbGibAddr;
+        primaryTjpAddr?: IbGibAddr;
     }): Promise<RegisterEmailIndexResult>;
+    /**
+     * Retrieves the registered identity info for an email address.
+     * Returns `undefined` if email is not indexed.
+     */
+    lookupIdentityByEmail({ email, }: {
+        email: string;
+    }): Promise<{
+        primaryTjpAddr: IbGibAddr;
+        tjpAddr: IbGibAddr;
+        createdAt: number;
+    } | undefined>;
     /**
      * Retrieves the registered `IdentityIndexRecord` for an email address.
      * Returns `undefined` if email is not indexed.
@@ -38,4 +51,8 @@ export declare class IdentityIndexService {
         email: string;
     }): Promise<boolean>;
 }
+/**
+ * Singleton factory getter for the IdentityIndexService.
+ */
+export declare function getIdentityIndexService(): IdentityIndexService;
 //# sourceMappingURL=identity-index-service.d.mts.map

package/dist/serve-gib/identity-index/identity-index-service.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-service.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAGzD,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAExH;;GAEG;AACH,qBAAa,oBAAoB;IAC7B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,IAAI,CAAS;IAErB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,2BAA2B,EAIzD;IAED;;;;OAIG;IACG,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,GACV,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,SAAS,CAAC;KACtB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoBpC;IAED;;;OAGG;IACG,aAAa,CAAC,EAChB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAG3C;IAED;;;OAGG;IACG,mBAAmB,CAAC,EACtB,SAAS,GACZ,EAAE;QACC,SAAS,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAY3C;IAED;;;OAGG;IACG,oBAAoB,CAAC,EACvB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAYnB;CACJ"}
+{"version":3,"file":"identity-index-service.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAKzD,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAIxH;;GAEG;AACH,qBAAa,oBAAoB;IAC7B,OAAO,CAAC,EAAE,CAAoC;IAC9C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,IAAI,CAAS;IAErB,YAAY,OAAO,CAAC,EAAE,2BAA2B,EAKhD;IA6CD;;;;OAIG;IACG,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,EACP,cAAc,GACjB,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,SAAS,CAAC;QACpB,cAAc,CAAC,EAAE,SAAS,CAAC;KAC9B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAyBpC;IAED;;;OAGG;IACG,qBAAqB,CAAC,EACxB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAQ5F;IAED;;;OAGG;IACG,aAAa,CAAC,EAChB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAmB3C;IAED;;;OAGG;IACG,mBAAmB,CAAC,EACtB,SAAS,GACZ,EAAE;QACC,SAAS,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAwB3C;IAED;;;OAGG;IACG,oBAAoB,CAAC,EACvB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAYnB;CACJ;AAID;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,oBAAoB,CAK9D"}