@ibgib/node-gib 0.0.14 → 0.0.17

package/dist/serve-gib/identity-index/identity-index-service.mjs

@@ -1,30 +1,81 @@
 import * as fs from 'fs/promises';
-import { DEFAULT_IDENTITY_INDEX_SALT } from './identity-index-constants.mjs';
+import * as path from 'path';
+import { extractErrorMsg, pretty } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { GLOBAL_LOG_A_LOT } from '../server-constants.mjs';
+import { DEFAULT_IDENTITY_INDEX_SALT, DEFAULT_IDENTITY_INDEX_DIR_NAME } from './identity-index-constants.mjs';
 import { getIdentityEmailHash, getShardedIndexPath } from './identity-index-helpers.mjs';
+const logalot = GLOBAL_LOG_A_LOT || true;
 /**
  * Service managing atomic, sharded identity index files for backwards email -> primary identity tjpAddr lookups.
  */
 export class IdentityIndexService {
+    lc = `[${IdentityIndexService.name}]`;
     baseDir;
     salt;
-    constructor({ baseDir, salt }) {
-        if (!baseDir) {
-            throw new Error('baseDir must be provided to IdentityIndexService.');
-        }
-        this.baseDir = baseDir;
+    constructor(options) {
+        const { baseDir, dataDir, salt } = options ?? {};
+        const finalDataDir = dataDir || process.env.DATA_DIR || 'data';
+        this.baseDir = baseDir || process.env.IDENTITY_INDEX_BASE_DIR || path.join(finalDataDir, DEFAULT_IDENTITY_INDEX_DIR_NAME);
         this.salt = salt || process.env.IDENTITY_INDEX_SALT || DEFAULT_IDENTITY_INDEX_SALT;
     }
+    // /**
+    //  * Static helper to register an email index.
+    //  * @deprecated Use `getIdentityIndexService().registerEmailIndex(...)` instead.
+    //  */
+    // static async registerEmailIndex(opts: {
+    //     email: string;
+    //     primaryTjpAddr: IbGibAddr;
+    //     dataDir?: string;
+    //     baseDir?: string;
+    //     salt?: string;
+    // }): Promise<RegisterEmailIndexResult> {
+    //     return getIdentityIndexService().registerEmailIndex({
+    //         email: opts.email,
+    //         primaryTjpAddr: opts.primaryTjpAddr
+    //     });
+    // }
+    // /**
+    //  * Static helper to lookup an identity record by email address.
+    //  * @deprecated Use `getIdentityIndexService().lookupIdentityByEmail(...)` instead.
+    //  */
+    // static async lookupIdentityByEmail(opts: {
+    //     email: string;
+    //     dataDir?: string;
+    //     baseDir?: string;
+    //     salt?: string;
+    // }): Promise<{ primaryTjpAddr: IbGibAddr; tjpAddr: IbGibAddr; createdAt: number } | undefined> {
+    //     return getIdentityIndexService().lookupIdentityByEmail({ email: opts.email });
+    // }
+    // /**
+    //  * Static helper to unregister an email index.
+    //  * @deprecated Use `getIdentityIndexService().unregisterEmailIndex(...)` instead.
+    //  */
+    // static async unregisterEmailIndex(opts: {
+    //     email: string;
+    //     dataDir?: string;
+    //     baseDir?: string;
+    //     salt?: string;
+    // }): Promise<boolean> {
+    //     return getIdentityIndexService().unregisterEmailIndex({ email: opts.email });
+    // }
     /**
      * Registers an email to a primary identity tjpAddr.
      * Uses atomic OS file creation (`flag: 'wx'`) to guarantee single-server ACID uniqueness.
      * Throws `duplicate_identity_409` error if email is already registered.
      */
-    async registerEmailIndex({ email, tjpAddr, }) {
+    async registerEmailIndex({ email, tjpAddr, primaryTjpAddr, }) {
+        const targetAddr = tjpAddr || primaryTjpAddr;
+        if (!targetAddr) {
+            throw new Error('Either tjpAddr or primaryTjpAddr must be provided. (E: 62f15851b9a8c8d718279ab84e426826)');
+        }
         const emailHash = await getIdentityEmailHash({ email, salt: this.salt });
-        const { folderPath, filePath } = getShardedIndexPath({ baseDir: this.baseDir, emailHash });
+        const { folderPath, filePath } = getShardedIndexPath({
+            baseDir: this.baseDir,
+            emailHash
+        });
         await fs.mkdir(folderPath, { recursive: true });
         const record = {
-            tjpAddr,
+            tjpAddr: targetAddr,
             createdAt: Date.now(),
         };
         try {
@@ -38,31 +89,86 @@ export class IdentityIndexService {
             throw error;
         }
     }
+    /**
+     * Retrieves the registered identity info for an email address.
+     * Returns `undefined` if email is not indexed.
+     */
+    async lookupIdentityByEmail({ email, }) {
+        const record = await this.getEmailIndex({ email });
+        if (!record) {
+            return undefined;
+        }
+        return {
+            primaryTjpAddr: record.tjpAddr,
+            tjpAddr: record.tjpAddr,
+            createdAt: record.createdAt,
+        };
+    }
     /**
      * Retrieves the registered `IdentityIndexRecord` for an email address.
      * Returns `undefined` if email is not indexed.
      */
     async getEmailIndex({ email, }) {
-        const emailHash = await getIdentityEmailHash({ email, salt: this.salt });
-        return this.getEmailIndexByHash({ emailHash });
+        const lc = `${this.lc}[${this.getEmailIndex.name}]`;
+        try {
+            if (logalot) {
+                console.log(`${lc} starting... (I: 3cd3e8e7bd88e193668a8d842d326826)`);
+            }
+            const emailHash = await getIdentityEmailHash({ email, salt: this.salt });
+            if (logalot) {
+                console.log(`${lc} emailHash: ${emailHash} (I: cae3161784e8eb00e5c6128a17aadf26)`);
+            }
+            const emailIndex = this.getEmailIndexByHash({ emailHash });
+            if (logalot) {
+                console.log(`${lc} emailIndex: ${emailIndex ? pretty(emailIndex) : 'undefined'} (I: dce1a8387affbd99c85f970853eac826)`);
+            }
+            return emailIndex;
+        }
+        catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        }
+        finally {
+            if (logalot) {
+                console.log(`${lc} complete.`);
+            }
+        }
     }
     /**
      * Retrieves the registered `IdentityIndexRecord` directly by `emailHash`.
      * Returns `undefined` if hash file does not exist.
      */
     async getEmailIndexByHash({ emailHash, }) {
-        const { filePath } = getShardedIndexPath({ baseDir: this.baseDir, emailHash });
+        const lc = `${this.lc}[${this.getEmailIndexByHash.name}]`;
         try {
-            const content = await fs.readFile(filePath, 'utf8');
-            const record = JSON.parse(content);
-            return record;
+            if (logalot) {
+                console.log(`${lc} starting... (I: 206328babd08908ad876fd69a4b37826)`);
+            }
+            const { filePath } = getShardedIndexPath({ baseDir: this.baseDir, emailHash });
+            if (logalot) {
+                console.log(`${lc} filePath: ${filePath} (I: e8f318aabc06320db8b0c3c8b34c5926)`);
+            }
+            try {
+                const content = await fs.readFile(filePath, 'utf8');
+                const record = JSON.parse(content);
+                return record;
+            }
+            catch (error) {
+                if (error.code === 'ENOENT') {
+                    return undefined;
+                }
+                throw error;
+            }
         }
         catch (error) {
-            if (error.code === 'ENOENT') {
-                return undefined;
-            }
+            console.error(`${lc} ${extractErrorMsg(error)}`);
             throw error;
         }
+        finally {
+            if (logalot) {
+                console.log(`${lc} complete.`);
+            }
+        }
     }
     /**
      * Unindexes an email address (deletes the index JSON file).
@@ -83,4 +189,14 @@ export class IdentityIndexService {
         }
     }
 }
+let _identityIndexService;
+/**
+ * Singleton factory getter for the IdentityIndexService.
+ */
+export function getIdentityIndexService() {
+    if (!_identityIndexService) {
+        _identityIndexService = new IdentityIndexService();
+    }
+    return _identityIndexService;
+}
 //# sourceMappingURL=identity-index-service.mjs.map

package/dist/serve-gib/identity-index/identity-index-service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-service.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGzF;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACrB,OAAO,CAAS;IAChB,IAAI,CAAS;IAErB,YAAY,EAAE,OAAO,EAAE,IAAI,EAA+B;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAAC,CAAC;QACvF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,2BAA2B,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,GAIV;QACG,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3F,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAwB;YAChC,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,EAChB,KAAK,GAGR;QACG,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,EACtB,SAAS,GAGZ;QACG,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,MAAM,GAAwB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACvB,KAAK,GAGR;QACG,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"identity-index-service.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,iDAAiD,CAAC;AAG1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGzF,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACrB,EAAE,GAAG,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC;IACtC,OAAO,CAAS;IAChB,IAAI,CAAS;IAErB,YAAY,OAAqC;QAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,+BAA+B,CAAC,CAAC;QAC1H,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,2BAA2B,CAAC;IACvF,CAAC;IAED,MAAM;IACN,+CAA+C;IAC/C,kFAAkF;IAClF,MAAM;IACN,0CAA0C;IAC1C,qBAAqB;IACrB,iCAAiC;IACjC,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,0CAA0C;IAC1C,4DAA4D;IAC5D,6BAA6B;IAC7B,8CAA8C;IAC9C,UAAU;IACV,IAAI;IAEJ,MAAM;IACN,kEAAkE;IAClE,qFAAqF;IACrF,MAAM;IACN,6CAA6C;IAC7C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,kGAAkG;IAClG,qFAAqF;IACrF,IAAI;IAEJ,MAAM;IACN,iDAAiD;IACjD,oFAAoF;IACpF,MAAM;IACN,4CAA4C;IAC5C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,oFAAoF;IACpF,IAAI;IAEJ;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,EACP,cAAc,GAKjB;QACG,MAAM,UAAU,GAAG,OAAO,IAAI,cAAc,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAAC,CAAC;QACjI,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS;SACZ,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAwB;YAChC,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,EACxB,KAAK,GAGR;QACG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAClC,OAAO;YACH,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC9B,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,EAChB,KAAK,GAGR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;QACpD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,SAAS,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEpG,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAE3D,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEzI,OAAO,UAAU,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,EACtB,SAAS,GAGZ;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC;QAC1D,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/E,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,QAAQ,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAClG,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAwB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxD,OAAO,MAAM,CAAC;YAClB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO,SAAS,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;QAEL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACvB,KAAK,GAGR;QACG,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,IAAI,qBAAuD,CAAC;AAE5D;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACnC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,qBAAqB,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC"}

package/dist/serve-gib/identity-index/identity-index-types.d.mts

@@ -12,8 +12,10 @@ export interface IdentityIndexRecord {
  * Configuration options for initializing IdentityIndexService.
  */
 export interface IdentityIndexServiceOptions {
-    /** Base directory where index shards will be stored (e.g. `data/index`). */
-    baseDir: string;
+    /** Base directory where index shards will be stored (e.g. `data/identity_index`). */
+    baseDir?: string;
+    /** Server root data directory (e.g. `data`). If baseDir is omitted, `baseDir` defaults to `path.join(dataDir, DEFAULT_IDENTITY_INDEX_DIR_NAME)`. */
+    dataDir?: string;
     /** Server salt for privacy email hashing. Defaults to `DEFAULT_IDENTITY_INDEX_SALT`. */
     salt?: string;
 }

package/dist/serve-gib/identity-index/identity-index-types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-types.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-types.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,6CAA6C;IAC7C,OAAO,EAAE,SAAS,CAAC;IACnB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACrC,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,MAAM,EAAE,mBAAmB,CAAC;CAC/B"}
+{"version":3,"file":"identity-index-types.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-types.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,6CAA6C;IAC7C,OAAO,EAAE,SAAS,CAAC;IACnB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oJAAoJ;IACpJ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACrC,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,MAAM,EAAE,mBAAmB,CAAC;CAC/B"}

package/dist/serve-gib/index.d.mts

@@ -31,8 +31,12 @@ export * from './handlers/api/keystone/keystone-check-email.handler.mjs';
 export * from './handlers/api/keystone/sso-config.handler.mjs';
 export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
+export * from './handlers/api/email/email-verification-code.handler.mjs';
+export * from './handlers/api/email/email-verify-code-onetime.handler.mjs';
 export * from './handlers/api/debug/ws-echo.handler.mjs';
 export * from './handlers/ws/ws-types.mjs';
 export * from './handlers/ws/ws-helper.mjs';

package/dist/serve-gib/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAG5D,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgB9C,MAAM,WAAW,uBAAuB;IACpC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,GAAE,uBAA4B,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAsB3G"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAG5D,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gEAAgE,CAAC;AAC/E,cAAc,0EAA0E,CAAC;AACzF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAoB9C,MAAM,WAAW,uBAAuB;IACpC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,GAAE,uBAA4B,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CA0B3G"}

package/dist/serve-gib/index.mjs

@@ -32,8 +32,12 @@ export * from './handlers/api/keystone/keystone-check-email.handler.mjs';
 export * from './handlers/api/keystone/sso-config.handler.mjs';
 export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
+export * from './handlers/api/email/email-verification-code.handler.mjs';
+export * from './handlers/api/email/email-verify-code-onetime.handler.mjs';
 export * from './handlers/api/debug/ws-echo.handler.mjs';
 export * from './handlers/ws/ws-types.mjs';
 export * from './handlers/ws/ws-helper.mjs';
@@ -50,8 +54,12 @@ import { KeystoneCheckEmailHandler } from './handlers/api/keystone/keystone-chec
 import { SsoLinkHandler } from './handlers/api/keystone/sso-link.handler.mjs';
 import { SsoLoginHandler } from './handlers/api/keystone/sso-login.handler.mjs';
 import { SsoConfigHandler } from './handlers/api/keystone/sso-config.handler.mjs';
+import { KeystoneCustodianGenesisHandler } from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+import { KeystoneCustodianRegisterDelegateHandler } from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 import { EmailInboundHandler } from './handlers/api/email/email-inbound.handler.mjs';
 import { EmailOutboundHandler } from './handlers/api/email/email-outbound.handler.mjs';
+import { EmailVerificationCodeHandler } from './handlers/api/email/email-verification-code.handler.mjs';
+import { EmailVerifyCodeOnetimeHandler } from './handlers/api/email/email-verify-code-onetime.handler.mjs';
 import { StaticFileHandler } from './handlers/static-handler.mjs';
 /**
  * Returns the standard pipeline array of ibgib HTTP request handlers for serve-gib.
@@ -69,8 +77,12 @@ export function getStandardServeGibHandlers(opts = {}) {
         new SsoLinkHandler(),
         new SsoLoginHandler(),
         new SsoConfigHandler(),
+        new KeystoneCustodianGenesisHandler(),
+        new KeystoneCustodianRegisterDelegateHandler(),
         new EmailInboundHandler(),
         new EmailOutboundHandler(),
+        new EmailVerificationCodeHandler(),
+        new EmailVerifyCodeOnetimeHandler(),
     ];
     if (opts.clientDir) {
         handlers.push(new StaticFileHandler(opts.clientDir));

package/dist/serve-gib/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAE5D,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAA4B,EAAE;IAC1E,MAAM,QAAQ,GAAgC;QAC1C,IAAI,aAAa,EAAE;QACnB,IAAI,YAAY,EAAE;QAClB,IAAI,sBAAsB,EAAE;QAC5B,IAAI,qBAAqB,EAAE;QAC3B,IAAI,mBAAmB,EAAE;QACzB,IAAI,kBAAkB,EAAE;QACxB,IAAI,qBAAqB,EAAE;QAC3B,IAAI,yBAAyB,EAAE;QAC/B,IAAI,cAAc,EAAE;QACpB,IAAI,eAAe,EAAE;QACrB,IAAI,gBAAgB,EAAE;QACtB,IAAI,mBAAmB,EAAE;QACzB,IAAI,oBAAoB,EAAE;KAC7B,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAE5D,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gEAAgE,CAAC;AAC/E,cAAc,0EAA0E,CAAC;AACzF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gEAAgE,CAAC;AACjH,OAAO,EAAE,wCAAwC,EAAE,MAAM,0EAA0E,CAAC;AACpI,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAA4B,EAAE;IAC1E,MAAM,QAAQ,GAAgC;QAC1C,IAAI,aAAa,EAAE;QACnB,IAAI,YAAY,EAAE;QAClB,IAAI,sBAAsB,EAAE;QAC5B,IAAI,qBAAqB,EAAE;QAC3B,IAAI,mBAAmB,EAAE;QACzB,IAAI,kBAAkB,EAAE;QACxB,IAAI,qBAAqB,EAAE;QAC3B,IAAI,yBAAyB,EAAE;QAC/B,IAAI,cAAc,EAAE;QACpB,IAAI,eAAe,EAAE;QACrB,IAAI,gBAAgB,EAAE;QACtB,IAAI,+BAA+B,EAAE;QACrC,IAAI,wCAAwC,EAAE;QAC9C,IAAI,mBAAmB,EAAE;QACzB,IAAI,oBAAoB,EAAE;QAC1B,IAAI,4BAA4B,EAAE;QAClC,IAAI,6BAA6B,EAAE;KACtC,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/serve-gib/path-constants.d.mts

@@ -97,6 +97,23 @@ export declare const API_PATH_REGEXES: {
      * /api/email/send
      */
     EMAIL_SEND: RegExp;
+    /**
+     * /api/email/verification-code
+     */
+    EMAIL_VERIFICATION_CODE: RegExp;
+    /**
+     * /api/email/verify or /api/email/verify-code
+     */
+    EMAIL_VERIFY: RegExp;
+    EMAIL_VERIFY_CODE: RegExp;
+    /**
+     * /api/identity/custodian/genesis
+     */
+    KEYSTONE_CUSTODIAN_GENESIS: RegExp;
+    /**
+     * /api/identity/custodian/register-delegate
+     */
+    KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: RegExp;
 };
 export declare const VALID_STATIC_PATH_REGEX: RegExp;
 //# sourceMappingURL=path-constants.d.mts.map

package/dist/serve-gib/path-constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"path-constants.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAK9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;IACzB;;OAEG;IACH,MAAM;IAEN;;OAEG;IACH,WAAW;IAEX;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,QAAQ;IAER;;OAEG;IACH,aAAa;IAEb;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,eAAe;IAEf;;;;;;;;OAQG;IACH,gBAAgB;IAEhB;;OAEG;IACH,eAAe;IAEf;;OAEG;IACH,oBAAoB;IAEpB;;;;;;;;;;;OAWG;IACH,aAAa;IACb;;OAEG;IACH,OAAO;IACP;;OAEG;IACH,iBAAiB;IACjB;;OAEG;IACH,kBAAkB;IAClB;;OAEG;IACH,mBAAmB;IACnB;;OAEG;IACH,aAAa;IACb;;OAEG;IACH,UAAU;CACb,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAA4B,CAAC"}
+{"version":3,"file":"path-constants.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAK9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;IACzB;;OAEG;IACH,MAAM;IAEN;;OAEG;IACH,WAAW;IAEX;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,QAAQ;IAER;;OAEG;IACH,aAAa;IAEb;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,eAAe;IAEf;;;;;;;;OAQG;IACH,gBAAgB;IAEhB;;OAEG;IACH,eAAe;IAEf;;OAEG;IACH,oBAAoB;IAEpB;;;;;;;;;;;OAWG;IACH,aAAa;IACb;;OAEG;IACH,OAAO;IACP;;OAEG;IACH,iBAAiB;IACjB;;OAEG;IACH,kBAAkB;IAClB;;OAEG;IACH,mBAAmB;IACnB;;OAEG;IACH,aAAa;IACb;;OAEG;IACH,UAAU;IACV;;OAEG;IACH,uBAAuB;IAEvB;;OAEG;IACH,YAAY;IACZ,iBAAiB;IAEjB;;OAEG;IACH,0BAA0B;IAE1B;;OAEG;IACH,oCAAoC;CACvC,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAA4B,CAAC"}

package/dist/serve-gib/path-constants.mjs

@@ -102,6 +102,23 @@ export const API_PATH_REGEXES = {
      * /api/email/send
      */
     EMAIL_SEND: /^\/api\/email\/send\/?$/,
+    /**
+     * /api/email/verification-code
+     */
+    EMAIL_VERIFICATION_CODE: /^\/api\/email\/verification-code\/?$/,
+    /**
+     * /api/email/verify or /api/email/verify-code
+     */
+    EMAIL_VERIFY: /^\/api\/email\/verify\/?$/,
+    EMAIL_VERIFY_CODE: /^\/api\/email\/verify-code\/?$/,
+    /**
+     * /api/identity/custodian/genesis
+     */
+    KEYSTONE_CUSTODIAN_GENESIS: /^\/api\/identity\/custodian\/genesis\/?$/i,
+    /**
+     * /api/identity/custodian/register-delegate
+     */
+    KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: /^\/api\/identity\/custodian\/register-delegate\/?$/i,
 };
 export const VALID_STATIC_PATH_REGEX = /^\/[a-zA-Z0-9\-_\.\/]*$/;
 //# sourceMappingURL=path-constants.mjs.map

package/dist/serve-gib/path-constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"path-constants.mjs","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAO,yBAAyB;IACtC,MAAM,EAAO,uBAAuB;IACpC,IAAI,EAAS,gBAAgB;IAC7B,UAAU,EAAG,wCAAwC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B;;OAEG;IACH,MAAM,EAAE,oBAAoB;IAE5B;;OAEG;IACH,WAAW,EAAE,oFAAoF;IAEjG;;OAEG;IACH,UAAU,EAAE,6EAA6E;IAEzF;;OAEG;IACH,QAAQ,EAAE,sBAAsB;IAEhC;;OAEG;IACH,aAAa,EAAE,mDAAmD;IAElE;;OAEG;IACH,UAAU,EAAE,mBAAmB;IAE/B;;OAEG;IACH,eAAe,EAAE,2DAA2D;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,+BAA+B;IAEjD;;OAEG;IACH,eAAe,EAAE,8BAA8B;IAE/C;;OAEG;IACH,oBAAoB,EAAE,mCAAmC;IAEzD;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,mDAAmD;IAC5D;;OAEG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;OAEG;IACH,kBAAkB,EAAE,kCAAkC;IACtD;;OAEG;IACH,mBAAmB,EAAE,mCAAmC;IACxD;;OAEG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,UAAU,EAAE,yBAAyB;CACxC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"path-constants.mjs","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAO,yBAAyB;IACtC,MAAM,EAAO,uBAAuB;IACpC,IAAI,EAAS,gBAAgB;IAC7B,UAAU,EAAG,wCAAwC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B;;OAEG;IACH,MAAM,EAAE,oBAAoB;IAE5B;;OAEG;IACH,WAAW,EAAE,oFAAoF;IAEjG;;OAEG;IACH,UAAU,EAAE,6EAA6E;IAEzF;;OAEG;IACH,QAAQ,EAAE,sBAAsB;IAEhC;;OAEG;IACH,aAAa,EAAE,mDAAmD;IAElE;;OAEG;IACH,UAAU,EAAE,mBAAmB;IAE/B;;OAEG;IACH,eAAe,EAAE,2DAA2D;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,+BAA+B;IAEjD;;OAEG;IACH,eAAe,EAAE,8BAA8B;IAE/C;;OAEG;IACH,oBAAoB,EAAE,mCAAmC;IAEzD;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,mDAAmD;IAC5D;;OAEG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;OAEG;IACH,kBAAkB,EAAE,kCAAkC;IACtD;;OAEG;IACH,mBAAmB,EAAE,mCAAmC;IACxD;;OAEG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,UAAU,EAAE,yBAAyB;IACrC;;OAEG;IACH,uBAAuB,EAAE,sCAAsC;IAE/D;;OAEG;IACH,YAAY,EAAE,2BAA2B;IACzC,iBAAiB,EAAE,gCAAgC;IAEnD;;OAEG;IACH,0BAA0B,EAAE,2CAA2C;IAEvE;;OAEG;IACH,oCAAoC,EAAE,qDAAqD;CAC9F,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC"}

package/e2e/identity-custodian-lifecycle.e2e.md

@@ -0,0 +1,93 @@
+# E2E Test Plan: Full Custodian Passwordless Onboarding & Single-Turn Authorization Ceremony
+
+Tests custodian (passwordless) account creation, add-device.
+
+* **Create Account**: passwordless, Google or custom email
+* **Sign in**: passwordless, Google or custom email
+
+---
+
+## Overview & Execution Model
+
+| Property | Specification |
+| :--- | :--- |
+| **Primary Domain Target** | `https://local.ibgib.space` (Google OAuth callback domain) |
+| **Server Mode** | `EMAIL_MODE=mock` |
+| **Target Audience** | Human QA Testers / Agent Browser Testers |
+
+### Fail-Fast Sequential Lifecycle
+- Executed linearly from **Phase 0 through Phase 3**.
+- If any step in any phase fails, execution halts immediately, and the E2E test run is marked as **FAILED**.
+
+---
+
+## Test Variables
+
+* `<E2E_TEST_GMAIL_ADDRESS_ALICE>` - located in `.env`
+* `<test_url>` - `https://local.ibgib.space`
+
+---
+
+## Sequential Test Phases
+
+### Phase 0: Prerequisites & Environment Setup
+Verify that local Docker services are running, server listens on port 3000, target domain `<test_url>` resolves, server data directory is cleaned, and local browser storage (IndexedDB, LocalStorage, SessionStorage) is cleared.
+
+> [!WARNING]
+> Cleaning the server wipes `<dataDir>/` (`identity_index/`, email hashes, and all registered domain tenancy folders). Do not run server cleaning if active personal testing or long-running server state needs to be preserved!
+
+#### Steps
+1. **Clean and reset local server state**:
+   - Run `npm run clean:space-gib:server` in monorepo root (deletes `.data/` directory and resets email index).
+   - *(Optional UX Tip)*: If using Docker Desktop on Windows, clear the container log terminal view before restarting to eliminate log noise when locating 6-digit verification code log entries.
+   - Run `npm run restart:space-gib` to restart the server with a clean data state, or `npm run docker:space-gib` / `npm run docker:space-gib:d` if not started.
+2. **Confirm server startup log outputs**: (e.g. `[space-gib server] dataDir: /data/ibgib-space` and `[space-gib server] listening on http://0.0.0.0:3000`).
+3. **Open test browser(s)**: Navigate to `<test_url>`.
+4. **Clear browser data for `<test_url>`** (all ibgib data is stored in IndexedDB): Ensure you are you at `<test_url>` -> Open Developer Tools (F12) -> Application -> IndexedDB -> `space_gib_db` -> Delete database, then refresh the browser
+5. **Test Credentials**: Refer to (vcs ignored) `.env` for `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and password.
+
+### Phase 1: First-Time Passwordless Account Creation & Custodian Genesis
+Create a new custodian identity on `<test_url>` using the **Quick / Passwordless** workflow (6-digit OTP email code or Google SSO), verify single-turn `custodianReqs` generation, and confirm local delegate keystone registration.
+
+#### Steps
+1. Open browser to `<test_url>`.
+2. In `<ibgib-identity-header>`, click **Create Account**.
+3. Observe the default **Quick (Passwordless)** tab is selected by default.
+4. Enter email `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and click **Send Code** (or click **Continue with Google**).
+5. Open server console / terminal logs to locate the dispatched 6-digit OTP verification code.
+6. Enter the 6-digit OTP code into the PIN input prompt in the same tab and click **Verify Code**.
+7. Verify API execution:
+   - Client calls `POST /api/identity/custodian/genesis`.
+   - Server returns `isNewIdentity: true`, `primaryTjpAddr`, `primaryKeystone`, and single-turn `custodianReqs`.
+   - Client derives local delegate secret, constructs $K_{\text{delegate}}$, and calls `POST /api/identity/custodian/register-delegate`.
+8. Verify outcomes:
+   - Identity header displays avatar & username (derived from email).
+   - Local browser user space contains $K_{\text{primary}}$ and $K_{\text{delegate}}$.
+   - `<dataDir>/identity_index/email/hashes/` contains the registered email index.
+
+
+### Phase 2: Second-Device Passwordless Sign-In & Device Pairing
+Open a fresh Incognito browser window to `<test_url>`, execute passwordless sign-in for `<E2E_TEST_GMAIL_ADDRESS_ALICE>`, and verify that the server provisions a fresh `custodianReqs` payload and registers a second device delegate ($K_{\text{delegate2}}$).
+
+#### Steps
+1. Open a second browser window (or Incognito window) at `<test_url>`.
+2. Click **Sign In** in `<ibgib-identity-header>`.
+3. Enter the same email address `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and click **Send Code** (or click **Continue with Google**).
+4. Copy the 6-digit OTP code from the server console log and submit it.
+5. Verify API execution:
+   - Server returns `isNewIdentity: false`, existing `primaryTjpAddr`, and fresh single-turn `custodianReqs`.
+   - Second browser constructs its local $K_{\text{delegate2}}$ and registers via `POST /api/identity/custodian/register-delegate`.
+6. Verify outcomes:
+   - Second device successfully pairs and displays user identity header.
+   - Server evolves $K_{\text{primary}} \to K_{\text{primary}, n=2}$ with both device delegates registered in `rel8ns.sync_delegate`.
+
+
+### Phase 3: Single-Turn Nonce Replay Prevention
+Attempt to re-submit a previously consumed `custodianReqs` payload to `POST /api/identity/custodian/register-delegate` and verify that the server kernel atomically rejects the request.
+
+#### Steps
+1. Copy or intercept a `custodianReqs` payload previously consumed in Phase 1 or Phase 2.
+2. Re-submit the same `delegateKeystone` (or identical `custodianReqs` payload) to `POST /api/identity/custodian/register-delegate`.
+3. Verify rejection outcome:
+   - Server rejects the request with **HTTP 409 Conflict**:
+     `"Custodian requirements payload has already been used. Nonce single-turn reservation violation."`

package/e2e/identity-sso-lifecycle.e2e.md

@@ -0,0 +1,132 @@
+# E2E Test Plan: Identity, SSO & 6-Digit Email Code Lifecycle
+
+This document is the official End-to-End (E2E) browser test plan for the complete identity creation, 6-digit email OTP verification, Google SSO linking, new-device sign-in, and delegate revocation user lifecycle.
+
+* **Create Account**: Create local/sovereign identity
+* **Verify Email**: 6-digit code
+* **Link SSO**: Google is only OAuth2 provider atow
+* **Sign in**: add device
+* **Revoke delegate**: remove device
+
+---
+
+## Overview & Execution Model
+
+| Property | Specification |
+| :--- | :--- |
+| **Primary Domain Target** | `https://local.ibgib.space` (Google OAuth callback domain) |
+| **Server Mode** | `EMAIL_MODE=mock` |
+| **Target Audience** | Human QA Testers / Agent Browser Testers |
+
+### Fail-Fast Sequential Lifecycle
+- Executed linearly from **Phase 0 through Phase 5**.
+- If any step in any phase fails, execution halts immediately, and the E2E test run is marked as **FAILED**.
+
+---
+
+## Test Variables
+
+* `<E2E_TEST_GMAIL_ADDRESS_ALICE>` - located in `.env`
+* `<test_url>` - `https://local.ibgib.space`
+
+---
+
+## Sequential Test Phases
+
+### Phase 0: Prerequisites & Environment Setup
+Verify that local Docker services are running, server listens on port 3000, target domain `https://local.ibgib.space` resolves, server data directory is cleaned, and local browser storage (IndexedDB, LocalStorage, SessionStorage) is cleared.
+
+> [!WARNING]
+> Cleaning the server wipes `<dataDir>/` (`identity_index/`, email hashes, and all registered domain tenancy folders). Do not run server cleaning if active personal testing or long-running server state needs to be preserved!
+
+#### Steps
+1. **Clean and reset local server state**:
+   - Run `npm run clean:space-gib:server` in monorepo root (deletes `.data/` directory and resets email index).
+   - *(Optional UX Tip)*: If using Docker Desktop on Windows, clear the container log terminal view before restarting to eliminate log noise when locating 6-digit verification code log entries.
+   - Run `npm run restart:space-gib` to restart the server with a clean data state, or `npm run docker:space-gib` / `npm run docker:space-gib:d` if not started.
+2. **Confirm server startup log outputs**: (e.g. `[space-gib server] dataDir: /data/ibgib-space` and `[space-gib server] listening on http://0.0.0.0:3000`).
+3. **Open test browser(s)**: Navigate to `<test_url>`.
+4. **Clear browser data for `<test_url>`** (all ibgib data is stored in IndexedDB): Ensure you are you at `<test_url>` -> Open Developer Tools (F12) -> Application -> IndexedDB -> `space_gib_db` -> Delete database, then refresh the browser
+5. **Test Credentials**: Refer to (vcs ignored) `.env` for `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and password.
+
+### Phase 1: Account Creation & Email Verification Code Dispatch
+Create a new identity `alice` with email `<E2E_TEST_GMAIL_ADDRESS_ALICE>` (from `.env`) on `https://local.ibgib.space` and verify that the genesis keystone is quarantined in the `email/pending/` staging directory with `code.json` and Ahead-of-Time (AOT) metadata JSON files.
+
+#### Steps
+1. Open browser to `https://local.ibgib.space`.
+2. In `<ibgib-identity-header>`, click **Create Account**.
+3. Input registration credentials:
+   - **Username**: `alice`
+   - **Passphrase**: `asdf`
+   - **Email**: `<E2E_TEST_GMAIL_ADDRESS_ALICE>` (from `.env`)
+4. Click **Generate Identity**.
+5. Verify status message in UI: `✉️ Verification code sent to your email. Enter 6-digit code below:`
+6. Verify PIN input field (`#section-code-verification`) appears in the UI.
+7. Verify server terminal log contains 6-digit verification code:
+   `[EmailSenderMock] ✉️ Verification Code for <E2E_TEST_GMAIL_ADDRESS_ALICE>: <6-DIGIT-CODE>`
+8. Verify file system staging quarantine:
+   - Check `<dataDir>/identity_index/email/pending/<expiryTicks>_<tjpHash>/` exists.
+   - Confirm folder contains `keystone.json`, `code.json`, and `emails/<emailHash>.json` with `{ "email": "<E2E_TEST_GMAIL_ADDRESS_ALICE>", "verified": false }`.
+   - Confirm `<dataDir>/identity_index/email/hashes/` does NOT yet contain `<E2E_TEST_GMAIL_ADDRESS_ALICE>`.
+
+
+### Phase 2: 6-Digit Verification Code Entry, Account Activation & Automatic Delegate Sync
+Copy the 6-digit verification code from the server log, enter it into the UI PIN input prompt in the same tab, verify account activation, confirm promotion of the keystone to official server space, and verify automatic delegate keystone sync.
+
+#### Steps
+1. Copy the 6-digit verification code from the server log (e.g. `482901`).
+2. In the same browser tab, enter the code into the PIN input field and click **Verify Code**.
+3. Verify status message in UI: `Identity fully created & activated!`
+4. Verify file system promotion:
+   - Check `<dataDir>/identity_index/email/pending/` staging folder is automatically removed.
+   - Check `<dataDir>/identity_index/email/hashes/` contains `<emailHash>.json` mapping `<E2E_TEST_GMAIL_ADDRESS_ALICE>` to `primaryTjpAddr`.
+   - Confirm domain identity keystone is registered in official server space under `<dataDir>/domains/<domainGib>/`.
+   - Confirm sync delegate keystone is successfully registered on the evolved parent keystone on the server."
+
+
+### Phase 3: Google SSO Linking in Identity Manager
+Open Identity Manager on `https://local.ibgib.space`, trigger Google OAuth2 linking, and verify that the primary keystone evolves to attach `challengePools["custodian-manage-google"]`.
+
+#### Steps
+1. Return to the main app tab on `https://local.ibgib.space`.
+2. Click `<ibgib-identity-header>` -> Select **Identity Manager** (`<ibgib-keystone-details>`).
+3. Click **"Link Google SSO"**.
+4. Complete Google OAuth2 popup authentication.
+5. Verify primary keystone evolution:
+   - Keystone evolves ($A_0 \to A_1$) adding `challengePools["custodian-manage-google"]`.
+   - Identity Manager updates to display `Google SSO Linked ✅`.
+6. Verify server log contains: `[SsoLinkHandler] Successfully linked google SSO for primary identity`.
+
+
+### Phase 4: New-Device Google SSO Sign-In (Incognito Mode)
+Open a clean Incognito browser window to `https://local.ibgib.space`, complete Google SSO sign-in, verify that `IdentityIndexService` resolves the primary identity, verifies the `custodian-manage-google` pool, and pairs the new device.
+
+#### Steps
+1. Open a fresh **Incognito Window** (ctrl+shift+N) to `https://local.ibgib.space`.
+2. In `<ibgib-identity-header>`, click **Sign In with Google**.
+3. Complete Google OAuth2 popup authentication.
+4. Verify server log processing:
+   - `[IdentityIndexService]` resolves `<E2E_TEST_GMAIL_ADDRESS_ALICE>` -> `primaryTjpAddr`.
+   - Server loads domain graph, verifies `custodian-manage-google` challenge pool, and issues delegate challenge.
+5. Verify client UI result:
+   - Browser receives delegate response and pairs device seamlessly.
+   - Active identity header updates to `alice` with active status badge `🟢`.
+
+
+### Phase 5: Delegate Device Tagging & Revocation
+Return to the primary device window, open Identity Manager, verify the remote paired device displays its device tag icon, click **`[Revoke]`**, enter the master passphrase, and verify parent keystone evolution $A_n \to A_{n+1}$.
+
+#### Steps
+1. Switch back to the primary browser window on `https://local.ibgib.space`.
+2. Open Identity Manager (`<ibgib-keystone-details>`).
+3. Inspect the **Registered Delegates** table:
+   - Confirm remote paired device from Phase 4 is listed.
+   - Confirm device tag icon and name are displayed (e.g. `💻 work-laptop`).
+   - Confirm red **`[Revoke]`** button is rendered next to the delegate entry.
+4. Click **`[Revoke]`** next to the remote delegate device.
+5. Enter master passphrase `MySecretPassword123!` when prompted.
+6. Verify primary keystone evolution ($A_1 \to A_2$):
+   - Primary keystone evolves removing the revoked delegate from `data.delegates`.
+   - Keystone evolution is posted to server via `putEvolveKeystone()`.
+   - Table re-renders with the revoked delegate removed.
+7. Switch back to the Incognito window (Phase 4 device) $\to$ trigger sync or refresh $\to$ confirm device is unlinked/deauthorized.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/node-gib",
-  "version": "0.0.14",
+  "version": "0.0.17",
   "description": "Node and server-specific ibGib code, i.e., things that don't run in the browser.",
   "funding": {
     "type": "individual",
@@ -24,10 +24,10 @@
   "author": "William Raiford",
   "license": "ISC",
   "dependencies": {
-    "@ibgib/helper-gib": "^0.0.36",
-    "@ibgib/ts-gib": "^0.5.33",
-    "@ibgib/core-gib": "^0.1.70",
-    "@ibgib/encrypt-gib": "^0.2.37"
+    "@ibgib/helper-gib": "*",
+    "@ibgib/ts-gib": "*",
+    "@ibgib/core-gib": "*",
+    "@ibgib/encrypt-gib": "*"
   },
   "devDependencies": {
     "@types/node": "^20.2.1"