@ibgib/node-gib 0.0.15 → 0.0.17

package/{test-data-magic-link → data}/identity_index/email/hashes/32/13/49/e64f32730f01a61ada211f29eaf0a210fc2386b668ad04d7e8a9b16766.json

@@ -1,4 +1,4 @@
 {
   "tjpAddr": "keystone^MULTIEMAIL_TJP",
-  "createdAt": 1786120867529
+  "createdAt": 1786369164040
 }

package/dist/identity/sso/custodian-auth-helpers.d.mts

@@ -0,0 +1,45 @@
+import { CustodianRequirements } from './sso-types.mjs';
+/**
+ * Derives a deterministic single-turn authorization code using the server's private KDF secret
+ * and the JSON-stringified `custodianReqs` (excluding `authCode` itself) as salt.
+ *
+ * @param custodianReqsOmitAuthCode The custodian requirements object omitting the `authCode` property.
+ * @param serverSecret The server's private KDF secret (`SSO_SERVER_KDF_SECRET`).
+ */
+export declare function deriveCustodianAuthCode({ custodianReqsOmitAuthCode, serverSecret, }: {
+    custodianReqsOmitAuthCode: Omit<CustodianRequirements, 'authCode'>;
+    serverSecret: string;
+}): Promise<string>;
+/**
+ * Generates a full `CustodianRequirements` object containing single-turn nonce,
+ * expiration timestamp, permitted verbs, and derived auth code.
+ *
+ * @param primaryTjpAddr Primary identity keystone TJP address (`ib^gib`).
+ * @param ttlMs Time-to-live duration in milliseconds. Defaults to 15 minutes.
+ * @param allowedVerbs Permitted keystone verbs. Defaults to `['sync', 'connect']`.
+ * @param serverSecret The server's private KDF secret (`SSO_SERVER_KDF_SECRET`).
+ */
+export declare function generateCustodianRequirements({ primaryTjpAddr, ttlMs, allowedVerbs, serverSecret, }: {
+    primaryTjpAddr: string;
+    ttlMs?: number;
+    allowedVerbs?: string[];
+    serverSecret: string;
+}): Promise<CustodianRequirements>;
+/**
+ * Computes the deterministic index hash (`authCustodianIndex`) over the full `CustodianRequirements` object
+ * used for atomic file reservation tracking on the server filesystem.
+ */
+export declare function getAuthCustodianIndex({ custodianReqs, }: {
+    custodianReqs: CustodianRequirements;
+}): Promise<string>;
+/**
+ * Cryptographically verifies a `CustodianRequirements` object against expiration and server KDF authCode match.
+ */
+export declare function verifyCustodianRequirements({ custodianReqs, serverSecret, }: {
+    custodianReqs: CustodianRequirements;
+    serverSecret: string;
+}): Promise<{
+    valid: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=custodian-auth-helpers.d.mts.map

package/dist/identity/sso/custodian-auth-helpers.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custodian-auth-helpers.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/custodian-auth-helpers.mts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,EAC1C,yBAAyB,EACzB,YAAY,GACf,EAAE;IACC,yBAAyB,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IACnE,YAAY,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CAAC,EAChD,cAAc,EACd,KAAsB,EACtB,YAA0D,EAC1D,YAAY,GACf,EAAE;IACC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiCjC;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,EACxC,aAAa,GAChB,EAAE;IACC,aAAa,EAAE,qBAAqB,CAAC;CACxC,GAAG,OAAO,CAAC,MAAM,CAAC,CAKlB;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,EAC9C,aAAa,EACb,YAAY,GACf,EAAE;IACC,aAAa,EAAE,qBAAqB,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB9C"}

package/dist/identity/sso/custodian-auth-helpers.mjs

@@ -0,0 +1,108 @@
+import { getUUID, hash, HashAlgorithm, extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { kdf_recursiveSaltWrap } from '@ibgib/core-gib/dist/keystone/kdf/kdf-helpers.mjs';
+import { KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+/**
+ * Derives a deterministic single-turn authorization code using the server's private KDF secret
+ * and the JSON-stringified `custodianReqs` (excluding `authCode` itself) as salt.
+ *
+ * @param custodianReqsOmitAuthCode The custodian requirements object omitting the `authCode` property.
+ * @param serverSecret The server's private KDF secret (`SSO_SERVER_KDF_SECRET`).
+ */
+export async function deriveCustodianAuthCode({ custodianReqsOmitAuthCode, serverSecret, }) {
+    const lc = `[${deriveCustodianAuthCode.name}]`;
+    try {
+        if (!serverSecret) {
+            throw new Error('serverSecret required for custodian auth code derivation (E: a1b2c3d4e5f67890123456789abcdef0)');
+        }
+        const salt = await hash({
+            s: JSON.stringify(custodianReqsOmitAuthCode),
+            algorithm: HashAlgorithm.sha_512
+        });
+        return await kdf_recursiveSaltWrap({
+            masterSecret: serverSecret,
+            salt,
+            rounds: 1000,
+            algorithm: HashAlgorithm.sha_512
+        });
+    }
+    catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+}
+/**
+ * Generates a full `CustodianRequirements` object containing single-turn nonce,
+ * expiration timestamp, permitted verbs, and derived auth code.
+ *
+ * @param primaryTjpAddr Primary identity keystone TJP address (`ib^gib`).
+ * @param ttlMs Time-to-live duration in milliseconds. Defaults to 15 minutes.
+ * @param allowedVerbs Permitted keystone verbs. Defaults to `['sync', 'connect']`.
+ * @param serverSecret The server's private KDF secret (`SSO_SERVER_KDF_SECRET`).
+ */
+export async function generateCustodianRequirements({ primaryTjpAddr, ttlMs = 15 * 60 * 1000, allowedVerbs = [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT], serverSecret, }) {
+    const lc = `[${generateCustodianRequirements.name}]`;
+    try {
+        if (!primaryTjpAddr) {
+            throw new Error('primaryTjpAddr is required to generate custodian requirements (E: b2c3d4e5f67890123456789abcdef01)');
+        }
+        if (!serverSecret) {
+            throw new Error('serverSecret is required to generate custodian requirements (E: c3d4e5f67890123456789abcdef012)');
+        }
+        const nonce = await getUUID();
+        const expiresAt = Date.now() + ttlMs;
+        const custodianReqsOmitAuthCode = {
+            primaryTjpAddr,
+            nonce,
+            expiresAt,
+            allowedVerbs,
+        };
+        const authCode = await deriveCustodianAuthCode({
+            custodianReqsOmitAuthCode,
+            serverSecret
+        });
+        return {
+            ...custodianReqsOmitAuthCode,
+            authCode
+        };
+    }
+    catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+}
+/**
+ * Computes the deterministic index hash (`authCustodianIndex`) over the full `CustodianRequirements` object
+ * used for atomic file reservation tracking on the server filesystem.
+ */
+export async function getAuthCustodianIndex({ custodianReqs, }) {
+    return await hash({
+        s: JSON.stringify(custodianReqs),
+        algorithm: HashAlgorithm.sha_256
+    });
+}
+/**
+ * Cryptographically verifies a `CustodianRequirements` object against expiration and server KDF authCode match.
+ */
+export async function verifyCustodianRequirements({ custodianReqs, serverSecret, }) {
+    try {
+        if (!custodianReqs || !custodianReqs.authCode || !custodianReqs.nonce || !custodianReqs.expiresAt || !custodianReqs.primaryTjpAddr) {
+            return { valid: false, error: 'Malformed custodian requirements structure. (E: d4e5f67890123456789abcdef0123)' };
+        }
+        if (Date.now() > custodianReqs.expiresAt) {
+            return { valid: false, error: 'Custodian requirements have expired. (E: e5f67890123456789abcdef01234)' };
+        }
+        const { authCode, ...custodianReqsOmitAuthCode } = custodianReqs;
+        const expectedAuthCode = await deriveCustodianAuthCode({
+            custodianReqsOmitAuthCode,
+            serverSecret
+        });
+        if (authCode !== expectedAuthCode) {
+            return { valid: false, error: 'Cryptographic authCode mismatch. Requirement payload tampered or invalid. (E: f67890123456789abcdef012345)' };
+        }
+        return { valid: true };
+    }
+    catch (error) {
+        return { valid: false, error: `Verification failed: ${extractErrorMsg(error)} (E: 7890123456789abcdef0123456)` };
+    }
+}
+//# sourceMappingURL=custodian-auth-helpers.mjs.map

package/dist/identity/sso/custodian-auth-helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"custodian-auth-helpers.mjs","sourceRoot":"","sources":["../../../src/identity/sso/custodian-auth-helpers.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAIjH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC1C,yBAAyB,EACzB,YAAY,GAIf;IACG,MAAM,EAAE,GAAG,IAAI,uBAAuB,CAAC,IAAI,GAAG,CAAC;IAC/C,IAAI,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACtH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;YACpB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC;YAC5C,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;QAEH,OAAO,MAAM,qBAAqB,CAAC;YAC/B,YAAY,EAAE,YAAY;YAC1B,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAChD,cAAc,EACd,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EACtB,YAAY,GAAG,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,EAC1D,YAAY,GAMf;IACG,MAAM,EAAE,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC;IACrD,IAAI,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;QACvH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAErC,MAAM,yBAAyB,GAA4C;YACvE,cAAc;YACd,KAAK;YACL,SAAS;YACT,YAAY;SACf,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;YAC3C,yBAAyB;YACzB,YAAY;SACf,CAAC,CAAC;QAEH,OAAO;YACH,GAAG,yBAAyB;YAC5B,QAAQ;SACX,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EACxC,aAAa,GAGhB;IACG,OAAO,MAAM,IAAI,CAAC;QACd,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;QAChC,SAAS,EAAE,aAAa,CAAC,OAAO;KACnC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAC9C,aAAa,EACb,YAAY,GAIf;IACG,IAAI,CAAC;QACD,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,SAAS,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;YACjI,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gFAAgF,EAAE,CAAC;QACrH,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wEAAwE,EAAE,CAAC;QAC7G,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,yBAAyB,EAAE,GAAG,aAAa,CAAC;QACjE,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC;YACnD,yBAAyB;YACzB,YAAY;SACf,CAAC,CAAC;QAEH,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4GAA4G,EAAE,CAAC;QACjJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,eAAe,CAAC,KAAK,CAAC,kCAAkC,EAAE,CAAC;IACrH,CAAC;AACL,CAAC"}

package/dist/identity/sso/sso-types.d.mts

@@ -37,4 +37,35 @@ export interface OAuthUserInfo {
     name?: string;
     picture?: string;
 }
+/**
+ * Single-turn authorization requirements object issued by the custodian server
+ * after successful passwordless SSO/Email authentication.
+ *
+ * Placed in `delegateKeystone.data.frameDetails.custodianReqs` when registering
+ * a client delegate keystone via passwordless onboarding.
+ */
+export interface CustodianRequirements {
+    /**
+     * The primary identity keystone TJP address (`ib^gib`) to which the delegate keystone will be registered.
+     * Prevents Man-In-The-Middle reuse of authorization requirements across different primary identities.
+     */
+    primaryTjpAddr: string;
+    /**
+     * High-entropy, single-turn random nonce generated by the server.
+     * Prevents replay attacks when registering delegate keystones.
+     */
+    nonce: string;
+    /**
+     * Single-turn authorization code computed by the server over `Omit<CustodianRequirements, 'authCode'>`.
+     */
+    authCode: string;
+    /**
+     * Expiration timestamp in epoch milliseconds after which this requirements object is invalid.
+     */
+    expiresAt: number;
+    /**
+     * Explicit list of permitted keystone verbs allowed for the delegate keystone (e.g., `['sync', 'connect']`).
+     */
+    allowedVerbs: string[];
+}
 //# sourceMappingURL=sso-types.d.mts.map

package/dist/identity/sso/sso-types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-types.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-types.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD,MAAM,WAAW,uBAAuB;IACpC,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACpC,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC5B,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,aAAa;IAC1B,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,CAAC;IAC1B,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"sso-types.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-types.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD,MAAM,WAAW,uBAAuB;IACpC,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACpC,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC5B,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,aAAa;IAC1B,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,CAAC;IAC1B,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IAClC;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CAC1B"}

package/dist/index.d.mts

@@ -12,5 +12,6 @@ export { DEFAULT_EMAIL_CHARSET, EMAIL_MODE_AWS, EMAIL_MODE_MOCK, DEFAULT_AWS_REG
 export type * from './email/email-types.mjs';
 export * from './identity/sso/sso-custodian-service.mjs';
 export * from './identity/sso/sso-config-helper.mjs';
+export * from './identity/sso/custodian-auth-helpers.mjs';
 export type * from './identity/sso/sso-types.mjs';
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAG5B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EACH,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,mBAAmB,yBAAyB,CAAC;AAG7C,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,mBAAmB,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAG5B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EACH,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,mBAAmB,yBAAyB,CAAC;AAG7C,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,mBAAmB,8BAA8B,CAAC"}

package/dist/index.mjs

@@ -14,4 +14,5 @@ export { DEFAULT_EMAIL_CHARSET, EMAIL_MODE_AWS, EMAIL_MODE_MOCK, DEFAULT_AWS_REG
 // identity & SSO custodian infrastructure
 export * from './identity/sso/sso-custodian-service.mjs';
 export * from './identity/sso/sso-config-helper.mjs';
+export * from './identity/sso/custodian-auth-helpers.mjs';
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAE5B,2BAA2B;AAC3B,cAAc,uBAAuB,CAAC;AAEtC,uBAAuB;AACvB,OAAO,EACH,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACrB,MAAM,mBAAmB,CAAC;AAG3B,0CAA0C;AAC1C,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAE5B,2BAA2B;AAC3B,cAAc,uBAAuB,CAAC;AAEtC,uBAAuB;AACvB,OAAO,EACH,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACrB,MAAM,mBAAmB,CAAC;AAG3B,0CAA0C;AAC1C,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC"}

package/dist/serve-gib/handlers/api/email/email-verification-code.handler.d.mts

@@ -11,7 +11,7 @@ export interface EmailMagicLinkHandlerOptions {
 }
 export interface EmailMagicLinkRequestBody {
     email: string;
-    primaryTjpAddr: string;
+    primaryTjpAddr?: string;
     keystone?: any;
 }
 /**

package/dist/serve-gib/handlers/api/email/email-verification-code.handler.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification-code.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/email/email-verification-code.handler.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,WAAW,EAAiB,MAAM,mCAAmC,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAO7D,MAAM,WAAW,4BAA4B;IACzC,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,GAAG,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,mBAAmB;IACjE,UAAmB,EAAE,SAA4C;IACjE,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAA4C;IAEpE,OAAO,CAAC,MAAM,CAAc;IAE5B,YAAY,OAAO,GAAE,4BAAiC,EAuBrD;IAED,UAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAsF3F;CACJ"}
+{"version":3,"file":"email-verification-code.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/email/email-verification-code.handler.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,WAAW,EAAiB,MAAM,mCAAmC,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAQ7D,MAAM,WAAW,4BAA4B;IACzC,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,GAAG,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,mBAAmB;IACjE,UAAmB,EAAE,SAA4C;IACjE,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAA4C;IAEpE,OAAO,CAAC,MAAM,CAAc;IAE5B,YAAY,OAAO,GAAE,4BAAiC,EAuBrD;IAED,UAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CA8F3F;CACJ"}

package/dist/serve-gib/handlers/api/email/email-verification-code.handler.mjs

@@ -9,8 +9,9 @@ import { EmailSenderMock } from '../../../../email/mock/email-sender-mock.mjs';
 import { API_PATH_REGEXES } from '../../../path-constants.mjs';
 import { ServeGibHandlerBase } from '../../handler-base.mjs';
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
-import { generateVerificationCode, getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord } from '../../../../email/verify/email-verify-helpers.mjs';
+import { generateVerificationCode, getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord, savePendingStagingKeystone } from '../../../../email/verify/email-verify-helpers.mjs';
 import { validateEmail } from '../../../../email/email-helpers.mjs';
+import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
 const logalot = GLOBAL_LOG_A_LOT || true;
 /**
  * POST /api/email/verification-code
@@ -77,13 +78,21 @@ export class EmailVerificationCodeHandler extends ServeGibHandlerBase {
             if (!email || !validateEmail(email)) {
                 return this.error(400, 'Invalid email address format (E: e3f4a5b67890123456789abcdef012)');
             }
-            if (!primaryTjpAddr || typeof primaryTjpAddr !== 'string') {
-                return this.error(400, 'primaryTjpAddr is required (E: f4a5b67890123456789abcdef0123)');
-            }
-            const tjpHash = await getPendingTjpHash(primaryTjpAddr);
+            const normEmail = normalizeEmail(email);
+            const effectivePrimaryTjpAddr = primaryTjpAddr || `pending:${normEmail}`;
+            const tjpHash = await getPendingTjpHash(effectivePrimaryTjpAddr);
             const code = generateVerificationCode();
             if (reqCtx.dataDir && tjpHash) {
-                const info = await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash });
+                let info = await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash });
+                if (!info) {
+                    // Create pending staging directory for this email if not yet present
+                    await savePendingStagingKeystone({
+                        dataDir: reqCtx.dataDir,
+                        primaryTjpAddr: effectivePrimaryTjpAddr,
+                        emails: [normEmail],
+                    });
+                    info = await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash });
+                }
                 if (info) {
                     await savePendingCodeRecord({ pendingDir: info.pendingDir, code });
                     if (logalot) {
@@ -91,7 +100,7 @@ export class EmailVerificationCodeHandler extends ServeGibHandlerBase {
                     }
                 }
                 else {
-                    console.warn(`${lc} Pending staging directory not found for tjpHash ${tjpHash}`);
+                    console.warn(`${lc} Failed to create or access pending staging directory for tjpHash ${tjpHash}`);
                 }
             }
             const outboundEmail = {

package/dist/serve-gib/handlers/api/email/email-verification-code.handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification-code.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/email/email-verification-code.handler.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAG5E,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC7J,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAYzC;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,mBAAmB;IAC9C,EAAE,GAAG,IAAI,4BAA4B,CAAC,IAAI,GAAG,CAAC;IAC9C,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,uBAAuB,CAAC;IAE5D,MAAM,CAAc;IAE5B,YAAY,OAAO,GAAiC,EAAE;QAClD,KAAK,EAAE,CAAC;QAER,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACjC,CAAC;aAAM,CAAC;YACJ,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjF,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,CAAC;oBAC7B,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;oBAChD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE;oBACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;iBAChD,CAAC,CAAC;YACP,CAAC;iBAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,IAAI,MAAM,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;gBACrH,CAAC;gBACD,IAAI,CAAC,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,mEAAmE,CAAC,CAAC;YACxH,CAAC;QACL,CAAC;IACL,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,MAAsB;QAClD,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,MAAM,aAAa,GAAG,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;QACpE,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;YAAC,CAAC;YACvF,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,CAAC;YAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;YAC1F,CAAC;YAED,IAAI,IAA+B,CAAC;YACpC,IAAI,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,sEAAsE,CAAC,CAAC;YACnG,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;YAAC,CAAC;YAElE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;YAEvC,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,kEAAkE,CAAC,CAAC;YAC/F,CAAC;YAED,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACxD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+DAA+D,CAAC,CAAC;YAC5F,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAExD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9E,IAAI,IAAI,EAAE,CAAC;oBACP,MAAM,qBAAqB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,IAAI,OAAO,EAAE,CAAC;wBAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,sCAAsC,CAAC,CAAC;oBAAC,CAAC;gBAC5F,CAAC;qBAAM,CAAC;oBACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,oDAAoD,OAAO,EAAE,CAAC,CAAC;gBACrF,CAAC;YACL,CAAC;YAED,MAAM,aAAa,GAAkB;gBACjC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,mBAAmB;gBAC3D,EAAE,EAAE,CAAC,KAAK,CAAC;gBACX,OAAO,EAAE,kCAAkC;gBAC3C,QAAQ,EAAE,2EAA2E,IAAI,oGAAoG;gBAC7L,QAAQ,EAAE;;;4GAGkF,IAAI;;OAEzG;aACM,CAAC;YAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAC9D,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;YAAC,CAAC;YAEvE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qCAAqC,KAAK,OAAO,cAAc,WAAW,UAAU,CAAC,SAAS,wCAAwC,CAAC,CAAC;gBACzJ,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;gBACrD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBACjF,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,+CAA+C,KAAK,KAAK,IAAI,wCAAwC,CAAC,CAAC;gBAC5H,CAAC;gBACD,OAAO,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;YAC7F,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,qCAAqC,UAAU,CAAC,KAAK,wCAAwC,CAAC,CAAC;gBAClH,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,GAAG,EAAE,UAAU,CAAC,KAAK,IAAI,iCAAiC,CAAC,CAAC;YAC3G,CAAC;QAEL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,IAAI,uCAAuC,CAAC,CAAC;YAC/F,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAC/B,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"email-verification-code.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/email/email-verification-code.handler.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAG5E,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AACzL,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AAEpF,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAYzC;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,mBAAmB;IAC9C,EAAE,GAAG,IAAI,4BAA4B,CAAC,IAAI,GAAG,CAAC;IAC9C,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,uBAAuB,CAAC;IAE5D,MAAM,CAAc;IAE5B,YAAY,OAAO,GAAiC,EAAE;QAClD,KAAK,EAAE,CAAC;QAER,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACjC,CAAC;aAAM,CAAC;YACJ,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACjF,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,CAAC;oBAC7B,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;oBAChD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE;oBACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;iBAChD,CAAC,CAAC;YACP,CAAC;iBAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,IAAI,MAAM,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;gBACrH,CAAC;gBACD,IAAI,CAAC,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,mEAAmE,CAAC,CAAC;YACxH,CAAC;QACL,CAAC;IACL,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,MAAsB;QAClD,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,MAAM,aAAa,GAAG,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;QACpE,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;YAAC,CAAC;YACvF,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,CAAC;YAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;YAC1F,CAAC;YAED,IAAI,IAA+B,CAAC;YACpC,IAAI,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,sEAAsE,CAAC,CAAC;YACnG,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;YAAC,CAAC;YAElE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;YAEvC,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,kEAAkE,CAAC,CAAC;YAC/F,CAAC;YAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,uBAAuB,GAAG,cAAc,IAAI,WAAW,SAAS,EAAE,CAAC;YACzE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;YAEjE,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,IAAI,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;oBACR,qEAAqE;oBACrE,MAAM,0BAA0B,CAAC;wBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,cAAc,EAAE,uBAAuB;wBACvC,MAAM,EAAE,CAAC,SAAS,CAAC;qBACtB,CAAC,CAAC;oBACH,IAAI,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBAED,IAAI,IAAI,EAAE,CAAC;oBACP,MAAM,qBAAqB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,IAAI,OAAO,EAAE,CAAC;wBAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,sCAAsC,CAAC,CAAC;oBAAC,CAAC;gBAC5F,CAAC;qBAAM,CAAC;oBACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,qEAAqE,OAAO,EAAE,CAAC,CAAC;gBACtG,CAAC;YACL,CAAC;YAED,MAAM,aAAa,GAAkB;gBACjC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,mBAAmB;gBAC3D,EAAE,EAAE,CAAC,KAAK,CAAC;gBACX,OAAO,EAAE,kCAAkC;gBAC3C,QAAQ,EAAE,2EAA2E,IAAI,oGAAoG;gBAC7L,QAAQ,EAAE;;;4GAGkF,IAAI;;OAEzG;aACM,CAAC;YAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAC9D,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;YAAC,CAAC;YAEvE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,qCAAqC,KAAK,OAAO,cAAc,WAAW,UAAU,CAAC,SAAS,wCAAwC,CAAC,CAAC;gBACzJ,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;gBACrD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBACjF,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,+CAA+C,KAAK,KAAK,IAAI,wCAAwC,CAAC,CAAC;gBAC5H,CAAC;gBACD,OAAO,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;YAC7F,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,qCAAqC,UAAU,CAAC,KAAK,wCAAwC,CAAC,CAAC;gBAClH,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,GAAG,EAAE,UAAU,CAAC,KAAK,IAAI,iCAAiC,CAAC,CAAC;YAC3G,CAAC;QAEL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,IAAI,uCAAuC,CAAC,CAAC;YAC/F,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAC/B,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.d.mts

@@ -0,0 +1,37 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-genesis.handler
+ *
+ * POST /api/identity/custodian/genesis
+ *
+ * Single-turn passwordless onboarding & custodian genesis endpoint.
+ * Returns the primary identity keystone (or primaryTjpAddr) along with a fresh,
+ * single-turn `CustodianRequirements` payload containing `authCode` and single-use `nonce`.
+ */
+import { FlatIbGibGraph } from '@ibgib/core-gib/dist/common/other/graph-types.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
+import { CustodianRequirements } from '../../../../identity/sso/sso-types.mjs';
+export interface CustodianGenesisRequestBody {
+    email: string;
+    code?: string;
+    username?: string;
+}
+export interface CustodianGenesisResponseBody {
+    success: boolean;
+    isNewIdentity: boolean;
+    primaryTjpAddr: string;
+    primaryKeystone?: any;
+    primaryGraph?: FlatIbGibGraph;
+    custodianReqs: CustodianRequirements;
+    message?: string;
+}
+/**
+ * POST /api/identity/custodian/genesis
+ */
+export declare class KeystoneCustodianGenesisHandler extends ServeGibHandlerBase<undefined, undefined> {
+    protected lc: string;
+    protected method: ServeGibHttpMethod;
+    protected regex: RegExp;
+    protected handleRouteImpl(reqCtx: RequestContext<undefined, undefined>): Promise<ResponseResult | undefined>;
+}
+//# sourceMappingURL=keystone-custodian-genesis.handler.d.mts.map

package/dist/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-custodian-genesis.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAMnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAK/E,MAAM,WAAW,2BAA2B;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,aAAa,EAAE,qBAAqB,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;IAC1F,UAAmB,EAAE,EAAE,MAAM,CAA+C;IAC5E,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAA+C;IAEvE,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CA4KrC;CACJ"}

package/dist/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.mjs

@@ -0,0 +1,192 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-genesis.handler
+ *
+ * POST /api/identity/custodian/genesis
+ *
+ * Single-turn passwordless onboarding & custodian genesis endpoint.
+ * Returns the primary identity keystone (or primaryTjpAddr) along with a fresh,
+ * single-turn `CustodianRequirements` payload containing `authCode` and single-use `nonce`.
+ */
+import * as fs from 'node:fs/promises';
+import { extractErrorMsg, hash, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getTjpAddr } from '@ibgib/core-gib/dist/common/other/ibgib-helper.mjs';
+import { getDependencyGraph } from '@ibgib/core-gib/dist/common/other/graph-helper.mjs';
+import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { validateEmail } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
+import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { API_PATH_REGEXES } from '../../../path-constants.mjs';
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
+import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
+import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
+import { generateCustodianRequirements } from '../../../../identity/sso/custodian-auth-helpers.mjs';
+import { getPendingStagingDir, getPendingTjpHash, verifyPendingCode } from '../../../../email/verify/email-verify-helpers.mjs';
+const logalot = GLOBAL_LOG_A_LOT || true;
+/**
+ * POST /api/identity/custodian/genesis
+ */
+export class KeystoneCustodianGenesisHandler extends ServeGibHandlerBase {
+    lc = `[${KeystoneCustodianGenesisHandler.name}]`;
+    method = 'POST';
+    regex = API_PATH_REGEXES.KEYSTONE_CUSTODIAN_GENESIS;
+    async handleRouteImpl(reqCtx) {
+        const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
+        try {
+            if (logalot) {
+                console.log(`${lc} starting... (I: a123456789abcdef0123456789b0001)`);
+            }
+            if (reqCtx.method !== 'POST') {
+                return this.error(405, 'Method Not Allowed');
+            }
+            if (!reqCtx.body) {
+                return this.error(400, 'Request body is empty (E: b123456789abcdef0123456789b0002)');
+            }
+            let body;
+            try {
+                body = JSON.parse(reqCtx.body);
+            }
+            catch {
+                return this.error(400, 'Request body must be valid JSON (E: c123456789abcdef0123456789b0003)');
+            }
+            const { email, username, code } = body;
+            if (!email || !validateEmail(email)) {
+                return this.error(400, 'Invalid email address format (E: d123456789abcdef0123456789b0004)');
+            }
+            const normEmail = normalizeEmail(email);
+            const indexService = getIdentityIndexService();
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const existing = await indexService.lookupIdentityByEmail({ email: normEmail });
+            const effectivePrimaryTjpAddr = existing ? existing.primaryTjpAddr : `pending:${normEmail}`;
+            // Verify 6-digit OTP code if provided or if staging record exists
+            if (code || !existing) {
+                if (!code || typeof code !== 'string' || code.trim().length !== 6) {
+                    return this.error(400, '6-digit verification code is required (E: e123456789abcdef0123456789b0009)');
+                }
+                const tjpHash = await getPendingTjpHash(effectivePrimaryTjpAddr);
+                const pendingInfo = reqCtx.dataDir && tjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash }) : undefined;
+                if (!pendingInfo || pendingInfo.isExpired) {
+                    return this.error(400, 'Verification record missing or expired. Please request a new verification code. (E: f123456789abcdef0123456789b0010)');
+                }
+                const codeVerifyResult = await verifyPendingCode({
+                    pendingDir: pendingInfo.pendingDir,
+                    code,
+                });
+                if (!codeVerifyResult.valid) {
+                    return this.error(400, codeVerifyResult.error || 'Invalid verification code (E: g123456789abcdef0123456789b0011)');
+                }
+            }
+            let primaryTjpAddr;
+            let primaryKeystone;
+            let isNewIdentity = false;
+            if (existing) {
+                // Identity already exists — retrieve primary identity info
+                primaryTjpAddr = existing.primaryTjpAddr;
+                console.log(`${lc} Found existing identity for ${normEmail}: ${primaryTjpAddr} (I: e123456789abcdef0123456789b0005)`);
+                // Bootstrap domain space to fetch primary keystone frame
+                const metaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const space = await metaspace.getLocalUserSpace({ lock: false });
+                if (space) {
+                    const latestAddr = await metaspace.getLatestAddr({ addr: primaryTjpAddr, space }) ?? primaryTjpAddr;
+                    const getRes = await metaspace.get({ addrs: [latestAddr], space });
+                    primaryKeystone = getRes.ibGibs?.[0];
+                }
+            }
+            else {
+                // New custodian identity creation
+                isNewIdentity = true;
+                console.log(`${lc} Creating new custodian primary identity for ${normEmail} (I: f123456789abcdef0123456789b0006)`);
+                const defaultUsername = username || normEmail.split('@')[0];
+                const primaryBuilder = KeystoneProfileBuilder.buildKeystone('sync')
+                    .withUsername(defaultUsername)
+                    .withDescription(`Full Custodian Primary Identity for ${normEmail}`)
+                    .withDetails({
+                    emails: [normEmail],
+                    custodyMode: 'full',
+                });
+                const configs = await primaryBuilder.compileConfigs();
+                const primarySecret = await hash({ s: `${serverSecret}_custodian_${normEmail}` });
+                // Bootstrap temporary domain metaspace to perform genesis
+                const tempMetaspace = await bootstrapDomainMetaspace(`temp^${await getUUID()}`, reqCtx.dataDir);
+                const tempSpace = await tempMetaspace.getLocalUserSpace({ lock: false });
+                if (!tempSpace) {
+                    throw new Error(`Failed to create temp domain space for new primary identity (E: 123456789abcdef0123456789b0007)`);
+                }
+                const keystoneService = new KeystoneService_V1();
+                primaryKeystone = await keystoneService.genesis({
+                    masterSecret: primarySecret,
+                    emails: [normEmail],
+                    frameDetails: primaryBuilder.getFrameDetails(),
+                    configs,
+                    metaspace: tempMetaspace,
+                    space: tempSpace,
+                    isPrimary: true
+                });
+                primaryTjpAddr = getTjpAddr({ ibGib: primaryKeystone, defaultIfNone: 'incomingAddr' });
+                // Bootstrap permanent domain space for primaryTjpAddr and persist primary keystone
+                const metaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const space = await metaspace.getLocalUserSpace({ lock: false });
+                if (!space) {
+                    throw new Error(`Failed to create domain space for new primary identity ${primaryTjpAddr} (E: 123456789abcdef0123456789b0008)`);
+                }
+                await metaspace.put({ ibGibs: [primaryKeystone], space });
+                await metaspace.registerNewIbGib({ ibGib: primaryKeystone, space });
+                // Register in identity reverse index
+                await indexService.registerEmailIndex({
+                    email: normEmail,
+                    primaryTjpAddr
+                });
+                // Clean up pending staging directory if present
+                const tjpHash = await getPendingTjpHash(effectivePrimaryTjpAddr);
+                const pendingInfo = reqCtx.dataDir && tjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash }) : undefined;
+                if (pendingInfo?.pendingDir) {
+                    try {
+                        await fs.rm(pendingInfo.pendingDir, { recursive: true, force: true });
+                    }
+                    catch { }
+                }
+            }
+            // Generate single-turn CustodianRequirements for client delegate registration
+            const custodianReqs = await generateCustodianRequirements({
+                primaryTjpAddr,
+                serverSecret
+            });
+            // Extract complete primary keystone dependency graph
+            let primaryGraph;
+            if (primaryKeystone) {
+                const domainMetaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const domainSpace = await domainMetaspace.getLocalUserSpace({ lock: false });
+                if (domainSpace) {
+                    primaryGraph = await getDependencyGraph({
+                        ibGib: primaryKeystone,
+                        space: domainSpace,
+                        live: false
+                    });
+                }
+            }
+            const responseBody = {
+                success: true,
+                isNewIdentity,
+                primaryTjpAddr,
+                primaryKeystone,
+                primaryGraph,
+                custodianReqs,
+                message: isNewIdentity ? 'Custodian primary identity created.' : 'Custodian identity located.'
+            };
+            return this.ok(responseBody, isNewIdentity ? 201 : 200);
+        }
+        catch (error) {
+            const emsg = extractErrorMsg(error);
+            console.error(`${lc} ${emsg}`);
+            return this.error(500, emsg);
+        }
+        finally {
+            if (logalot) {
+                console.log(`${lc} complete.`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=keystone-custodian-genesis.handler.mjs.map

package/dist/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-custodian-genesis.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAExF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mEAAmE,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,oDAAoD,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AAEpG,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AAE/H,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAkBzC;;GAEG;AACH,MAAM,OAAO,+BAAgC,SAAQ,mBAAyC;IACvE,EAAE,GAAW,IAAI,+BAA+B,CAAC,IAAI,GAAG,CAAC;IACzD,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,0BAA0B,CAAC;IAE7D,KAAK,CAAC,eAAe,CAC3B,MAA4C;QAE5C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;YAAC,CAAC;YAEvF,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,4DAA4D,CAAC,CAAC;YACzF,CAAC;YAED,IAAI,IAAiC,CAAC;YACtC,IAAI,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,sEAAsE,CAAC,CAAC;YACnG,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YACvC,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,mEAAmE,CAAC,CAAC;YAChG,CAAC;YAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,SAAS,CAAC,kBAAkB,CAAC;YAElD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAChF,MAAM,uBAAuB,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,SAAS,EAAE,CAAC;YAE5F,kEAAkE;YAClE,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,4EAA4E,CAAC,CAAC;gBACzG,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;gBACjE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE7H,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;oBACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,sHAAsH,CAAC,CAAC;gBACnJ,CAAC;gBAED,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,CAAC;oBAC7C,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,IAAI;iBACP,CAAC,CAAC;gBAEH,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;oBAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,IAAI,gEAAgE,CAAC,CAAC;gBACvH,CAAC;YACL,CAAC;YAED,IAAI,cAAsB,CAAC;YAC3B,IAAI,eAAgC,CAAC;YACrC,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,IAAI,QAAQ,EAAE,CAAC;gBACX,2DAA2D;gBAC3D,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,SAAS,KAAK,cAAc,uCAAuC,CAAC,CAAC;gBAEtH,yDAAyD;gBACzD,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjE,IAAI,KAAK,EAAE,CAAC;oBACR,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,IAAI,cAAc,CAAC;oBACpG,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBACnE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,kCAAkC;gBAClC,aAAa,GAAG,IAAI,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gDAAgD,SAAS,uCAAuC,CAAC,CAAC;gBAEnH,MAAM,eAAe,GAAG,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,MAAM,cAAc,GAAG,sBAAsB,CAAC,aAAa,CAAC,MAAM,CAAC;qBAC9D,YAAY,CAAC,eAAe,CAAC;qBAC7B,eAAe,CAAC,uCAAuC,SAAS,EAAE,CAAC;qBACnE,WAAW,CAAC;oBACT,MAAM,EAAE,CAAC,SAAS,CAAC;oBACnB,WAAW,EAAE,MAAM;iBACtB,CAAC,CAAC;gBAEP,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,cAAc,SAAS,EAAE,EAAE,CAAC,CAAC;gBAElF,0DAA0D;gBAC1D,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,QAAQ,MAAM,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChG,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;gBACvH,CAAC;gBAED,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBACjD,eAAe,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC;oBAC5C,YAAY,EAAE,aAAa;oBAC3B,MAAM,EAAE,CAAC,SAAS,CAAC;oBACnB,YAAY,EAAE,cAAc,CAAC,eAAe,EAAE;oBAC9C,OAAO;oBACP,SAAS,EAAE,aAAa;oBACxB,KAAK,EAAE,SAAS;oBAChB,SAAS,EAAE,IAAI;iBAClB,CAAC,CAAC;gBAEH,cAAc,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,CAAE,CAAC;gBAExF,mFAAmF;gBACnF,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CAAC,0DAA0D,cAAc,sCAAsC,CAAC,CAAC;gBACpI,CAAC;gBAED,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1D,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEpE,qCAAqC;gBACrC,MAAM,YAAY,CAAC,kBAAkB,CAAC;oBAClC,KAAK,EAAE,SAAS;oBAChB,cAAc;iBACjB,CAAC,CAAC;gBAEH,gDAAgD;gBAChD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;gBACjE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7H,IAAI,WAAW,EAAE,UAAU,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBAAC,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,CAAC;gBAC5F,CAAC;YACL,CAAC;YAED,8EAA8E;YAC9E,MAAM,aAAa,GAAG,MAAM,6BAA6B,CAAC;gBACtD,cAAc;gBACd,YAAY;aACf,CAAC,CAAC;YAEH,qDAAqD;YACrD,IAAI,YAAwC,CAAC;YAC7C,IAAI,eAAe,EAAE,CAAC;gBAClB,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7E,IAAI,WAAW,EAAE,CAAC;oBACd,YAAY,GAAG,MAAM,kBAAkB,CAAC;wBACpC,KAAK,EAAE,eAAe;wBACtB,KAAK,EAAE,WAAW;wBAClB,IAAI,EAAE,KAAK;qBACd,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,MAAM,YAAY,GAAiC;gBAC/C,OAAO,EAAE,IAAI;gBACb,aAAa;gBACb,cAAc;gBACd,eAAe;gBACf,YAAY;gBACZ,aAAa;gBACb,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,6BAA6B;aACjG,CAAC;YAEF,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.d.mts

@@ -0,0 +1,33 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler
+ *
+ * POST /api/identity/custodian/register-delegate
+ *
+ * Validates a client delegate keystone containing single-turn `custodianReqs`,
+ * enforces single-use nonce reservation, verifies cryptographic `authCode`,
+ * evolves the server-held primary identity keystone to link the delegate,
+ * and returns the updated `evolvedPrimaryKeystone`.
+ */
+import { FlatIbGibGraph } from '@ibgib/core-gib/dist/common/other/graph-types.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
+export interface CustodianRegisterDelegateRequestBody {
+    delegateKeystone: any;
+}
+export interface CustodianRegisterDelegateResponseBody {
+    success: boolean;
+    primaryTjpAddr: string;
+    evolvedPrimaryKeystone: any;
+    primaryGraph?: FlatIbGibGraph;
+    message?: string;
+}
+/**
+ * POST /api/identity/custodian/register-delegate
+ */
+export declare class KeystoneCustodianRegisterDelegateHandler extends ServeGibHandlerBase<undefined, undefined> {
+    protected lc: string;
+    protected method: ServeGibHttpMethod;
+    protected regex: RegExp;
+    protected handleRouteImpl(reqCtx: RequestContext<undefined, undefined>): Promise<ResponseResult | undefined>;
+}
+//# sourceMappingURL=keystone-custodian-register-delegate.handler.d.mts.map

package/dist/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-custodian-register-delegate.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAMnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AASxF,MAAM,WAAW,oCAAoC;IACjD,gBAAgB,EAAE,GAAG,CAAC;CACzB;AAED,MAAM,WAAW,qCAAqC;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,GAAG,CAAC;IAC5B,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,wCAAyC,SAAQ,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;IACnG,UAAmB,EAAE,EAAE,MAAM,CAAwD;IACrF,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAAyD;IAEjF,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAyJrC;CACJ"}