@ibgib/node-gib 0.0.15 → 0.0.17

package/dist/serve-gib/index.mjs

@@ -32,6 +32,8 @@ export * from './handlers/api/keystone/keystone-check-email.handler.mjs';
 export * from './handlers/api/keystone/sso-config.handler.mjs';
 export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
 export * from './handlers/api/email/email-verification-code.handler.mjs';
@@ -52,6 +54,8 @@ import { KeystoneCheckEmailHandler } from './handlers/api/keystone/keystone-chec
 import { SsoLinkHandler } from './handlers/api/keystone/sso-link.handler.mjs';
 import { SsoLoginHandler } from './handlers/api/keystone/sso-login.handler.mjs';
 import { SsoConfigHandler } from './handlers/api/keystone/sso-config.handler.mjs';
+import { KeystoneCustodianGenesisHandler } from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+import { KeystoneCustodianRegisterDelegateHandler } from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 import { EmailInboundHandler } from './handlers/api/email/email-inbound.handler.mjs';
 import { EmailOutboundHandler } from './handlers/api/email/email-outbound.handler.mjs';
 import { EmailVerificationCodeHandler } from './handlers/api/email/email-verification-code.handler.mjs';
@@ -73,6 +77,8 @@ export function getStandardServeGibHandlers(opts = {}) {
         new SsoLinkHandler(),
         new SsoLoginHandler(),
         new SsoConfigHandler(),
+        new KeystoneCustodianGenesisHandler(),
+        new KeystoneCustodianRegisterDelegateHandler(),
         new EmailInboundHandler(),
         new EmailOutboundHandler(),
         new EmailVerificationCodeHandler(),

package/dist/serve-gib/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAE5D,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAA4B,EAAE;IAC1E,MAAM,QAAQ,GAAgC;QAC1C,IAAI,aAAa,EAAE;QACnB,IAAI,YAAY,EAAE;QAClB,IAAI,sBAAsB,EAAE;QAC5B,IAAI,qBAAqB,EAAE;QAC3B,IAAI,mBAAmB,EAAE;QACzB,IAAI,kBAAkB,EAAE;QACxB,IAAI,qBAAqB,EAAE;QAC3B,IAAI,yBAAyB,EAAE;QAC/B,IAAI,cAAc,EAAE;QACpB,IAAI,eAAe,EAAE;QACrB,IAAI,gBAAgB,EAAE;QACtB,IAAI,mBAAmB,EAAE;QACzB,IAAI,oBAAoB,EAAE;QAC1B,IAAI,4BAA4B,EAAE;QAClC,IAAI,6BAA6B,EAAE;KACtC,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAE5D,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gEAAgE,CAAC;AAC/E,cAAc,0EAA0E,CAAC;AACzF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gEAAgE,CAAC;AACjH,OAAO,EAAE,wCAAwC,EAAE,MAAM,0EAA0E,CAAC;AACpI,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAA4B,EAAE;IAC1E,MAAM,QAAQ,GAAgC;QAC1C,IAAI,aAAa,EAAE;QACnB,IAAI,YAAY,EAAE;QAClB,IAAI,sBAAsB,EAAE;QAC5B,IAAI,qBAAqB,EAAE;QAC3B,IAAI,mBAAmB,EAAE;QACzB,IAAI,kBAAkB,EAAE;QACxB,IAAI,qBAAqB,EAAE;QAC3B,IAAI,yBAAyB,EAAE;QAC/B,IAAI,cAAc,EAAE;QACpB,IAAI,eAAe,EAAE;QACrB,IAAI,gBAAgB,EAAE;QACtB,IAAI,+BAA+B,EAAE;QACrC,IAAI,wCAAwC,EAAE;QAC9C,IAAI,mBAAmB,EAAE;QACzB,IAAI,oBAAoB,EAAE;QAC1B,IAAI,4BAA4B,EAAE;QAClC,IAAI,6BAA6B,EAAE;KACtC,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/serve-gib/path-constants.d.mts

@@ -106,6 +106,14 @@ export declare const API_PATH_REGEXES: {
      */
     EMAIL_VERIFY: RegExp;
     EMAIL_VERIFY_CODE: RegExp;
+    /**
+     * /api/identity/custodian/genesis
+     */
+    KEYSTONE_CUSTODIAN_GENESIS: RegExp;
+    /**
+     * /api/identity/custodian/register-delegate
+     */
+    KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: RegExp;
 };
 export declare const VALID_STATIC_PATH_REGEX: RegExp;
 //# sourceMappingURL=path-constants.d.mts.map

package/dist/serve-gib/path-constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"path-constants.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAK9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;IACzB;;OAEG;IACH,MAAM;IAEN;;OAEG;IACH,WAAW;IAEX;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,QAAQ;IAER;;OAEG;IACH,aAAa;IAEb;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,eAAe;IAEf;;;;;;;;OAQG;IACH,gBAAgB;IAEhB;;OAEG;IACH,eAAe;IAEf;;OAEG;IACH,oBAAoB;IAEpB;;;;;;;;;;;OAWG;IACH,aAAa;IACb;;OAEG;IACH,OAAO;IACP;;OAEG;IACH,iBAAiB;IACjB;;OAEG;IACH,kBAAkB;IAClB;;OAEG;IACH,mBAAmB;IACnB;;OAEG;IACH,aAAa;IACb;;OAEG;IACH,UAAU;IACV;;OAEG;IACH,uBAAuB;IAEvB;;OAEG;IACH,YAAY;IACZ,iBAAiB;CACpB,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAA4B,CAAC"}
+{"version":3,"file":"path-constants.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAK9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;IACzB;;OAEG;IACH,MAAM;IAEN;;OAEG;IACH,WAAW;IAEX;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,QAAQ;IAER;;OAEG;IACH,aAAa;IAEb;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,eAAe;IAEf;;;;;;;;OAQG;IACH,gBAAgB;IAEhB;;OAEG;IACH,eAAe;IAEf;;OAEG;IACH,oBAAoB;IAEpB;;;;;;;;;;;OAWG;IACH,aAAa;IACb;;OAEG;IACH,OAAO;IACP;;OAEG;IACH,iBAAiB;IACjB;;OAEG;IACH,kBAAkB;IAClB;;OAEG;IACH,mBAAmB;IACnB;;OAEG;IACH,aAAa;IACb;;OAEG;IACH,UAAU;IACV;;OAEG;IACH,uBAAuB;IAEvB;;OAEG;IACH,YAAY;IACZ,iBAAiB;IAEjB;;OAEG;IACH,0BAA0B;IAE1B;;OAEG;IACH,oCAAoC;CACvC,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAA4B,CAAC"}

package/dist/serve-gib/path-constants.mjs

@@ -111,6 +111,14 @@ export const API_PATH_REGEXES = {
      */
     EMAIL_VERIFY: /^\/api\/email\/verify\/?$/,
     EMAIL_VERIFY_CODE: /^\/api\/email\/verify-code\/?$/,
+    /**
+     * /api/identity/custodian/genesis
+     */
+    KEYSTONE_CUSTODIAN_GENESIS: /^\/api\/identity\/custodian\/genesis\/?$/i,
+    /**
+     * /api/identity/custodian/register-delegate
+     */
+    KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: /^\/api\/identity\/custodian\/register-delegate\/?$/i,
 };
 export const VALID_STATIC_PATH_REGEX = /^\/[a-zA-Z0-9\-_\.\/]*$/;
 //# sourceMappingURL=path-constants.mjs.map

package/dist/serve-gib/path-constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"path-constants.mjs","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAO,yBAAyB;IACtC,MAAM,EAAO,uBAAuB;IACpC,IAAI,EAAS,gBAAgB;IAC7B,UAAU,EAAG,wCAAwC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B;;OAEG;IACH,MAAM,EAAE,oBAAoB;IAE5B;;OAEG;IACH,WAAW,EAAE,oFAAoF;IAEjG;;OAEG;IACH,UAAU,EAAE,6EAA6E;IAEzF;;OAEG;IACH,QAAQ,EAAE,sBAAsB;IAEhC;;OAEG;IACH,aAAa,EAAE,mDAAmD;IAElE;;OAEG;IACH,UAAU,EAAE,mBAAmB;IAE/B;;OAEG;IACH,eAAe,EAAE,2DAA2D;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,+BAA+B;IAEjD;;OAEG;IACH,eAAe,EAAE,8BAA8B;IAE/C;;OAEG;IACH,oBAAoB,EAAE,mCAAmC;IAEzD;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,mDAAmD;IAC5D;;OAEG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;OAEG;IACH,kBAAkB,EAAE,kCAAkC;IACtD;;OAEG;IACH,mBAAmB,EAAE,mCAAmC;IACxD;;OAEG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,UAAU,EAAE,yBAAyB;IACrC;;OAEG;IACH,uBAAuB,EAAE,sCAAsC;IAE/D;;OAEG;IACH,YAAY,EAAE,2BAA2B;IACzC,iBAAiB,EAAE,gCAAgC;CACtD,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"path-constants.mjs","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAO,yBAAyB;IACtC,MAAM,EAAO,uBAAuB;IACpC,IAAI,EAAS,gBAAgB;IAC7B,UAAU,EAAG,wCAAwC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B;;OAEG;IACH,MAAM,EAAE,oBAAoB;IAE5B;;OAEG;IACH,WAAW,EAAE,oFAAoF;IAEjG;;OAEG;IACH,UAAU,EAAE,6EAA6E;IAEzF;;OAEG;IACH,QAAQ,EAAE,sBAAsB;IAEhC;;OAEG;IACH,aAAa,EAAE,mDAAmD;IAElE;;OAEG;IACH,UAAU,EAAE,mBAAmB;IAE/B;;OAEG;IACH,eAAe,EAAE,2DAA2D;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,+BAA+B;IAEjD;;OAEG;IACH,eAAe,EAAE,8BAA8B;IAE/C;;OAEG;IACH,oBAAoB,EAAE,mCAAmC;IAEzD;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,mDAAmD;IAC5D;;OAEG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;OAEG;IACH,kBAAkB,EAAE,kCAAkC;IACtD;;OAEG;IACH,mBAAmB,EAAE,mCAAmC;IACxD;;OAEG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,UAAU,EAAE,yBAAyB;IACrC;;OAEG;IACH,uBAAuB,EAAE,sCAAsC;IAE/D;;OAEG;IACH,YAAY,EAAE,2BAA2B;IACzC,iBAAiB,EAAE,gCAAgC;IAEnD;;OAEG;IACH,0BAA0B,EAAE,2CAA2C;IAEvE;;OAEG;IACH,oCAAoC,EAAE,qDAAqD;CAC9F,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC"}

package/e2e/identity-custodian-lifecycle.e2e.md

@@ -0,0 +1,93 @@
+# E2E Test Plan: Full Custodian Passwordless Onboarding & Single-Turn Authorization Ceremony
+
+Tests custodian (passwordless) account creation, add-device.
+
+* **Create Account**: passwordless, Google or custom email
+* **Sign in**: passwordless, Google or custom email
+
+---
+
+## Overview & Execution Model
+
+| Property | Specification |
+| :--- | :--- |
+| **Primary Domain Target** | `https://local.ibgib.space` (Google OAuth callback domain) |
+| **Server Mode** | `EMAIL_MODE=mock` |
+| **Target Audience** | Human QA Testers / Agent Browser Testers |
+
+### Fail-Fast Sequential Lifecycle
+- Executed linearly from **Phase 0 through Phase 3**.
+- If any step in any phase fails, execution halts immediately, and the E2E test run is marked as **FAILED**.
+
+---
+
+## Test Variables
+
+* `<E2E_TEST_GMAIL_ADDRESS_ALICE>` - located in `.env`
+* `<test_url>` - `https://local.ibgib.space`
+
+---
+
+## Sequential Test Phases
+
+### Phase 0: Prerequisites & Environment Setup
+Verify that local Docker services are running, server listens on port 3000, target domain `<test_url>` resolves, server data directory is cleaned, and local browser storage (IndexedDB, LocalStorage, SessionStorage) is cleared.
+
+> [!WARNING]
+> Cleaning the server wipes `<dataDir>/` (`identity_index/`, email hashes, and all registered domain tenancy folders). Do not run server cleaning if active personal testing or long-running server state needs to be preserved!
+
+#### Steps
+1. **Clean and reset local server state**:
+   - Run `npm run clean:space-gib:server` in monorepo root (deletes `.data/` directory and resets email index).
+   - *(Optional UX Tip)*: If using Docker Desktop on Windows, clear the container log terminal view before restarting to eliminate log noise when locating 6-digit verification code log entries.
+   - Run `npm run restart:space-gib` to restart the server with a clean data state, or `npm run docker:space-gib` / `npm run docker:space-gib:d` if not started.
+2. **Confirm server startup log outputs**: (e.g. `[space-gib server] dataDir: /data/ibgib-space` and `[space-gib server] listening on http://0.0.0.0:3000`).
+3. **Open test browser(s)**: Navigate to `<test_url>`.
+4. **Clear browser data for `<test_url>`** (all ibgib data is stored in IndexedDB): Ensure you are you at `<test_url>` -> Open Developer Tools (F12) -> Application -> IndexedDB -> `space_gib_db` -> Delete database, then refresh the browser
+5. **Test Credentials**: Refer to (vcs ignored) `.env` for `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and password.
+
+### Phase 1: First-Time Passwordless Account Creation & Custodian Genesis
+Create a new custodian identity on `<test_url>` using the **Quick / Passwordless** workflow (6-digit OTP email code or Google SSO), verify single-turn `custodianReqs` generation, and confirm local delegate keystone registration.
+
+#### Steps
+1. Open browser to `<test_url>`.
+2. In `<ibgib-identity-header>`, click **Create Account**.
+3. Observe the default **Quick (Passwordless)** tab is selected by default.
+4. Enter email `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and click **Send Code** (or click **Continue with Google**).
+5. Open server console / terminal logs to locate the dispatched 6-digit OTP verification code.
+6. Enter the 6-digit OTP code into the PIN input prompt in the same tab and click **Verify Code**.
+7. Verify API execution:
+   - Client calls `POST /api/identity/custodian/genesis`.
+   - Server returns `isNewIdentity: true`, `primaryTjpAddr`, `primaryKeystone`, and single-turn `custodianReqs`.
+   - Client derives local delegate secret, constructs $K_{\text{delegate}}$, and calls `POST /api/identity/custodian/register-delegate`.
+8. Verify outcomes:
+   - Identity header displays avatar & username (derived from email).
+   - Local browser user space contains $K_{\text{primary}}$ and $K_{\text{delegate}}$.
+   - `<dataDir>/identity_index/email/hashes/` contains the registered email index.
+
+
+### Phase 2: Second-Device Passwordless Sign-In & Device Pairing
+Open a fresh Incognito browser window to `<test_url>`, execute passwordless sign-in for `<E2E_TEST_GMAIL_ADDRESS_ALICE>`, and verify that the server provisions a fresh `custodianReqs` payload and registers a second device delegate ($K_{\text{delegate2}}$).
+
+#### Steps
+1. Open a second browser window (or Incognito window) at `<test_url>`.
+2. Click **Sign In** in `<ibgib-identity-header>`.
+3. Enter the same email address `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and click **Send Code** (or click **Continue with Google**).
+4. Copy the 6-digit OTP code from the server console log and submit it.
+5. Verify API execution:
+   - Server returns `isNewIdentity: false`, existing `primaryTjpAddr`, and fresh single-turn `custodianReqs`.
+   - Second browser constructs its local $K_{\text{delegate2}}$ and registers via `POST /api/identity/custodian/register-delegate`.
+6. Verify outcomes:
+   - Second device successfully pairs and displays user identity header.
+   - Server evolves $K_{\text{primary}} \to K_{\text{primary}, n=2}$ with both device delegates registered in `rel8ns.sync_delegate`.
+
+
+### Phase 3: Single-Turn Nonce Replay Prevention
+Attempt to re-submit a previously consumed `custodianReqs` payload to `POST /api/identity/custodian/register-delegate` and verify that the server kernel atomically rejects the request.
+
+#### Steps
+1. Copy or intercept a `custodianReqs` payload previously consumed in Phase 1 or Phase 2.
+2. Re-submit the same `delegateKeystone` (or identical `custodianReqs` payload) to `POST /api/identity/custodian/register-delegate`.
+3. Verify rejection outcome:
+   - Server rejects the request with **HTTP 409 Conflict**:
+     `"Custodian requirements payload has already been used. Nonce single-turn reservation violation."`

package/e2e/identity-sso-lifecycle.e2e.md

@@ -1,6 +1,12 @@
-# E2E Test Plan: Identity, SSO & Magic Link Lifecycle
+# E2E Test Plan: Identity, SSO & 6-Digit Email Code Lifecycle
 
-This document is the official End-to-End (E2E) browser test plan for the complete identity creation, manual email verification, Google SSO linking, new-device sign-in, and delegate revocation user lifecycle.
+This document is the official End-to-End (E2E) browser test plan for the complete identity creation, 6-digit email OTP verification, Google SSO linking, new-device sign-in, and delegate revocation user lifecycle.
+
+* **Create Account**: Create local/sovereign identity
+* **Verify Email**: 6-digit code
+* **Link SSO**: Google is only OAuth2 provider atow
+* **Sign in**: add device
+* **Revoke delegate**: remove device
 
 ---
 
@@ -18,6 +24,13 @@ This document is the official End-to-End (E2E) browser test plan for the complet
 
 ---
 
+## Test Variables
+
+* `<E2E_TEST_GMAIL_ADDRESS_ALICE>` - located in `.env`
+* `<test_url>` - `https://local.ibgib.space`
+
+---
+
 ## Sequential Test Phases
 
 ### Phase 0: Prerequisites & Environment Setup
@@ -27,14 +40,14 @@ Verify that local Docker services are running, server listens on port 3000, targ
 > Cleaning the server wipes `<dataDir>/` (`identity_index/`, email hashes, and all registered domain tenancy folders). Do not run server cleaning if active personal testing or long-running server state needs to be preserved!
 
 #### Steps
-1. Clean and reset local server state:
+1. **Clean and reset local server state**:
    - Run `npm run clean:space-gib:server` in monorepo root (deletes `.data/` directory and resets email index).
-   - *(Optional UX Tip)*: If using Docker Desktop on Windows, clear the container log terminal view before restarting to eliminate log noise when locating Magic Link URLs.
-   - Run `npm run restart:space-gib` (or `npm run docker:space-gib` / `npm run docker:space-gib:d`) to restart the server with a clean data state.
-2. Confirm server startup log outputs the data directory and listening URI + port (e.g. `[space-gib server] dataDir: /data/ibgib-space` and `[space-gib server] listening on http://0.0.0.0:3000`).
-3. Clear browser storage: Open Developer Tools (F12) -> Application -> Clear Storage -> Click **Clear site data** (clears IndexedDB, LocalStorage, and SessionStorage).
-4. *(Optional Test Credentials)*: Store your test Google OAuth credentials (email/password) in `.env` in the monorepo root (gitignored) for fast copy/paste during manual testing. Never write real credentials in `.md` test specs!
-
+   - *(Optional UX Tip)*: If using Docker Desktop on Windows, clear the container log terminal view before restarting to eliminate log noise when locating 6-digit verification code log entries.
+   - Run `npm run restart:space-gib` to restart the server with a clean data state, or `npm run docker:space-gib` / `npm run docker:space-gib:d` if not started.
+2. **Confirm server startup log outputs**: (e.g. `[space-gib server] dataDir: /data/ibgib-space` and `[space-gib server] listening on http://0.0.0.0:3000`).
+3. **Open test browser(s)**: Navigate to `<test_url>`.
+4. **Clear browser data for `<test_url>`** (all ibgib data is stored in IndexedDB): Ensure you are you at `<test_url>` -> Open Developer Tools (F12) -> Application -> IndexedDB -> `space_gib_db` -> Delete database, then refresh the browser
+5. **Test Credentials**: Refer to (vcs ignored) `.env` for `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and password.
 
 ### Phase 1: Account Creation & Email Verification Code Dispatch
 Create a new identity `alice` with email `<E2E_TEST_GMAIL_ADDRESS_ALICE>` (from `.env`) on `https://local.ibgib.space` and verify that the genesis keystone is quarantined in the `email/pending/` staging directory with `code.json` and Ahead-of-Time (AOT) metadata JSON files.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/node-gib",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "Node and server-specific ibGib code, i.e., things that don't run in the browser.",
   "funding": {
     "type": "individual",
@@ -24,10 +24,10 @@
   "author": "William Raiford",
   "license": "ISC",
   "dependencies": {
-    "@ibgib/helper-gib": "^0.0.36",
-    "@ibgib/ts-gib": "^0.5.33",
-    "@ibgib/core-gib": "^0.1.71",
-    "@ibgib/encrypt-gib": "^0.2.37"
+    "@ibgib/helper-gib": "*",
+    "@ibgib/ts-gib": "*",
+    "@ibgib/core-gib": "*",
+    "@ibgib/encrypt-gib": "*"
   },
   "devDependencies": {
     "@types/node": "^20.2.1"

package/src/identity/sso/custodian-auth-helpers.mts

@@ -0,0 +1,146 @@
+import { getUUID, hash, HashAlgorithm, extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { kdf_recursiveSaltWrap } from '@ibgib/core-gib/dist/keystone/kdf/kdf-helpers.mjs';
+import { KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+
+import { CustodianRequirements } from './sso-types.mjs';
+
+/**
+ * Derives a deterministic single-turn authorization code using the server's private KDF secret
+ * and the JSON-stringified `custodianReqs` (excluding `authCode` itself) as salt.
+ *
+ * @param custodianReqsOmitAuthCode The custodian requirements object omitting the `authCode` property.
+ * @param serverSecret The server's private KDF secret (`SSO_SERVER_KDF_SECRET`).
+ */
+export async function deriveCustodianAuthCode({
+    custodianReqsOmitAuthCode,
+    serverSecret,
+}: {
+    custodianReqsOmitAuthCode: Omit<CustodianRequirements, 'authCode'>;
+    serverSecret: string;
+}): Promise<string> {
+    const lc = `[${deriveCustodianAuthCode.name}]`;
+    try {
+        if (!serverSecret) {
+            throw new Error('serverSecret required for custodian auth code derivation (E: a1b2c3d4e5f67890123456789abcdef0)');
+        }
+
+        const salt = await hash({
+            s: JSON.stringify(custodianReqsOmitAuthCode),
+            algorithm: HashAlgorithm.sha_512
+        });
+
+        return await kdf_recursiveSaltWrap({
+            masterSecret: serverSecret,
+            salt,
+            rounds: 1000,
+            algorithm: HashAlgorithm.sha_512
+        });
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+}
+
+/**
+ * Generates a full `CustodianRequirements` object containing single-turn nonce,
+ * expiration timestamp, permitted verbs, and derived auth code.
+ *
+ * @param primaryTjpAddr Primary identity keystone TJP address (`ib^gib`).
+ * @param ttlMs Time-to-live duration in milliseconds. Defaults to 15 minutes.
+ * @param allowedVerbs Permitted keystone verbs. Defaults to `['sync', 'connect']`.
+ * @param serverSecret The server's private KDF secret (`SSO_SERVER_KDF_SECRET`).
+ */
+export async function generateCustodianRequirements({
+    primaryTjpAddr,
+    ttlMs = 15 * 60 * 1000,
+    allowedVerbs = [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+    serverSecret,
+}: {
+    primaryTjpAddr: string;
+    ttlMs?: number;
+    allowedVerbs?: string[];
+    serverSecret: string;
+}): Promise<CustodianRequirements> {
+    const lc = `[${generateCustodianRequirements.name}]`;
+    try {
+        if (!primaryTjpAddr) {
+            throw new Error('primaryTjpAddr is required to generate custodian requirements (E: b2c3d4e5f67890123456789abcdef01)');
+        }
+        if (!serverSecret) {
+            throw new Error('serverSecret is required to generate custodian requirements (E: c3d4e5f67890123456789abcdef012)');
+        }
+
+        const nonce = await getUUID();
+        const expiresAt = Date.now() + ttlMs;
+
+        const custodianReqsOmitAuthCode: Omit<CustodianRequirements, 'authCode'> = {
+            primaryTjpAddr,
+            nonce,
+            expiresAt,
+            allowedVerbs,
+        };
+
+        const authCode = await deriveCustodianAuthCode({
+            custodianReqsOmitAuthCode,
+            serverSecret
+        });
+
+        return {
+            ...custodianReqsOmitAuthCode,
+            authCode
+        };
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+}
+
+/**
+ * Computes the deterministic index hash (`authCustodianIndex`) over the full `CustodianRequirements` object
+ * used for atomic file reservation tracking on the server filesystem.
+ */
+export async function getAuthCustodianIndex({
+    custodianReqs,
+}: {
+    custodianReqs: CustodianRequirements;
+}): Promise<string> {
+    return await hash({
+        s: JSON.stringify(custodianReqs),
+        algorithm: HashAlgorithm.sha_256
+    });
+}
+
+/**
+ * Cryptographically verifies a `CustodianRequirements` object against expiration and server KDF authCode match.
+ */
+export async function verifyCustodianRequirements({
+    custodianReqs,
+    serverSecret,
+}: {
+    custodianReqs: CustodianRequirements;
+    serverSecret: string;
+}): Promise<{ valid: boolean; error?: string }> {
+    try {
+        if (!custodianReqs || !custodianReqs.authCode || !custodianReqs.nonce || !custodianReqs.expiresAt || !custodianReqs.primaryTjpAddr) {
+            return { valid: false, error: 'Malformed custodian requirements structure. (E: d4e5f67890123456789abcdef0123)' };
+        }
+
+        if (Date.now() > custodianReqs.expiresAt) {
+            return { valid: false, error: 'Custodian requirements have expired. (E: e5f67890123456789abcdef01234)' };
+        }
+
+        const { authCode, ...custodianReqsOmitAuthCode } = custodianReqs;
+        const expectedAuthCode = await deriveCustodianAuthCode({
+            custodianReqsOmitAuthCode,
+            serverSecret
+        });
+
+        if (authCode !== expectedAuthCode) {
+            return { valid: false, error: 'Cryptographic authCode mismatch. Requirement payload tampered or invalid. (E: f67890123456789abcdef012345)' };
+        }
+
+        return { valid: true };
+    } catch (error) {
+        return { valid: false, error: `Verification failed: ${extractErrorMsg(error)} (E: 7890123456789abcdef0123456)` };
+    }
+}

package/src/identity/sso/custodian-auth-helpers.respec.mts

@@ -0,0 +1,97 @@
+import {
+    respecfully,
+    iReckon,
+    ifWe
+} from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+
+import {
+    deriveCustodianAuthCode,
+    generateCustodianRequirements,
+    getAuthCustodianIndex,
+    verifyCustodianRequirements
+} from './custodian-auth-helpers.mjs';
+
+const maam = `[${import.meta.url}]`, sir = maam;
+
+await respecfully(sir, 'CustodianAuthHelpers', async () => {
+    const serverSecret = 'test-server-kdf-secret-123456789';
+    const primaryTjpAddr = 'keystone^1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef';
+
+    await ifWe(sir, 'generate custodian requirements cleanly with derived auth code', async () => {
+        const reqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+            ttlMs: 60 * 1000,
+            allowedVerbs: ['sync', 'connect']
+        });
+
+        iReckon(sir, reqs).not.isGonnaBeUndefined();
+        iReckon(sir, reqs.primaryTjpAddr).isGonnaBe(primaryTjpAddr);
+        iReckon(sir, reqs.allowedVerbs).willEqual(['sync', 'connect']);
+        iReckon(sir, reqs.nonce.length > 10).isGonnaBeTrue();
+        iReckon(sir, reqs.authCode.length > 20).isGonnaBeTrue();
+        iReckon(sir, reqs.expiresAt > Date.now()).isGonnaBeTrue();
+    });
+
+    await ifWe(sir, 'verify valid custodian requirements successfully', async () => {
+        const reqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+        });
+
+        const verifyRes = await verifyCustodianRequirements({
+            custodianReqs: reqs,
+            serverSecret
+        });
+
+        iReckon(sir, verifyRes.valid).isGonnaBeTrue();
+        iReckon(sir, verifyRes.error).isGonnaBeUndefined();
+    });
+
+    await ifWe(sir, 'fail verification if payload or authCode is tampered', async () => {
+        const reqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+        });
+
+        // Tamper with allowedVerbs
+        const tamperedReqs = { ...reqs, allowedVerbs: ['sync', 'connect', 'manage'] };
+
+        const verifyRes = await verifyCustodianRequirements({
+            custodianReqs: tamperedReqs,
+            serverSecret
+        });
+
+        iReckon(sir, verifyRes.valid).isGonnaBeFalse();
+        iReckon(sir, verifyRes.error).includes('mismatch');
+    });
+
+    await ifWe(sir, 'fail verification if requirements are expired', async () => {
+        const expiredReqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+            ttlMs: -1000 // expired 1s ago
+        });
+
+        const verifyRes = await verifyCustodianRequirements({
+            custodianReqs: expiredReqs,
+            serverSecret
+        });
+
+        iReckon(sir, verifyRes.valid).isGonnaBeFalse();
+        iReckon(sir, verifyRes.error).includes('expired');
+    });
+
+    await ifWe(sir, 'calculate deterministic authCustodianIndex for atomic file reservation', async () => {
+        const reqs = await generateCustodianRequirements({
+            primaryTjpAddr,
+            serverSecret,
+        });
+
+        const index1 = await getAuthCustodianIndex({ custodianReqs: reqs });
+        const index2 = await getAuthCustodianIndex({ custodianReqs: reqs });
+
+        iReckon(sir, index1).isGonnaBe(index2);
+        iReckon(sir, index1.length).isGonnaBe(64); // SHA-256 hash length
+    });
+});

package/src/identity/sso/sso-types.mts

@@ -42,3 +42,39 @@ export interface OAuthUserInfo {
     name?: string;
     picture?: string;
 }
+
+/**
+ * Single-turn authorization requirements object issued by the custodian server
+ * after successful passwordless SSO/Email authentication.
+ *
+ * Placed in `delegateKeystone.data.frameDetails.custodianReqs` when registering
+ * a client delegate keystone via passwordless onboarding.
+ */
+export interface CustodianRequirements {
+    /**
+     * The primary identity keystone TJP address (`ib^gib`) to which the delegate keystone will be registered.
+     * Prevents Man-In-The-Middle reuse of authorization requirements across different primary identities.
+     */
+    primaryTjpAddr: string;
+
+    /**
+     * High-entropy, single-turn random nonce generated by the server.
+     * Prevents replay attacks when registering delegate keystones.
+     */
+    nonce: string;
+
+    /**
+     * Single-turn authorization code computed by the server over `Omit<CustodianRequirements, 'authCode'>`.
+     */
+    authCode: string;
+
+    /**
+     * Expiration timestamp in epoch milliseconds after which this requirements object is invalid.
+     */
+    expiresAt: number;
+
+    /**
+     * Explicit list of permitted keystone verbs allowed for the delegate keystone (e.g., `['sync', 'connect']`).
+     */
+    allowedVerbs: string[];
+}

package/src/index.mts

@@ -50,5 +50,6 @@ export type * from './email/email-types.mjs';
 // identity & SSO custodian infrastructure
 export * from './identity/sso/sso-custodian-service.mjs';
 export * from './identity/sso/sso-config-helper.mjs';
+export * from './identity/sso/custodian-auth-helpers.mjs';
 export type * from './identity/sso/sso-types.mjs';
 

package/src/serve-gib/handlers/api/email/email-verification-code.handler.mts

@@ -13,8 +13,9 @@ import { API_PATH_REGEXES } from '../../../path-constants.mjs';
 import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
 import { ServeGibHandlerBase } from '../../handler-base.mjs';
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
-import { generateVerificationCode, getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord } from '../../../../email/verify/email-verify-helpers.mjs';
+import { generateVerificationCode, getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord, savePendingStagingKeystone } from '../../../../email/verify/email-verify-helpers.mjs';
 import { validateEmail } from '../../../../email/email-helpers.mjs';
+import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT || true;
 
@@ -24,7 +25,7 @@ export interface EmailMagicLinkHandlerOptions {
 
 export interface EmailMagicLinkRequestBody {
     email: string;
-    primaryTjpAddr: string;
+    primaryTjpAddr?: string;
     keystone?: any;
 }
 
@@ -94,20 +95,28 @@ export class EmailVerificationCodeHandler extends ServeGibHandlerBase {
                 return this.error(400, 'Invalid email address format (E: e3f4a5b67890123456789abcdef012)');
             }
 
-            if (!primaryTjpAddr || typeof primaryTjpAddr !== 'string') {
-                return this.error(400, 'primaryTjpAddr is required (E: f4a5b67890123456789abcdef0123)');
-            }
-
-            const tjpHash = await getPendingTjpHash(primaryTjpAddr);
+            const normEmail = normalizeEmail(email);
+            const effectivePrimaryTjpAddr = primaryTjpAddr || `pending:${normEmail}`;
+            const tjpHash = await getPendingTjpHash(effectivePrimaryTjpAddr);
 
             const code = generateVerificationCode();
             if (reqCtx.dataDir && tjpHash) {
-                const info = await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash });
+                let info = await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash });
+                if (!info) {
+                    // Create pending staging directory for this email if not yet present
+                    await savePendingStagingKeystone({
+                        dataDir: reqCtx.dataDir,
+                        primaryTjpAddr: effectivePrimaryTjpAddr,
+                        emails: [normEmail],
+                    });
+                    info = await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash });
+                }
+
                 if (info) {
                     await savePendingCodeRecord({ pendingDir: info.pendingDir, code });
                     if (logalot) { console.timeLog(timestampUUID, 'code record saved to pending staging'); }
                 } else {
-                    console.warn(`${lc} Pending staging directory not found for tjpHash ${tjpHash}`);
+                    console.warn(`${lc} Failed to create or access pending staging directory for tjpHash ${tjpHash}`);
                 }
             }