@ibgib/node-gib 0.0.15 → 0.0.18

package/dist/serve-gib/handlers/api/keystone/sso-login.handler.mjs

@@ -1,14 +1,24 @@
-import { createHmac } from 'node:crypto';
-import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+/**
+ * @module serve-gib/handlers/api/keystone/sso-login.handler
+ *
+ * POST /api/identity/sso/login
+ *
+ * Handles OAuth2 SSO code exchange (Google, GitHub, etc.).
+ * Retrieves verified email, looks up or provisions the custodian primary identity keystone,
+ * generates a fresh single-turn `CustodianRequirements` payload, and returns it to the client.
+ */
+import { extractErrorMsg, hash, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getTjpAddr } from '@ibgib/core-gib/dist/common/other/ibgib-helper.mjs';
+import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { API_PATH_REGEXES } from '../../../path-constants.mjs';
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
 import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
 import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
-import { KEYSTONE_VERB_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
-import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs';
 import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
-import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
-import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
-import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
-import { API_PATH_REGEXES } from '../../../path-constants.mjs';
+import { generateCustodianRequirements } from '../../../../identity/sso/custodian-auth-helpers.mjs';
 const logalot = GLOBAL_LOG_A_LOT;
 let custodian;
 function getCustodian() {
@@ -18,45 +28,17 @@ function getCustodian() {
     }
     return custodian;
 }
-function signSessionToken(payload, secret) {
-    const header = { alg: 'HS256', typ: 'JWT' };
-    const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
-    const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
-    const data = `${headerB64}.${payloadB64}`;
-    const signature = createHmac('sha256', secret).update(data).digest('base64url');
-    return `${data}.${signature}`;
-}
 /**
  * POST /api/identity/sso/login
- *
- * Exposes login endpoint for SSO authentication. Verifies provider identity, asserts
- * that the deterministic server-delegate keystone is registered in the parent keystone,
- * and yields a secure HttpOnly session token.
  */
-export class SsoLoginHandler extends ServeGibHandlerWithMetaspaceBase {
+export class SsoLoginHandler extends ServeGibHandlerBase {
     lc = `[${SsoLoginHandler.name}]`;
     method = 'POST';
     regex = API_PATH_REGEXES.IDENTITY_SSO_LOGIN;
-    async parseParamsImpl(reqCtx) {
-        let parsed;
-        try {
-            parsed = JSON.parse(reqCtx.body);
-        }
-        catch {
-            return { parentTjpAddr: undefined, domainInfo: undefined };
-        }
-        const parentTjpAddr = parsed?.parentTjpAddr;
-        return {
-            parentTjpAddr,
-            domainInfo: parentTjpAddr ? this.getDomainInfo({ domainAddr: parentTjpAddr }) : undefined
-        };
-    }
-    async initConcreteContext(reqCtx) {
-        if (reqCtx.params?.domainInfo) {
-            await this.initAndPopulateDomainContext(reqCtx);
-        }
+    async parseParamsImpl() {
+        return undefined;
     }
-    async validateQueryParams({ queryParams }) {
+    async validateQueryParams() {
         return [];
     }
     async handleRouteImpl(reqCtx) {
@@ -65,118 +47,113 @@ export class SsoLoginHandler extends ServeGibHandlerWithMetaspaceBase {
             if (logalot) {
                 console.log(`${lc} starting... (I: 9b5d2a3c4e5f67890a1b2c3d4e5f6789)`);
             }
+            if (reqCtx.method !== 'POST') {
+                return this.error(405, 'Method Not Allowed');
+            }
+            if (!reqCtx.body) {
+                return this.error(400, 'Request body is empty (E: 0a1b2c3d4e5f67890a1b2c3d4e5f6789)');
+            }
             let parsed;
             try {
                 parsed = JSON.parse(reqCtx.body);
             }
             catch {
-                return this.error(400, 'Request body must be valid JSON (E: 0a1b2c3d4e5f67890a1b2c3d4e5f6789)');
+                return this.error(400, 'Request body must be valid JSON (E: 1a1b2c3d4e5f67890a1b2c3d4e5f6789)');
             }
-            const { code, providerId, userNonce, redirectUri } = parsed;
-            let parentTjpAddr = parsed?.parentTjpAddr;
-            if (!code || !providerId || !userNonce || !redirectUri) {
-                return this.error(400, 'Body missing required parameters (code, providerId, userNonce, redirectUri) (E: 1b2c3d4e5f678901b2c3d4e5f6789012)');
+            const { code, providerId, redirectUri } = parsed;
+            if (!code || !providerId || !redirectUri) {
+                return this.error(400, 'Body missing required parameters (code, providerId, redirectUri) (E: 2b2c3d4e5f678901b2c3d4e5f6789012)');
             }
-            // 1. Authenticate with provider and retrieve user info
+            // 1. Authenticate code with provider and retrieve normalized user info
             const service = getCustodian();
             const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
-            let resolvedParentTjpAddr = parentTjpAddr;
-            if (!resolvedParentTjpAddr) {
-                if (!userInfo.email) {
-                    return this.error(404, 'No email returned from SSO provider to perform identity lookup. (E: 2c3d4e5f67890123c4d5e6f789012345)');
-                }
-                const lookup = await getIdentityIndexService().lookupIdentityByEmail({
-                    email: userInfo.email,
-                });
-                if (!lookup || !lookup.primaryTjpAddr) {
-                    return this.error(404, `No identity found linked to email ${userInfo.email} (E: 3d4e5f6789012345d6e7f89012345678)`);
-                }
-                resolvedParentTjpAddr = lookup.primaryTjpAddr;
-            }
-            // Ensure metaspace is initialized with resolvedParentTjpAddr
-            if (!reqCtx.metaspace) {
-                reqCtx.metaspace = await bootstrapDomainMetaspace(resolvedParentTjpAddr, reqCtx.dataDir);
-            }
-            const space = await reqCtx.metaspace.getLocalUserSpace({ lock: false });
-            if (!space) {
-                return this.error(500, 'No local user space found in domain metaspace (E: 4e5f678901234567e8f9012345678901)');
-            }
-            // 2. Derive custodian secret using providerKey and userNonce
-            const custodianSecret = await service.deriveServerDelegateSecret(userInfo.providerKey, userNonce);
-            // 3. Fetch latest parent keystone from metaspace
-            const latestParentAddr = await reqCtx.metaspace.getLatestAddr({ addr: resolvedParentTjpAddr, space });
-            if (!latestParentAddr) {
-                return this.error(404, `Parent identity keystone not found for address: ${resolvedParentTjpAddr} (E: 5f67890123456789f0a1b23456789012)`);
+            if (!userInfo || !userInfo.email) {
+                return this.error(400, `No email address returned from SSO provider ${providerId} (E: 3c3d4e5f67890123c4d5e6f789012345)`);
             }
-            const resGet = await reqCtx.metaspace.get({ addr: latestParentAddr, space });
-            const parentKeystone = resGet.ibGibs?.[0];
-            if (!parentKeystone) {
-                return this.error(404, `Parent identity keystone not found in space for address: ${latestParentAddr} (E: 6078901234567890a1b2c34567890123)`);
+            const email = userInfo.email.trim().toLowerCase();
+            const username = userInfo.name || email.split('@')[0];
+            // 2. Check if primary identity exists for this email
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const primarySecret = await hash({ s: `${serverSecret}_custodian_${email}` });
+            const indexService = getIdentityIndexService();
+            const existingLookup = await indexService.lookupIdentityByEmail({ email });
+            let primaryTjpAddr;
+            let primaryKeystone;
+            let isNewIdentity = false;
+            if (existingLookup && existingLookup.primaryTjpAddr) {
+                // Existing identity
+                primaryTjpAddr = existingLookup.primaryTjpAddr;
+                const domainMetaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const space = await domainMetaspace.getLocalUserSpace({ lock: false });
+                const latestPrimaryAddr = await domainMetaspace.getLatestAddr({ addr: primaryTjpAddr, space: space }) ?? primaryTjpAddr;
+                const getRes = await domainMetaspace.get({ addrs: [latestPrimaryAddr], space: space });
+                primaryKeystone = getRes.ibGibs?.[0];
             }
-            // 4. Resolve the custodian pool from the parent keystone using dynamic poolId
-            const targetPoolId = `custodian-manage-${providerId}`;
-            const custodianPool = parentKeystone.data?.challengePools?.find((p) => p.id === targetPoolId);
-            if (!custodianPool) {
-                return this.error(401, `Unauthorized: Custodian pool '${targetPoolId}' is not registered in the parent identity keystone. (E: 7189012345678901b2c3d45678901234)`);
-            }
-            // 5. Assert allowed verbs contain KEYSTONE_VERB_MANAGE
-            const allowedVerbs = custodianPool.config.allowedVerbs || [];
-            if (!allowedVerbs.includes(KEYSTONE_VERB_MANAGE)) {
-                return this.error(401, `Unauthorized: Custodian pool does not have the required manage permission. (E: 8290123456789012c3d4e56789012345)`);
-            }
-            // 6. Cryptographically verify the custodian secret against the pool's challenges
-            const strategy = KeystoneStrategyFactory.create({ config: custodianPool.config });
-            const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
-            for (const [id, challenge] of Object.entries(custodianPool.challenges)) {
-                const solution = await strategy.generateSolution({
-                    poolSecret,
-                    poolId: custodianPool.id,
-                    challengeId: id
-                });
-                const hashValue = await strategy.generateChallenge({ solution });
-                if (hashValue.hash !== challenge.hash) {
-                    return this.error(401, 'Unauthorized: Cryptographic verification of custodian pool challenges failed. (E: 9301234567890123d4e5f67890123456)');
+            else {
+                // First-time custodian identity creation
+                isNewIdentity = true;
+                const tempId = await getUUID();
+                const tempDomainMetaspace = await bootstrapDomainMetaspace(`temp^${tempId}`, reqCtx.dataDir);
+                const tempSpace = await tempDomainMetaspace.getLocalUserSpace({ lock: false });
+                const primaryProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_PRIMARY;
+                if (!primaryProfileName || !primaryProfileName.trim()) {
+                    throw new Error('KEYSTONE_PROFILE_CUSTODIAN_PRIMARY environment variable is missing. Expected valid profile name like "primary-profile.dev" or "primary-profile.prod". (E: 2b3c4d5e6f7890123456789abcdef2)');
                 }
+                const primaryBuilder = KeystoneProfileBuilder.buildKeystone(primaryProfileName.trim())
+                    .withUsername(username)
+                    .withEmails([email])
+                    .withDetails({
+                    client: 'space-gib-server',
+                    role: 'custodian-primary',
+                    custodianProvider: providerId,
+                });
+                const configs = await primaryBuilder.compileConfigs();
+                const keystoneService = new KeystoneService_V1();
+                primaryKeystone = await keystoneService.genesis({
+                    masterSecret: primarySecret,
+                    emails: [email],
+                    frameDetails: primaryBuilder.getFrameDetails(),
+                    configs,
+                    metaspace: tempDomainMetaspace,
+                    space: tempSpace,
+                    isPrimary: true
+                });
+                primaryTjpAddr = getTjpAddr({ ibGib: primaryKeystone, defaultIfNone: 'incomingAddr' });
+                // Persist into permanent domain space & register index
+                const permanentMetaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const permanentSpace = await permanentMetaspace.getLocalUserSpace({ lock: false });
+                await permanentMetaspace.put({ ibGibs: [primaryKeystone], space: permanentSpace });
+                await permanentMetaspace.registerNewIbGib({ ibGib: primaryKeystone, space: permanentSpace });
+                await indexService.registerEmailIndex({
+                    email,
+                    primaryTjpAddr
+                });
             }
-            // Fetch domain graph to return in response
-            const domainGraph = await reqCtx.metaspace.getDependencyGraph({
-                ibGibAddr: latestParentAddr,
-                live: false,
-                space,
+            // 3. Generate single-turn custodian requirements payload
+            const custodianReqs = await generateCustodianRequirements({
+                primaryTjpAddr,
+                serverSecret
             });
-            // 7. Issue secure HttpOnly session cookie
-            const sessionPayload = {
-                parentTjpAddr: resolvedParentTjpAddr,
-                providerKey: userInfo.providerKey,
-                exp: Math.floor(Date.now() / 1000) + 24 * 3600 // 24-hour expiration
-            };
-            const config = loadSsoServerConfig();
-            const sessionToken = signSessionToken(sessionPayload, config.sessionSecret);
-            const headers = {
-                'Set-Cookie': `space_gib_session=${sessionToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`
-            };
-            console.log(`${lc} login successful for parent: ${resolvedParentTjpAddr}, custodian providerKey: ${userInfo.providerKey} (I: 0412345678901234e5f6a78901234567)`);
-            return {
-                status: 200,
-                headers,
-                body: {
-                    success: true,
-                    parentTjpAddr: resolvedParentTjpAddr,
-                    domainGraph,
-                    token: sessionToken,
-                    custodianPoolId: custodianPool.id
-                },
-                isJson: true
+            const responseBody = {
+                success: true,
+                isNewIdentity,
+                primaryTjpAddr,
+                primaryKeystone,
+                custodianReqs,
+                userInfo,
+                message: isNewIdentity ? 'Created new custodian identity via SSO' : 'Looked up existing custodian identity via SSO'
             };
+            return this.ok(responseBody, 200);
         }
         catch (error) {
             const emsg = extractErrorMsg(error);
-            console.error(`${lc} Login failed: ${emsg} (E: 1523456789012345f6a7b89012345678)`);
-            return this.error(500, `Login failed: ${emsg} (E: 2634567890123456a7b8c90123456789)`);
+            console.error(`${lc} SSO login failed: ${emsg} (E: 4d5e6f7890123456e7f8901234567890)`);
+            return this.error(500, `SSO login failed: ${emsg}`);
         }
         finally {
             if (logalot) {
-                console.log(`${lc} complete. (I: 3745678901234567b8c9d01234567890)`);
+                console.log(`${lc} complete.`);
             }
         }
     }

package/dist/serve-gib/handlers/api/keystone/sso-login.handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sso-login.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/sso-login.handler.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAEzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/D,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC,IAAI,SAA0C,CAAC;AAC/C,SAAS,YAAY;IACjB,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAY,EAAE,MAAc;IAClD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChF,OAAO,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;AAClC,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,gCAAkD;IAChE,EAAE,GAAW,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,kBAAkB,CAAC;IAE5C,KAAK,CAAC,eAAe,CAAC,MAAwC;QAC7E,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAgB,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,CAAC;QAC5C,OAAO;YACH,aAAa;YACb,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAE,SAAiB;SACrG,CAAC;IACN,CAAC;IAEkB,KAAK,CAAC,mBAAmB,CAAC,MAAwC;QACjF,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAwB;QAC9E,OAAO,EAAE,CAAC;IACd,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,MAAmC;QAC/D,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,IAAI,MAAiB,CAAC;YACtB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uEAAuE,CAAC,CAAC;YACpG,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;YAC5D,IAAI,aAAa,GAAG,MAAM,EAAE,aAAa,CAAC;YAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,mHAAmH,CAAC,CAAC;YAChJ,CAAC;YAED,uDAAuD;YACvD,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAE/E,IAAI,qBAAqB,GAAG,aAAa,CAAC;YAC1C,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;oBAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uGAAuG,CAAC,CAAC;gBACpI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAC,qBAAqB,CAAC;oBACjE,KAAK,EAAE,QAAQ,CAAC,KAAK;iBACxB,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qCAAqC,QAAQ,CAAC,KAAK,wCAAwC,CAAC,CAAC;gBACxH,CAAC;gBACD,qBAAqB,GAAG,MAAM,CAAC,cAAc,CAAC;YAClD,CAAC;YAED,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,CAAC,SAAS,GAAG,MAAM,wBAAwB,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7F,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qFAAqF,CAAC,CAAC;YAClH,CAAC;YAED,6DAA6D;YAC7D,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAElG,iDAAiD;YACjD,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC;YACtG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,mDAAmD,qBAAqB,wCAAwC,CAAC,CAAC;YAC7I,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,4DAA4D,gBAAgB,wCAAwC,CAAC,CAAC;YACjJ,CAAC;YAED,8EAA8E;YAC9E,MAAM,YAAY,GAAG,oBAAoB,UAAU,EAAE,CAAC;YACtD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YACnG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,iCAAiC,YAAY,4FAA4F,CAAC,CAAC;YACtK,CAAC;YAED,uDAAuD;YACvD,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;YAC7D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,kHAAkH,CAAC,CAAC;YAC/I,CAAC;YAED,iFAAiF;YACjF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;YAClF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;YAEtF,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC;oBAC7C,UAAU;oBACV,MAAM,EAAE,aAAa,CAAC,EAAE;oBACxB,WAAW,EAAE,EAAE;iBAClB,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjE,IAAI,SAAS,CAAC,IAAI,KAAM,SAAiB,CAAC,IAAI,EAAE,CAAC;oBAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qHAAqH,CAAC,CAAC;gBAClJ,CAAC;YACL,CAAC;YAED,2CAA2C;YAC3C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;gBAC1D,SAAS,EAAE,gBAAgB;gBAC3B,IAAI,EAAE,KAAK;gBACX,KAAK;aACR,CAAC,CAAC;YAEH,0CAA0C;YAC1C,MAAM,cAAc,GAAG;gBACnB,aAAa,EAAE,qBAAqB;gBACpC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,qBAAqB;aACvE,CAAC;YAEF,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,YAAY,GAAG,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAE5E,MAAM,OAAO,GAAG;gBACZ,YAAY,EAAE,qBAAqB,YAAY,oDAAoD;aACtG,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,qBAAqB,4BAA4B,QAAQ,CAAC,WAAW,wCAAwC,CAAC,CAAC;YAEjK,OAAO;gBACH,MAAM,EAAE,GAAG;gBACX,OAAO;gBACP,IAAI,EAAE;oBACF,OAAO,EAAE,IAAI;oBACb,aAAa,EAAE,qBAAqB;oBACpC,WAAW;oBACX,KAAK,EAAE,YAAY;oBACnB,eAAe,EAAE,aAAa,CAAC,EAAE;iBACpC;gBACD,MAAM,EAAE,IAAI;aACf,CAAC;QAEN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,IAAI,wCAAwC,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,IAAI,wCAAwC,CAAC,CAAC;QAC1F,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAC;YAAC,CAAC;QAC1F,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"sso-login.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/sso-login.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mEAAmE,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AAEpG,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC,IAAI,SAA0C,CAAC;AAC/C,SAAS,YAAY;IACjB,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAkBD;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,mBAAyC;IACvD,EAAE,GAAW,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,kBAAkB,CAAC;IAE5C,KAAK,CAAC,eAAe;QACpC,OAAO,SAAS,CAAC;IACrB,CAAC;IAEkB,KAAK,CAAC,mBAAmB;QACxC,OAAO,EAAE,CAAC;IACd,CAAC;IAES,KAAK,CAAC,eAAe,CAC3B,MAA4C;QAE5C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;YAC1F,CAAC;YAED,IAAI,MAAoB,CAAC;YACzB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uEAAuE,CAAC,CAAC;YACpG,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,wGAAwG,CAAC,CAAC;YACrI,CAAC;YAED,uEAAuE;YACvE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAE/E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+CAA+C,UAAU,wCAAwC,CAAC,CAAC;YAC9H,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtD,qDAAqD;YACrD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,SAAS,CAAC,kBAAkB,CAAC;YAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,cAAc,KAAK,EAAE,EAAE,CAAC,CAAC;YAE9E,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAE3E,IAAI,cAAsB,CAAC;YAC3B,IAAI,eAAoB,CAAC;YACzB,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,IAAI,cAAc,IAAI,cAAc,CAAC,cAAc,EAAE,CAAC;gBAClD,oBAAoB;gBACpB,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC;gBAC/C,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEvE,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,IAAI,cAAc,CAAC;gBACzH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,CAAC;gBACxF,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACJ,yCAAyC;gBACzC,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC/B,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CAAC,QAAQ,MAAM,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7F,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAE/E,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;gBAC1E,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CAAC,2LAA2L,CAAC,CAAC;gBACjN,CAAC;gBAED,MAAM,cAAc,GAAG,sBAAsB,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,EAAS,CAAC;qBACxF,YAAY,CAAC,QAAQ,CAAC;qBACtB,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC;qBACnB,WAAW,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,IAAI,EAAE,mBAAmB;oBACzB,iBAAiB,EAAE,UAAU;iBAChC,CAAC,CAAC;gBAEP,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBACjD,eAAe,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC;oBAC5C,YAAY,EAAE,aAAa;oBAC3B,MAAM,EAAE,CAAC,KAAK,CAAC;oBACf,YAAY,EAAE,cAAc,CAAC,eAAe,EAAE;oBAC9C,OAAO;oBACP,SAAS,EAAE,mBAAmB;oBAC9B,KAAK,EAAE,SAAU;oBACjB,SAAS,EAAE,IAAI;iBAClB,CAAC,CAAC;gBAEH,cAAc,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,CAAE,CAAC;gBAExF,uDAAuD;gBACvD,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC1F,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEnF,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,cAAe,EAAE,CAAC,CAAC;gBACpF,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAe,EAAE,CAAC,CAAC;gBAE9F,MAAM,YAAY,CAAC,kBAAkB,CAAC;oBAClC,KAAK;oBACL,cAAc;iBACjB,CAAC,CAAC;YACP,CAAC;YAED,yDAAyD;YACzD,MAAM,aAAa,GAAG,MAAM,6BAA6B,CAAC;gBACtD,cAAc;gBACd,YAAY;aACf,CAAC,CAAC;YAEH,MAAM,YAAY,GAAyB;gBACvC,OAAO,EAAE,IAAI;gBACb,aAAa;gBACb,cAAc;gBACd,eAAe;gBACf,aAAa;gBACb,QAAQ;gBACR,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,+CAA+C;aACtH,CAAC;YAEF,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,IAAI,wCAAwC,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/index.d.mts

@@ -31,6 +31,8 @@ export * from './handlers/api/keystone/keystone-check-email.handler.mjs';
 export * from './handlers/api/keystone/sso-config.handler.mjs';
 export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
 export * from './handlers/api/email/email-verification-code.handler.mjs';

package/dist/serve-gib/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAG5D,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkB9C,MAAM,WAAW,uBAAuB;IACpC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,GAAE,uBAA4B,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAwB3G"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAG5D,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gEAAgE,CAAC;AAC/E,cAAc,0EAA0E,CAAC;AACzF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAoB9C,MAAM,WAAW,uBAAuB;IACpC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,GAAE,uBAA4B,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CA0B3G"}

package/dist/serve-gib/index.mjs

@@ -32,6 +32,8 @@ export * from './handlers/api/keystone/keystone-check-email.handler.mjs';
 export * from './handlers/api/keystone/sso-config.handler.mjs';
 export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
 export * from './handlers/api/email/email-verification-code.handler.mjs';
@@ -52,6 +54,8 @@ import { KeystoneCheckEmailHandler } from './handlers/api/keystone/keystone-chec
 import { SsoLinkHandler } from './handlers/api/keystone/sso-link.handler.mjs';
 import { SsoLoginHandler } from './handlers/api/keystone/sso-login.handler.mjs';
 import { SsoConfigHandler } from './handlers/api/keystone/sso-config.handler.mjs';
+import { KeystoneCustodianGenesisHandler } from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+import { KeystoneCustodianRegisterDelegateHandler } from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 import { EmailInboundHandler } from './handlers/api/email/email-inbound.handler.mjs';
 import { EmailOutboundHandler } from './handlers/api/email/email-outbound.handler.mjs';
 import { EmailVerificationCodeHandler } from './handlers/api/email/email-verification-code.handler.mjs';
@@ -73,6 +77,8 @@ export function getStandardServeGibHandlers(opts = {}) {
         new SsoLinkHandler(),
         new SsoLoginHandler(),
         new SsoConfigHandler(),
+        new KeystoneCustodianGenesisHandler(),
+        new KeystoneCustodianRegisterDelegateHandler(),
         new EmailInboundHandler(),
         new EmailOutboundHandler(),
         new EmailVerificationCodeHandler(),

package/dist/serve-gib/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAE5D,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAA4B,EAAE;IAC1E,MAAM,QAAQ,GAAgC;QAC1C,IAAI,aAAa,EAAE;QACnB,IAAI,YAAY,EAAE;QAClB,IAAI,sBAAsB,EAAE;QAC5B,IAAI,qBAAqB,EAAE;QAC3B,IAAI,mBAAmB,EAAE;QACzB,IAAI,kBAAkB,EAAE;QACxB,IAAI,qBAAqB,EAAE;QAC3B,IAAI,yBAAyB,EAAE;QAC/B,IAAI,cAAc,EAAE;QACpB,IAAI,eAAe,EAAE;QACrB,IAAI,gBAAgB,EAAE;QACtB,IAAI,mBAAmB,EAAE;QACzB,IAAI,oBAAoB,EAAE;QAC1B,IAAI,4BAA4B,EAAE;QAClC,IAAI,6BAA6B,EAAE;KACtC,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAE5D,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gEAAgE,CAAC;AAC/E,cAAc,0EAA0E,CAAC;AACzF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gEAAgE,CAAC;AACjH,OAAO,EAAE,wCAAwC,EAAE,MAAM,0EAA0E,CAAC;AACpI,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAA4B,EAAE;IAC1E,MAAM,QAAQ,GAAgC;QAC1C,IAAI,aAAa,EAAE;QACnB,IAAI,YAAY,EAAE;QAClB,IAAI,sBAAsB,EAAE;QAC5B,IAAI,qBAAqB,EAAE;QAC3B,IAAI,mBAAmB,EAAE;QACzB,IAAI,kBAAkB,EAAE;QACxB,IAAI,qBAAqB,EAAE;QAC3B,IAAI,yBAAyB,EAAE;QAC/B,IAAI,cAAc,EAAE;QACpB,IAAI,eAAe,EAAE;QACrB,IAAI,gBAAgB,EAAE;QACtB,IAAI,+BAA+B,EAAE;QACrC,IAAI,wCAAwC,EAAE;QAC9C,IAAI,mBAAmB,EAAE;QACzB,IAAI,oBAAoB,EAAE;QAC1B,IAAI,4BAA4B,EAAE;QAClC,IAAI,6BAA6B,EAAE;KACtC,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/serve-gib/path-constants.d.mts

@@ -106,6 +106,14 @@ export declare const API_PATH_REGEXES: {
      */
     EMAIL_VERIFY: RegExp;
     EMAIL_VERIFY_CODE: RegExp;
+    /**
+     * /api/identity/custodian/genesis
+     */
+    KEYSTONE_CUSTODIAN_GENESIS: RegExp;
+    /**
+     * /api/identity/custodian/register-delegate
+     */
+    KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: RegExp;
 };
 export declare const VALID_STATIC_PATH_REGEX: RegExp;
 //# sourceMappingURL=path-constants.d.mts.map

package/dist/serve-gib/path-constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"path-constants.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAK9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;IACzB;;OAEG;IACH,MAAM;IAEN;;OAEG;IACH,WAAW;IAEX;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,QAAQ;IAER;;OAEG;IACH,aAAa;IAEb;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,eAAe;IAEf;;;;;;;;OAQG;IACH,gBAAgB;IAEhB;;OAEG;IACH,eAAe;IAEf;;OAEG;IACH,oBAAoB;IAEpB;;;;;;;;;;;OAWG;IACH,aAAa;IACb;;OAEG;IACH,OAAO;IACP;;OAEG;IACH,iBAAiB;IACjB;;OAEG;IACH,kBAAkB;IAClB;;OAEG;IACH,mBAAmB;IACnB;;OAEG;IACH,aAAa;IACb;;OAEG;IACH,UAAU;IACV;;OAEG;IACH,uBAAuB;IAEvB;;OAEG;IACH,YAAY;IACZ,iBAAiB;CACpB,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAA4B,CAAC"}
+{"version":3,"file":"path-constants.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAK9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;IACzB;;OAEG;IACH,MAAM;IAEN;;OAEG;IACH,WAAW;IAEX;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,QAAQ;IAER;;OAEG;IACH,aAAa;IAEb;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,eAAe;IAEf;;;;;;;;OAQG;IACH,gBAAgB;IAEhB;;OAEG;IACH,eAAe;IAEf;;OAEG;IACH,oBAAoB;IAEpB;;;;;;;;;;;OAWG;IACH,aAAa;IACb;;OAEG;IACH,OAAO;IACP;;OAEG;IACH,iBAAiB;IACjB;;OAEG;IACH,kBAAkB;IAClB;;OAEG;IACH,mBAAmB;IACnB;;OAEG;IACH,aAAa;IACb;;OAEG;IACH,UAAU;IACV;;OAEG;IACH,uBAAuB;IAEvB;;OAEG;IACH,YAAY;IACZ,iBAAiB;IAEjB;;OAEG;IACH,0BAA0B;IAE1B;;OAEG;IACH,oCAAoC;CACvC,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAA4B,CAAC"}

package/dist/serve-gib/path-constants.mjs

@@ -111,6 +111,14 @@ export const API_PATH_REGEXES = {
      */
     EMAIL_VERIFY: /^\/api\/email\/verify\/?$/,
     EMAIL_VERIFY_CODE: /^\/api\/email\/verify-code\/?$/,
+    /**
+     * /api/identity/custodian/genesis
+     */
+    KEYSTONE_CUSTODIAN_GENESIS: /^\/api\/identity\/custodian\/genesis\/?$/i,
+    /**
+     * /api/identity/custodian/register-delegate
+     */
+    KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: /^\/api\/identity\/custodian\/register-delegate\/?$/i,
 };
 export const VALID_STATIC_PATH_REGEX = /^\/[a-zA-Z0-9\-_\.\/]*$/;
 //# sourceMappingURL=path-constants.mjs.map

package/dist/serve-gib/path-constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"path-constants.mjs","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAO,yBAAyB;IACtC,MAAM,EAAO,uBAAuB;IACpC,IAAI,EAAS,gBAAgB;IAC7B,UAAU,EAAG,wCAAwC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B;;OAEG;IACH,MAAM,EAAE,oBAAoB;IAE5B;;OAEG;IACH,WAAW,EAAE,oFAAoF;IAEjG;;OAEG;IACH,UAAU,EAAE,6EAA6E;IAEzF;;OAEG;IACH,QAAQ,EAAE,sBAAsB;IAEhC;;OAEG;IACH,aAAa,EAAE,mDAAmD;IAElE;;OAEG;IACH,UAAU,EAAE,mBAAmB;IAE/B;;OAEG;IACH,eAAe,EAAE,2DAA2D;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,+BAA+B;IAEjD;;OAEG;IACH,eAAe,EAAE,8BAA8B;IAE/C;;OAEG;IACH,oBAAoB,EAAE,mCAAmC;IAEzD;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,mDAAmD;IAC5D;;OAEG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;OAEG;IACH,kBAAkB,EAAE,kCAAkC;IACtD;;OAEG;IACH,mBAAmB,EAAE,mCAAmC;IACxD;;OAEG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,UAAU,EAAE,yBAAyB;IACrC;;OAEG;IACH,uBAAuB,EAAE,sCAAsC;IAE/D;;OAEG;IACH,YAAY,EAAE,2BAA2B;IACzC,iBAAiB,EAAE,gCAAgC;CACtD,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"path-constants.mjs","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAO,yBAAyB;IACtC,MAAM,EAAO,uBAAuB;IACpC,IAAI,EAAS,gBAAgB;IAC7B,UAAU,EAAG,wCAAwC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B;;OAEG;IACH,MAAM,EAAE,oBAAoB;IAE5B;;OAEG;IACH,WAAW,EAAE,oFAAoF;IAEjG;;OAEG;IACH,UAAU,EAAE,6EAA6E;IAEzF;;OAEG;IACH,QAAQ,EAAE,sBAAsB;IAEhC;;OAEG;IACH,aAAa,EAAE,mDAAmD;IAElE;;OAEG;IACH,UAAU,EAAE,mBAAmB;IAE/B;;OAEG;IACH,eAAe,EAAE,2DAA2D;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,+BAA+B;IAEjD;;OAEG;IACH,eAAe,EAAE,8BAA8B;IAE/C;;OAEG;IACH,oBAAoB,EAAE,mCAAmC;IAEzD;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,mDAAmD;IAC5D;;OAEG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;OAEG;IACH,kBAAkB,EAAE,kCAAkC;IACtD;;OAEG;IACH,mBAAmB,EAAE,mCAAmC;IACxD;;OAEG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,UAAU,EAAE,yBAAyB;IACrC;;OAEG;IACH,uBAAuB,EAAE,sCAAsC;IAE/D;;OAEG;IACH,YAAY,EAAE,2BAA2B;IACzC,iBAAiB,EAAE,gCAAgC;IAEnD;;OAEG;IACH,0BAA0B,EAAE,2CAA2C;IAEvE;;OAEG;IACH,oCAAoC,EAAE,qDAAqD;CAC9F,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC"}

package/e2e/identity-custodian-lifecycle.e2e.md

@@ -0,0 +1,93 @@
+# E2E Test Plan: Full Custodian Passwordless Onboarding & Single-Turn Authorization Ceremony
+
+Tests custodian (passwordless) account creation, add-device.
+
+* **Create Account**: passwordless, Google or custom email
+* **Sign in**: passwordless, Google or custom email
+
+---
+
+## Overview & Execution Model
+
+| Property | Specification |
+| :--- | :--- |
+| **Primary Domain Target** | `https://local.ibgib.space` (Google OAuth callback domain) |
+| **Server Mode** | `EMAIL_MODE=mock` |
+| **Target Audience** | Human QA Testers / Agent Browser Testers |
+
+### Fail-Fast Sequential Lifecycle
+- Executed linearly from **Phase 0 through Phase 3**.
+- If any step in any phase fails, execution halts immediately, and the E2E test run is marked as **FAILED**.
+
+---
+
+## Test Variables
+
+* `<E2E_TEST_GMAIL_ADDRESS_ALICE>` - located in `.env`
+* `<test_url>` - `https://local.ibgib.space`
+
+---
+
+## Sequential Test Phases
+
+### Phase 0: Prerequisites & Environment Setup
+Verify that local Docker services are running, server listens on port 3000, target domain `<test_url>` resolves, server data directory is cleaned, and local browser storage (IndexedDB, LocalStorage, SessionStorage) is cleared.
+
+> [!WARNING]
+> Cleaning the server wipes `<dataDir>/` (`identity_index/`, email hashes, and all registered domain tenancy folders). Do not run server cleaning if active personal testing or long-running server state needs to be preserved!
+
+#### Steps
+1. **Clean and reset local server state**:
+   - Run `npm run clean:space-gib:server` in monorepo root (deletes `.data/` directory and resets email index).
+   - *(Optional UX Tip)*: If using Docker Desktop on Windows, clear the container log terminal view before restarting to eliminate log noise when locating 6-digit verification code log entries.
+   - Run `npm run restart:space-gib` to restart the server with a clean data state, or `npm run docker:space-gib` / `npm run docker:space-gib:d` if not started.
+2. **Confirm server startup log outputs**: (e.g. `[space-gib server] dataDir: /data/ibgib-space` and `[space-gib server] listening on http://0.0.0.0:3000`).
+3. **Open test browser(s)**: Navigate to `<test_url>`.
+4. **Clear browser data for `<test_url>`** (all ibgib data is stored in IndexedDB): Ensure you are you at `<test_url>` -> Open Developer Tools (F12) -> Application -> IndexedDB -> `space_gib_db` -> Delete database, then refresh the browser
+5. **Test Credentials**: Refer to (vcs ignored) `.env` for `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and password.
+
+### Phase 1: First-Time Passwordless Account Creation & Custodian Genesis
+Create a new custodian identity on `<test_url>` using the **Quick / Passwordless** workflow (6-digit OTP email code or Google SSO), verify single-turn `custodianReqs` generation, and confirm local delegate keystone registration.
+
+#### Steps
+1. Open browser to `<test_url>`.
+2. In `<ibgib-identity-header>`, click **Create Account**.
+3. Observe the default **Quick (Passwordless)** tab is selected by default.
+4. Enter email `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and click **Send Code** (or click **Continue with Google**).
+5. Open server console / terminal logs to locate the dispatched 6-digit OTP verification code.
+6. Enter the 6-digit OTP code into the PIN input prompt in the same tab and click **Verify Code**.
+7. Verify API execution:
+   - Client calls `POST /api/identity/custodian/genesis`.
+   - Server returns `isNewIdentity: true`, `primaryTjpAddr`, `primaryKeystone`, and single-turn `custodianReqs`.
+   - Client derives local delegate secret, constructs $K_{\text{delegate}}$, and calls `POST /api/identity/custodian/register-delegate`.
+8. Verify outcomes:
+   - Identity header displays avatar & username (derived from email).
+   - Local browser user space contains $K_{\text{primary}}$ and $K_{\text{delegate}}$.
+   - `<dataDir>/identity_index/email/hashes/` contains the registered email index.
+
+
+### Phase 2: Second-Device Passwordless Sign-In & Device Pairing
+Open a fresh Incognito browser window to `<test_url>`, execute passwordless sign-in for `<E2E_TEST_GMAIL_ADDRESS_ALICE>`, and verify that the server provisions a fresh `custodianReqs` payload and registers a second device delegate ($K_{\text{delegate2}}$).
+
+#### Steps
+1. Open a second browser window (or Incognito window) at `<test_url>`.
+2. Click **Sign In** in `<ibgib-identity-header>`.
+3. Enter the same email address `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and click **Send Code** (or click **Continue with Google**).
+4. Copy the 6-digit OTP code from the server console log and submit it.
+5. Verify API execution:
+   - Server returns `isNewIdentity: false`, existing `primaryTjpAddr`, and fresh single-turn `custodianReqs`.
+   - Second browser constructs its local $K_{\text{delegate2}}$ and registers via `POST /api/identity/custodian/register-delegate`.
+6. Verify outcomes:
+   - Second device successfully pairs and displays user identity header.
+   - Server evolves $K_{\text{primary}} \to K_{\text{primary}, n=2}$ with both device delegates registered in `rel8ns.sync_delegate`.
+
+
+### Phase 3: Single-Turn Nonce Replay Prevention
+Attempt to re-submit a previously consumed `custodianReqs` payload to `POST /api/identity/custodian/register-delegate` and verify that the server kernel atomically rejects the request.
+
+#### Steps
+1. Copy or intercept a `custodianReqs` payload previously consumed in Phase 1 or Phase 2.
+2. Re-submit the same `delegateKeystone` (or identical `custodianReqs` payload) to `POST /api/identity/custodian/register-delegate`.
+3. Verify rejection outcome:
+   - Server rejects the request with **HTTP 409 Conflict**:
+     `"Custodian requirements payload has already been used. Nonce single-turn reservation violation."`

package/e2e/identity-sso-lifecycle.e2e.md

@@ -1,6 +1,12 @@
-# E2E Test Plan: Identity, SSO & Magic Link Lifecycle
+# E2E Test Plan: Identity, SSO & 6-Digit Email Code Lifecycle
 
-This document is the official End-to-End (E2E) browser test plan for the complete identity creation, manual email verification, Google SSO linking, new-device sign-in, and delegate revocation user lifecycle.
+This document is the official End-to-End (E2E) browser test plan for the complete identity creation, 6-digit email OTP verification, Google SSO linking, new-device sign-in, and delegate revocation user lifecycle.
+
+* **Create Account**: Create local/sovereign identity
+* **Verify Email**: 6-digit code
+* **Link SSO**: Google is only OAuth2 provider atow
+* **Sign in**: add device
+* **Revoke delegate**: remove device
 
 ---
 
@@ -18,6 +24,13 @@ This document is the official End-to-End (E2E) browser test plan for the complet
 
 ---
 
+## Test Variables
+
+* `<E2E_TEST_GMAIL_ADDRESS_ALICE>` - located in `.env`
+* `<test_url>` - `https://local.ibgib.space`
+
+---
+
 ## Sequential Test Phases
 
 ### Phase 0: Prerequisites & Environment Setup
@@ -27,14 +40,14 @@ Verify that local Docker services are running, server listens on port 3000, targ
 > Cleaning the server wipes `<dataDir>/` (`identity_index/`, email hashes, and all registered domain tenancy folders). Do not run server cleaning if active personal testing or long-running server state needs to be preserved!
 
 #### Steps
-1. Clean and reset local server state:
+1. **Clean and reset local server state**:
    - Run `npm run clean:space-gib:server` in monorepo root (deletes `.data/` directory and resets email index).
-   - *(Optional UX Tip)*: If using Docker Desktop on Windows, clear the container log terminal view before restarting to eliminate log noise when locating Magic Link URLs.
-   - Run `npm run restart:space-gib` (or `npm run docker:space-gib` / `npm run docker:space-gib:d`) to restart the server with a clean data state.
-2. Confirm server startup log outputs the data directory and listening URI + port (e.g. `[space-gib server] dataDir: /data/ibgib-space` and `[space-gib server] listening on http://0.0.0.0:3000`).
-3. Clear browser storage: Open Developer Tools (F12) -> Application -> Clear Storage -> Click **Clear site data** (clears IndexedDB, LocalStorage, and SessionStorage).
-4. *(Optional Test Credentials)*: Store your test Google OAuth credentials (email/password) in `.env` in the monorepo root (gitignored) for fast copy/paste during manual testing. Never write real credentials in `.md` test specs!
-
+   - *(Optional UX Tip)*: If using Docker Desktop on Windows, clear the container log terminal view before restarting to eliminate log noise when locating 6-digit verification code log entries.
+   - Run `npm run restart:space-gib` to restart the server with a clean data state, or `npm run docker:space-gib` / `npm run docker:space-gib:d` if not started.
+2. **Confirm server startup log outputs**: (e.g. `[space-gib server] dataDir: /data/ibgib-space` and `[space-gib server] listening on http://0.0.0.0:3000`).
+3. **Open test browser(s)**: Navigate to `<test_url>`.
+4. **Clear browser data for `<test_url>`** (all ibgib data is stored in IndexedDB): Ensure you are you at `<test_url>` -> Open Developer Tools (F12) -> Application -> IndexedDB -> `space_gib_db` -> Delete database, then refresh the browser
+5. **Test Credentials**: Refer to (vcs ignored) `.env` for `<E2E_TEST_GMAIL_ADDRESS_ALICE>` and password.
 
 ### Phase 1: Account Creation & Email Verification Code Dispatch
 Create a new identity `alice` with email `<E2E_TEST_GMAIL_ADDRESS_ALICE>` (from `.env`) on `https://local.ibgib.space` and verify that the genesis keystone is quarantined in the `email/pending/` staging directory with `code.json` and Ahead-of-Time (AOT) metadata JSON files.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/node-gib",
-  "version": "0.0.15",
+  "version": "0.0.18",
   "description": "Node and server-specific ibGib code, i.e., things that don't run in the browser.",
   "funding": {
     "type": "individual",
@@ -24,10 +24,10 @@
   "author": "William Raiford",
   "license": "ISC",
   "dependencies": {
-    "@ibgib/helper-gib": "^0.0.36",
+    "@ibgib/helper-gib": "^0.0.37",
     "@ibgib/ts-gib": "^0.5.33",
-    "@ibgib/core-gib": "^0.1.71",
-    "@ibgib/encrypt-gib": "^0.2.37"
+    "@ibgib/core-gib": "^0.1.73",
+    "@ibgib/encrypt-gib": "^0.3.1"
   },
   "devDependencies": {
     "@types/node": "^20.2.1"