@ibgib/node-gib 0.0.19 → 0.0.20

package/dist/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.d.mts

@@ -0,0 +1,39 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler
+ *
+ * POST /api/identity/custodian/add-master-password
+ *
+ * Single-turn sovereignty elevation endpoint for purely custodial identities.
+ * Authenticates the user via fresh OAuth code or 6-digit email OTP, validates that
+ * the provided `newManagePool` config matches the existing custodian pool config,
+ * evolves the custodian manage pool into an auxiliary inward custodian pool (e.g. `custodian-manage-google`),
+ * installs the user's new sovereign pool as `manage`, and signs the evolution using the server's custodian secret.
+ */
+import { KeystoneChallengePool } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
+import { SsoProviderId } from '../../../../identity/sso/sso-types.mjs';
+export interface CustodianAddMasterPasswordRequestBody {
+    primaryTjpAddr: string;
+    newManagePool: KeystoneChallengePool;
+    providerId?: SsoProviderId;
+    code?: string;
+    redirectUri?: string;
+    email?: string;
+}
+export interface CustodianAddMasterPasswordResponseBody {
+    success: boolean;
+    primaryTjpAddr: string;
+    primaryKeystone: any;
+    message?: string;
+}
+/**
+ * POST /api/identity/custodian/add-master-password
+ */
+export declare class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBase<undefined, undefined> {
+    protected lc: string;
+    protected method: ServeGibHttpMethod;
+    protected regex: RegExp;
+    protected handleRouteImpl(reqCtx: RequestContext<undefined, undefined>): Promise<ResponseResult | undefined>;
+}
+//# sourceMappingURL=keystone-custodian-add-master-password.handler.d.mts.map

package/dist/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-custodian-add-master-password.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAOzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOxF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAcvE,MAAM,WAAW,qCAAqC;IAClD,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,qBAAqB,CAAC;IACrC,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sCAAsC;IACnD,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,GAAG,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,yCAA0C,SAAQ,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;IACpG,UAAmB,EAAE,EAAE,MAAM,CAAyD;IACtF,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAA2D;IAEnF,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CA4KrC;CACJ"}

package/dist/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.mjs

@@ -0,0 +1,197 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler
+ *
+ * POST /api/identity/custodian/add-master-password
+ *
+ * Single-turn sovereignty elevation endpoint for purely custodial identities.
+ * Authenticates the user via fresh OAuth code or 6-digit email OTP, validates that
+ * the provided `newManagePool` config matches the existing custodian pool config,
+ * evolves the custodian manage pool into an auxiliary inward custodian pool (e.g. `custodian-manage-google`),
+ * installs the user's new sovereign pool as `manage`, and signs the evolution using the server's custodian secret.
+ */
+import { extractErrorMsg, hash } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { CUSTODIAN_POOL_ID_PREFIX } from '@ibgib/core-gib/dist/keystone/delegate/delegate-constants.mjs';
+import { validateEmail } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
+import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { API_PATH_REGEXES } from '../../../path-constants.mjs';
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
+import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
+import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
+import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
+import { getPendingStagingDir, getPendingTjpHash, verifyPendingCode } from '../../../../email/verify/email-verify-helpers.mjs';
+const logalot = GLOBAL_LOG_A_LOT || true;
+let custodian;
+function getCustodian() {
+    if (!custodian) {
+        const config = loadSsoServerConfig();
+        custodian = new SsoCustodianService(config);
+    }
+    return custodian;
+}
+/**
+ * POST /api/identity/custodian/add-master-password
+ */
+export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBase {
+    lc = `[${KeystoneCustodianAddMasterPasswordHandler.name}]`;
+    method = 'POST';
+    regex = API_PATH_REGEXES.KEYSTONE_CUSTODIAN_ADD_MASTER_PASSWORD;
+    async handleRouteImpl(reqCtx) {
+        const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
+        try {
+            if (logalot) {
+                console.log(`${lc} starting... (I: 8a1b2c3d4e5f67890a1b2c3d4e5f6790)`);
+            }
+            if (reqCtx.method !== 'POST') {
+                return this.error(405, 'Method Not Allowed');
+            }
+            if (!reqCtx.body) {
+                return this.error(400, 'Request body is empty (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6791)');
+            }
+            let body;
+            try {
+                body = JSON.parse(reqCtx.body);
+            }
+            catch {
+                return this.error(400, 'Request body must be valid JSON (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6792)');
+            }
+            const { primaryTjpAddr, newManagePool, providerId, code, redirectUri, email } = body;
+            if (!primaryTjpAddr) {
+                return this.error(400, 'primaryTjpAddr is required (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6793)');
+            }
+            if (!newManagePool || typeof newManagePool !== 'object' || newManagePool.id !== POOL_ID_MANAGE) {
+                return this.error(400, 'newManagePool is invalid. Must be an object with id "manage" (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6794)');
+            }
+            if (!newManagePool.challenges || Object.keys(newManagePool.challenges).length === 0) {
+                return this.error(400, 'newManagePool must contain pre-generated public challenges (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6795)');
+            }
+            // 1. Authenticate user credentials via OAuth code or Email OTP
+            let verifiedEmail;
+            let effectiveProvider = providerId || 'email';
+            if (providerId && code && redirectUri) {
+                const service = getCustodian();
+                const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
+                if (!userInfo || !userInfo.email) {
+                    return this.error(401, `Failed to authenticate with SSO provider ${providerId} (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6796)`);
+                }
+                verifiedEmail = normalizeEmail(userInfo.email);
+            }
+            else if (email && code) {
+                if (!validateEmail(email)) {
+                    return this.error(400, 'Invalid email address format (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6797)');
+                }
+                verifiedEmail = normalizeEmail(email);
+                const tjpHash = await getPendingTjpHash(primaryTjpAddr);
+                const pendingInfo = reqCtx.dataDir && tjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash }) : undefined;
+                if (!pendingInfo || pendingInfo.isExpired) {
+                    return this.error(400, 'Verification record missing or expired. Please request a new verification code. (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6798)');
+                }
+                const codeVerifyResult = await verifyPendingCode({
+                    pendingDir: pendingInfo.pendingDir,
+                    code,
+                });
+                if (!codeVerifyResult.valid) {
+                    return this.error(401, codeVerifyResult.error || 'Invalid verification code (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6799)');
+                }
+            }
+            else {
+                return this.error(400, 'Authentication credentials required (providerId+code+redirectUri or email+code) (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679a)');
+            }
+            // 2. Lookup primary identity and confirm email matches
+            const indexService = getIdentityIndexService();
+            const identityRecord = await indexService.lookupIdentityByEmail({ email: verifiedEmail });
+            if (!identityRecord || identityRecord.primaryTjpAddr !== primaryTjpAddr) {
+                return this.error(403, `Authenticated email ${verifiedEmail} does not match primary identity ${primaryTjpAddr} (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679b)`);
+            }
+            // 3. Bootstrap domain metaspace and load latest keystone
+            const metaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) {
+                return this.error(500, `Local domain space not found for identity ${primaryTjpAddr}`);
+            }
+            const keystoneService = new KeystoneService_V1();
+            const latestKeystone = await keystoneService.getLatestKeystone({
+                addr: primaryTjpAddr,
+                metaspace,
+                space
+            });
+            if (!latestKeystone || !latestKeystone.data) {
+                return this.error(404, `Primary identity keystone not found for address ${primaryTjpAddr}`);
+            }
+            // 4. Verify existing custodial manage pool
+            const prevPools = latestKeystone.data.challengePools || [];
+            const existingManagePool = prevPools.find(p => p.id === POOL_ID_MANAGE);
+            if (!existingManagePool) {
+                return this.error(400, 'Primary keystone missing active "manage" pool (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679c)');
+            }
+            // Validate new pool config matches existing manage pool config structure
+            if (existingManagePool.config?.type && newManagePool.config?.type !== existingManagePool.config.type) {
+                return this.error(400, `newManagePool type "${newManagePool.config?.type}" does not match required type "${existingManagePool.config.type}" (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679d)`);
+            }
+            // 5. Build next pool set:
+            // Convert existing custodian manage pool to auxiliary custodian pool (e.g. custodian-manage-google)
+            // and install user's newManagePool as 'manage'.
+            const custodianPoolId = `${CUSTODIAN_POOL_ID_PREFIX}${effectiveProvider}`;
+            const auxiliaryCustodianPool = {
+                ...existingManagePool,
+                id: custodianPoolId,
+            };
+            const nextPools = [];
+            for (const pool of prevPools) {
+                if (pool.id === POOL_ID_MANAGE) {
+                    nextPools.push(newManagePool);
+                    nextPools.push(auxiliaryCustodianPool);
+                }
+                else if (pool.id === custodianPoolId) {
+                    // Skip if already present to prevent duplicate
+                }
+                else {
+                    nextPools.push(pool);
+                }
+            }
+            // 6. Sign evolution turn using server's custodian secret
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const primarySecret = await hash({ s: `${serverSecret}_custodian_${verifiedEmail}` });
+            const claim = {
+                verb: KEYSTONE_VERB_MANAGE,
+                target: getIbGibAddr({ ibGib: latestKeystone })
+            };
+            const evolvedKeystone = await keystoneService.sign({
+                latestKeystone,
+                masterSecret: primarySecret,
+                claim,
+                poolId: POOL_ID_MANAGE,
+                metaspace,
+                space,
+                dataToPatch: {
+                    challengePools: nextPools,
+                    frameDetails: {
+                        action: 'add_master_password',
+                        custodyMode: 'hybrid',
+                        elevatedAt: new Date().toISOString(),
+                    }
+                }
+            });
+            // 7. Persist evolved keystone in domain space
+            await metaspace.put({ ibGibs: [evolvedKeystone], space });
+            await metaspace.registerNewIbGib({ ibGib: evolvedKeystone, space });
+            const response = {
+                success: true,
+                primaryTjpAddr,
+                primaryKeystone: evolvedKeystone,
+                message: 'Successfully elevated identity to sovereign master password'
+            };
+            return this.ok(response);
+        }
+        catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            return this.error(500, `Internal error adding master password: ${extractErrorMsg(error)}`);
+        }
+    }
+}
+//# sourceMappingURL=keystone-custodian-add-master-password.handler.mjs.map

package/dist/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-custodian-add-master-password.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,+DAA+D,CAAC;AAEzG,OAAO,EAAE,aAAa,EAAE,MAAM,oDAAoD,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAEzF,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AAE/H,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAEzC,IAAI,SAA0C,CAAC;AAC/C,SAAS,YAAY;IACjB,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAkBD;;GAEG;AACH,MAAM,OAAO,yCAA0C,SAAQ,mBAAyC;IACjF,EAAE,GAAW,IAAI,yCAAyC,CAAC,IAAI,GAAG,CAAC;IACnE,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,sCAAsC,CAAC;IAEzE,KAAK,CAAC,eAAe,CAC3B,MAA4C;QAE5C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;YAC1F,CAAC;YAED,IAAI,IAA2C,CAAC;YAChD,IAAI,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uEAAuE,CAAC,CAAC;YACpG,CAAC;YAED,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;YAErF,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,kEAAkE,CAAC,CAAC;YAC/F,CAAC;YAED,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;gBAC7F,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oGAAoG,CAAC,CAAC;YACjI,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,kGAAkG,CAAC,CAAC;YAC/H,CAAC;YAED,+DAA+D;YAC/D,IAAI,aAAqB,CAAC;YAC1B,IAAI,iBAAiB,GAAW,UAAU,IAAI,OAAO,CAAC;YAEtD,IAAI,UAAU,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC/E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;oBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,4CAA4C,UAAU,wCAAwC,CAAC,CAAC;gBAC3H,CAAC;gBACD,aAAa,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oEAAoE,CAAC,CAAC;gBACjG,CAAC;gBACD,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBAEtC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAC;gBACxD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE7H,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;oBACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uHAAuH,CAAC,CAAC;gBACpJ,CAAC;gBAED,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,CAAC;oBAC7C,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,IAAI;iBACP,CAAC,CAAC;gBAEH,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;oBAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,IAAI,iEAAiE,CAAC,CAAC;gBACxH,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uHAAuH,CAAC,CAAC;YACpJ,CAAC;YAED,uDAAuD;YACvD,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,aAAa,oCAAoC,cAAc,wCAAwC,CAAC,CAAC;YAC3J,CAAC;YAED,yDAAyD;YACzD,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACjF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,6CAA6C,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YAED,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACjD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC;gBAC3D,IAAI,EAAE,cAAc;gBACpB,SAAS;gBACT,KAAK;aACR,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,mDAAmD,cAAc,EAAE,CAAC,CAAC;YAChG,CAAC;YAED,2CAA2C;YAC3C,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;YAC3D,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC;YACxE,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qFAAqF,CAAC,CAAC;YAClH,CAAC;YAED,yEAAyE;YACzE,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,KAAK,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACnG,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,aAAa,CAAC,MAAM,EAAE,IAAI,mCAAmC,kBAAkB,CAAC,MAAM,CAAC,IAAI,yCAAyC,CAAC,CAAC;YACxL,CAAC;YAED,0BAA0B;YAC1B,oGAAoG;YACpG,gDAAgD;YAChD,MAAM,eAAe,GAAG,GAAG,wBAAwB,GAAG,iBAAiB,EAAE,CAAC;YAC1E,MAAM,sBAAsB,GAA0B;gBAClD,GAAG,kBAAkB;gBACrB,EAAE,EAAE,eAAe;aACtB,CAAC;YAEF,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;oBAC7B,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC9B,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBAC3C,CAAC;qBAAM,IAAI,IAAI,CAAC,EAAE,KAAK,eAAe,EAAE,CAAC;oBACrC,+CAA+C;gBACnD,CAAC;qBAAM,CAAC;oBACJ,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;YACL,CAAC;YAED,yDAAyD;YACzD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,SAAS,CAAC,kBAAkB,CAAC;YAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,cAAc,aAAa,EAAE,EAAE,CAAC,CAAC;YAEtF,MAAM,KAAK,GAA2B;gBAClC,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;aAClD,CAAC;YAEF,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC;gBAC/C,cAAc;gBACd,YAAY,EAAE,aAAa;gBAC3B,KAAK;gBACL,MAAM,EAAE,cAAc;gBACtB,SAAS;gBACT,KAAK;gBACL,WAAW,EAAE;oBACT,cAAc,EAAE,SAAS;oBACzB,YAAY,EAAE;wBACV,MAAM,EAAE,qBAAqB;wBAC7B,WAAW,EAAE,QAAQ;wBACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACvC;iBACJ;aACJ,CAAC,CAAC;YAEH,8CAA8C;YAC9C,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAEpE,MAAM,QAAQ,GAA2C;gBACrD,OAAO,EAAE,IAAI;gBACb,cAAc;gBACd,eAAe,EAAE,eAAe;gBAChC,OAAO,EAAE,6DAA6D;aACzE,CAAC;YAEF,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QAE7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,0CAA0C,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/handlers/api/keystone/sso-login.handler.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-login.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/sso-login.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAevE,MAAM,WAAW,YAAY;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,aAAa,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;IAC1E,UAAmB,EAAE,EAAE,MAAM,CAA+B;IAC5D,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAAuC;IAE/D,UAAyB,eAAe,IAAI,OAAO,CAAC,SAAS,CAAC,CAE7D;IAED,UAAyB,mBAAmB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAEhE;IAED,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAsIrC;CACJ"}
+{"version":3,"file":"sso-login.handler.d.mts","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/sso-login.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAevE,MAAM,WAAW,YAAY;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,aAAa,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;IAC1E,UAAmB,EAAE,EAAE,MAAM,CAA+B;IAC5D,UAAmB,MAAM,EAAE,kBAAkB,CAAU;IACvD,UAAmB,KAAK,SAAuC;IAE/D,UAAyB,eAAe,IAAI,OAAO,CAAC,SAAS,CAAC,CAE7D;IAED,UAAyB,mBAAmB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAEhE;IAED,UAAgB,eAAe,CAC3B,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,GAC7C,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAuIrC;CACJ"}

package/dist/serve-gib/handlers/api/keystone/sso-login.handler.mjs

@@ -111,6 +111,7 @@ export class SsoLoginHandler extends ServeGibHandlerBase {
                     client: 'space-gib-server',
                     role: 'custodian-primary',
                     custodianProvider: providerId,
+                    custodyMode: 'full',
                     [`rawSSOName-${providerId}`]: rawSSOName,
                 });
                 const configs = await primaryBuilder.compileConfigs();

package/dist/serve-gib/handlers/api/keystone/sso-login.handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sso-login.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/sso-login.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mEAAmE,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AAEpG,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC,IAAI,SAA0C,CAAC;AAC/C,SAAS,YAAY;IACjB,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAkBD;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,mBAAyC;IACvD,EAAE,GAAW,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,kBAAkB,CAAC;IAE5C,KAAK,CAAC,eAAe;QACpC,OAAO,SAAS,CAAC;IACrB,CAAC;IAEkB,KAAK,CAAC,mBAAmB;QACxC,OAAO,EAAE,CAAC;IACd,CAAC;IAES,KAAK,CAAC,eAAe,CAC3B,MAA4C;QAE5C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;YAC1F,CAAC;YAED,IAAI,MAAoB,CAAC;YACzB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uEAAuE,CAAC,CAAC;YACpG,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,wGAAwG,CAAC,CAAC;YACrI,CAAC;YAED,uEAAuE;YACvE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAE/E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+CAA+C,UAAU,wCAAwC,CAAC,CAAC;YAC9H,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAChH;YAEL,qDAAqD;YACrD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,SAAS,CAAC,kBAAkB,CAAC;YAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,cAAc,KAAK,EAAE,EAAE,CAAC,CAAC;YAE9E,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAE3E,IAAI,cAAsB,CAAC;YAC3B,IAAI,eAAoB,CAAC;YACzB,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,IAAI,cAAc,IAAI,cAAc,CAAC,cAAc,EAAE,CAAC;gBAClD,oBAAoB;gBACpB,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC;gBAC/C,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvE,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBACjD,eAAe,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC;oBACtD,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,eAAe;oBAC1B,KAAK,EAAE,KAAM;iBAChB,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACJ,yCAAyC;gBACzC,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC/B,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CAAC,QAAQ,MAAM,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7F,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAE/E,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;gBAC1E,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CAAC,2LAA2L,CAAC,CAAC;gBACjN,CAAC;gBAED,MAAM,cAAc,GAAG,sBAAsB,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,EAAS,CAAC;qBACxF,YAAY,CAAC,QAAQ,CAAC;qBACtB,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC;qBACnB,WAAW,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,IAAI,EAAE,mBAAmB;oBACzB,iBAAiB,EAAE,UAAU;oBAC7B,CAAC,cAAc,UAAU,EAAE,CAAC,EAAE,UAAU;iBAC3C,CAAC,CAAC;gBAEP,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBACjD,eAAe,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC;oBAC5C,YAAY,EAAE,aAAa;oBAC3B,MAAM,EAAE,CAAC,KAAK,CAAC;oBACf,YAAY,EAAE,cAAc,CAAC,eAAe,EAAE;oBAC9C,OAAO;oBACP,SAAS,EAAE,mBAAmB;oBAC9B,KAAK,EAAE,SAAU;oBACjB,SAAS,EAAE,IAAI;iBAClB,CAAC,CAAC;gBAEH,cAAc,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,CAAE,CAAC;gBAExF,uDAAuD;gBACvD,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC1F,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEnF,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,cAAe,EAAE,CAAC,CAAC;gBACpF,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAe,EAAE,CAAC,CAAC;gBAE9F,MAAM,YAAY,CAAC,kBAAkB,CAAC;oBAClC,KAAK;oBACL,cAAc;iBACjB,CAAC,CAAC;YACP,CAAC;YAED,yDAAyD;YACzD,MAAM,aAAa,GAAG,MAAM,6BAA6B,CAAC;gBACtD,cAAc;gBACd,YAAY;aACf,CAAC,CAAC;YAEH,MAAM,YAAY,GAAyB;gBACvC,OAAO,EAAE,IAAI;gBACb,aAAa;gBACb,cAAc;gBACd,eAAe;gBACf,aAAa;gBACb,QAAQ;gBACR,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,+CAA+C;aACtH,CAAC;YAEF,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,IAAI,wCAAwC,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"sso-login.handler.mjs","sourceRoot":"","sources":["../../../../../src/serve-gib/handlers/api/keystone/sso-login.handler.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mEAAmE,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AAEpG,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC,IAAI,SAA0C,CAAC;AAC/C,SAAS,YAAY;IACjB,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,SAAS,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAkBD;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,mBAAyC;IACvD,EAAE,GAAW,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,GAAuB,MAAM,CAAC;IACpC,KAAK,GAAG,gBAAgB,CAAC,kBAAkB,CAAC;IAE5C,KAAK,CAAC,eAAe;QACpC,OAAO,SAAS,CAAC;IACrB,CAAC;IAEkB,KAAK,CAAC,mBAAmB;QACxC,OAAO,EAAE,CAAC;IACd,CAAC;IAES,KAAK,CAAC,eAAe,CAC3B,MAA4C;QAE5C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;YAC1F,CAAC;YAED,IAAI,MAAoB,CAAC;YACzB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uEAAuE,CAAC,CAAC;YACpG,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,wGAAwG,CAAC,CAAC;YACrI,CAAC;YAED,uEAAuE;YACvE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAE/E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,+CAA+C,UAAU,wCAAwC,CAAC,CAAC;YAC9H,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAChH;YAEL,qDAAqD;YACrD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,SAAS,CAAC,kBAAkB,CAAC;YAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,cAAc,KAAK,EAAE,EAAE,CAAC,CAAC;YAE9E,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAE3E,IAAI,cAAsB,CAAC;YAC3B,IAAI,eAAoB,CAAC;YACzB,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,IAAI,cAAc,IAAI,cAAc,CAAC,cAAc,EAAE,CAAC;gBAClD,oBAAoB;gBACpB,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC;gBAC/C,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvE,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBACjD,eAAe,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC;oBACtD,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,eAAe;oBAC1B,KAAK,EAAE,KAAM;iBAChB,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACJ,yCAAyC;gBACzC,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC/B,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CAAC,QAAQ,MAAM,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7F,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAE/E,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;gBAC1E,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CAAC,2LAA2L,CAAC,CAAC;gBACjN,CAAC;gBAED,MAAM,cAAc,GAAG,sBAAsB,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,EAAS,CAAC;qBACxF,YAAY,CAAC,QAAQ,CAAC;qBACtB,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC;qBACnB,WAAW,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,IAAI,EAAE,mBAAmB;oBACzB,iBAAiB,EAAE,UAAU;oBAC7B,WAAW,EAAE,MAAM;oBACnB,CAAC,cAAc,UAAU,EAAE,CAAC,EAAE,UAAU;iBAC3C,CAAC,CAAC;gBAEP,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBACjD,eAAe,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC;oBAC5C,YAAY,EAAE,aAAa;oBAC3B,MAAM,EAAE,CAAC,KAAK,CAAC;oBACf,YAAY,EAAE,cAAc,CAAC,eAAe,EAAE;oBAC9C,OAAO;oBACP,SAAS,EAAE,mBAAmB;oBAC9B,KAAK,EAAE,SAAU;oBACjB,SAAS,EAAE,IAAI;iBAClB,CAAC,CAAC;gBAEH,cAAc,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,CAAE,CAAC;gBAExF,uDAAuD;gBACvD,MAAM,kBAAkB,GAAG,MAAM,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC1F,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEnF,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,cAAe,EAAE,CAAC,CAAC;gBACpF,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAe,EAAE,CAAC,CAAC;gBAE9F,MAAM,YAAY,CAAC,kBAAkB,CAAC;oBAClC,KAAK;oBACL,cAAc;iBACjB,CAAC,CAAC;YACP,CAAC;YAED,yDAAyD;YACzD,MAAM,aAAa,GAAG,MAAM,6BAA6B,CAAC;gBACtD,cAAc;gBACd,YAAY;aACf,CAAC,CAAC;YAEH,MAAM,YAAY,GAAyB;gBACvC,OAAO,EAAE,IAAI;gBACb,aAAa;gBACb,cAAc;gBACd,eAAe;gBACf,aAAa;gBACb,QAAQ;gBACR,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,+CAA+C;aACtH,CAAC;YAEF,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,IAAI,wCAAwC,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;CACJ"}

package/dist/serve-gib/identity-index/identity-index-service.d.mts

@@ -54,5 +54,9 @@ export declare class IdentityIndexService {
 /**
  * Singleton factory getter for the IdentityIndexService.
  */
-export declare function getIdentityIndexService(): IdentityIndexService;
+export declare function getIdentityIndexService(opts?: IdentityIndexServiceOptions): IdentityIndexService;
+/**
+ * Resets the cached singleton instance (useful during testing across different data directories).
+ */
+export declare function resetIdentityIndexService(): void;
 //# sourceMappingURL=identity-index-service.d.mts.map

package/dist/serve-gib/identity-index/identity-index-service.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-service.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAKzD,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAIxH;;GAEG;AACH,qBAAa,oBAAoB;IAC7B,OAAO,CAAC,EAAE,CAAoC;IAC9C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,IAAI,CAAS;IAErB,YAAY,OAAO,CAAC,EAAE,2BAA2B,EAKhD;IA6CD;;;;OAIG;IACG,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,EACP,cAAc,GACjB,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,SAAS,CAAC;QACpB,cAAc,CAAC,EAAE,SAAS,CAAC;KAC9B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAyBpC;IAED;;;OAGG;IACG,qBAAqB,CAAC,EACxB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAQ5F;IAED;;;OAGG;IACG,aAAa,CAAC,EAChB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAmB3C;IAED;;;OAGG;IACG,mBAAmB,CAAC,EACtB,SAAS,GACZ,EAAE;QACC,SAAS,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAwB3C;IAED;;;OAGG;IACG,oBAAoB,CAAC,EACvB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAYnB;CACJ;AAID;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,oBAAoB,CAK9D"}
+{"version":3,"file":"identity-index-service.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAKzD,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAIxH;;GAEG;AACH,qBAAa,oBAAoB;IAC7B,OAAO,CAAC,EAAE,CAAoC;IAC9C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,IAAI,CAAS;IAErB,YAAY,OAAO,CAAC,EAAE,2BAA2B,EAKhD;IA6CD;;;;OAIG;IACG,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,EACP,cAAc,GACjB,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,SAAS,CAAC;QACpB,cAAc,CAAC,EAAE,SAAS,CAAC;KAC9B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAyBpC;IAED;;;OAGG;IACG,qBAAqB,CAAC,EACxB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAQ5F;IAED;;;OAGG;IACG,aAAa,CAAC,EAChB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAmB3C;IAED;;;OAGG;IACG,mBAAmB,CAAC,EACtB,SAAS,GACZ,EAAE;QACC,SAAS,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAwB3C;IAED;;;OAGG;IACG,oBAAoB,CAAC,EACvB,KAAK,GACR,EAAE;QACC,KAAK,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAYnB;CACJ;AAID;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,CAAC,EAAE,2BAA2B,GAAG,oBAAoB,CAQhG;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD"}

package/dist/serve-gib/identity-index/identity-index-service.mjs

@@ -193,10 +193,19 @@ let _identityIndexService;
 /**
  * Singleton factory getter for the IdentityIndexService.
  */
-export function getIdentityIndexService() {
+export function getIdentityIndexService(opts) {
+    if (opts) {
+        return new IdentityIndexService(opts);
+    }
     if (!_identityIndexService) {
         _identityIndexService = new IdentityIndexService();
     }
     return _identityIndexService;
 }
+/**
+ * Resets the cached singleton instance (useful during testing across different data directories).
+ */
+export function resetIdentityIndexService() {
+    _identityIndexService = undefined;
+}
 //# sourceMappingURL=identity-index-service.mjs.map

package/dist/serve-gib/identity-index/identity-index-service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-service.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,iDAAiD,CAAC;AAG1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGzF,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACrB,EAAE,GAAG,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC;IACtC,OAAO,CAAS;IAChB,IAAI,CAAS;IAErB,YAAY,OAAqC;QAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,+BAA+B,CAAC,CAAC;QAC1H,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,2BAA2B,CAAC;IACvF,CAAC;IAED,MAAM;IACN,+CAA+C;IAC/C,kFAAkF;IAClF,MAAM;IACN,0CAA0C;IAC1C,qBAAqB;IACrB,iCAAiC;IACjC,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,0CAA0C;IAC1C,4DAA4D;IAC5D,6BAA6B;IAC7B,8CAA8C;IAC9C,UAAU;IACV,IAAI;IAEJ,MAAM;IACN,kEAAkE;IAClE,qFAAqF;IACrF,MAAM;IACN,6CAA6C;IAC7C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,kGAAkG;IAClG,qFAAqF;IACrF,IAAI;IAEJ,MAAM;IACN,iDAAiD;IACjD,oFAAoF;IACpF,MAAM;IACN,4CAA4C;IAC5C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,oFAAoF;IACpF,IAAI;IAEJ;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,EACP,cAAc,GAKjB;QACG,MAAM,UAAU,GAAG,OAAO,IAAI,cAAc,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAAC,CAAC;QACjI,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS;SACZ,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAwB;YAChC,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,EACxB,KAAK,GAGR;QACG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAClC,OAAO;YACH,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC9B,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,EAChB,KAAK,GAGR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;QACpD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,SAAS,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEpG,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAE3D,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEzI,OAAO,UAAU,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,EACtB,SAAS,GAGZ;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC;QAC1D,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/E,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,QAAQ,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAClG,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAwB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxD,OAAO,MAAM,CAAC;YAClB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO,SAAS,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;QAEL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACvB,KAAK,GAGR;QACG,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,IAAI,qBAAuD,CAAC;AAE5D;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACnC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,qBAAqB,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"identity-index-service.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,iDAAiD,CAAC;AAG1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGzF,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACrB,EAAE,GAAG,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC;IACtC,OAAO,CAAS;IAChB,IAAI,CAAS;IAErB,YAAY,OAAqC;QAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,+BAA+B,CAAC,CAAC;QAC1H,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,2BAA2B,CAAC;IACvF,CAAC;IAED,MAAM;IACN,+CAA+C;IAC/C,kFAAkF;IAClF,MAAM;IACN,0CAA0C;IAC1C,qBAAqB;IACrB,iCAAiC;IACjC,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,0CAA0C;IAC1C,4DAA4D;IAC5D,6BAA6B;IAC7B,8CAA8C;IAC9C,UAAU;IACV,IAAI;IAEJ,MAAM;IACN,kEAAkE;IAClE,qFAAqF;IACrF,MAAM;IACN,6CAA6C;IAC7C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,kGAAkG;IAClG,qFAAqF;IACrF,IAAI;IAEJ,MAAM;IACN,iDAAiD;IACjD,oFAAoF;IACpF,MAAM;IACN,4CAA4C;IAC5C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,oFAAoF;IACpF,IAAI;IAEJ;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,EACP,cAAc,GAKjB;QACG,MAAM,UAAU,GAAG,OAAO,IAAI,cAAc,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAAC,CAAC;QACjI,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS;SACZ,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAwB;YAChC,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,EACxB,KAAK,GAGR;QACG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAClC,OAAO;YACH,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC9B,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,EAChB,KAAK,GAGR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;QACpD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,SAAS,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEpG,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAE3D,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEzI,OAAO,UAAU,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,EACtB,SAAS,GAGZ;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC;QAC1D,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/E,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,QAAQ,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAClG,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAwB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxD,OAAO,MAAM,CAAC;YAClB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO,SAAS,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;QAEL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACvB,KAAK,GAGR;QACG,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,IAAI,qBAAuD,CAAC;AAE5D;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAkC;IACtE,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,qBAAqB,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACrC,qBAAqB,GAAG,SAAS,CAAC;AACtC,CAAC"}

package/dist/serve-gib/index.d.mts

@@ -33,6 +33,7 @@ export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
 export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
 export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-add-master-password.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
 export * from './handlers/api/email/email-verification-code.handler.mjs';

package/dist/serve-gib/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAG5D,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gEAAgE,CAAC;AAC/E,cAAc,0EAA0E,CAAC;AACzF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAoB9C,MAAM,WAAW,uBAAuB;IACpC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,GAAE,uBAA4B,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CA0B3G"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAG5D,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gEAAgE,CAAC;AAC/E,cAAc,0EAA0E,CAAC;AACzF,cAAc,4EAA4E,CAAC;AAC3F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAqB9C,MAAM,WAAW,uBAAuB;IACpC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,GAAE,uBAA4B,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CA2B3G"}

package/dist/serve-gib/index.mjs

@@ -34,6 +34,7 @@ export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
 export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
 export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-add-master-password.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
 export * from './handlers/api/email/email-verification-code.handler.mjs';
@@ -56,6 +57,7 @@ import { SsoLoginHandler } from './handlers/api/keystone/sso-login.handler.mjs';
 import { SsoConfigHandler } from './handlers/api/keystone/sso-config.handler.mjs';
 import { KeystoneCustodianGenesisHandler } from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
 import { KeystoneCustodianRegisterDelegateHandler } from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
+import { KeystoneCustodianAddMasterPasswordHandler } from './handlers/api/identity/keystone-custodian-add-master-password.handler.mjs';
 import { EmailInboundHandler } from './handlers/api/email/email-inbound.handler.mjs';
 import { EmailOutboundHandler } from './handlers/api/email/email-outbound.handler.mjs';
 import { EmailVerificationCodeHandler } from './handlers/api/email/email-verification-code.handler.mjs';
@@ -79,6 +81,7 @@ export function getStandardServeGibHandlers(opts = {}) {
         new SsoConfigHandler(),
         new KeystoneCustodianGenesisHandler(),
         new KeystoneCustodianRegisterDelegateHandler(),
+        new KeystoneCustodianAddMasterPasswordHandler(),
         new EmailInboundHandler(),
         new EmailOutboundHandler(),
         new EmailVerificationCodeHandler(),

package/dist/serve-gib/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAE5D,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gEAAgE,CAAC;AAC/E,cAAc,0EAA0E,CAAC;AACzF,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gEAAgE,CAAC;AACjH,OAAO,EAAE,wCAAwC,EAAE,MAAM,0EAA0E,CAAC;AACpI,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAA4B,EAAE;IAC1E,MAAM,QAAQ,GAAgC;QAC1C,IAAI,aAAa,EAAE;QACnB,IAAI,YAAY,EAAE;QAClB,IAAI,sBAAsB,EAAE;QAC5B,IAAI,qBAAqB,EAAE;QAC3B,IAAI,mBAAmB,EAAE;QACzB,IAAI,kBAAkB,EAAE;QACxB,IAAI,qBAAqB,EAAE;QAC3B,IAAI,yBAAyB,EAAE;QAC/B,IAAI,cAAc,EAAE;QACpB,IAAI,eAAe,EAAE;QACrB,IAAI,gBAAgB,EAAE;QACtB,IAAI,+BAA+B,EAAE;QACrC,IAAI,wCAAwC,EAAE;QAC9C,IAAI,mBAAmB,EAAE;QACzB,IAAI,oBAAoB,EAAE;QAC1B,IAAI,4BAA4B,EAAE;QAClC,IAAI,6BAA6B,EAAE;KACtC,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/serve-gib/index.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAE5D,WAAW;AACX,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,qDAAqD,CAAC;AACpE,cAAc,0DAA0D,CAAC;AACzE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gEAAgE,CAAC;AAC/E,cAAc,0EAA0E,CAAC;AACzF,cAAc,4EAA4E,CAAC;AAC3F,cAAc,gDAAgD,CAAC;AAC/D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gEAAgE,CAAC;AACjH,OAAO,EAAE,wCAAwC,EAAE,MAAM,0EAA0E,CAAC;AACpI,OAAO,EAAE,yCAAyC,EAAE,MAAM,4EAA4E,CAAC;AACvI,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAA4B,EAAE;IAC1E,MAAM,QAAQ,GAAgC;QAC1C,IAAI,aAAa,EAAE;QACnB,IAAI,YAAY,EAAE;QAClB,IAAI,sBAAsB,EAAE;QAC5B,IAAI,qBAAqB,EAAE;QAC3B,IAAI,mBAAmB,EAAE;QACzB,IAAI,kBAAkB,EAAE;QACxB,IAAI,qBAAqB,EAAE;QAC3B,IAAI,yBAAyB,EAAE;QAC/B,IAAI,cAAc,EAAE;QACpB,IAAI,eAAe,EAAE;QACrB,IAAI,gBAAgB,EAAE;QACtB,IAAI,+BAA+B,EAAE;QACrC,IAAI,wCAAwC,EAAE;QAC9C,IAAI,yCAAyC,EAAE;QAC/C,IAAI,mBAAmB,EAAE;QACzB,IAAI,oBAAoB,EAAE;QAC1B,IAAI,4BAA4B,EAAE;QAClC,IAAI,6BAA6B,EAAE;KACtC,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/serve-gib/path-constants.d.mts

@@ -114,6 +114,10 @@ export declare const API_PATH_REGEXES: {
      * /api/identity/custodian/register-delegate
      */
     KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: RegExp;
+    /**
+     * /api/identity/custodian/add-master-password
+     */
+    KEYSTONE_CUSTODIAN_ADD_MASTER_PASSWORD: RegExp;
 };
 export declare const VALID_STATIC_PATH_REGEX: RegExp;
 //# sourceMappingURL=path-constants.d.mts.map

package/dist/serve-gib/path-constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"path-constants.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAK9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;IACzB;;OAEG;IACH,MAAM;IAEN;;OAEG;IACH,WAAW;IAEX;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,QAAQ;IAER;;OAEG;IACH,aAAa;IAEb;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,eAAe;IAEf;;;;;;;;OAQG;IACH,gBAAgB;IAEhB;;OAEG;IACH,eAAe;IAEf;;OAEG;IACH,oBAAoB;IAEpB;;;;;;;;;;;OAWG;IACH,aAAa;IACb;;OAEG;IACH,OAAO;IACP;;OAEG;IACH,iBAAiB;IACjB;;OAEG;IACH,kBAAkB;IAClB;;OAEG;IACH,mBAAmB;IACnB;;OAEG;IACH,aAAa;IACb;;OAEG;IACH,UAAU;IACV;;OAEG;IACH,uBAAuB;IAEvB;;OAEG;IACH,YAAY;IACZ,iBAAiB;IAEjB;;OAEG;IACH,0BAA0B;IAE1B;;OAEG;IACH,oCAAoC;CACvC,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAA4B,CAAC"}
+{"version":3,"file":"path-constants.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAK9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;IACzB;;OAEG;IACH,MAAM;IAEN;;OAEG;IACH,WAAW;IAEX;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,QAAQ;IAER;;OAEG;IACH,aAAa;IAEb;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,eAAe;IAEf;;;;;;;;OAQG;IACH,gBAAgB;IAEhB;;OAEG;IACH,eAAe;IAEf;;OAEG;IACH,oBAAoB;IAEpB;;;;;;;;;;;OAWG;IACH,aAAa;IACb;;OAEG;IACH,OAAO;IACP;;OAEG;IACH,iBAAiB;IACjB;;OAEG;IACH,kBAAkB;IAClB;;OAEG;IACH,mBAAmB;IACnB;;OAEG;IACH,aAAa;IACb;;OAEG;IACH,UAAU;IACV;;OAEG;IACH,uBAAuB;IAEvB;;OAEG;IACH,YAAY;IACZ,iBAAiB;IAEjB;;OAEG;IACH,0BAA0B;IAE1B;;OAEG;IACH,oCAAoC;IAEpC;;OAEG;IACH,sCAAsC;CACzC,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAA4B,CAAC"}

package/dist/serve-gib/path-constants.mjs

@@ -119,6 +119,10 @@ export const API_PATH_REGEXES = {
      * /api/identity/custodian/register-delegate
      */
     KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: /^\/api\/identity\/custodian\/register-delegate\/?$/i,
+    /**
+     * /api/identity/custodian/add-master-password
+     */
+    KEYSTONE_CUSTODIAN_ADD_MASTER_PASSWORD: /^\/api\/identity\/custodian\/add-master-password\/?$/i,
 };
 export const VALID_STATIC_PATH_REGEX = /^\/[a-zA-Z0-9\-_\.\/]*$/;
 //# sourceMappingURL=path-constants.mjs.map

package/dist/serve-gib/path-constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"path-constants.mjs","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAO,yBAAyB;IACtC,MAAM,EAAO,uBAAuB;IACpC,IAAI,EAAS,gBAAgB;IAC7B,UAAU,EAAG,wCAAwC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B;;OAEG;IACH,MAAM,EAAE,oBAAoB;IAE5B;;OAEG;IACH,WAAW,EAAE,oFAAoF;IAEjG;;OAEG;IACH,UAAU,EAAE,6EAA6E;IAEzF;;OAEG;IACH,QAAQ,EAAE,sBAAsB;IAEhC;;OAEG;IACH,aAAa,EAAE,mDAAmD;IAElE;;OAEG;IACH,UAAU,EAAE,mBAAmB;IAE/B;;OAEG;IACH,eAAe,EAAE,2DAA2D;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,+BAA+B;IAEjD;;OAEG;IACH,eAAe,EAAE,8BAA8B;IAE/C;;OAEG;IACH,oBAAoB,EAAE,mCAAmC;IAEzD;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,mDAAmD;IAC5D;;OAEG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;OAEG;IACH,kBAAkB,EAAE,kCAAkC;IACtD;;OAEG;IACH,mBAAmB,EAAE,mCAAmC;IACxD;;OAEG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,UAAU,EAAE,yBAAyB;IACrC;;OAEG;IACH,uBAAuB,EAAE,sCAAsC;IAE/D;;OAEG;IACH,YAAY,EAAE,2BAA2B;IACzC,iBAAiB,EAAE,gCAAgC;IAEnD;;OAEG;IACH,0BAA0B,EAAE,2CAA2C;IAEvE;;OAEG;IACH,oCAAoC,EAAE,qDAAqD;CAC9F,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"path-constants.mjs","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAO,yBAAyB;IACtC,MAAM,EAAO,uBAAuB;IACpC,IAAI,EAAS,gBAAgB;IAC7B,UAAU,EAAG,wCAAwC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B;;OAEG;IACH,MAAM,EAAE,oBAAoB;IAE5B;;OAEG;IACH,WAAW,EAAE,oFAAoF;IAEjG;;OAEG;IACH,UAAU,EAAE,6EAA6E;IAEzF;;OAEG;IACH,QAAQ,EAAE,sBAAsB;IAEhC;;OAEG;IACH,aAAa,EAAE,mDAAmD;IAElE;;OAEG;IACH,UAAU,EAAE,mBAAmB;IAE/B;;OAEG;IACH,eAAe,EAAE,2DAA2D;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,+BAA+B;IAEjD;;OAEG;IACH,eAAe,EAAE,8BAA8B;IAE/C;;OAEG;IACH,oBAAoB,EAAE,mCAAmC;IAEzD;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,mDAAmD;IAC5D;;OAEG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;OAEG;IACH,kBAAkB,EAAE,kCAAkC;IACtD;;OAEG;IACH,mBAAmB,EAAE,mCAAmC;IACxD;;OAEG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,UAAU,EAAE,yBAAyB;IACrC;;OAEG;IACH,uBAAuB,EAAE,sCAAsC;IAE/D;;OAEG;IACH,YAAY,EAAE,2BAA2B;IACzC,iBAAiB,EAAE,gCAAgC;IAEnD;;OAEG;IACH,0BAA0B,EAAE,2CAA2C;IAEvE;;OAEG;IACH,oCAAoC,EAAE,qDAAqD;IAE3F;;OAEG;IACH,sCAAsC,EAAE,uDAAuD;CAClG,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC"}

package/e2e/identity-custodian-lifecycle.e2e.md

@@ -91,3 +91,40 @@ Attempt to re-submit a previously consumed `custodianReqs` payload to `POST /api
 3. Verify rejection outcome:
    - Server rejects the request with **HTTP 409 Conflict**:
      `"Custodian requirements payload has already been used. Nonce single-turn reservation violation."`
+
+
+### Phase 4: Keystone Details Inspection & Sovereign Elevation
+Inspect the identity in `<ibgib-keystone-details>` to verify that capabilities, device badges, and password options adapt dynamically to the custodial state, and add a sovereign master password.
+
+#### Steps
+1. In Browser 1, open `<ibgib-identity-header>` and click the active identity to open `<ibgib-keystone-details>`.
+2. Verify dynamic UI elements:
+   - **Password Card**: Displays **"Add Master Password"** (with New Password and Confirm Password inputs; Current Password is hidden).
+   - **SSO Status Card**: Displays `"Google (Primary Account) ✅"` or provider primary indicator.
+   - **Registered Delegates Table**:
+     - Browser 1's delegate displays the green **"This Device"** badge.
+     - Browser 2's delegate (from Phase 2) displays the blue **"Remote Device"** badge.
+3. Click **View Details** on Browser 2's remote delegate:
+   - Verify modal opens showing remote device metadata without throwing or failing.
+4. In the **Add Master Password** card, enter `<E2E_TEST_NEW_PASSWORD>` in New Password and Confirm Password inputs, and click **Add Master Password**.
+5. Verify outcomes:
+   - Client adds a sovereign `manage` pool via `keystoneService.addPools()`, evolves the primary identity, and syncs to server.
+   - The password card updates dynamically to **"Change Password"** (now displaying Current Password input).
+   - Identity capability transitions from Custodial to **Hybrid**.
+
+
+### Phase 5: Silent Background Sync & Expired Session Renewal ("Sign Back In")
+Verify that daily background sync operations execute silently via stored IndexedDB delegate tokens ($S_D$), and verify that expired sync delegates cleanly pause sync and prompt the user to "Sign Back In".
+
+#### Steps
+1. In Browser 1, click **Check for Updates** and **Update Identity**:
+   - Verify sync succeeds silently in the background without prompting for master passwords.
+2. Simulate delegate expiration / session expiry:
+   - Option A: Clear the stored device delegate secret from IndexedDB (`space_gib_db` -> `space_gib_store` -> delete `ibgib_device_delegate_secret_<primaryTjpAddr>`).
+   - Option B: Test with a short TTL development profile (`sync-profile.dev.json` with `defaultTtlSeconds: 10`) and wait for expiration.
+3. Trigger a sync check or page refresh:
+   - Verify `KeystoneSyncService` detects the expired / missing delegate token and fires `EVENT_IBGIB_IDENTITY_RENEWAL_REQUIRED`.
+   - Verify the UI prompts the user to **"Sign Back In"**.
+4. Re-authenticate via Email OTP (or Google SSO / Master Password):
+   - Verify single-turn re-authentication generates and registers a fresh outward sync delegate ($D_{\text{device}}$).
+   - Verify the new secret ($S_D$) is stored in IndexedDB and silent background sync resumes seamlessly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/node-gib",
-  "version": "0.0.19",
+  "version": "0.0.20",
   "description": "Node and server-specific ibGib code, i.e., things that don't run in the browser.",
   "funding": {
     "type": "individual",
@@ -26,7 +26,7 @@
   "dependencies": {
     "@ibgib/helper-gib": "^0.0.37",
     "@ibgib/ts-gib": "^0.5.34",
-    "@ibgib/core-gib": "^0.1.74",
+    "@ibgib/core-gib": "^0.1.75",
     "@ibgib/encrypt-gib": "^0.3.1"
   },
   "devDependencies": {

package/src/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.mts

@@ -0,0 +1,245 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler
+ *
+ * POST /api/identity/custodian/add-master-password
+ *
+ * Single-turn sovereignty elevation endpoint for purely custodial identities.
+ * Authenticates the user via fresh OAuth code or 6-digit email OTP, validates that
+ * the provided `newManagePool` config matches the existing custodian pool config,
+ * evolves the custodian manage pool into an auxiliary inward custodian pool (e.g. `custodian-manage-google`),
+ * installs the user's new sovereign pool as `manage`, and signs the evolution using the server's custodian secret.
+ */
+
+import { extractErrorMsg, hash } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
+import { getTjpAddr } from '@ibgib/core-gib/dist/common/other/ibgib-helper.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { KeystoneChallengePool } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { CUSTODIAN_POOL_ID_PREFIX } from '@ibgib/core-gib/dist/keystone/delegate/delegate-constants.mjs';
+import { KeystoneClaim } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { validateEmail } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
+
+import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
+import { API_PATH_REGEXES } from '../../../path-constants.mjs';
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
+import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
+import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
+import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
+import { SsoProviderId } from '../../../../identity/sso/sso-types.mjs';
+import { getPendingStagingDir, getPendingTjpHash, verifyPendingCode } from '../../../../email/verify/email-verify-helpers.mjs';
+
+const logalot = GLOBAL_LOG_A_LOT || true;
+
+let custodian: SsoCustodianService | undefined;
+function getCustodian(): SsoCustodianService {
+    if (!custodian) {
+        const config = loadSsoServerConfig();
+        custodian = new SsoCustodianService(config);
+    }
+    return custodian;
+}
+
+export interface CustodianAddMasterPasswordRequestBody {
+    primaryTjpAddr: string;
+    newManagePool: KeystoneChallengePool;
+    providerId?: SsoProviderId;
+    code?: string;
+    redirectUri?: string;
+    email?: string;
+}
+
+export interface CustodianAddMasterPasswordResponseBody {
+    success: boolean;
+    primaryTjpAddr: string;
+    primaryKeystone: any;
+    message?: string;
+}
+
+/**
+ * POST /api/identity/custodian/add-master-password
+ */
+export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBase<undefined, undefined> {
+    protected override lc: string = `[${KeystoneCustodianAddMasterPasswordHandler.name}]`;
+    protected override method: ServeGibHttpMethod = 'POST';
+    protected override regex = API_PATH_REGEXES.KEYSTONE_CUSTODIAN_ADD_MASTER_PASSWORD;
+
+    protected async handleRouteImpl(
+        reqCtx: RequestContext<undefined, undefined>
+    ): Promise<ResponseResult | undefined> {
+        const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 8a1b2c3d4e5f67890a1b2c3d4e5f6790)`); }
+
+            if (reqCtx.method !== 'POST') {
+                return this.error(405, 'Method Not Allowed');
+            }
+
+            if (!reqCtx.body) {
+                return this.error(400, 'Request body is empty (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6791)');
+            }
+
+            let body: CustodianAddMasterPasswordRequestBody;
+            try {
+                body = JSON.parse(reqCtx.body);
+            } catch {
+                return this.error(400, 'Request body must be valid JSON (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6792)');
+            }
+
+            const { primaryTjpAddr, newManagePool, providerId, code, redirectUri, email } = body;
+
+            if (!primaryTjpAddr) {
+                return this.error(400, 'primaryTjpAddr is required (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6793)');
+            }
+
+            if (!newManagePool || typeof newManagePool !== 'object' || newManagePool.id !== POOL_ID_MANAGE) {
+                return this.error(400, 'newManagePool is invalid. Must be an object with id "manage" (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6794)');
+            }
+
+            if (!newManagePool.challenges || Object.keys(newManagePool.challenges).length === 0) {
+                return this.error(400, 'newManagePool must contain pre-generated public challenges (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6795)');
+            }
+
+            // 1. Authenticate user credentials via OAuth code or Email OTP
+            let verifiedEmail: string;
+            let effectiveProvider: string = providerId || 'email';
+
+            if (providerId && code && redirectUri) {
+                const service = getCustodian();
+                const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
+                if (!userInfo || !userInfo.email) {
+                    return this.error(401, `Failed to authenticate with SSO provider ${providerId} (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6796)`);
+                }
+                verifiedEmail = normalizeEmail(userInfo.email);
+            } else if (email && code) {
+                if (!validateEmail(email)) {
+                    return this.error(400, 'Invalid email address format (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6797)');
+                }
+                verifiedEmail = normalizeEmail(email);
+
+                const tjpHash = await getPendingTjpHash(primaryTjpAddr);
+                const pendingInfo = reqCtx.dataDir && tjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash }) : undefined;
+
+                if (!pendingInfo || pendingInfo.isExpired) {
+                    return this.error(400, 'Verification record missing or expired. Please request a new verification code. (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6798)');
+                }
+
+                const codeVerifyResult = await verifyPendingCode({
+                    pendingDir: pendingInfo.pendingDir,
+                    code,
+                });
+
+                if (!codeVerifyResult.valid) {
+                    return this.error(401, codeVerifyResult.error || 'Invalid verification code (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6799)');
+                }
+            } else {
+                return this.error(400, 'Authentication credentials required (providerId+code+redirectUri or email+code) (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679a)');
+            }
+
+            // 2. Lookup primary identity and confirm email matches
+            const indexService = getIdentityIndexService();
+            const identityRecord = await indexService.lookupIdentityByEmail({ email: verifiedEmail });
+            if (!identityRecord || identityRecord.primaryTjpAddr !== primaryTjpAddr) {
+                return this.error(403, `Authenticated email ${verifiedEmail} does not match primary identity ${primaryTjpAddr} (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679b)`);
+            }
+
+            // 3. Bootstrap domain metaspace and load latest keystone
+            const metaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) {
+                return this.error(500, `Local domain space not found for identity ${primaryTjpAddr}`);
+            }
+
+            const keystoneService = new KeystoneService_V1();
+            const latestKeystone = await keystoneService.getLatestKeystone({
+                addr: primaryTjpAddr,
+                metaspace,
+                space
+            });
+
+            if (!latestKeystone || !latestKeystone.data) {
+                return this.error(404, `Primary identity keystone not found for address ${primaryTjpAddr}`);
+            }
+
+            // 4. Verify existing custodial manage pool
+            const prevPools = latestKeystone.data.challengePools || [];
+            const existingManagePool = prevPools.find(p => p.id === POOL_ID_MANAGE);
+            if (!existingManagePool) {
+                return this.error(400, 'Primary keystone missing active "manage" pool (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679c)');
+            }
+
+            // Validate new pool config matches existing manage pool config structure
+            if (existingManagePool.config?.type && newManagePool.config?.type !== existingManagePool.config.type) {
+                return this.error(400, `newManagePool type "${newManagePool.config?.type}" does not match required type "${existingManagePool.config.type}" (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679d)`);
+            }
+
+            // 5. Build next pool set:
+            // Convert existing custodian manage pool to auxiliary custodian pool (e.g. custodian-manage-google)
+            // and install user's newManagePool as 'manage'.
+            const custodianPoolId = `${CUSTODIAN_POOL_ID_PREFIX}${effectiveProvider}`;
+            const auxiliaryCustodianPool: KeystoneChallengePool = {
+                ...existingManagePool,
+                id: custodianPoolId,
+            };
+
+            const nextPools: KeystoneChallengePool[] = [];
+            for (const pool of prevPools) {
+                if (pool.id === POOL_ID_MANAGE) {
+                    nextPools.push(newManagePool);
+                    nextPools.push(auxiliaryCustodianPool);
+                } else if (pool.id === custodianPoolId) {
+                    // Skip if already present to prevent duplicate
+                } else {
+                    nextPools.push(pool);
+                }
+            }
+
+            // 6. Sign evolution turn using server's custodian secret
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const primarySecret = await hash({ s: `${serverSecret}_custodian_${verifiedEmail}` });
+
+            const claim: Partial<KeystoneClaim> = {
+                verb: KEYSTONE_VERB_MANAGE,
+                target: getIbGibAddr({ ibGib: latestKeystone })
+            };
+
+            const evolvedKeystone = await keystoneService.sign({
+                latestKeystone,
+                masterSecret: primarySecret,
+                claim,
+                poolId: POOL_ID_MANAGE,
+                metaspace,
+                space,
+                dataToPatch: {
+                    challengePools: nextPools,
+                    frameDetails: {
+                        action: 'add_master_password',
+                        custodyMode: 'hybrid',
+                        elevatedAt: new Date().toISOString(),
+                    }
+                }
+            });
+
+            // 7. Persist evolved keystone in domain space
+            await metaspace.put({ ibGibs: [evolvedKeystone], space });
+            await metaspace.registerNewIbGib({ ibGib: evolvedKeystone, space });
+
+            const response: CustodianAddMasterPasswordResponseBody = {
+                success: true,
+                primaryTjpAddr,
+                primaryKeystone: evolvedKeystone,
+                message: 'Successfully elevated identity to sovereign master password'
+            };
+
+            return this.ok(response);
+
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            return this.error(500, `Internal error adding master password: ${extractErrorMsg(error)}`);
+        }
+    }
+}

package/src/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.respec.mts

@@ -0,0 +1,167 @@
+import { existsSync, rmSync } from 'node:fs';
+
+import {
+    respecfully,
+    iReckon,
+    ifWe,
+    ifWeMight
+} from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+
+import { KeystoneCustodianGenesisHandler } from './keystone-custodian-genesis.handler.mjs';
+import { KeystoneCustodianAddMasterPasswordHandler } from './keystone-custodian-add-master-password.handler.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { CUSTODIAN_POOL_ID_PREFIX } from '@ibgib/core-gib/dist/keystone/delegate/delegate-constants.mjs';
+import { generatePoolChallenges } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
+import { getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord, savePendingStagingKeystone } from '../../../../email/verify/email-verify-helpers.mjs';
+import { resetIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+
+const sir = `[${import.meta.url}]`;
+
+await respecfully(sir, 'KeystoneCustodianAddMasterPasswordHandler', async () => {
+    const testDataDir = './test-data-custodian-add-password';
+
+    if (existsSync(testDataDir)) {
+        rmSync(testDataDir, { recursive: true, force: true });
+    }
+
+    const origDataDir = process.env.DATA_DIR;
+    process.env.DATA_DIR = testDataDir;
+    process.env.KEYSTONE_PROFILE_CUSTODIAN_PRIMARY = 'primary-profile.dev';
+    process.env.SSO_SERVER_KDF_SECRET = 'test-sso-server-kdf-secret-12345';
+    process.env.SESSION_SECRET = 'test-session-secret-12345';
+    resetIdentityIndexService();
+
+    const genesisHandler = new KeystoneCustodianGenesisHandler();
+    const addPasswordHandler = new KeystoneCustodianAddMasterPasswordHandler();
+
+    await ifWe(sir, 'reject request with 400 if required fields are missing', async () => {
+        const reqCtx: any = {
+            method: 'POST',
+            pathname: '/api/identity/custodian/add-master-password',
+            url: new URL('http://localhost/api/identity/custodian/add-master-password'),
+            body: JSON.stringify({}),
+            dataDir: testDataDir
+        };
+
+        const res = await addPasswordHandler.handleRoute(reqCtx);
+        iReckon(sir, res?.status).isGonnaBe(400);
+    });
+
+    await ifWe(sir, 'successfully elevate custodial identity to sovereign master password', async () => {
+        try {
+            const email = 'alice.elevate@example.com';
+            const genesisCode = '123456';
+
+            // 1. Create custodial identity via genesis handler with staged code
+            const genesisStaging = await savePendingStagingKeystone({
+                primaryTjpAddr: `pending:${email}`,
+                emails: [email],
+                dataDir: testDataDir,
+            });
+            await savePendingCodeRecord({
+                pendingDir: genesisStaging.pendingDir,
+                code: genesisCode,
+            });
+
+            const genesisReqCtx: any = {
+                method: 'POST',
+                pathname: '/api/identity/custodian/genesis',
+                url: new URL('http://localhost/api/identity/custodian/genesis'),
+                body: JSON.stringify({ email, username: 'alice', code: genesisCode }),
+                dataDir: testDataDir
+            };
+
+            const genesisRes = await genesisHandler.handleRoute(genesisReqCtx);
+            if (genesisRes?.status !== 201) {
+                console.error(`[DEBUG] genesisRes failed: ${genesisRes?.status}, body:`, JSON.stringify(genesisRes?.body));
+            }
+            iReckon(sir, genesisRes?.status).isGonnaBe(201);
+
+            const genesisBody = typeof genesisRes?.body === 'string' ? JSON.parse(genesisRes?.body) : genesisRes?.body;
+            const primaryTjpAddr = genesisBody.primaryTjpAddr;
+            const initialKeystone = genesisBody.primaryKeystone;
+
+            iReckon(sir, primaryTjpAddr).not.isGonnaBeUndefined();
+            iReckon(sir, initialKeystone).not.isGonnaBeUndefined();
+
+            const initialManagePool = initialKeystone.data.challengePools.find((p: any) => p.id === POOL_ID_MANAGE);
+            iReckon(sir, initialManagePool).not.isGonnaBeUndefined();
+
+            // 2. Generate new sovereign manage challenge pool locally with user's new password
+            const userNewPassword = 'AliceSuperSecretPassphrase2026!';
+            const newChallenges = await generatePoolChallenges({
+                config: initialManagePool.config,
+                masterSecret: userNewPassword,
+            });
+            const newManagePool = {
+                id: POOL_ID_MANAGE,
+                config: initialManagePool.config,
+                challenges: newChallenges,
+            };
+
+            // Stage verification code for the elevation turn
+            const elevateStaging = await savePendingStagingKeystone({
+                primaryTjpAddr,
+                emails: [email],
+                dataDir: testDataDir,
+            });
+            const elevateCode = '654321';
+            await savePendingCodeRecord({
+                pendingDir: elevateStaging.pendingDir,
+                code: elevateCode,
+            });
+
+            // 3. Call add-master-password endpoint
+            const addPasswordReqCtx: any = {
+                method: 'POST',
+                pathname: '/api/identity/custodian/add-master-password',
+                url: new URL('http://localhost/api/identity/custodian/add-master-password'),
+                body: JSON.stringify({
+                    primaryTjpAddr,
+                    email,
+                    code: elevateCode,
+                    newManagePool,
+                }),
+                dataDir: testDataDir
+            };
+
+            const addPasswordRes = await addPasswordHandler.handleRoute(addPasswordReqCtx);
+            if (addPasswordRes?.status !== 200) {
+                console.error(`[DEBUG] addPasswordRes failed with status: ${addPasswordRes?.status}, body:`, addPasswordRes?.body);
+            }
+            iReckon(sir, addPasswordRes?.status).isGonnaBe(200);
+
+            const addPasswordBody = typeof addPasswordRes?.body === 'string' ? JSON.parse(addPasswordRes?.body) : addPasswordRes?.body;
+            iReckon(sir, addPasswordBody.success).isGonnaBeTrue();
+            iReckon(sir, addPasswordBody.primaryTjpAddr).isGonnaBe(primaryTjpAddr);
+
+            const evolvedKeystone = addPasswordBody.primaryKeystone;
+            iReckon(sir, evolvedKeystone).not.isGonnaBeUndefined();
+            iReckon(sir, evolvedKeystone.data.n).isGonnaBe(1);
+            iReckon(sir, evolvedKeystone.data.frameDetails.custodyMode).isGonnaBe('hybrid');
+
+            // Check pools: should contain both 'manage' and 'custodian-manage-email'
+            const poolIds = evolvedKeystone.data.challengePools.map((p: any) => p.id);
+            iReckon(sir, poolIds.includes('manage')).isGonnaBeTrue();
+            iReckon(sir, poolIds.includes(`${CUSTODIAN_POOL_ID_PREFIX}email`)).isGonnaBeTrue();
+
+            // 4. Verify user password solves the evolved manage pool
+            const keystoneService = new KeystoneService_V1();
+            const isUserPasswordValid = await keystoneService.verifySigningSecret({
+                keystoneIbGib: evolvedKeystone,
+                signingSecret: userNewPassword,
+                poolId: POOL_ID_MANAGE,
+            });
+            iReckon(sir, isUserPasswordValid).isGonnaBeTrue();
+        } catch (error) {
+            console.error(`[DEBUG TEST 2 EXCEPTION]`, error);
+            throw error;
+        }
+    });
+
+    if (existsSync(testDataDir)) {
+        rmSync(testDataDir, { recursive: true, force: true });
+    }
+    process.env.DATA_DIR = origDataDir;
+});

package/src/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.respec.mts

@@ -10,7 +10,7 @@ import { KeystoneCustodianGenesisHandler } from './keystone-custodian-genesis.ha
 import { KeystoneCustodianRegisterDelegateHandler } from './keystone-custodian-register-delegate.handler.mjs';
 import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
 import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
-import { deriveLocalCustodianDelegateSecret } from '@ibgib/web-gib/dist/identity/custodian-delegate-helper.mjs';
+import { deriveDeviceDelegateSecret } from '@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs';
 import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
 
 const sir = `[${import.meta.url}]`;
@@ -58,7 +58,7 @@ await respecfully(sir, 'KeystoneCustodianRegisterDelegateHandler', async () => {
         iReckon(sir, custodianReqs).not.isGonnaBeUndefined();
 
         // Step 2: Build client delegate keystone containing custodianReqs
-        const delegateSecret = await deriveLocalCustodianDelegateSecret({ primaryTjpAddr });
+        const delegateSecret = await deriveDeviceDelegateSecret({ primaryTjpAddr, deviceTag: 'phone' });
         const delegateBuilder = KeystoneProfileBuilder.buildKeystone('sync-profile.dev')
             .withUsername('bob-sync-phone')
             .withDescription('Sync Delegate for bob on phone')

package/src/serve-gib/handlers/api/keystone/sso-login.handler.mts

@@ -149,6 +149,7 @@ export class SsoLoginHandler extends ServeGibHandlerBase<undefined, undefined> {
                         client: 'space-gib-server',
                         role: 'custodian-primary',
                         custodianProvider: providerId,
+                        custodyMode: 'full',
                         [`rawSSOName-${providerId}`]: rawSSOName,
                     });
 

package/src/serve-gib/identity-index/identity-index-service.mts

@@ -218,9 +218,19 @@ let _identityIndexService: IdentityIndexService | undefined;
 /**
  * Singleton factory getter for the IdentityIndexService.
  */
-export function getIdentityIndexService(): IdentityIndexService {
+export function getIdentityIndexService(opts?: IdentityIndexServiceOptions): IdentityIndexService {
+    if (opts) {
+        return new IdentityIndexService(opts);
+    }
     if (!_identityIndexService) {
         _identityIndexService = new IdentityIndexService();
     }
     return _identityIndexService;
 }
+
+/**
+ * Resets the cached singleton instance (useful during testing across different data directories).
+ */
+export function resetIdentityIndexService(): void {
+    _identityIndexService = undefined;
+}

package/src/serve-gib/index.mts

@@ -36,6 +36,7 @@ export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
 export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
 export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-add-master-password.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
 export * from './handlers/api/email/email-verification-code.handler.mjs';
@@ -60,6 +61,7 @@ import { SsoLoginHandler } from './handlers/api/keystone/sso-login.handler.mjs';
 import { SsoConfigHandler } from './handlers/api/keystone/sso-config.handler.mjs';
 import { KeystoneCustodianGenesisHandler } from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
 import { KeystoneCustodianRegisterDelegateHandler } from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
+import { KeystoneCustodianAddMasterPasswordHandler } from './handlers/api/identity/keystone-custodian-add-master-password.handler.mjs';
 import { EmailInboundHandler } from './handlers/api/email/email-inbound.handler.mjs';
 import { EmailOutboundHandler } from './handlers/api/email/email-outbound.handler.mjs';
 import { EmailVerificationCodeHandler } from './handlers/api/email/email-verification-code.handler.mjs';
@@ -89,6 +91,7 @@ export function getStandardServeGibHandlers(opts: StandardHandlersOptions = {}):
         new SsoConfigHandler(),
         new KeystoneCustodianGenesisHandler(),
         new KeystoneCustodianRegisterDelegateHandler(),
+        new KeystoneCustodianAddMasterPasswordHandler(),
         new EmailInboundHandler(),
         new EmailOutboundHandler(),
         new EmailVerificationCodeHandler(),

package/src/serve-gib/path-constants.mts

@@ -134,6 +134,11 @@ export const API_PATH_REGEXES = {
      * /api/identity/custodian/register-delegate
      */
     KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: /^\/api\/identity\/custodian\/register-delegate\/?$/i,
+
+    /**
+     * /api/identity/custodian/add-master-password
+     */
+    KEYSTONE_CUSTODIAN_ADD_MASTER_PASSWORD: /^\/api\/identity\/custodian\/add-master-password\/?$/i,
 };
 
 export const VALID_STATIC_PATH_REGEX = /^\/[a-zA-Z0-9\-_\.\/]*$/;