@ibgib/node-gib 0.0.19 → 0.0.21

package/src/serve-gib/handlers/api/email/email-verification-code.handler.mts

@@ -4,7 +4,10 @@
  * Handler for POST /api/email/verification-code
  */
 
-import { extractErrorMsg, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import * as path from 'node:path';
+import * as fs from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { extractErrorMsg, getUUID, delay } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { EmailSenderAws } from '../../../../email/aws/email-sender-aws.mjs';
 // import { generateVerificationCode, getPendingTjpHash, savePendingCodeRecord, getPendingStagingDir, validateEmail } from '../../../../email/index.mjs';
 import { EmailSender, OutboundEmail } from '../../../../email/email-types.mjs';
@@ -13,7 +16,7 @@ import { API_PATH_REGEXES } from '../../../path-constants.mjs';
 import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
 import { ServeGibHandlerBase } from '../../handler-base.mjs';
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
-import { createDefaultEmailSender, generateVerificationCode, getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord, savePendingStagingKeystone } from '../../../../email/verify/email-verify-helpers.mjs';
+import { createDefaultEmailSender, generateVerificationCode, getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord, savePendingStagingKeystone, PendingCodeRecord } from '../../../../email/verify/email-verify-helpers.mjs';
 import { validateEmail } from '../../../../email/email-helpers.mjs';
 import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
 
@@ -75,11 +78,14 @@ export class EmailVerificationCodeHandler extends ServeGibHandlerBase {
                 return this.error(400, 'Invalid email address format (E: e3f4a5b67890123456789abcdef012)');
             }
 
+            // Artificial delay to mitigate brute force & timing attacks (min 1s)
+            await delay(1000 + Math.random() * 500);
+
             const normEmail = normalizeEmail(email);
             const effectivePrimaryTjpAddr = primaryTjpAddr || `pending:${normEmail}`;
             const tjpHash = await getPendingTjpHash(effectivePrimaryTjpAddr);
 
-            const code = generateVerificationCode();
+            let code: string = generateVerificationCode();
             if (reqCtx.dataDir && tjpHash) {
                 let info = await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash });
                 if (!info) {
@@ -93,8 +99,49 @@ export class EmailVerificationCodeHandler extends ServeGibHandlerBase {
                 }
 
                 if (info) {
-                    await savePendingCodeRecord({ pendingDir: info.pendingDir, code });
-                    if (logalot) { console.timeLog(timestampUUID, 'code record saved to pending staging'); }
+                    const codeFilePath = path.join(info.pendingDir, 'code.json');
+                    let existingRecord: PendingCodeRecord | undefined;
+                    if (existsSync(codeFilePath)) {
+                        try {
+                            existingRecord = JSON.parse(await fs.readFile(codeFilePath, 'utf-8'));
+                        } catch { /* ignore corrupted record */ }
+                    }
+
+                    const now = Date.now();
+                    if (existingRecord) {
+                        // Check 30-second cooldown
+                        const elapsedMs = now - (existingRecord.dispatchedAt || 0);
+                        if (elapsedMs < 30_000) {
+                            const remainingSecs = Math.ceil((30_000 - elapsedMs) / 1000);
+                            return this.error(429, `Please wait ${remainingSecs}s before requesting another verification code.`);
+                        }
+
+                        // Check Max Resend limit (5 resends per 15-minute window)
+                        if (existingRecord.resendCount >= 5 && now < existingRecord.expiresAt) {
+                            return this.error(429, 'Too many verification code requests. Please wait 15 minutes before trying again.');
+                        }
+
+                        // Reuse existing valid code if not expired and attempts < maxAttempts
+                        if (existingRecord.rawCode && now < existingRecord.expiresAt && existingRecord.attempts < existingRecord.maxAttempts) {
+                            code = existingRecord.rawCode;
+                            existingRecord.dispatchedAt = now;
+                            existingRecord.resendCount = (existingRecord.resendCount || 0) + 1;
+                            await fs.writeFile(codeFilePath, JSON.stringify(existingRecord, null, 2), 'utf-8');
+                        } else {
+                            // Generate fresh code and increment resendCount
+                            code = generateVerificationCode();
+                            await savePendingCodeRecord({
+                                pendingDir: info.pendingDir,
+                                code,
+                                resendCount: (existingRecord.resendCount || 0) + 1,
+                                attempts: 0,
+                            });
+                        }
+                    } else {
+                        code = generateVerificationCode();
+                        await savePendingCodeRecord({ pendingDir: info.pendingDir, code, resendCount: 0, attempts: 0 });
+                    }
+                    if (logalot) { console.timeLog(timestampUUID, 'code record processed in pending staging'); }
                 } else {
                     console.warn(`${lc} Failed to create or access pending staging directory for tjpHash ${tjpHash}`);
                 }

package/src/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.mts

@@ -0,0 +1,252 @@
+/**
+ * @module serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler
+ *
+ * POST /api/identity/custodian/add-master-password
+ *
+ * Single-turn sovereignty elevation endpoint for purely custodial identities.
+ * Authenticates the user via fresh OAuth code or 6-digit email OTP, validates that
+ * the provided `newManagePool` config matches the existing custodian pool config,
+ * evolves the custodian manage pool into an auxiliary inward custodian pool (e.g. `custodian-manage-google`),
+ * installs the user's new sovereign pool as `manage`, and signs the evolution using the server's custodian secret.
+ */
+
+import { extractErrorMsg, hash } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
+import { getTjpAddr } from '@ibgib/core-gib/dist/common/other/ibgib-helper.mjs';
+import { getDependencyGraph } from '@ibgib/core-gib/dist/common/other/graph-helper.mjs';
+import { FlatIbGibGraph } from '@ibgib/core-gib/dist/common/other/graph-types.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { KeystoneChallengePool } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { CUSTODIAN_POOL_ID_PREFIX } from '@ibgib/core-gib/dist/keystone/delegate/delegate-constants.mjs';
+import { KeystoneClaim } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { validateEmail } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
+
+import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
+import { API_PATH_REGEXES } from '../../../path-constants.mjs';
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
+import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
+import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
+import { getSsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
+import { SsoProviderId } from '../../../../identity/sso/sso-types.mjs';
+import { getPendingStagingDir, getPendingTjpHash, verifyPendingCode } from '../../../../email/verify/email-verify-helpers.mjs';
+
+const logalot = GLOBAL_LOG_A_LOT || true;
+
+export interface CustodianAddMasterPasswordRequestBody {
+    code: string;
+    providerId?: SsoProviderId;
+    redirectUri?: string;
+    email?: string;
+    primaryTjpAddr: string;
+    newManagePool: KeystoneChallengePool;
+}
+
+export interface CustodianAddMasterPasswordResponseBody {
+    success: boolean;
+    primaryTjpAddr?: string;
+    primaryKeystone?: any;
+    primaryGraph?: FlatIbGibGraph;
+    message?: string;
+    error?: string;
+}
+
+/**
+ * POST /api/identity/custodian/add-master-password
+ */
+export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBase<undefined, undefined> {
+    protected override lc: string = `[${KeystoneCustodianAddMasterPasswordHandler.name}]`;
+    protected override method: ServeGibHttpMethod = 'POST';
+    protected override regex = API_PATH_REGEXES.KEYSTONE_CUSTODIAN_ADD_MASTER_PASSWORD;
+
+    protected async handleRouteImpl(
+        reqCtx: RequestContext<undefined, undefined>
+    ): Promise<ResponseResult | undefined> {
+        const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 8a1b2c3d4e5f67890a1b2c3d4e5f6790)`); }
+
+            if (reqCtx.method !== 'POST') {
+                return this.error(405, 'Method Not Allowed');
+            }
+
+            if (!reqCtx.body) {
+                return this.error(400, 'Request body is empty (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6791)');
+            }
+
+            let body: CustodianAddMasterPasswordRequestBody;
+            try {
+                body = JSON.parse(reqCtx.body);
+            } catch {
+                return this.error(400, 'Request body must be valid JSON (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6792)');
+            }
+
+            const { primaryTjpAddr, newManagePool, providerId, code, redirectUri, email } = body;
+
+            if (!primaryTjpAddr) {
+                return this.error(400, 'primaryTjpAddr is required (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6793)');
+            }
+
+            if (!newManagePool || typeof newManagePool !== 'object' || newManagePool.id !== POOL_ID_MANAGE) {
+                return this.error(400, 'newManagePool is invalid. Must be an object with id "manage" (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6794)');
+            }
+
+            if (!newManagePool.challenges || Object.keys(newManagePool.challenges).length === 0) {
+                return this.error(400, 'newManagePool must contain pre-generated public challenges (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6795)');
+            }
+
+            // 1. Authenticate user credentials via OAuth code or Email OTP
+            let verifiedEmail: string;
+            let effectiveProvider: string = providerId || 'email';
+
+            if (providerId && code && redirectUri) {
+                const service = getSsoCustodianService();
+                const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
+                if (!userInfo || !userInfo.email) {
+                    return this.error(401, `Failed to authenticate with SSO provider ${providerId} (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6796)`);
+                }
+                verifiedEmail = normalizeEmail(userInfo.email);
+            } else if (email && code) {
+                if (!validateEmail(email)) {
+                    return this.error(400, 'Invalid email address format (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6797)');
+                }
+                verifiedEmail = normalizeEmail(email);
+
+                const tjpHash = await getPendingTjpHash(primaryTjpAddr);
+                let pendingInfo = reqCtx.dataDir && tjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash }) : undefined;
+                if (!pendingInfo) {
+                    const emailTjpHash = await getPendingTjpHash(`pending:${verifiedEmail}`);
+                    pendingInfo = reqCtx.dataDir && emailTjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash: emailTjpHash }) : undefined;
+                }
+
+                if (!pendingInfo || pendingInfo.isExpired) {
+                    return this.error(400, 'Verification record missing or expired. Please request a new verification code. (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6798)');
+                }
+
+                const codeVerifyResult = await verifyPendingCode({
+                    pendingDir: pendingInfo.pendingDir,
+                    code,
+                });
+
+                if (!codeVerifyResult.valid) {
+                    return this.error(401, codeVerifyResult.error || 'Invalid verification code (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6799)');
+                }
+            } else {
+                return this.error(400, 'Authentication credentials required (providerId+code+redirectUri or email+code) (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679a)');
+            }
+
+            // 2. Lookup primary identity and confirm email matches
+            const indexService = getIdentityIndexService();
+            const identityRecord = await indexService.lookupIdentityByEmail({ email: verifiedEmail });
+            if (!identityRecord || identityRecord.primaryTjpAddr !== primaryTjpAddr) {
+                return this.error(403, `Authenticated email ${verifiedEmail} does not match primary identity ${primaryTjpAddr} (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679b)`);
+            }
+
+            // 3. Bootstrap domain metaspace and load latest keystone
+            const metaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) {
+                return this.error(500, `Local domain space not found for identity ${primaryTjpAddr}`);
+            }
+
+            const keystoneService = new KeystoneService_V1();
+            const latestKeystone = await keystoneService.getLatestKeystone({
+                addr: primaryTjpAddr,
+                metaspace,
+                space
+            });
+
+            if (!latestKeystone || !latestKeystone.data) {
+                return this.error(404, `Primary identity keystone not found for address ${primaryTjpAddr}`);
+            }
+
+            // 4. Verify existing custodial manage pool
+            const prevPools = latestKeystone.data.challengePools || [];
+            const existingManagePool = prevPools.find(p => p.id === POOL_ID_MANAGE);
+            if (!existingManagePool) {
+                return this.error(400, 'Primary keystone missing active "manage" pool (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679c)');
+            }
+
+            // Validate new pool config matches existing manage pool config structure
+            if (existingManagePool.config?.type && newManagePool.config?.type !== existingManagePool.config.type) {
+                return this.error(400, `newManagePool type "${newManagePool.config?.type}" does not match required type "${existingManagePool.config.type}" (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679d)`);
+            }
+
+            // 5. Build next pool set:
+            // Convert existing custodian manage pool to auxiliary custodian pool (e.g. custodian-manage-google)
+            // and install user's newManagePool as 'manage'.
+            const custodianPoolId = `${CUSTODIAN_POOL_ID_PREFIX}${effectiveProvider}`;
+            const auxiliaryCustodianPool: KeystoneChallengePool = {
+                ...existingManagePool,
+                id: custodianPoolId,
+            };
+
+            const nextPools: KeystoneChallengePool[] = [];
+            for (const pool of prevPools) {
+                if (pool.id === POOL_ID_MANAGE) {
+                    nextPools.push(newManagePool);
+                    nextPools.push(auxiliaryCustodianPool);
+                } else if (pool.id === custodianPoolId) {
+                    // Skip if already present to prevent duplicate
+                } else {
+                    nextPools.push(pool);
+                }
+            }
+
+            // 6. Sign evolution turn using server's custodian secret
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const primarySecret = await hash({ s: `${serverSecret}_custodian_${verifiedEmail}` });
+
+            const claim: Partial<KeystoneClaim> = {
+                verb: KEYSTONE_VERB_MANAGE,
+                target: getIbGibAddr({ ibGib: latestKeystone })
+            };
+
+            const evolvedKeystone = await keystoneService.sign({
+                latestKeystone,
+                masterSecret: primarySecret,
+                claim,
+                poolId: POOL_ID_MANAGE,
+                metaspace,
+                space,
+                dataToPatch: {
+                    challengePools: nextPools,
+                    frameDetails: {
+                        action: 'add_master_password',
+                        custodyMode: 'hybrid',
+                        elevatedAt: new Date().toISOString(),
+                    }
+                }
+            });
+
+            // 7. Persist evolved keystone in domain space
+            await metaspace.put({ ibGibs: [evolvedKeystone], space });
+            await metaspace.registerNewIbGib({ ibGib: evolvedKeystone, space });
+
+            // Extract complete primary keystone dependency graph across all frames
+            const primaryGraph = await getDependencyGraph({
+                ibGib: evolvedKeystone,
+                space,
+                live: false
+            });
+
+            const response: CustodianAddMasterPasswordResponseBody = {
+                success: true,
+                primaryTjpAddr,
+                primaryKeystone: evolvedKeystone,
+                primaryGraph,
+                message: 'Successfully elevated identity to sovereign master password'
+            };
+
+            return this.ok(response);
+
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            return this.error(500, `Internal error adding master password: ${extractErrorMsg(error)}`);
+        }
+    }
+}

package/src/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.respec.mts

@@ -0,0 +1,167 @@
+import { existsSync, rmSync } from 'node:fs';
+
+import {
+    respecfully,
+    iReckon,
+    ifWe,
+    ifWeMight
+} from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+
+import { KeystoneCustodianGenesisHandler } from './keystone-custodian-genesis.handler.mjs';
+import { KeystoneCustodianAddMasterPasswordHandler } from './keystone-custodian-add-master-password.handler.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { CUSTODIAN_POOL_ID_PREFIX } from '@ibgib/core-gib/dist/keystone/delegate/delegate-constants.mjs';
+import { generatePoolChallenges } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
+import { getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord, savePendingStagingKeystone } from '../../../../email/verify/email-verify-helpers.mjs';
+import { resetIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+
+const sir = `[${import.meta.url}]`;
+
+await respecfully(sir, 'KeystoneCustodianAddMasterPasswordHandler', async () => {
+    const testDataDir = './test-data-custodian-add-password';
+
+    if (existsSync(testDataDir)) {
+        rmSync(testDataDir, { recursive: true, force: true });
+    }
+
+    const origDataDir = process.env.DATA_DIR;
+    process.env.DATA_DIR = testDataDir;
+    process.env.KEYSTONE_PROFILE_CUSTODIAN_PRIMARY = 'primary-profile.dev';
+    process.env.SSO_SERVER_KDF_SECRET = 'test-sso-server-kdf-secret-12345';
+    process.env.SESSION_SECRET = 'test-session-secret-12345';
+    resetIdentityIndexService();
+
+    const genesisHandler = new KeystoneCustodianGenesisHandler();
+    const addPasswordHandler = new KeystoneCustodianAddMasterPasswordHandler();
+
+    await ifWe(sir, 'reject request with 400 if required fields are missing', async () => {
+        const reqCtx: any = {
+            method: 'POST',
+            pathname: '/api/identity/custodian/add-master-password',
+            url: new URL('http://localhost/api/identity/custodian/add-master-password'),
+            body: JSON.stringify({}),
+            dataDir: testDataDir
+        };
+
+        const res = await addPasswordHandler.handleRoute(reqCtx);
+        iReckon(sir, res?.status).isGonnaBe(400);
+    });
+
+    await ifWe(sir, 'successfully elevate custodial identity to sovereign master password', async () => {
+        try {
+            const email = 'alice.elevate@example.com';
+            const genesisCode = '123456';
+
+            // 1. Create custodial identity via genesis handler with staged code
+            const genesisStaging = await savePendingStagingKeystone({
+                primaryTjpAddr: `pending:${email}`,
+                emails: [email],
+                dataDir: testDataDir,
+            });
+            await savePendingCodeRecord({
+                pendingDir: genesisStaging.pendingDir,
+                code: genesisCode,
+            });
+
+            const genesisReqCtx: any = {
+                method: 'POST',
+                pathname: '/api/identity/custodian/genesis',
+                url: new URL('http://localhost/api/identity/custodian/genesis'),
+                body: JSON.stringify({ email, username: 'alice', code: genesisCode }),
+                dataDir: testDataDir
+            };
+
+            const genesisRes = await genesisHandler.handleRoute(genesisReqCtx);
+            if (genesisRes?.status !== 201) {
+                console.error(`[DEBUG] genesisRes failed: ${genesisRes?.status}, body:`, JSON.stringify(genesisRes?.body));
+            }
+            iReckon(sir, genesisRes?.status).isGonnaBe(201);
+
+            const genesisBody = typeof genesisRes?.body === 'string' ? JSON.parse(genesisRes?.body) : genesisRes?.body;
+            const primaryTjpAddr = genesisBody.primaryTjpAddr;
+            const initialKeystone = genesisBody.primaryKeystone;
+
+            iReckon(sir, primaryTjpAddr).not.isGonnaBeUndefined();
+            iReckon(sir, initialKeystone).not.isGonnaBeUndefined();
+
+            const initialManagePool = initialKeystone.data.challengePools.find((p: any) => p.id === POOL_ID_MANAGE);
+            iReckon(sir, initialManagePool).not.isGonnaBeUndefined();
+
+            // 2. Generate new sovereign manage challenge pool locally with user's new password
+            const userNewPassword = 'AliceSuperSecretPassphrase2026!';
+            const newChallenges = await generatePoolChallenges({
+                config: initialManagePool.config,
+                masterSecret: userNewPassword,
+            });
+            const newManagePool = {
+                id: POOL_ID_MANAGE,
+                config: initialManagePool.config,
+                challenges: newChallenges,
+            };
+
+            // Stage verification code for the elevation turn
+            const elevateStaging = await savePendingStagingKeystone({
+                primaryTjpAddr,
+                emails: [email],
+                dataDir: testDataDir,
+            });
+            const elevateCode = '654321';
+            await savePendingCodeRecord({
+                pendingDir: elevateStaging.pendingDir,
+                code: elevateCode,
+            });
+
+            // 3. Call add-master-password endpoint
+            const addPasswordReqCtx: any = {
+                method: 'POST',
+                pathname: '/api/identity/custodian/add-master-password',
+                url: new URL('http://localhost/api/identity/custodian/add-master-password'),
+                body: JSON.stringify({
+                    primaryTjpAddr,
+                    email,
+                    code: elevateCode,
+                    newManagePool,
+                }),
+                dataDir: testDataDir
+            };
+
+            const addPasswordRes = await addPasswordHandler.handleRoute(addPasswordReqCtx);
+            if (addPasswordRes?.status !== 200) {
+                console.error(`[DEBUG] addPasswordRes failed with status: ${addPasswordRes?.status}, body:`, addPasswordRes?.body);
+            }
+            iReckon(sir, addPasswordRes?.status).isGonnaBe(200);
+
+            const addPasswordBody = typeof addPasswordRes?.body === 'string' ? JSON.parse(addPasswordRes?.body) : addPasswordRes?.body;
+            iReckon(sir, addPasswordBody.success).isGonnaBeTrue();
+            iReckon(sir, addPasswordBody.primaryTjpAddr).isGonnaBe(primaryTjpAddr);
+
+            const evolvedKeystone = addPasswordBody.primaryKeystone;
+            iReckon(sir, evolvedKeystone).not.isGonnaBeUndefined();
+            iReckon(sir, evolvedKeystone.data.n).isGonnaBe(1);
+            iReckon(sir, evolvedKeystone.data.frameDetails.custodyMode).isGonnaBe('hybrid');
+
+            // Check pools: should contain both 'manage' and 'custodian-manage-email'
+            const poolIds = evolvedKeystone.data.challengePools.map((p: any) => p.id);
+            iReckon(sir, poolIds.includes('manage')).isGonnaBeTrue();
+            iReckon(sir, poolIds.includes(`${CUSTODIAN_POOL_ID_PREFIX}email`)).isGonnaBeTrue();
+
+            // 4. Verify user password solves the evolved manage pool
+            const keystoneService = new KeystoneService_V1();
+            const isUserPasswordValid = await keystoneService.verifySigningSecret({
+                keystoneIbGib: evolvedKeystone,
+                signingSecret: userNewPassword,
+                poolId: POOL_ID_MANAGE,
+            });
+            iReckon(sir, isUserPasswordValid).isGonnaBeTrue();
+        } catch (error) {
+            console.error(`[DEBUG TEST 2 EXCEPTION]`, error);
+            throw error;
+        }
+    });
+
+    if (existsSync(testDataDir)) {
+        rmSync(testDataDir, { recursive: true, force: true });
+    }
+    process.env.DATA_DIR = origDataDir;
+});

package/src/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.mts

@@ -162,15 +162,20 @@ export class KeystoneCustodianRegisterDelegateHandler extends ServeGibHandlerBas
 
             const primarySecret = await hash({ s: `${serverSecret}_custodian_${primaryEmail}` });
 
+            const delegateDeviceName = delegateKeystone.data?.frameDetails?.deviceTag
+                || frameDetails?.deviceTag
+                || 'client-delegate';
+
             // Execute primary keystone evolution linking the new delegate
             const evolvedPrimaryKeystone = await keystoneService.registerDelegate({
                 parentKeystone,
                 delegateKeystone,
                 masterSecret: primarySecret,
+                signingPoolId: 'manage',
                 metaspace,
                 space,
                 allowedVerbs: custodianReqs.allowedVerbs || [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
-                deviceName: frameDetails?.deviceTag || 'client-delegate'
+                deviceName: delegateDeviceName
             });
 
             // Persist delegate keystone in domain space

package/src/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.respec.mts

@@ -10,7 +10,7 @@ import { KeystoneCustodianGenesisHandler } from './keystone-custodian-genesis.ha
 import { KeystoneCustodianRegisterDelegateHandler } from './keystone-custodian-register-delegate.handler.mjs';
 import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
 import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
-import { deriveLocalCustodianDelegateSecret } from '@ibgib/web-gib/dist/identity/custodian-delegate-helper.mjs';
+import { deriveDeviceDelegateSecret } from '@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs';
 import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
 
 const sir = `[${import.meta.url}]`;
@@ -58,7 +58,7 @@ await respecfully(sir, 'KeystoneCustodianRegisterDelegateHandler', async () => {
         iReckon(sir, custodianReqs).not.isGonnaBeUndefined();
 
         // Step 2: Build client delegate keystone containing custodianReqs
-        const delegateSecret = await deriveLocalCustodianDelegateSecret({ primaryTjpAddr });
+        const delegateSecret = await deriveDeviceDelegateSecret({ primaryTjpAddr, deviceTag: 'phone' });
         const delegateBuilder = KeystoneProfileBuilder.buildKeystone('sync-profile.dev')
             .withUsername('bob-sync-phone')
             .withDescription('Sync Delegate for bob on phone')

package/src/serve-gib/handlers/api/keystone/keystone-evolve.handler.mts

@@ -12,6 +12,7 @@
 
 import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
+import { getGibInfo } from '@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
 import { validateAndRegisterEvolveKeystone } from '@ibgib/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs';
 import { KeystoneIbGib_V1 } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
@@ -56,7 +57,11 @@ export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase<Evol
         if (match && match.length >= 3) {
             const domainIb = decodeURIComponent(match[1]);
             const domainGib = decodeURIComponent(match[2]);
-            const domainAddr = getIbGibAddr({ ib: domainIb, gib: domainGib });
+            let domainAddr = getIbGibAddr({ ib: domainIb, gib: domainGib });
+            const { tjpGib } = getGibInfo({ ibGibAddr: domainAddr });
+            if (tjpGib && domainIb) {
+                domainAddr = `${domainIb}^${tjpGib}`;
+            }
             return {
                 domainAddr,
                 domainInfo: this.getDomainInfo({ domainAddr })

package/src/serve-gib/handlers/api/keystone/sso-config.handler.mts

@@ -1,6 +1,5 @@
 import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
-import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
-import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
+import { getSsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
 
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
 import { ServeGibHandlerBase } from '../../handler-base.mjs';
@@ -9,15 +8,6 @@ import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../typ
 
 const logalot = GLOBAL_LOG_A_LOT;
 
-let custodian: SsoCustodianService | undefined;
-function getCustodian(): SsoCustodianService {
-    if (!custodian) {
-        const config = loadSsoServerConfig();
-        custodian = new SsoCustodianService(config);
-    }
-    return custodian;
-}
-
 /**
  * GET /api/identity/sso/config
  *
@@ -46,7 +36,7 @@ export class SsoConfigHandler extends ServeGibHandlerBase<any, any> {
         try {
             if (logalot) { console.log(`${lc} starting...`); }
 
-            const service = getCustodian();
+            const service = getSsoCustodianService();
             const hostUrl = `${reqCtx.protocol}://${reqCtx.headers.host}`;
             const providers = service.getSsoClientConfigs(hostUrl);