@ibgib/node-gib 0.0.20 → 0.0.22

package/dist/serve-gib/identity-index/identity-index-service.mjs

@@ -64,30 +64,45 @@ export class IdentityIndexService {
      * Throws `duplicate_identity_409` error if email is already registered.
      */
     async registerEmailIndex({ email, tjpAddr, primaryTjpAddr, }) {
-        const targetAddr = tjpAddr || primaryTjpAddr;
-        if (!targetAddr) {
-            throw new Error('Either tjpAddr or primaryTjpAddr must be provided. (E: 62f15851b9a8c8d718279ab84e426826)');
-        }
-        const emailHash = await getIdentityEmailHash({ email, salt: this.salt });
-        const { folderPath, filePath } = getShardedIndexPath({
-            baseDir: this.baseDir,
-            emailHash
-        });
-        await fs.mkdir(folderPath, { recursive: true });
-        const record = {
-            tjpAddr: targetAddr,
-            createdAt: Date.now(),
-        };
+        const lc = `${this.lc}[${this.registerEmailIndex.name}]`;
         try {
-            await fs.writeFile(filePath, JSON.stringify(record, null, 2), { flag: 'wx' });
-            return { emailHash, filePath, record };
+            if (logalot) {
+                console.log(`${lc} starting... (I: 5d1728a955657616a8cf6ce8b5afa226)`);
+            }
+            const targetAddr = tjpAddr || primaryTjpAddr;
+            if (!targetAddr) {
+                throw new Error('Either tjpAddr or primaryTjpAddr must be provided. (E: 62f15851b9a8c8d718279ab84e426826)');
+            }
+            const emailHash = await getIdentityEmailHash({ email, salt: this.salt });
+            const { folderPath, filePath } = getShardedIndexPath({
+                baseDir: this.baseDir,
+                emailHash
+            });
+            await fs.mkdir(folderPath, { recursive: true });
+            const record = {
+                tjpAddr: targetAddr,
+                createdAt: Date.now(),
+            };
+            try {
+                await fs.writeFile(filePath, JSON.stringify(record, null, 2), { flag: 'wx' });
+                return { emailHash, filePath, record };
+            }
+            catch (error) {
+                if (error.code === 'EEXIST') {
+                    throw new Error(`Email is already registered (E: duplicate_identity_409)`);
+                }
+                throw error;
+            }
         }
         catch (error) {
-            if (error.code === 'EEXIST') {
-                throw new Error(`Email is already registered (E: duplicate_identity_409)`);
-            }
+            console.error(`${lc} ${extractErrorMsg(error)}`);
             throw error;
         }
+        finally {
+            if (logalot) {
+                console.log(`${lc} complete.`);
+            }
+        }
     }
     /**
      * Retrieves the registered identity info for an email address.

package/dist/serve-gib/identity-index/identity-index-service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity-index-service.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,iDAAiD,CAAC;AAG1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGzF,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACrB,EAAE,GAAG,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC;IACtC,OAAO,CAAS;IAChB,IAAI,CAAS;IAErB,YAAY,OAAqC;QAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,+BAA+B,CAAC,CAAC;QAC1H,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,2BAA2B,CAAC;IACvF,CAAC;IAED,MAAM;IACN,+CAA+C;IAC/C,kFAAkF;IAClF,MAAM;IACN,0CAA0C;IAC1C,qBAAqB;IACrB,iCAAiC;IACjC,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,0CAA0C;IAC1C,4DAA4D;IAC5D,6BAA6B;IAC7B,8CAA8C;IAC9C,UAAU;IACV,IAAI;IAEJ,MAAM;IACN,kEAAkE;IAClE,qFAAqF;IACrF,MAAM;IACN,6CAA6C;IAC7C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,kGAAkG;IAClG,qFAAqF;IACrF,IAAI;IAEJ,MAAM;IACN,iDAAiD;IACjD,oFAAoF;IACpF,MAAM;IACN,4CAA4C;IAC5C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,oFAAoF;IACpF,IAAI;IAEJ;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,EACP,cAAc,GAKjB;QACG,MAAM,UAAU,GAAG,OAAO,IAAI,cAAc,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAAC,CAAC;QACjI,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS;SACZ,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAwB;YAChC,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,EACxB,KAAK,GAGR;QACG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAClC,OAAO;YACH,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC9B,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,EAChB,KAAK,GAGR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;QACpD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,SAAS,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEpG,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAE3D,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEzI,OAAO,UAAU,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,EACtB,SAAS,GAGZ;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC;QAC1D,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/E,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,QAAQ,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAClG,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAwB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxD,OAAO,MAAM,CAAC;YAClB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO,SAAS,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;QAEL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACvB,KAAK,GAGR;QACG,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,IAAI,qBAAuD,CAAC;AAE5D;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAkC;IACtE,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,qBAAqB,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACrC,qBAAqB,GAAG,SAAS,CAAC;AACtC,CAAC"}
+{"version":3,"file":"identity-index-service.mjs","sourceRoot":"","sources":["../../../src/serve-gib/identity-index/identity-index-service.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,iDAAiD,CAAC;AAG1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAC9G,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGzF,MAAM,OAAO,GAAG,gBAAgB,IAAI,IAAI,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACrB,EAAE,GAAG,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC;IACtC,OAAO,CAAS;IAChB,IAAI,CAAS;IAErB,YAAY,OAAqC;QAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,+BAA+B,CAAC,CAAC;QAC1H,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,2BAA2B,CAAC;IACvF,CAAC;IAED,MAAM;IACN,+CAA+C;IAC/C,kFAAkF;IAClF,MAAM;IACN,0CAA0C;IAC1C,qBAAqB;IACrB,iCAAiC;IACjC,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,0CAA0C;IAC1C,4DAA4D;IAC5D,6BAA6B;IAC7B,8CAA8C;IAC9C,UAAU;IACV,IAAI;IAEJ,MAAM;IACN,kEAAkE;IAClE,qFAAqF;IACrF,MAAM;IACN,6CAA6C;IAC7C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,kGAAkG;IAClG,qFAAqF;IACrF,IAAI;IAEJ,MAAM;IACN,iDAAiD;IACjD,oFAAoF;IACpF,MAAM;IACN,4CAA4C;IAC5C,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,yBAAyB;IACzB,oFAAoF;IACpF,IAAI;IAEJ;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,EACrB,KAAK,EACL,OAAO,EACP,cAAc,GAKjB;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC;QACzD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,UAAU,GAAG,OAAO,IAAI,cAAc,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;YAAC,CAAC;YACjI,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC;gBACjD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS;aACZ,CAAC,CAAC;YAEH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAEhD,MAAM,MAAM,GAAwB;gBAChC,OAAO,EAAE,UAAU;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC;YAEF,IAAI,CAAC;gBACD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBAC/E,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,EACxB,KAAK,GAGR;QACG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAClC,OAAO;YACH,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC9B,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,EAChB,KAAK,GAGR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;QACpD,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,SAAS,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEpG,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAE3D,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAEzI,OAAO,UAAU,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,EACtB,SAAS,GAGZ;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC;QAC1D,IAAI,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YAExF,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/E,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,QAAQ,wCAAwC,CAAC,CAAC;YAAC,CAAC;YAClG,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAwB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxD,OAAO,MAAM,CAAC;YAClB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO,SAAS,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;QAEL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;gBAAS,CAAC;YACP,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACvB,KAAK,GAGR;QACG,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,IAAI,qBAAuD,CAAC;AAE5D;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAkC;IACtE,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,qBAAqB,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACrC,qBAAqB,GAAG,SAAS,CAAC;AACtC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/node-gib",
-  "version": "0.0.20",
+  "version": "0.0.22",
   "description": "Node and server-specific ibGib code, i.e., things that don't run in the browser.",
   "funding": {
     "type": "individual",
@@ -26,7 +26,7 @@
   "dependencies": {
     "@ibgib/helper-gib": "^0.0.37",
     "@ibgib/ts-gib": "^0.5.34",
-    "@ibgib/core-gib": "^0.1.75",
+    "@ibgib/core-gib": "^0.1.77",
     "@ibgib/encrypt-gib": "^0.3.1"
   },
   "devDependencies": {

package/src/email/verify/email-verify-helpers.mts

@@ -236,13 +236,18 @@ export interface SavePendingCodeRecordOptions {
     code: string;
     maxAttempts?: number;
     ttlMs?: number;
+    resendCount?: number;
+    attempts?: number;
 }
 
 export interface PendingCodeRecord {
     codeHash: string;
+    rawCode?: string;
     attempts: number;
     maxAttempts: number;
     expiresAt: number;
+    dispatchedAt: number;
+    resendCount: number;
 }
 
 /**
@@ -253,16 +258,22 @@ export async function savePendingCodeRecord({
     code,
     maxAttempts = 5,
     ttlMs = DEFAULT_MAGIC_LINK_TTL_MS,
-}: SavePendingCodeRecordOptions): Promise<void> {
+    resendCount = 0,
+    attempts = 0,
+}: SavePendingCodeRecordOptions): Promise<PendingCodeRecord> {
     const codeHash = await hash({ s: `verificationcode${code}` });
     const record: PendingCodeRecord = {
         codeHash,
-        attempts: 0,
+        rawCode: code,
+        attempts,
         maxAttempts,
         expiresAt: Date.now() + ttlMs,
+        dispatchedAt: Date.now(),
+        resendCount,
     };
     const codeFilePath = path.join(pendingDir, 'code.json');
     await fs.writeFile(codeFilePath, JSON.stringify(record, null, 2), 'utf-8');
+    return record;
 }
 
 /**

package/src/identity/sso/sso-custodian-service.mts

@@ -10,11 +10,15 @@ import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/
 import { MetaspaceService } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-types.mjs';
 import { IbGibSpaceAny } from '@ibgib/core-gib/dist/witness/space/space-base-v1.mjs';
 
+import { GLOBAL_LOG_A_LOT } from '../../constants.mjs';
+import { loadSsoServerConfig } from './sso-config-helper.mjs';
 import {
     SsoServerConfig, SsoProviderId, OAuthUserInfo, SsoProviderServerConfig,
     SsoProviderClientConfig
 } from './sso-types.mjs';
 
+const logalot = GLOBAL_LOG_A_LOT || true;
+
 interface JwkKey {
     kty: string;
     alg?: string;
@@ -62,33 +66,42 @@ export class SsoCustodianService {
      *   - Generator: Client/Server (Derived from environmental configuration and sent by client).
      */
     async getOAuthUserInfo(providerId: SsoProviderId, code: string, redirectUri: string): Promise<OAuthUserInfo> {
-        const lc = `${this.lc}[${this.getOAuthUserInfo.name}]`;
-        const providerConfig = this.config.providers[providerId];
-        if (!providerConfig) {
-            throw new Error(`Provider '${providerId}' is not configured on this server. (E: c28900abfefd23e89cf23f12)`);
-        }
+        const lc = `[${this.getOAuthUserInfo.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 3ad578b5065ec6d5517469571a4da826)`); }
 
-        console.log(`${lc} Exchanging code for provider: ${providerId}`);
+            const providerConfig = this.config.providers[providerId];
+            if (!providerConfig) {
+                throw new Error(`Provider '${providerId}' is not configured on this server. (E: c28900abfefd23e89cf23f12)`);
+            }
 
-        // 1. Exchange authorization code for tokens
-        const tokens = await this.exchangeCodeForTokens(providerConfig, code, redirectUri);
+            console.log(`${lc} Exchanging code for provider: ${providerId}`);
 
-        // 2. Retrieve and normalize user info
-        if (providerId === 'google') {
-            // Google returns an id_token (JWT) directly containing user info
-            if (!tokens.id_token) {
-                throw new Error(`Google token exchange did not return id_token. (E: e28900abfefd23e89cf45f23)`);
-            }
-            return this.verifyAndNormalizeGoogleToken(tokens.id_token);
-        } else if (providerId === 'github') {
-            // GitHub requires calling the /user API using the access_token
-            if (!tokens.access_token) {
-                throw new Error(`GitHub token exchange did not return access_token. (E: a28900abfefd23e89cf56f34)`);
+            // 1. Exchange authorization code for tokens
+            const tokens = await this.exchangeCodeForTokens(providerConfig, code, redirectUri);
+
+            // 2. Retrieve and normalize user info
+            if (providerId === 'google') {
+                // Google returns an id_token (JWT) directly containing user info
+                if (!tokens.id_token) {
+                    throw new Error(`Google token exchange did not return id_token. (E: e28900abfefd23e89cf45f23)`);
+                }
+                return this.verifyAndNormalizeGoogleToken(tokens.id_token);
+            } else if (providerId === 'github') {
+                // GitHub requires calling the /user API using the access_token
+                if (!tokens.access_token) {
+                    throw new Error(`GitHub token exchange did not return access_token. (E: a28900abfefd23e89cf56f34)`);
+                }
+                return this.fetchAndNormalizeGithubUser(providerConfig, tokens.access_token);
             }
-            return this.fetchAndNormalizeGithubUser(providerConfig, tokens.access_token);
-        }
 
-        throw new Error(`Unsupported provider: ${providerId}. (E: d28900abfefd23e89cf67f45)`);
+            throw new Error(`Unsupported provider: ${providerId}. (E: d28900abfefd23e89cf67f45)`);
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
     }
 
     /**
@@ -413,76 +426,87 @@ export class SsoCustodianService {
         metaspace: MetaspaceService;
         space: IbGibSpaceAny;
     }): Promise<KeystoneChallengePool> {
-        // 1. Fetch target keystone
-        const keystoneService = new KeystoneService_V1();
-        const targetKeystone = await keystoneService.getLatestKeystone({
-            addr: keystoneAddr,
-            metaspace,
-            space
-        });
+        const lc = `[${this.createCustodianChallengePool.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 4238580990ff19dd2815d5186ffa0826)`); }
+
+            // 1. Fetch target keystone
+            const keystoneService = new KeystoneService_V1();
+            const targetKeystone = await keystoneService.getLatestKeystone({
+                addr: keystoneAddr,
+                metaspace,
+                space
+            });
 
-        if (!targetKeystone) {
-            throw new Error(`Keystone not found for address: ${keystoneAddr} (E: 8a9c2b1d3e5f6a7b8c9d0e1f2a3b4c5d)`);
-        }
+            if (!targetKeystone) {
+                throw new Error(`Keystone not found for address: ${keystoneAddr} (E: 8a9c2b1d3e5f6a7b8c9d0e1f2a3b4c5d)`);
+            }
 
-        // 2. Locate native manage pool
-        const userManagePool = targetKeystone.data?.challengePools.find(p => p.id === POOL_ID_MANAGE);
-        if (!userManagePool) {
-            throw new Error(`Keystone manage pool not found. Custodian manage pool must match the user manage pool's security config. (E: 7c4e5f6a7b8c9d0e1f2a3b4c5e6f7a8b)`);
-        }
+            // 2. Locate native manage pool
+            const userManagePool = targetKeystone.data?.challengePools.find(p => p.id === POOL_ID_MANAGE);
+            if (!userManagePool) {
+                throw new Error(`Keystone manage pool not found. Custodian manage pool must match the user manage pool's security config. (E: 7c4e5f6a7b8c9d0e1f2a3b4c5e6f7a8b)`);
+            }
 
-        // 3. Dynamic poolId based on providerId with regex validation
-        if (!providerId || !KEYSTONE_POOL_ID_REGEXP.test(providerId)) {
-            throw new Error(`Invalid providerId: "${providerId}". Must match ${KEYSTONE_POOL_ID_REGEXP} (E: 3a2c4e5f6a7b8c9d0e1f2a3b4c5e6f)`);
-        }
-        const poolId = `custodian-manage-${providerId}`;
+            // 3. Dynamic poolId based on providerId with regex validation
+            if (!providerId || !KEYSTONE_POOL_ID_REGEXP.test(providerId)) {
+                throw new Error(`Invalid providerId: "${providerId}". Must match ${KEYSTONE_POOL_ID_REGEXP} (E: 3a2c4e5f6a7b8c9d0e1f2a3b4c5e6f)`);
+            }
+            const poolId = `custodian-manage-${providerId}`;
 
-        // 4. Derive delegate secrets
-        const custodianSecret = await this.deriveServerDelegateSecret(providerKey, userNonce);
+            // 4. Derive delegate secrets
+            const custodianSecret = await this.deriveServerDelegateSecret(providerKey, userNonce);
 
-        const poolSalt = await hash({
-            s: `${providerKey}:${userNonce}:salt`,
-            algorithm: HashAlgorithm.sha_256
-        });
-        const poolSaltShort = poolSalt.substring(0, 16);
-
-        // 5. Clone user's manage pool config, updating only ID, salt, and allowedVerbs
-        const config: KeystonePoolConfig = {
-            ...userManagePool.config,
-            id: poolId,
-            salt: poolSaltShort,
-            allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE]
-        };
+            const poolSalt = await hash({
+                s: `${providerKey}:${userNonce}:salt`,
+                algorithm: HashAlgorithm.sha_256
+            });
+            const poolSaltShort = poolSalt.substring(0, 16);
+
+            // 5. Clone user's manage pool config, updating only ID, salt, and allowedVerbs
+            const config: KeystonePoolConfig = {
+                ...userManagePool.config,
+                id: poolId,
+                salt: poolSaltShort,
+                allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE]
+            };
+
+            const strategy = KeystoneStrategyFactory.create({ config });
+            const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+            const challenges: { [id: string]: any } = {};
+            const timestamp = Date.now().toString();
+
+            for (let i = 0; i < config.behavior.size; i++) {
+                const challengeId = await generateOpaqueChallengeId({
+                    salt: config.salt,
+                    timestamp,
+                    index: i
+                });
+                const solution = await strategy.generateSolution({
+                    poolSecret,
+                    poolId: config.id,
+                    challengeId
+                });
+                challenges[challengeId] = await strategy.generateChallenge({ solution });
+            }
 
-        const strategy = KeystoneStrategyFactory.create({ config });
-        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
-        const challenges: { [id: string]: any } = {};
-        const timestamp = Date.now().toString();
+            return {
+                id: poolId,
+                config,
+                challenges,
+                isForeign: true,
+                metadata: {
+                    owner: 'custodian',
+                    providerKey
+                }
+            };
 
-        for (let i = 0; i < config.behavior.size; i++) {
-            const challengeId = await generateOpaqueChallengeId({
-                salt: config.salt,
-                timestamp,
-                index: i
-            });
-            const solution = await strategy.generateSolution({
-                poolSecret,
-                poolId: config.id,
-                challengeId
-            });
-            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
         }
-
-        return {
-            id: poolId,
-            config,
-            challenges,
-            isForeign: true,
-            metadata: {
-                owner: 'custodian',
-                providerKey
-            }
-        };
     }
 
     /**
@@ -564,3 +588,24 @@ export class SsoCustodianService {
         }
     }
 }
+
+let ssoCustodianService: SsoCustodianService | undefined;
+
+/**
+ * Gets or initializes the singleton SsoCustodianService instance.
+ */
+export function getSsoCustodianService(): SsoCustodianService {
+    if (!ssoCustodianService) {
+        const config = loadSsoServerConfig();
+        ssoCustodianService = new SsoCustodianService(config);
+    }
+    return ssoCustodianService;
+}
+
+/**
+ * Resets the singleton SsoCustodianService instance (useful for test resets).
+ */
+export function resetSsoCustodianService(): void {
+    ssoCustodianService = undefined;
+}
+

package/src/serve-gib/handlers/api/email/email-verification-code.handler.mts

@@ -4,7 +4,10 @@
  * Handler for POST /api/email/verification-code
  */
 
-import { extractErrorMsg, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import * as path from 'node:path';
+import * as fs from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { extractErrorMsg, getUUID, delay } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { EmailSenderAws } from '../../../../email/aws/email-sender-aws.mjs';
 // import { generateVerificationCode, getPendingTjpHash, savePendingCodeRecord, getPendingStagingDir, validateEmail } from '../../../../email/index.mjs';
 import { EmailSender, OutboundEmail } from '../../../../email/email-types.mjs';
@@ -13,7 +16,7 @@ import { API_PATH_REGEXES } from '../../../path-constants.mjs';
 import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
 import { ServeGibHandlerBase } from '../../handler-base.mjs';
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
-import { createDefaultEmailSender, generateVerificationCode, getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord, savePendingStagingKeystone } from '../../../../email/verify/email-verify-helpers.mjs';
+import { createDefaultEmailSender, generateVerificationCode, getPendingStagingDir, getPendingTjpHash, savePendingCodeRecord, savePendingStagingKeystone, PendingCodeRecord } from '../../../../email/verify/email-verify-helpers.mjs';
 import { validateEmail } from '../../../../email/email-helpers.mjs';
 import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
 
@@ -75,11 +78,14 @@ export class EmailVerificationCodeHandler extends ServeGibHandlerBase {
                 return this.error(400, 'Invalid email address format (E: e3f4a5b67890123456789abcdef012)');
             }
 
+            // Artificial delay to mitigate brute force & timing attacks (min 1s)
+            await delay(1000 + Math.random() * 500);
+
             const normEmail = normalizeEmail(email);
             const effectivePrimaryTjpAddr = primaryTjpAddr || `pending:${normEmail}`;
             const tjpHash = await getPendingTjpHash(effectivePrimaryTjpAddr);
 
-            const code = generateVerificationCode();
+            let code: string = generateVerificationCode();
             if (reqCtx.dataDir && tjpHash) {
                 let info = await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash });
                 if (!info) {
@@ -93,8 +99,49 @@ export class EmailVerificationCodeHandler extends ServeGibHandlerBase {
                 }
 
                 if (info) {
-                    await savePendingCodeRecord({ pendingDir: info.pendingDir, code });
-                    if (logalot) { console.timeLog(timestampUUID, 'code record saved to pending staging'); }
+                    const codeFilePath = path.join(info.pendingDir, 'code.json');
+                    let existingRecord: PendingCodeRecord | undefined;
+                    if (existsSync(codeFilePath)) {
+                        try {
+                            existingRecord = JSON.parse(await fs.readFile(codeFilePath, 'utf-8'));
+                        } catch { /* ignore corrupted record */ }
+                    }
+
+                    const now = Date.now();
+                    if (existingRecord) {
+                        // Check 30-second cooldown
+                        const elapsedMs = now - (existingRecord.dispatchedAt || 0);
+                        if (elapsedMs < 30_000) {
+                            const remainingSecs = Math.ceil((30_000 - elapsedMs) / 1000);
+                            return this.error(429, `Please wait ${remainingSecs}s before requesting another verification code.`);
+                        }
+
+                        // Check Max Resend limit (5 resends per 15-minute window)
+                        if (existingRecord.resendCount >= 5 && now < existingRecord.expiresAt) {
+                            return this.error(429, 'Too many verification code requests. Please wait 15 minutes before trying again.');
+                        }
+
+                        // Reuse existing valid code if not expired and attempts < maxAttempts
+                        if (existingRecord.rawCode && now < existingRecord.expiresAt && existingRecord.attempts < existingRecord.maxAttempts) {
+                            code = existingRecord.rawCode;
+                            existingRecord.dispatchedAt = now;
+                            existingRecord.resendCount = (existingRecord.resendCount || 0) + 1;
+                            await fs.writeFile(codeFilePath, JSON.stringify(existingRecord, null, 2), 'utf-8');
+                        } else {
+                            // Generate fresh code and increment resendCount
+                            code = generateVerificationCode();
+                            await savePendingCodeRecord({
+                                pendingDir: info.pendingDir,
+                                code,
+                                resendCount: (existingRecord.resendCount || 0) + 1,
+                                attempts: 0,
+                            });
+                        }
+                    } else {
+                        code = generateVerificationCode();
+                        await savePendingCodeRecord({ pendingDir: info.pendingDir, code, resendCount: 0, attempts: 0 });
+                    }
+                    if (logalot) { console.timeLog(timestampUUID, 'code record processed in pending staging'); }
                 } else {
                     console.warn(`${lc} Failed to create or access pending staging directory for tjpHash ${tjpHash}`);
                 }

package/src/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.mts

@@ -13,6 +13,8 @@
 import { extractErrorMsg, hash } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { getTjpAddr } from '@ibgib/core-gib/dist/common/other/ibgib-helper.mjs';
+import { getDependencyGraph } from '@ibgib/core-gib/dist/common/other/graph-helper.mjs';
+import { FlatIbGibGraph } from '@ibgib/core-gib/dist/common/other/graph-types.mjs';
 import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
 import { KeystoneChallengePool } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
 import { KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
@@ -28,35 +30,28 @@ import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
 import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
 import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
 import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
-import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
+import { getSsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
 import { SsoProviderId } from '../../../../identity/sso/sso-types.mjs';
 import { getPendingStagingDir, getPendingTjpHash, verifyPendingCode } from '../../../../email/verify/email-verify-helpers.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT || true;
 
-let custodian: SsoCustodianService | undefined;
-function getCustodian(): SsoCustodianService {
-    if (!custodian) {
-        const config = loadSsoServerConfig();
-        custodian = new SsoCustodianService(config);
-    }
-    return custodian;
-}
-
 export interface CustodianAddMasterPasswordRequestBody {
-    primaryTjpAddr: string;
-    newManagePool: KeystoneChallengePool;
+    code: string;
     providerId?: SsoProviderId;
-    code?: string;
     redirectUri?: string;
     email?: string;
+    primaryTjpAddr: string;
+    newManagePool: KeystoneChallengePool;
 }
 
 export interface CustodianAddMasterPasswordResponseBody {
     success: boolean;
-    primaryTjpAddr: string;
-    primaryKeystone: any;
+    primaryTjpAddr?: string;
+    primaryKeystone?: any;
+    primaryGraph?: FlatIbGibGraph;
     message?: string;
+    error?: string;
 }
 
 /**
@@ -108,7 +103,7 @@ export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBa
             let effectiveProvider: string = providerId || 'email';
 
             if (providerId && code && redirectUri) {
-                const service = getCustodian();
+                const service = getSsoCustodianService();
                 const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
                 if (!userInfo || !userInfo.email) {
                     return this.error(401, `Failed to authenticate with SSO provider ${providerId} (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6796)`);
@@ -121,7 +116,11 @@ export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBa
                 verifiedEmail = normalizeEmail(email);
 
                 const tjpHash = await getPendingTjpHash(primaryTjpAddr);
-                const pendingInfo = reqCtx.dataDir && tjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash }) : undefined;
+                let pendingInfo = reqCtx.dataDir && tjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash }) : undefined;
+                if (!pendingInfo) {
+                    const emailTjpHash = await getPendingTjpHash(`pending:${verifiedEmail}`);
+                    pendingInfo = reqCtx.dataDir && emailTjpHash ? await getPendingStagingDir({ dataDir: reqCtx.dataDir, tjpHash: emailTjpHash }) : undefined;
+                }
 
                 if (!pendingInfo || pendingInfo.isExpired) {
                     return this.error(400, 'Verification record missing or expired. Please request a new verification code. (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6798)');
@@ -228,10 +227,18 @@ export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBa
             await metaspace.put({ ibGibs: [evolvedKeystone], space });
             await metaspace.registerNewIbGib({ ibGib: evolvedKeystone, space });
 
+            // Extract complete primary keystone dependency graph across all frames
+            const primaryGraph = await getDependencyGraph({
+                ibGib: evolvedKeystone,
+                space,
+                live: false
+            });
+
             const response: CustodianAddMasterPasswordResponseBody = {
                 success: true,
                 primaryTjpAddr,
                 primaryKeystone: evolvedKeystone,
+                primaryGraph,
                 message: 'Successfully elevated identity to sovereign master password'
             };
 

package/src/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.mts

@@ -162,15 +162,20 @@ export class KeystoneCustodianRegisterDelegateHandler extends ServeGibHandlerBas
 
             const primarySecret = await hash({ s: `${serverSecret}_custodian_${primaryEmail}` });
 
+            const delegateDeviceName = delegateKeystone.data?.frameDetails?.deviceTag
+                || frameDetails?.deviceTag
+                || 'client-delegate';
+
             // Execute primary keystone evolution linking the new delegate
             const evolvedPrimaryKeystone = await keystoneService.registerDelegate({
                 parentKeystone,
                 delegateKeystone,
                 masterSecret: primarySecret,
+                signingPoolId: 'manage',
                 metaspace,
                 space,
                 allowedVerbs: custodianReqs.allowedVerbs || [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
-                deviceName: frameDetails?.deviceTag || 'client-delegate'
+                deviceName: delegateDeviceName
             });
 
             // Persist delegate keystone in domain space

package/src/serve-gib/handlers/api/keystone/keystone-evolve.handler.mts

@@ -12,6 +12,7 @@
 
 import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
+import { getGibInfo } from '@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
 import { validateAndRegisterEvolveKeystone } from '@ibgib/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs';
 import { KeystoneIbGib_V1 } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
@@ -56,7 +57,11 @@ export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase<Evol
         if (match && match.length >= 3) {
             const domainIb = decodeURIComponent(match[1]);
             const domainGib = decodeURIComponent(match[2]);
-            const domainAddr = getIbGibAddr({ ib: domainIb, gib: domainGib });
+            let domainAddr = getIbGibAddr({ ib: domainIb, gib: domainGib });
+            const { tjpGib } = getGibInfo({ ibGibAddr: domainAddr });
+            if (tjpGib && domainIb) {
+                domainAddr = `${domainIb}^${tjpGib}`;
+            }
             return {
                 domainAddr,
                 domainInfo: this.getDomainInfo({ domainAddr })