@ibgib/node-gib 0.0.22 → 0.0.24

package/src/email/email-sender.mts

@@ -14,16 +14,16 @@ export abstract class EmailSenderBase implements EmailSender {
      */
     protected validateOutboundEmail(email: OutboundEmail): void {
         if (!email) {
-            throw new Error('OutboundEmail is required. (E: 8f4e2a1b9c3d4e5f6a7b8c9d0e1f2a3b)');
+            throw new Error('OutboundEmail is required. (E: genuuid)');
         }
 
         const fromParsed = parseEmailAddress(email.from);
         if (!fromParsed.address || !validateEmail(fromParsed.address)) {
-            throw new Error(`Invalid "from" email address: ${fromParsed.address} (E: a1b2c3d4e5f67890123456789abcdef0)`);
+            throw new Error(`Invalid "from" email address: ${fromParsed.address} (E: genuuid)`);
         }
 
         if (!email.to || !Array.isArray(email.to) || email.to.length === 0) {
-            throw new Error('Outbound email must contain at least one recipient in "to". (E: 1a2b3c4d5e6f7890123456789abcdef1)');
+            throw new Error('Outbound email must contain at least one recipient in "to". (E: genuuid)');
         }
 
         for (const recipient of email.to) {

package/src/email/verify/email-verify-helpers.mts

@@ -33,7 +33,7 @@ export function createMagicLinkToken({
     nonce,
 }: CreateMagicLinkTokenOptions): string {
     if (!email || !validateEmail(email)) {
-        throw new Error(`Invalid email address provided for magic link token creation: ${email} (E: a9b8c7d6e5f43210123456789abcdef0)`);
+        throw new Error(`Invalid email address provided for magic link token creation: ${email} (E: genuuid)`);
     }
     if (!primaryTjpAddr) {
         throw new Error(`primaryTjpAddr is required for magic link token creation (E: b8c7d6e5f43210123456789abcdef01)`);
@@ -282,7 +282,7 @@ export async function savePendingCodeRecord({
 export function createDefaultEmailSender(): EmailSender {
     const rawMode = process.env.EMAIL_MODE;
     if (!rawMode || !rawMode.trim()) {
-        throw new Error('EMAIL_MODE environment variable is missing. Expected "aws" or "mock". (E: 7a8b9c0d1e2f3456789abcdef0123456)');
+        throw new Error('EMAIL_MODE environment variable is missing. Expected "aws" or "mock". (E: genuuid)');
     }
 
     const mode = rawMode.trim().toLowerCase();
@@ -292,7 +292,7 @@ export function createDefaultEmailSender(): EmailSender {
         const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
         const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
         if (!accessKeyId || !secretAccessKey) {
-            throw new Error('EMAIL_MODE=aws requires AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables. (E: 5e6f7890123456789abcdef5a6b7c8d9)');
+            throw new Error('EMAIL_MODE=aws requires AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables. (E: genuuid)');
         }
         return new EmailSenderAws({
             accessKeyId,
@@ -301,11 +301,11 @@ export function createDefaultEmailSender(): EmailSender {
         });
     } else if (mode === 'mock') {
         if (isProd) {
-            throw new Error('EMAIL_MODE=mock is prohibited when NODE_ENV=production. (E: 897a6b5c4d3e2f10987654321fedcba0)');
+            throw new Error('EMAIL_MODE=mock is prohibited when NODE_ENV=production. (E: genuuid)');
         }
         return new EmailSenderMock();
     } else {
-        throw new Error(`Unsupported EMAIL_MODE '${mode}'. Must be 'aws' or 'mock'. (E: 987a6b5c4d3e2f10987654321fedcba1)`);
+        throw new Error(`Unsupported EMAIL_MODE '${mode}'. Must be 'aws' or 'mock'. (E: genuuid)`);
     }
 }
 

package/src/identity/sso/custodian-auth-helpers.mts

@@ -21,7 +21,7 @@ export async function deriveCustodianAuthCode({
     const lc = `[${deriveCustodianAuthCode.name}]`;
     try {
         if (!serverSecret) {
-            throw new Error('serverSecret required for custodian auth code derivation (E: a1b2c3d4e5f67890123456789abcdef0)');
+            throw new Error('serverSecret required for custodian auth code derivation (E: genuuid)');
         }
 
         const salt = await hash({

package/src/identity/sso/sso-custodian-service.mts

@@ -17,7 +17,7 @@ import {
     SsoProviderClientConfig
 } from './sso-types.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 interface JwkKey {
     kty: string;
@@ -439,18 +439,18 @@ export class SsoCustodianService {
             });
 
             if (!targetKeystone) {
-                throw new Error(`Keystone not found for address: ${keystoneAddr} (E: 8a9c2b1d3e5f6a7b8c9d0e1f2a3b4c5d)`);
+                throw new Error(`Keystone not found for address: ${keystoneAddr} (E: genuuid)`);
             }
 
             // 2. Locate native manage pool
             const userManagePool = targetKeystone.data?.challengePools.find(p => p.id === POOL_ID_MANAGE);
             if (!userManagePool) {
-                throw new Error(`Keystone manage pool not found. Custodian manage pool must match the user manage pool's security config. (E: 7c4e5f6a7b8c9d0e1f2a3b4c5e6f7a8b)`);
+                throw new Error(`Keystone manage pool not found. Custodian manage pool must match the user manage pool's security config. (E: genuuid)`);
             }
 
             // 3. Dynamic poolId based on providerId with regex validation
             if (!providerId || !KEYSTONE_POOL_ID_REGEXP.test(providerId)) {
-                throw new Error(`Invalid providerId: "${providerId}". Must match ${KEYSTONE_POOL_ID_REGEXP} (E: 3a2c4e5f6a7b8c9d0e1f2a3b4c5e6f)`);
+                throw new Error(`Invalid providerId: "${providerId}". Must match ${KEYSTONE_POOL_ID_REGEXP} (E: genuuid)`);
             }
             const poolId = `custodian-manage-${providerId}`;
 

package/src/serve-gib/handlers/api/email/email-inbound.handler.mts

@@ -52,7 +52,7 @@ export class EmailInboundHandler extends ServeGibHandlerBase {
 
             const inboundEmail = await this.receiver.parseInboundPayload(payload);
 
-            console.log(`${lc} Successfully processed inbound email msgId: ${inboundEmail.messageId}, folder: ${inboundEmail.folder} (I: 890123456789abcdef8a9b0c1d2e3f4a)`);
+            console.log(`${lc} Successfully processed inbound email msgId: ${inboundEmail.messageId}, folder: ${inboundEmail.folder} (I: genuuid)`);
 
             return this.ok({
                 success: true,
@@ -60,7 +60,7 @@ export class EmailInboundHandler extends ServeGibHandlerBase {
             });
         } catch (error) {
             const emsg = extractErrorMsg(error);
-            console.error(`${lc} Inbound email handling failed: ${emsg} (E: 90123456789abcdef9a0b1c2d3e4f5a6)`);
+            console.error(`${lc} Inbound email handling failed: ${emsg} (E: genuuid)`);
             return this.error(500, `Inbound email error: ${emsg}`);
         }
     }

package/src/serve-gib/handlers/api/email/email-outbound.handler.mts

@@ -52,15 +52,15 @@ export class EmailOutboundHandler extends ServeGibHandlerBase {
             const sendResult = await this.sender.sendEmail(emailData);
 
             if (sendResult.success) {
-                console.log(`${lc} Successfully dispatched outbound email msgId: ${sendResult.messageId} (I: 0123456789abcdef0a1b2c3d4e5f6a7b)`);
+                console.log(`${lc} Successfully dispatched outbound email msgId: ${sendResult.messageId} (I: genuuid)`);
                 return this.ok(sendResult, sendResult.statusCode || 200);
             } else {
-                console.error(`${lc} Failed to send email: ${sendResult.error} (E: 123456789abcdef1a2b3c4d5e6f7a8b9)`);
+                console.error(`${lc} Failed to send email: ${sendResult.error} (E: genuuid)`);
                 return this.error(sendResult.statusCode || 500, sendResult.error || 'Failed to send email');
             }
         } catch (error) {
             const emsg = extractErrorMsg(error);
-            console.error(`${lc} Outbound email error: ${emsg} (E: 23456789abcdef2a3b4c5d6e7f8a9b0c)`);
+            console.error(`${lc} Outbound email error: ${emsg} (E: genuuid)`);
             return this.error(500, `Outbound email error: ${emsg}`);
         }
     }

package/src/serve-gib/handlers/api/email/email-verification-code.handler.mts

@@ -20,7 +20,7 @@ import { createDefaultEmailSender, generateVerificationCode, getPendingStagingDi
 import { validateEmail } from '../../../../email/email-helpers.mjs';
 import { normalizeEmail } from '../../../identity-index/identity-index-helpers.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 export interface EmailMagicLinkHandlerOptions {
     sender?: EmailSender;

package/src/serve-gib/handlers/api/email/email-verify-code-onetime.handler.mts

@@ -24,7 +24,7 @@ import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../typ
 import { ServeGibHandlerBase } from '../../handler-base.mjs';
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 export interface EmailVerifyCodeRequestBody {
     email: string;

package/src/serve-gib/handlers/api/email/email-verify.respec.mts

@@ -33,7 +33,7 @@ await respecfully(sir, '6-Digit Verification Code & Server Quarantine Policy', a
     }
     mkdirSync(testDataDir, { recursive: true });
 
-    await ifWeMight(sir, 'generate, verify, and enforce expiration & single-use rules on magic link tokens', async () => {
+    await ifWe(sir, 'generate, verify, and enforce expiration & single-use rules on magic link tokens', async () => {
         clearConsumedNonces();
         const email = 'alice@example.com';
         const primaryTjpAddr = 'keystone^ABC123DEF456_TJP';
@@ -69,7 +69,7 @@ await respecfully(sir, '6-Digit Verification Code & Server Quarantine Policy', a
         }
     });
 
-    await ifWeMight(sir, 'create pending staging quarantine folder and AOT metadata files', async () => {
+    await ifWe(sir, 'create pending staging quarantine folder and AOT metadata files', async () => {
         clearConsumedNonces();
         const primaryTjpAddr = 'keystone^STAGING123_TJP';
         const mockKeystone = {
@@ -102,7 +102,7 @@ await respecfully(sir, '6-Digit Verification Code & Server Quarantine Policy', a
         iReckon(sir, meta1.verified).asTo('meta1 initial verified status').isGonnaBeFalse();
     });
 
-    await ifWeMight(sir, 'handle 6-digit OTP code verification and promote identity upon verification', async () => {
+    await ifWe(sir, 'handle 6-digit OTP code verification and promote identity upon verification', async () => {
         clearConsumedNonces();
         const primaryTjpAddr = 'keystone^MULTIEMAIL_TJP';
         const email = 'multi1@example.com';
@@ -162,7 +162,7 @@ await respecfully(sir, '6-Digit Verification Code & Server Quarantine Policy', a
         iReckon(sir, record?.primaryTjpAddr).asTo('record primaryTjpAddr').isGonnaBe(primaryTjpAddr);
     });
 
-    await ifWeMight(sir, 'execute atomic GC lockfile cleanup on expired staging directories', async () => {
+    await ifWe(sir, 'execute atomic GC lockfile cleanup on expired staging directories', async () => {
         clearConsumedNonces();
         const expiredTjpAddr = 'keystone^EXPIRED_TJP';
         const mockKeystone = { ib: expiredTjpAddr, data: { tjpAddr: expiredTjpAddr } };

package/src/serve-gib/handlers/api/identity/keystone-custodian-add-master-password.handler.mts

@@ -34,7 +34,7 @@ import { getSsoCustodianService } from '../../../../identity/sso/sso-custodian-s
 import { SsoProviderId } from '../../../../identity/sso/sso-types.mjs';
 import { getPendingStagingDir, getPendingTjpHash, verifyPendingCode } from '../../../../email/verify/email-verify-helpers.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 export interface CustodianAddMasterPasswordRequestBody {
     code: string;
@@ -67,35 +67,35 @@ export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBa
     ): Promise<ResponseResult | undefined> {
         const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
         try {
-            if (logalot) { console.log(`${lc} starting... (I: 8a1b2c3d4e5f67890a1b2c3d4e5f6790)`); }
+            if (logalot) { console.log(`${lc} starting... (I: genuuid)`); }
 
             if (reqCtx.method !== 'POST') {
                 return this.error(405, 'Method Not Allowed');
             }
 
             if (!reqCtx.body) {
-                return this.error(400, 'Request body is empty (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6791)');
+                return this.error(400, 'Request body is empty (E: genuuid)');
             }
 
             let body: CustodianAddMasterPasswordRequestBody;
             try {
                 body = JSON.parse(reqCtx.body);
             } catch {
-                return this.error(400, 'Request body must be valid JSON (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6792)');
+                return this.error(400, 'Request body must be valid JSON (E: genuuid)');
             }
 
             const { primaryTjpAddr, newManagePool, providerId, code, redirectUri, email } = body;
 
             if (!primaryTjpAddr) {
-                return this.error(400, 'primaryTjpAddr is required (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6793)');
+                return this.error(400, 'primaryTjpAddr is required (E: genuuid)');
             }
 
             if (!newManagePool || typeof newManagePool !== 'object' || newManagePool.id !== POOL_ID_MANAGE) {
-                return this.error(400, 'newManagePool is invalid. Must be an object with id "manage" (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6794)');
+                return this.error(400, 'newManagePool is invalid. Must be an object with id "manage" (E: genuuid)');
             }
 
             if (!newManagePool.challenges || Object.keys(newManagePool.challenges).length === 0) {
-                return this.error(400, 'newManagePool must contain pre-generated public challenges (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6795)');
+                return this.error(400, 'newManagePool must contain pre-generated public challenges (E: genuuid)');
             }
 
             // 1. Authenticate user credentials via OAuth code or Email OTP
@@ -106,12 +106,12 @@ export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBa
                 const service = getSsoCustodianService();
                 const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
                 if (!userInfo || !userInfo.email) {
-                    return this.error(401, `Failed to authenticate with SSO provider ${providerId} (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6796)`);
+                    return this.error(401, `Failed to authenticate with SSO provider ${providerId} (E: genuuid)`);
                 }
                 verifiedEmail = normalizeEmail(userInfo.email);
             } else if (email && code) {
                 if (!validateEmail(email)) {
-                    return this.error(400, 'Invalid email address format (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6797)');
+                    return this.error(400, 'Invalid email address format (E: genuuid)');
                 }
                 verifiedEmail = normalizeEmail(email);
 
@@ -123,7 +123,7 @@ export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBa
                 }
 
                 if (!pendingInfo || pendingInfo.isExpired) {
-                    return this.error(400, 'Verification record missing or expired. Please request a new verification code. (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6798)');
+                    return this.error(400, 'Verification record missing or expired. Please request a new verification code. (E: genuuid)');
                 }
 
                 const codeVerifyResult = await verifyPendingCode({
@@ -132,17 +132,17 @@ export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBa
                 });
 
                 if (!codeVerifyResult.valid) {
-                    return this.error(401, codeVerifyResult.error || 'Invalid verification code (E: 8a1b2c3d4e5f67890a1b2c3d4e5f6799)');
+                    return this.error(401, codeVerifyResult.error || 'Invalid verification code (E: genuuid)');
                 }
             } else {
-                return this.error(400, 'Authentication credentials required (providerId+code+redirectUri or email+code) (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679a)');
+                return this.error(400, 'Authentication credentials required (providerId+code+redirectUri or email+code) (E: genuuid)');
             }
 
             // 2. Lookup primary identity and confirm email matches
             const indexService = getIdentityIndexService();
             const identityRecord = await indexService.lookupIdentityByEmail({ email: verifiedEmail });
             if (!identityRecord || identityRecord.primaryTjpAddr !== primaryTjpAddr) {
-                return this.error(403, `Authenticated email ${verifiedEmail} does not match primary identity ${primaryTjpAddr} (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679b)`);
+                return this.error(403, `Authenticated email ${verifiedEmail} does not match primary identity ${primaryTjpAddr} (E: genuuid)`);
             }
 
             // 3. Bootstrap domain metaspace and load latest keystone
@@ -167,12 +167,12 @@ export class KeystoneCustodianAddMasterPasswordHandler extends ServeGibHandlerBa
             const prevPools = latestKeystone.data.challengePools || [];
             const existingManagePool = prevPools.find(p => p.id === POOL_ID_MANAGE);
             if (!existingManagePool) {
-                return this.error(400, 'Primary keystone missing active "manage" pool (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679c)');
+                return this.error(400, 'Primary keystone missing active "manage" pool (E: genuuid)');
             }
 
             // Validate new pool config matches existing manage pool config structure
             if (existingManagePool.config?.type && newManagePool.config?.type !== existingManagePool.config.type) {
-                return this.error(400, `newManagePool type "${newManagePool.config?.type}" does not match required type "${existingManagePool.config.type}" (E: 8a1b2c3d4e5f67890a1b2c3d4e5f679d)`);
+                return this.error(400, `newManagePool type "${newManagePool.config?.type}" does not match required type "${existingManagePool.config.type}" (E: genuuid)`);
             }
 
             // 5. Build next pool set:

package/src/serve-gib/handlers/api/identity/keystone-custodian-genesis.handler.mts

@@ -29,7 +29,7 @@ import { generateCustodianRequirements } from '../../../../identity/sso/custodia
 import { CustodianRequirements } from '../../../../identity/sso/sso-types.mjs';
 import { getPendingStagingDir, getPendingTjpHash, verifyPendingCode } from '../../../../email/verify/email-verify-helpers.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 export interface CustodianGenesisRequestBody {
     email: string;
@@ -141,7 +141,7 @@ export class KeystoneCustodianGenesisHandler extends ServeGibHandlerBase<undefin
                 const defaultUsername = username || normEmail.split('@')[0];
                 const primaryProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_PRIMARY;
                 if (!primaryProfileName || !primaryProfileName.trim()) {
-                    throw new Error('KEYSTONE_PROFILE_CUSTODIAN_PRIMARY environment variable is missing. Expected valid profile name like "primary-profile.dev" or "primary-profile.prod". (E: 1a2b3c4d5e6f7890123456789abcdef1)');
+                    throw new Error('KEYSTONE_PROFILE_CUSTODIAN_PRIMARY environment variable is missing. Expected valid profile name like "primary-profile.dev" or "primary-profile.prod". (E: genuuid)');
                 }
 
                 const primaryBuilder = KeystoneProfileBuilder.buildKeystone(primaryProfileName.trim() as any)

package/src/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.handler.mts

@@ -29,7 +29,7 @@ import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.
 import { getAuthCustodianIndex, verifyCustodianRequirements } from '../../../../identity/sso/custodian-auth-helpers.mjs';
 import { CustodianRequirements } from '../../../../identity/sso/sso-types.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 export interface CustodianRegisterDelegateRequestBody {
     delegateKeystone: any;

package/src/serve-gib/handlers/api/keystone/keystone-genesis.handler.mts

@@ -47,7 +47,7 @@ import { getDomainRootPath } from '../../../bootstrap-helper.mjs';
 import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
 import { savePendingStagingKeystone, dispatchVerificationCode } from '../../../../email/verify/email-verify-helpers.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 
 /**
@@ -170,7 +170,7 @@ export class KeystoneGenesisHandler extends ServeGibHandlerBase<undefined, undef
             // ----------------------------------------------------------------
             const space = await metaspace.getLocalUserSpace({ lock: false });
             if (!space) {
-                throw new Error(`(UNEXPECTED) Could not get local user space after bootstrapping domain for ${addr} (E: b1c2d3e4f5a6b7c8d9e0f1a2b3c4d526)`);
+                throw new Error(`(UNEXPECTED) Could not get local user space after bootstrapping domain for ${addr} (E: genuuid)`);
             }
 
             await metaspace.put({ ibGibs: [keystoneIbGib], space });

package/src/serve-gib/handlers/api/keystone/keystone-lookup.handler.mts

@@ -15,7 +15,7 @@ import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../typ
 import { API_PATH_REGEXES } from '../../../path-constants.mjs';
 import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 /**
  * POST /api/keystone/lookup

package/src/serve-gib/handlers/api/keystone/sso-link.handler.mts

@@ -14,7 +14,7 @@ import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
 import { API_PATH_REGEXES } from '../../../path-constants.mjs';
 import { ParamsWithDomain, RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 interface LinkParams extends ParamsWithDomain {
     parentTjpAddr: string;
@@ -76,25 +76,25 @@ export class SsoLinkHandler extends ServeGibHandlerWithMetaspaceBase<LinkParams,
     protected async handleRouteImpl(reqCtx: RequestContext<LinkParams>): Promise<ResponseResult | undefined> {
         const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
         try {
-            if (logalot) { console.log(`${lc} starting... (I: 8a4c1f930e7b2d5a6c1e9f8a3b5c7d1e)`); }
+            if (logalot) { console.log(`${lc} starting... (I: genuuid)`); }
 
             if (!reqCtx.params) {
-                return this.error(400, 'Invalid parameters: parentTjpAddr missing (E: c9f1a2b3d4e5f60718293a4b5c6d7e8f)');
+                return this.error(400, 'Invalid parameters: parentTjpAddr missing (E: genuuid)');
             }
             if (!reqCtx.metaspace) {
-                return this.error(500, 'Metaspace not initialized (E: d0a1b2c3d4e5f6789a0b1c2d3e4f5a6b)');
+                return this.error(500, 'Metaspace not initialized (E: genuuid)');
             }
 
             let parsed: LinkBody;
             try {
                 parsed = JSON.parse(reqCtx.body);
             } catch {
-                return this.error(400, 'Request body must be valid JSON (E: e1b2c3d4e5f67890a1b2c3d4e5f67890)');
+                return this.error(400, 'Request body must be valid JSON (E: genuuid)');
             }
 
             let { code, providerId, parentTjpAddr, userNonce, redirectUri } = parsed;
             if (!code || !providerId || !parentTjpAddr || !userNonce || !redirectUri) {
-                return this.error(400, 'Body missing required parameters (code, providerId, parentTjpAddr, userNonce, redirectUri) (E: f2c3d4e5f6789012a3b4c5d6e7f89012)');
+                return this.error(400, 'Body missing required parameters (code, providerId, parentTjpAddr, userNonce, redirectUri) (E: genuuid)');
             }
 
             if (logalot) { console.log(`${lc} LinkBody parsed (I: 7525b8bd29c8504e989e918825d4e826)`); }

package/src/serve-gib/handlers/api/keystone/sso-login.handler.mts

@@ -63,21 +63,21 @@ export class SsoLoginHandler extends ServeGibHandlerBase<undefined, undefined> {
     ): Promise<ResponseResult | undefined> {
         const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
         try {
-            if (logalot) { console.log(`${lc} starting... (I: 9b5d2a3c4e5f67890a1b2c3d4e5f6789)`); }
+            if (logalot) { console.log(`${lc} starting... (I: genuuid)`); }
 
             if (reqCtx.method !== 'POST') {
                 return this.error(405, 'Method Not Allowed');
             }
 
             if (!reqCtx.body) {
-                return this.error(400, 'Request body is empty (E: 0a1b2c3d4e5f67890a1b2c3d4e5f6789)');
+                return this.error(400, 'Request body is empty (E: genuuid)');
             }
 
             let parsed: SsoLoginBody;
             try {
                 parsed = JSON.parse(reqCtx.body);
             } catch {
-                return this.error(400, 'Request body must be valid JSON (E: 1a1b2c3d4e5f67890a1b2c3d4e5f6789)');
+                return this.error(400, 'Request body must be valid JSON (E: genuuid)');
             }
 
             const { code, providerId, redirectUri } = parsed;

package/src/serve-gib/identity-index/identity-index-helpers.mts

@@ -5,7 +5,7 @@ import { KEYSTONE_EMAIL_REGEXP } from '@ibgib/core-gib/dist/keystone/keystone-co
 import { GLOBAL_LOG_A_LOT } from '../server-constants.mjs';
 import { DEFAULT_EMAIL_HASHES_SUBDIR, DEFAULT_IDENTITY_INDEX_SALT } from './identity-index-constants.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 /**
  * Validates an email address against length constraints and KEYSTONE_EMAIL_REGEXP.

package/src/serve-gib/identity-index/identity-index-service.mts

@@ -9,7 +9,7 @@ import { DEFAULT_IDENTITY_INDEX_SALT, DEFAULT_IDENTITY_INDEX_DIR_NAME } from './
 import { getIdentityEmailHash, getShardedIndexPath } from './identity-index-helpers.mjs';
 import { IdentityIndexRecord, IdentityIndexServiceOptions, RegisterEmailIndexResult } from './identity-index-types.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT || true;
+const logalot = GLOBAL_LOG_A_LOT;
 
 /**
  * Service managing atomic, sharded identity index files for backwards email -> primary identity tjpAddr lookups.

package/src/vcs/workspace-space-helper.mts

@@ -0,0 +1,104 @@
+/**
+ * @module workspace-space-helper
+ *
+ * Helper for managing NodeWorkspaceProjectionSpace_V1 in metaspace.
+ */
+
+import { clone, extractErrorMsg, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { Metaspace_Nodespace } from '../witness/space/metaspace/metaspace-nodespace/metaspace-nodespace.mjs';
+import { NodeWorkspaceProjectionSpace_V1 } from '../witness/space/node-workspace-projection-space/node-workspace-projection-space-v1.mjs';
+import { IbGibSpaceAny } from '@ibgib/core-gib/dist/witness/space/space-base-v1.mjs';
+import { GLOBAL_LOG_A_LOT } from '@ibgib/core-gib/dist/core-constants.mjs';
+
+const lcFile = `[workspace-space-helper]`;
+const logalot = GLOBAL_LOG_A_LOT;
+
+export interface GetOrCreateWorkspaceProjectionSpaceOpts {
+    metaspace: Metaspace_Nodespace;
+    workspaceRoot: string;
+    vcsFolderName?: string;
+    backingSpace: IbGibSpaceAny;
+    branchAddr?: string;
+    name?: string;
+}
+
+export interface GetOrCreateWorkspaceProjectionSpaceResult {
+    space: NodeWorkspaceProjectionSpace_V1;
+    spaceId: string;
+    spaceName: string;
+}
+
+/**
+ * Gets an existing projection space for a workspace root or instantiates and returns a NodeWorkspaceProjectionSpace_V1.
+ */
+export async function getOrCreateWorkspaceProjectionSpace({
+    metaspace,
+    workspaceRoot,
+    vcsFolderName = '.vcsgib',
+    backingSpace,
+    branchAddr,
+    name,
+}: GetOrCreateWorkspaceProjectionSpaceOpts): Promise<GetOrCreateWorkspaceProjectionSpaceResult> {
+    const lc = `${lcFile}[${getOrCreateWorkspaceProjectionSpace.name}]`;
+    try {
+        if (logalot) {
+            console.log(`${lc} starting... (I: genuuid)`);
+        }
+
+        if (!metaspace || !workspaceRoot || !backingSpace) {
+            throw new Error(`metaspace, workspaceRoot, and backingSpace are required (E: genuuid)`);
+        }
+
+        const spaceName = name || `ws_${workspaceRoot.replace(/[^a-zA-Z0-9_]/g, '_')}`;
+
+        const localSpaces = (await metaspace.getLocalUserSpaces({ lock: false })) || [];
+        const existingSpace = localSpaces.find(s =>
+            (s.data?.name === spaceName || s.ib === spaceName) ||
+            (s.data?.classname?.includes('WorkspaceProjectionSpace') && s.data?.workspaceRoot === workspaceRoot)
+        );
+
+        if (existingSpace) {
+            const spaceId = existingSpace.data?.uuid || existingSpace.data?.spaceId || spaceName;
+            if (logalot) {
+                console.log(`${lc} Found existing workspace projection space ${spaceName} (spaceId: ${spaceId})`);
+            }
+            return {
+                space: existingSpace as NodeWorkspaceProjectionSpace_V1,
+                spaceId,
+                spaceName,
+            };
+        }
+
+        const spaceUuid = await getUUID();
+        const space = new NodeWorkspaceProjectionSpace_V1({
+            initialData: {
+                workspaceRoot,
+                vcsFolderName,
+                classname: 'NodeWorkspaceProjectionSpace_V1',
+                name: spaceName,
+                uuid: spaceUuid,
+                version: '1',
+                branchAddr,
+            },
+            backingSpace,
+        });
+        await space.initialized;
+
+        if (logalot) {
+            console.log(`${lc} Created new workspace projection space ${spaceName} (spaceId: ${spaceUuid})`);
+        }
+
+        return {
+            space,
+            spaceId: spaceUuid,
+            spaceName,
+        };
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)} (E: genuuid)`);
+        throw error;
+    } finally {
+        if (logalot) {
+            console.log(`${lc} complete.`);
+        }
+    }
+}

package/src/witness/space/node-workspace-projection-space/node-workspace-projection-space-constants.mts

@@ -0,0 +1,8 @@
+/**
+ * @module node-workspace-projection-space-constants
+ *
+ * Constants for Node.js workspace projection spaces.
+ */
+
+export const DEFAULT_NODE_WORKSPACE_PROJECTION_SPACE_DESCRIPTION =
+    'Node.js space witness for projecting and observing workspace hierarchies on physical disk.';

package/src/witness/space/node-workspace-projection-space/node-workspace-projection-space-types.mts

@@ -0,0 +1,43 @@
+/**
+ * @module node-workspace-projection-space-types
+ *
+ * Types for Node.js workspace projection spaces.
+ */
+
+import {
+    WorkspaceProjectionSpaceData_V1,
+    WorkspaceProjectionSpaceRel8ns_V1
+} from '@ibgib/core-gib/dist/witness/space/workspace-projection-space/workspace-projection-space-types.mjs';
+import {
+    DEFAULT_LOCAL_SPACE_POLLING_INTERVAL_MS,
+    IBGIB_SPACE_NAME_DEFAULT,
+    ZERO_SPACE_ID
+} from '@ibgib/core-gib/dist/witness/space/space-constants.mjs';
+import {
+    DEFAULT_NODE_WORKSPACE_PROJECTION_SPACE_DESCRIPTION
+} from './node-workspace-projection-space-constants.mjs';
+
+/**
+ * Data payload for NodeWorkspaceProjectionSpace_V1.
+ */
+export interface NodeWorkspaceProjectionSpaceData_V1 extends WorkspaceProjectionSpaceData_V1 {
+}
+
+export const DEFAULT_NODE_WORKSPACE_PROJECTION_SPACE_DATA_V1: NodeWorkspaceProjectionSpaceData_V1 = {
+    version: '1',
+    uuid: ZERO_SPACE_ID,
+    name: IBGIB_SPACE_NAME_DEFAULT,
+    classname: 'NodeWorkspaceProjectionSpace_V1',
+    workspaceRoot: '',
+    vcsFolderName: '.vcsgib',
+    persistOptsAndResultIbGibs: false,
+    validateIbGibAddrsMatchIbGibs: false,
+    longPollingIntervalMs: DEFAULT_LOCAL_SPACE_POLLING_INTERVAL_MS,
+    allowPrimitiveArgs: false,
+    catchAllErrors: true,
+    description: DEFAULT_NODE_WORKSPACE_PROJECTION_SPACE_DESCRIPTION,
+    trace: false,
+};
+
+export interface NodeWorkspaceProjectionSpaceRel8ns_V1 extends WorkspaceProjectionSpaceRel8ns_V1 {
+}