@ibgib/node-gib 0.0.9 → 0.0.13

package/dist/serve-gib/keystone-schema-helpers.mjs

@@ -0,0 +1,99 @@
+/**
+ * Strict flatcase regex for individual tokens (username, role, deviceId, providerId).
+ * Lowercase alphanumeric characters only [a-z0-9], no hyphens or punctuation.
+ */
+export const FLATCASE_TOKEN_REGEXP = /^[a-z0-9]+$/;
+/**
+ * Validates if a string token is strict flatcase ([a-z0-9]+).
+ */
+export function validateFlatcaseToken(token) {
+    if (!token || typeof token !== 'string') {
+        return false;
+    }
+    return FLATCASE_TOKEN_REGEXP.test(token);
+}
+/**
+ * Sanitizes an input string to strict flatcase ([a-z0-9]).
+ */
+export function sanitizeToken(input) {
+    if (!input || typeof input !== 'string') {
+        return '';
+    }
+    return input.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+/**
+ * Validates a keystone name string against the naming conventions:
+ * 1. Primary identity: `[username]` (e.g. `alice`)
+ * 2. Delegate: `[username]-[role]-[deviceIdOrProviderId]` (e.g. `alice-sync-browsera` or `alice-sync-google`)
+ *
+ * Enforces strict flatcase on all inner tokens (`[a-z0-9]+`).
+ */
+export function validateKeystoneNameSchema(name) {
+    if (!name || typeof name !== 'string') {
+        return { valid: false, error: 'Keystone name must be a non-empty string.' };
+    }
+    const parts = name.split('-');
+    if (parts.length === 1) {
+        const username = parts[0];
+        if (!validateFlatcaseToken(username)) {
+            return { valid: false, error: `Invalid primary username token '${username}'. Must be flatcase [a-z0-9]+.` };
+        }
+        return { valid: true, type: 'primary', username };
+    }
+    else if (parts.length === 3) {
+        const [username, role, deviceIdOrProviderId] = parts;
+        if (!validateFlatcaseToken(username)) {
+            return { valid: false, error: `Invalid username token '${username}'. Must be flatcase [a-z0-9]+.` };
+        }
+        if (!validateFlatcaseToken(role)) {
+            return { valid: false, error: `Invalid role token '${role}'. Must be flatcase [a-z0-9]+.` };
+        }
+        if (!validateFlatcaseToken(deviceIdOrProviderId)) {
+            return { valid: false, error: `Invalid deviceId/providerId token '${deviceIdOrProviderId}'. Must be flatcase [a-z0-9]+.` };
+        }
+        return { valid: true, type: 'delegate', username, role, deviceIdOrProviderId };
+    }
+    else {
+        return {
+            valid: false,
+            error: `Invalid keystone name format '${name}'. Expected '[username]' or '[username]-[role]-[deviceId]' (3 hyphen-separated flatcase tokens).`
+        };
+    }
+}
+/**
+ * Validates a challenge pool ID string against pool conventions:
+ * 1. Native/User-Owned pool: single flatcase word (e.g. `manage`, `default`, `revoke`, `sync`, `connect`).
+ * 2. Custodial/Foreign pool: `custodian-[what]-[providerId]` (e.g. `custodian-manage-google`, `custodian-revoke-github`).
+ */
+export function validateChallengePoolIdSchema(poolId) {
+    if (!poolId || typeof poolId !== 'string') {
+        return { valid: false, error: 'Pool ID must be a non-empty string.' };
+    }
+    const parts = poolId.split('-');
+    if (parts.length === 1) {
+        if (!validateFlatcaseToken(parts[0])) {
+            return { valid: false, error: `Invalid native pool ID '${poolId}'. Must be flatcase [a-z0-9]+.` };
+        }
+        return { valid: true, isForeign: false };
+    }
+    else if (parts.length === 3) {
+        const [who, what, providerId] = parts;
+        if (who !== 'custodian') {
+            return { valid: false, error: `Invalid foreign pool 'who' token '${who}'. Must be 'custodian'.` };
+        }
+        if (!['manage', 'sync', 'revoke'].includes(what)) {
+            return { valid: false, error: `Invalid foreign pool 'what' token '${what}'. Must be 'manage', 'sync', or 'revoke'.` };
+        }
+        if (!validateFlatcaseToken(providerId)) {
+            return { valid: false, error: `Invalid foreign pool providerId token '${providerId}'. Must be flatcase [a-z0-9]+.` };
+        }
+        return { valid: true, isForeign: true, who, what, providerId };
+    }
+    else {
+        return {
+            valid: false,
+            error: `Invalid challenge pool ID '${poolId}'. Expected single flatcase word or 'custodian-[what]-[providerId]'.`
+        };
+    }
+}
+//# sourceMappingURL=keystone-schema-helpers.mjs.map

package/dist/serve-gib/keystone-schema-helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-schema-helpers.mjs","sourceRoot":"","sources":["../../src/serve-gib/keystone-schema-helpers.mts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAC1D,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACvD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACnD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,QAAQ,gCAAgC,EAAE,CAAC;QAChH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtD,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,oBAAoB,CAAC,GAAG,KAAK,CAAC;QACrD,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,QAAQ,gCAAgC,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,IAAI,gCAAgC,EAAE,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,oBAAoB,gCAAgC,EAAE,CAAC;QAC/H,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IACnF,CAAC;SAAM,CAAC;QACJ,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,iCAAiC,IAAI,kGAAkG;SACjJ,CAAC;IACN,CAAC;AACL,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IACxD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,MAAM,gCAAgC,EAAE,CAAC;QACtG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;QACtC,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,GAAG,yBAAyB,EAAE,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,IAAI,2CAA2C,EAAE,CAAC;QAC1H,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,UAAU,gCAAgC,EAAE,CAAC;QACzH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACnE,CAAC;SAAM,CAAC;QACJ,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,8BAA8B,MAAM,sEAAsE;SACpH,CAAC;IACN,CAAC;AACL,CAAC"}

package/dist/serve-gib/keystone-schema-helpers.respec.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=keystone-schema-helpers.respec.d.mts.map

package/dist/serve-gib/keystone-schema-helpers.respec.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-schema-helpers.respec.d.mts","sourceRoot":"","sources":["../../src/serve-gib/keystone-schema-helpers.respec.mts"],"names":[],"mappings":""}

package/dist/serve-gib/keystone-schema-helpers.respec.mjs

@@ -0,0 +1,68 @@
+import { respecfully, iReckon, ifWe } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+import { validateFlatcaseToken, sanitizeToken, validateKeystoneNameSchema, validateChallengePoolIdSchema, } from './keystone-schema-helpers.mjs';
+const sir = `[${import.meta.url}]`;
+await respecfully(sir, 'Keystone Schema Helpers', async () => {
+    await ifWe(sir, 'validate flatcase tokens accurately', async () => {
+        iReckon(sir, validateFlatcaseToken('alice')).isGonnaBeTrue();
+        iReckon(sir, validateFlatcaseToken('bobbobbins')).isGonnaBeTrue();
+        iReckon(sir, validateFlatcaseToken('dev123')).isGonnaBeTrue();
+        iReckon(sir, validateFlatcaseToken('google')).isGonnaBeTrue();
+        // Invalid: hyphens, uppercase, spaces, special chars
+        iReckon(sir, validateFlatcaseToken('alice-bob')).isGonnaBeFalse();
+        iReckon(sir, validateFlatcaseToken('Alice')).isGonnaBeFalse();
+        iReckon(sir, validateFlatcaseToken('user_name')).isGonnaBeFalse();
+        iReckon(sir, validateFlatcaseToken('user@domain')).isGonnaBeFalse();
+        iReckon(sir, validateFlatcaseToken('')).isGonnaBeFalse();
+    });
+    await ifWe(sir, 'sanitize tokens to clean flatcase', async () => {
+        iReckon(sir, sanitizeToken('Alice_Bob-123!')).willEqual('alicebob123');
+        iReckon(sir, sanitizeToken('user.name@example.com')).willEqual('usernameexamplecom');
+        iReckon(sir, sanitizeToken('GOOGLE-auth')).willEqual('googleauth');
+    });
+    await ifWe(sir, 'validate primary and delegate keystone names', async () => {
+        // Happy path primary identity
+        const resPrimary = validateKeystoneNameSchema('alice');
+        iReckon(sir, resPrimary.valid).isGonnaBeTrue();
+        iReckon(sir, resPrimary.type).willEqual('primary');
+        iReckon(sir, resPrimary.username).willEqual('alice');
+        // Happy path local device delegate
+        const resDelegateDev = validateKeystoneNameSchema('alice-sync-dev123');
+        iReckon(sir, resDelegateDev.valid).isGonnaBeTrue();
+        iReckon(sir, resDelegateDev.type).willEqual('delegate');
+        iReckon(sir, resDelegateDev.username).willEqual('alice');
+        iReckon(sir, resDelegateDev.role).willEqual('sync');
+        iReckon(sir, resDelegateDev.deviceIdOrProviderId).willEqual('dev123');
+        // Happy path SSO custodial delegate
+        const resDelegateSSO = validateKeystoneNameSchema('alice-sync-google');
+        iReckon(sir, resDelegateSSO.valid).isGonnaBeTrue();
+        iReckon(sir, resDelegateSSO.type).willEqual('delegate');
+        iReckon(sir, resDelegateSSO.username).willEqual('alice');
+        iReckon(sir, resDelegateSSO.role).willEqual('sync');
+        iReckon(sir, resDelegateSSO.deviceIdOrProviderId).willEqual('google');
+        // Sad paths: invalid token casing or hyphen counts
+        iReckon(sir, validateKeystoneNameSchema('alice-sync-dev-123').valid).isGonnaBeFalse(); // 4 parts
+        iReckon(sir, validateKeystoneNameSchema('Alice-sync-dev123').valid).isGonnaBeFalse(); // Uppercase
+        iReckon(sir, validateKeystoneNameSchema('alice_bob').valid).isGonnaBeFalse(); // Underscore not allowed in flatcase token
+    });
+    await ifWe(sir, 'validate native and foreign challenge pool IDs', async () => {
+        // Happy path native pools
+        const resManage = validateChallengePoolIdSchema('manage');
+        iReckon(sir, resManage.valid).isGonnaBeTrue();
+        iReckon(sir, resManage.isForeign).isGonnaBeFalse();
+        const resDefault = validateChallengePoolIdSchema('default');
+        iReckon(sir, resDefault.valid).isGonnaBeTrue();
+        iReckon(sir, resDefault.isForeign).isGonnaBeFalse();
+        // Happy path custodial foreign pool
+        const resForeign = validateChallengePoolIdSchema('custodian-manage-google');
+        iReckon(sir, resForeign.valid).isGonnaBeTrue();
+        iReckon(sir, resForeign.isForeign).isGonnaBeTrue();
+        iReckon(sir, resForeign.who).willEqual('custodian');
+        iReckon(sir, resForeign.what).willEqual('manage');
+        iReckon(sir, resForeign.providerId).willEqual('google');
+        // Sad paths: invalid who/what/providerId
+        iReckon(sir, validateChallengePoolIdSchema('user-manage-google').valid).isGonnaBeFalse(); // who must be 'custodian'
+        iReckon(sir, validateChallengePoolIdSchema('custodian-invalidverb-google').valid).isGonnaBeFalse(); // invalid verb
+        iReckon(sir, validateChallengePoolIdSchema('custodian-manage-Google').valid).isGonnaBeFalse(); // non-flatcase providerId
+    });
+});
+//# sourceMappingURL=keystone-schema-helpers.respec.mjs.map

package/dist/serve-gib/keystone-schema-helpers.respec.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystone-schema-helpers.respec.mjs","sourceRoot":"","sources":["../../src/serve-gib/keystone-schema-helpers.respec.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EACH,qBAAqB,EACrB,aAAa,EACb,0BAA0B,EAC1B,6BAA6B,GAChC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,GAAG,GAAG,IAAI,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC;AAEnC,MAAM,WAAW,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,IAAI,EAAE;IAEzD,MAAM,IAAI,CAAC,GAAG,EAAE,qCAAqC,EAAE,KAAK,IAAI,EAAE;QAC9D,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAE9D,qDAAqD;QACrD,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACpE,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,GAAG,EAAE,mCAAmC,EAAE,KAAK,IAAI,EAAE;QAC5D,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,GAAG,EAAE,8CAA8C,EAAE,KAAK,IAAI,EAAE;QACvE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAErD,mCAAmC;QACnC,MAAM,cAAc,GAAG,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEtE,oCAAoC;QACpC,MAAM,cAAc,GAAG,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEtE,mDAAmD;QACnD,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,UAAU;QACjG,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY;QAClG,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,2CAA2C;IAC7H,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,GAAG,EAAE,gDAAgD,EAAE,KAAK,IAAI,EAAE;QACzE,0BAA0B;QAC1B,MAAM,SAAS,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC;QAEnD,MAAM,UAAU,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC;QAEpD,oCAAoC;QACpC,MAAM,UAAU,GAAG,6BAA6B,CAAC,yBAAyB,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAExD,yCAAyC;QACzC,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,0BAA0B;QACpH,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC,8BAA8B,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,eAAe;QACnH,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC,yBAAyB,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,0BAA0B;IAC7H,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/serve-gib/metaspace-nodeindexedspace/metaspace-nodeindexedspace.d.mts

@@ -0,0 +1,38 @@
+/**
+ * @module node-metaspace driven by a node+fs storage substrate
+ *
+ * a metaspace is a space of spaces. it adds/removes spaces and does
+ * inter-spatial composition related things. it's similar to what people think
+ * of in terms of a node in a p2p network.
+ */
+import { IbGibSpaceAny } from '@ibgib/core-gib/dist/witness/space/space-base-v1.mjs';
+import { IbGibCacheService } from '@ibgib/core-gib/dist/common/cache/cache-types.mjs';
+import { MetaspaceBase } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-base.mjs';
+import { MetaspaceFactory } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-types.mjs';
+import { SpaceId } from '@ibgib/core-gib/dist/witness/space/space-types.mjs';
+/**
+ *
+ */
+export declare class Metaspace_Nodeindexedspace extends MetaspaceBase {
+    protected cacheSvc: IbGibCacheService | undefined;
+    protected lc: string;
+    get zeroSpace(): IbGibSpaceAny;
+    constructor(cacheSvc: IbGibCacheService | undefined);
+    protected initializeMetaspaceFactory({ metaspaceFactory }: {
+        metaspaceFactory: MetaspaceFactory;
+    }): Promise<void>;
+    /**
+     * Space deletion on server-side `Metaspace_Nodeindexedspace` is intentionally disabled.
+     *
+     * ## security rationale
+     * Server metaspaces are exposed to network traffic. Exposing automated space deletion
+     * on the server without extensive security/authorization controls introduces a major
+     * attack vector. Server spaces must not be deleted via metaspace API until explicit
+     * server authorization controls are designed and implemented.
+     */
+    deleteLocalUserSpace({ spaceId, deletePhysicalStorage, }: {
+        spaceId: SpaceId;
+        deletePhysicalStorage?: boolean;
+    }): Promise<void>;
+}
+//# sourceMappingURL=metaspace-nodeindexedspace.d.mts.map

package/dist/serve-gib/metaspace-nodeindexedspace/metaspace-nodeindexedspace.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metaspace-nodeindexedspace.d.mts","sourceRoot":"","sources":["../../../src/serve-gib/metaspace-nodeindexedspace/metaspace-nodeindexedspace.mts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,iEAAiE,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kEAAkE,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,oDAAoD,CAAC;AAO7E;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,aAAa;IAiBzD,SAAS,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS;IAdnD,SAAS,CAAC,EAAE,EAAE,MAAM,CAA0C;IAE9D,IAAI,SAAS,IAAI,aAAa,CAO7B;IAED,YAGY,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EAWlD;IAED,UAAgB,0BAA0B,CAAC,EAAE,gBAAgB,EAAE,EAAE;QAC/D,gBAAgB,EAAE,gBAAgB,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;IAED;;;;;;;;OAQG;IACY,oBAAoB,CAAC,EAClC,OAAO,EACP,qBAA4B,GAC7B,EAAE;QACD,OAAO,EAAE,OAAO,CAAC;QACjB,qBAAqB,CAAC,EAAE,OAAO,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhB;CAeF"}

package/dist/serve-gib/metaspace-nodeindexedspace/metaspace-nodeindexedspace.mjs

@@ -0,0 +1,85 @@
+/**
+ * @module node-metaspace driven by a node+fs storage substrate
+ *
+ * a metaspace is a space of spaces. it adds/removes spaces and does
+ * inter-spatial composition related things. it's similar to what people think
+ * of in terms of a node in a p2p network.
+ */
+import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { MetaspaceBase } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-base.mjs';
+import { GLOBAL_LOG_A_LOT, GLOBAL_TIMER_NAME } from '../server-constants.mjs';
+const logalot = GLOBAL_LOG_A_LOT;
+/**
+ *
+ */
+export class Metaspace_Nodeindexedspace extends MetaspaceBase {
+    cacheSvc;
+    // we won't get an object back, only a DTO ibGib essentially
+    lc = `[${Metaspace_Nodeindexedspace.name}]`;
+    get zeroSpace() {
+        const lc = `[${this.lc}][get zeroSpace]`;
+        if (this.metaspaceFactory.fnZeroSpaceFactory) {
+            return this.metaspaceFactory.fnZeroSpaceFactory();
+        }
+        else {
+            throw new Error(`${lc} (UNEXPECTED) this.metaspaceFactory.fnZeroSpaceFactory falsy. not initialized? (E: 9e6c6954dacd868b18c9f34a71e63523)`);
+        }
+    }
+    constructor(
+    // public modalController: ModalController,
+    // public alertController: AlertController,
+    cacheSvc) {
+        super(cacheSvc);
+        this.cacheSvc = cacheSvc;
+        const lc = `${this.lc}[ctor]`;
+        if (logalot) {
+            console.log(`${lc}${GLOBAL_TIMER_NAME}`);
+            console.timeLog(GLOBAL_TIMER_NAME);
+            console.log(`${lc} created. (I: 5690dc2ebf774df3a442bd463dee7455)`);
+        }
+    }
+    async initializeMetaspaceFactory({ metaspaceFactory }) {
+        const lc = `[${this.initializeMetaspaceFactory.name}]`;
+        try {
+            if (logalot) {
+                console.log(`${lc} starting... (I: 5a29670439ac47634dcdfe25225c8223)`);
+            }
+            if (!metaspaceFactory) {
+                throw new Error(`(UNEXPECTED) metaspaceFactory falsy? space-gib server initialization should have guaranteed this to be truthy (E: f305356c2978cf0ee8062fd818940826)`);
+            }
+            if (!metaspaceFactory.fnDefaultLocalSpaceFactory) {
+                throw new Error(`(UNEXPECTED) !metaspaceFactory.fnDefaultLocalSpaceFactory? space-gib server initialization should have guaranteed this to be truthy (E: 884281e5251bd65528eb7b3f48737826)`);
+            }
+            if (!metaspaceFactory.fnDtoToSpace) {
+                throw new Error(`(UNEXPECTED) !metaspaceFactory.fnDtoToSpace? space-gib server initialization should have guaranteed this to be truthy (E: 885b7828606f36f9183bb9e687e25826)`);
+            }
+            if (!metaspaceFactory.fnZeroSpaceFactory) {
+                throw new Error(`(UNEXPECTED) !metaspaceFactory.fnZeroSpaceFactory? space-gib server initialization should have guaranteed this to be truthy (E: 336cf6655758bad4aaeea8ce08d8c826)`);
+            }
+            await super.initializeMetaspaceFactory({ metaspaceFactory });
+        }
+        catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        }
+        finally {
+            if (logalot) {
+                console.log(`${lc} complete.`);
+            }
+        }
+    }
+    /**
+     * Space deletion on server-side `Metaspace_Nodeindexedspace` is intentionally disabled.
+     *
+     * ## security rationale
+     * Server metaspaces are exposed to network traffic. Exposing automated space deletion
+     * on the server without extensive security/authorization controls introduces a major
+     * attack vector. Server spaces must not be deleted via metaspace API until explicit
+     * server authorization controls are designed and implemented.
+     */
+    async deleteLocalUserSpace({ spaceId, deletePhysicalStorage = true, }) {
+        const lc = `${this.lc}[${this.deleteLocalUserSpace.name}]`;
+        throw new Error(`${lc} Space deletion on server-side Metaspace_Nodeindexedspace is intentionally disabled to prevent internet-exposed attack vectors. (E: c9410a5170d14b4fb2478d102e3b2e23)`);
+    }
+}
+//# sourceMappingURL=metaspace-nodeindexedspace.mjs.map

package/dist/serve-gib/metaspace-nodeindexedspace/metaspace-nodeindexedspace.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"metaspace-nodeindexedspace.mjs","sourceRoot":"","sources":["../../../src/serve-gib/metaspace-nodeindexedspace/metaspace-nodeindexedspace.mts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAGlF,OAAO,EAAE,aAAa,EAAE,MAAM,iEAAiE,CAAC;AAIhG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG9E,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,aAAa;IAiB/C,QAAQ;IAfpB,4DAA4D;IAClD,EAAE,GAAW,IAAI,0BAA0B,CAAC,IAAI,GAAG,CAAC;IAE9D,IAAI,SAAS;QACX,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,kBAAkB,CAAC;QACzC,IAAI,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,sHAAsH,CAAC,CAAC;QAC/I,CAAC;IACH,CAAC;IAED;IACE,2CAA2C;IAC3C,2CAA2C;IACjC,QAAuC;QAGjD,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAHN,QAAQ;QAIlB,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,QAAQ,CAAC;QAC9B,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;QACtE,CAAC;IAEH,CAAC;IAES,KAAK,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,EAE5D;QACC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,IAAI,GAAG,CAAC;QACvD,IAAI,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAAC,CAAC;YACxF,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,qJAAqJ,CAAC,CAAC;YAAC,CAAC;YAClM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,2KAA2K,CAAC,CAAC;YAAC,CAAC;YACnP,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,6JAA6J,CAAC,CAAC;YAAC,CAAC;YACvN,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,mKAAmK,CAAC,CAAC;YAAC,CAAC;YAEnO,MAAM,KAAK,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACM,KAAK,CAAC,oBAAoB,CAAC,EAClC,OAAO,EACP,qBAAqB,GAAG,IAAI,GAI7B;QACC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,uKAAuK,CAAC,CAAC;IAChM,CAAC;CAeF"}

package/dist/serve-gib/path-constants.d.mts

@@ -0,0 +1,102 @@
+/** Maximum allowed path length to prevent DoS. */
+export declare const MAX_PATH_LENGTH = 2048;
+/**
+ * Blacklisted patterns for any incoming path.
+ * We iterate through these for a quick security check.
+ */
+export declare const FORBIDDEN_PATTERNS: RegExp[];
+/**
+ * Regex for valid API paths.
+ *
+ * IMPORTANT: See IMPLEMENTATION.md for overall path schema documentation.
+ *
+ * Paths are URL encoded. The `ib` and `gib` portions of addresses are captured explicitly
+ * by splitting on `%5E` or `^`.
+ */
+export declare const API_PATH_REGEXES: {
+    /**
+     * /api/health
+     */
+    HEALTH: RegExp;
+    /**
+     * /api/ibgib/graph/:domainAddr/:ibgibAddr
+     */
+    IBGIB_GRAPH: RegExp;
+    /**
+     * /api/ibgib/:domainAddr/:ibgibAddr
+     */
+    IBGIB_ADDR: RegExp;
+    /**
+     * /api/keystone
+     */
+    KEYSTONE: RegExp;
+    /**
+     * /api/keystone/:domainAddr
+     */
+    KEYSTONE_ADDR: RegExp;
+    /**
+     * /api/ibgib
+     */
+    IBGIB_BASE: RegExp;
+    /**
+     * /api/keystone/evolve/:domainAddr
+     */
+    KEYSTONE_EVOLVE: RegExp;
+    /**
+     * /api/keystone/genesis
+     *
+     * Accepts a single genesis-frame keystone ibgib and creates a new
+     * domain-isolated metaspace for it. No `:domainAddr` in the URL because
+     * the server derives the domain from the incoming keystone ibgib itself.
+     *
+     * Parallel to /api/keystone/evolve.
+     */
+    KEYSTONE_GENESIS: RegExp;
+    /**
+     * /api/keystone/lookup
+     */
+    KEYSTONE_LOOKUP: RegExp;
+    /**
+     * /api/keystone/check-email
+     */
+    KEYSTONE_CHECK_EMAIL: RegExp;
+    /**
+     * /api/debug/ws-echo
+     *
+     * Minimal WebSocket echo endpoint for validating WS plumbing (Traefik
+     * passthrough, server upgrade handling, client connectivity) before
+     * integrating real sync logic.
+     *
+     * ## intent
+     *
+     * NOT for production use. Remove or gate behind a flag once WS sync is
+     * confirmed working end-to-end.
+     */
+    DEBUG_WS_ECHO: RegExp;
+    /**
+     * /api/sync/ws/:domainAddr
+     */
+    SYNC_WS: RegExp;
+    /**
+     * /api/identity/sso/link
+     */
+    IDENTITY_SSO_LINK: RegExp;
+    /**
+     * /api/identity/sso/login
+     */
+    IDENTITY_SSO_LOGIN: RegExp;
+    /**
+     * /api/identity/sso/config
+     */
+    IDENTITY_SSO_CONFIG: RegExp;
+    /**
+     * /api/email/inbound
+     */
+    EMAIL_INBOUND: RegExp;
+    /**
+     * /api/email/send
+     */
+    EMAIL_SEND: RegExp;
+};
+export declare const VALID_STATIC_PATH_REGEX: RegExp;
+//# sourceMappingURL=path-constants.d.mts.map

package/dist/serve-gib/path-constants.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-constants.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAK9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;IACzB;;OAEG;IACH,MAAM;IAEN;;OAEG;IACH,WAAW;IAEX;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,QAAQ;IAER;;OAEG;IACH,aAAa;IAEb;;OAEG;IACH,UAAU;IAEV;;OAEG;IACH,eAAe;IAEf;;;;;;;;OAQG;IACH,gBAAgB;IAEhB;;OAEG;IACH,eAAe;IAEf;;OAEG;IACH,oBAAoB;IAEpB;;;;;;;;;;;OAWG;IACH,aAAa;IACb;;OAEG;IACH,OAAO;IACP;;OAEG;IACH,iBAAiB;IACjB;;OAEG;IACH,kBAAkB;IAClB;;OAEG;IACH,mBAAmB;IACnB;;OAEG;IACH,aAAa;IACb;;OAEG;IACH,UAAU;CACb,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAA4B,CAAC"}

package/dist/serve-gib/path-constants.mjs

@@ -0,0 +1,107 @@
+/** Maximum allowed path length to prevent DoS. */
+export const MAX_PATH_LENGTH = 2048;
+/**
+ * Blacklisted patterns for any incoming path.
+ * We iterate through these for a quick security check.
+ */
+export const FORBIDDEN_PATTERNS = [
+    /\.\./, // No directory traversal
+    /\/\//, // No redundant slashes
+    /\0/, // No null bytes
+    /(^|\/)\./, // No hidden/dot-files (e.g. .env, .git)
+];
+/**
+ * Regex for valid API paths.
+ *
+ * IMPORTANT: See IMPLEMENTATION.md for overall path schema documentation.
+ *
+ * Paths are URL encoded. The `ib` and `gib` portions of addresses are captured explicitly
+ * by splitting on `%5E` or `^`.
+ */
+export const API_PATH_REGEXES = {
+    /**
+     * /api/health
+     */
+    HEALTH: /^\/api\/health\/?$/,
+    /**
+     * /api/ibgib/graph/:domainAddr/:ibgibAddr
+     */
+    IBGIB_GRAPH: /^\/api\/ibgib\/graph\/([^\/]+?)(?:%5E|\^)([^\/]+)\/([^\/]+?)(?:%5E|\^)([^\/]+)\/?$/,
+    /**
+     * /api/ibgib/:domainAddr/:ibgibAddr
+     */
+    IBGIB_ADDR: /^\/api\/ibgib\/([^\/]+?)(?:%5E|\^)([^\/]+)\/([^\/]+?)(?:%5E|\^)([^\/]+)\/?$/,
+    /**
+     * /api/keystone
+     */
+    KEYSTONE: /^\/api\/keystone\/?$/,
+    /**
+     * /api/keystone/:domainAddr
+     */
+    KEYSTONE_ADDR: /^\/api\/keystone\/([^\/]+?)(?:%5E|\^)([^\/]+)\/?$/,
+    /**
+     * /api/ibgib
+     */
+    IBGIB_BASE: /^\/api\/ibgib\/?$/,
+    /**
+     * /api/keystone/evolve/:domainAddr
+     */
+    KEYSTONE_EVOLVE: /^\/api\/keystone\/evolve\/([^\/]+?)(?:%5E|\^)([^\/]+)\/?$/,
+    /**
+     * /api/keystone/genesis
+     *
+     * Accepts a single genesis-frame keystone ibgib and creates a new
+     * domain-isolated metaspace for it. No `:domainAddr` in the URL because
+     * the server derives the domain from the incoming keystone ibgib itself.
+     *
+     * Parallel to /api/keystone/evolve.
+     */
+    KEYSTONE_GENESIS: /^\/api\/keystone\/genesis\/?$/,
+    /**
+     * /api/keystone/lookup
+     */
+    KEYSTONE_LOOKUP: /^\/api\/keystone\/lookup\/?$/,
+    /**
+     * /api/keystone/check-email
+     */
+    KEYSTONE_CHECK_EMAIL: /^\/api\/keystone\/check-email\/?$/,
+    /**
+     * /api/debug/ws-echo
+     *
+     * Minimal WebSocket echo endpoint for validating WS plumbing (Traefik
+     * passthrough, server upgrade handling, client connectivity) before
+     * integrating real sync logic.
+     *
+     * ## intent
+     *
+     * NOT for production use. Remove or gate behind a flag once WS sync is
+     * confirmed working end-to-end.
+     */
+    DEBUG_WS_ECHO: /^\/api\/debug\/ws-echo\/?$/,
+    /**
+     * /api/sync/ws/:domainAddr
+     */
+    SYNC_WS: /^\/api\/sync\/ws\/([^\/]+?)(?:%5E|\^)([^\/]+)\/?$/,
+    /**
+     * /api/identity/sso/link
+     */
+    IDENTITY_SSO_LINK: /^\/api\/identity\/sso\/link\/?$/,
+    /**
+     * /api/identity/sso/login
+     */
+    IDENTITY_SSO_LOGIN: /^\/api\/identity\/sso\/login\/?$/,
+    /**
+     * /api/identity/sso/config
+     */
+    IDENTITY_SSO_CONFIG: /^\/api\/identity\/sso\/config\/?$/,
+    /**
+     * /api/email/inbound
+     */
+    EMAIL_INBOUND: /^\/api\/email\/inbound\/?$/,
+    /**
+     * /api/email/send
+     */
+    EMAIL_SEND: /^\/api\/email\/send\/?$/,
+};
+export const VALID_STATIC_PATH_REGEX = /^\/[a-zA-Z0-9\-_\.\/]*$/;
+//# sourceMappingURL=path-constants.mjs.map

package/dist/serve-gib/path-constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-constants.mjs","sourceRoot":"","sources":["../../src/serve-gib/path-constants.mts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,MAAM,EAAO,yBAAyB;IACtC,MAAM,EAAO,uBAAuB;IACpC,IAAI,EAAS,gBAAgB;IAC7B,UAAU,EAAG,wCAAwC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B;;OAEG;IACH,MAAM,EAAE,oBAAoB;IAE5B;;OAEG;IACH,WAAW,EAAE,oFAAoF;IAEjG;;OAEG;IACH,UAAU,EAAE,6EAA6E;IAEzF;;OAEG;IACH,QAAQ,EAAE,sBAAsB;IAEhC;;OAEG;IACH,aAAa,EAAE,mDAAmD;IAElE;;OAEG;IACH,UAAU,EAAE,mBAAmB;IAE/B;;OAEG;IACH,eAAe,EAAE,2DAA2D;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,+BAA+B;IAEjD;;OAEG;IACH,eAAe,EAAE,8BAA8B;IAE/C;;OAEG;IACH,oBAAoB,EAAE,mCAAmC;IAEzD;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,OAAO,EAAE,mDAAmD;IAC5D;;OAEG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;OAEG;IACH,kBAAkB,EAAE,kCAAkC;IACtD;;OAEG;IACH,mBAAmB,EAAE,mCAAmC;IACxD;;OAEG;IACH,aAAa,EAAE,4BAA4B;IAC3C;;OAEG;IACH,UAAU,EAAE,yBAAyB;CACxC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC"}

package/dist/serve-gib/path-helper.d.mts

@@ -0,0 +1,23 @@
+/**
+ * little helper function just to DRY out code.
+ */
+export declare function runtimeErrorValidationStrings(lc: string, error: any): string[];
+/**
+ * Validates that a path is safe from common attacks and under max length.
+ */
+export declare function validateRawPath(rawPath: string): string[];
+/**
+ * simple boolean wrapper for {@link validateRawPath}
+ */
+export declare function isSafePath(path: string): boolean;
+export declare function validateStaticPath(path: string): string[];
+/**
+ * Validates a static file path.
+ */
+export declare function isValidStaticPath(path: string): boolean;
+/**
+ * Decodes and validates a single ibGib address segment from a URL path.
+ * Uses the library's internal validateIbGibAddr for deep checking.
+ */
+export declare function validateAddressSegment(encodedAddr: string): string[];
+//# sourceMappingURL=path-helper.d.mts.map

package/dist/serve-gib/path-helper.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-helper.d.mts","sourceRoot":"","sources":["../../src/serve-gib/path-helper.mts"],"names":[],"mappings":"AAQA;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM,EAAE,CAI9E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBzD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGhD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBzD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAepE"}