@ibgib/space-gib 0.0.16 → 0.0.17

package/dist/server/server.mjs

@@ -14497,7 +14497,6 @@ var MetaspaceBase = class _MetaspaceBase {
         console.timeLog(timerName);
       }
       await this.initializeSpecialIbGibs_required({ timerName });
-      await this.initializeSpecialIbGibs_outerspaces({ timerName });
       await this.initializeSpecialIbGibs_other({ timerName });
       if (logalot33) {
         console.timeEnd(timerName);
@@ -14531,26 +14530,10 @@ var MetaspaceBase = class _MetaspaceBase {
       if (logalot33) {
         console.timeLog(timerName);
       }
-      await this.getSpecialIbGib({ type: SpecialIbGibType.aliases, initialize: true });
-      if (logalot33) {
-        console.timeLog(timerName);
-      }
-      await this.getSpecialIbGib({ type: "robbots", initialize: true });
-      if (logalot33) {
-        console.timeLog(timerName);
-      }
       await this.getSpecialIbGib({ type: "apps", initialize: true });
       if (logalot33) {
         console.timeLog(timerName);
       }
-      await this.getSpecialIbGib({ type: "secrets", initialize: true });
-      if (logalot33) {
-        console.timeLog(timerName);
-      }
-      await this.getSpecialIbGib({ type: "encryptions", initialize: true });
-      if (logalot33) {
-        console.timeLog(timerName);
-      }
     } catch (error) {
       console.error(`${lc2} ${error.message}`);
       throw error;
@@ -20888,12 +20871,21 @@ async function savePendingCodeRecord({ pendingDir, code, maxAttempts = 5, ttlMs
   await fs2.writeFile(codeFilePath, JSON.stringify(record, null, 2), "utf-8");
 }
 function createDefaultEmailSender() {
+  const rawMode = process.env.EMAIL_MODE;
+  if (!rawMode || !rawMode.trim()) {
+    throw new Error('EMAIL_MODE environment variable is missing. Expected "aws" or "mock". (E: 7a8b9c0d1e2f3456789abcdef0123456)');
+  }
+  const mode = rawMode.trim().toLowerCase();
   const isProd = true;
-  const mode = (process.env.EMAIL_MODE || (isProd ? "aws" : "mock")).toLowerCase();
   if (mode === "aws") {
+    const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+    const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+    if (!accessKeyId || !secretAccessKey) {
+      throw new Error("EMAIL_MODE=aws requires AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables. (E: 5e6f7890123456789abcdef5a6b7c8d9)");
+    }
     return new EmailSenderAws({
-      accessKeyId: process.env.AWS_ACCESS_KEY_ID || "",
-      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || "",
+      accessKeyId,
+      secretAccessKey,
       region: process.env.AWS_REGION || "us-east-1"
     });
   } else if (mode === "mock") {
@@ -22792,57 +22784,124 @@ function createPoolConfigFromJson({ template, salt }) {
   }).forVerbs(template.allowedVerbs).build();
 }
 
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-high.json
-var profile_high_default = {
-  $schema: "../schemas/keystone.high.schema.json",
+// ../../libs/core-gib/dist/keystone/policy/profiles/primary/primary-profile.dev.json
+var primary_profile_dev_default = {
+  $schema: "../../schemas/primary/primary-keystone.schema.json",
   metadata: {
-    name: "High Security Profile",
-    securityLevel: "high"
+    name: "Primary Identity Profile (Dev)",
+    securityLevel: "low"
   },
   pools: {
-    sync: {
-      id: "sync",
+    manage: {
+      id: "manage",
       allowedVerbs: [
-        "sync"
+        "manage",
+        "revoke"
+      ],
+      algo: "SHA-256",
+      rounds: 1,
+      behavior: {
+        size: 10,
+        replenish: "replace-all",
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
+      }
+    }
+  }
+};
+
+// ../../libs/core-gib/dist/keystone/policy/profiles/primary/primary-profile.staging.json
+var primary_profile_staging_default = {
+  $schema: "../../schemas/primary/primary-keystone.schema.json",
+  metadata: {
+    name: "Primary Identity Profile (Staging)",
+    securityLevel: "medium"
+  },
+  pools: {
+    manage: {
+      id: "manage",
+      allowedVerbs: [
+        "manage",
+        "revoke"
       ],
       algo: "SHA-512",
-      rounds: 4,
+      rounds: 3,
       behavior: {
-        size: 2e3,
-        replenish: "top-up",
-        selectSequentially: 10,
-        selectRandomly: 10,
-        targetBindingCount: 16
+        size: 500,
+        replenish: "replace-all",
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
-    },
+    }
+  }
+};
+
+// ../../libs/core-gib/dist/keystone/policy/profiles/primary/primary-profile.prod.json
+var primary_profile_prod_default = {
+  $schema: "../../schemas/primary/primary-keystone.schema.json",
+  metadata: {
+    name: "Primary Identity Profile (Prod)",
+    securityLevel: "high"
+  },
+  pools: {
     manage: {
       id: "manage",
       allowedVerbs: [
-        "manage"
+        "manage",
+        "revoke"
       ],
       algo: "SHA-512",
-      rounds: 4,
+      rounds: 6,
       behavior: {
         size: 2e3,
         replenish: "replace-all",
-        selectSequentially: 10,
-        selectRandomly: 10,
+        selectSequentially: 12,
+        selectRandomly: 12,
         targetBindingCount: 16
       }
+    }
+  }
+};
+
+// ../../libs/core-gib/dist/keystone/policy/profiles/sync/sync-profile.dev.json
+var sync_profile_dev_default = {
+  $schema: "../../schemas/sync/sync-keystone.schema.json",
+  metadata: {
+    name: "Sync Delegate Profile (Dev)",
+    securityLevel: "low"
+  },
+  pools: {
+    sync: {
+      id: "sync",
+      allowedVerbs: [
+        "sync"
+      ],
+      algo: "SHA-256",
+      rounds: 1,
+      behavior: {
+        size: 10,
+        replenish: "top-up",
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
+      }
     },
-    revoke: {
-      id: "revoke",
+    manage: {
+      id: "manage",
       allowedVerbs: [
+        "manage",
         "revoke"
       ],
-      algo: "SHA-512",
-      rounds: 20,
+      algo: "SHA-256",
+      rounds: 2,
       behavior: {
-        size: 2e3,
-        replenish: "delete-all",
-        selectSequentially: 50,
-        selectRandomly: 50,
-        targetBindingCount: 0
+        size: 10,
+        replenish: "replace-all",
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
       }
     },
     connect: {
@@ -22850,14 +22909,14 @@ var profile_high_default = {
       allowedVerbs: [
         "connect"
       ],
-      algo: "SHA-512",
-      rounds: 4,
+      algo: "SHA-256",
+      rounds: 1,
       behavior: {
-        size: 2e3,
+        size: 10,
         replenish: "top-up",
-        selectSequentially: 10,
-        selectRandomly: 10,
-        targetBindingCount: 16
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
       }
     },
     sign: {
@@ -22865,24 +22924,24 @@ var profile_high_default = {
       allowedVerbs: [
         "sign"
       ],
-      algo: "SHA-512",
-      rounds: 4,
+      algo: "SHA-256",
+      rounds: 2,
       behavior: {
-        size: 2e3,
+        size: 10,
         replenish: "top-up",
-        selectSequentially: 10,
-        selectRandomly: 10,
-        targetBindingCount: 16
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
       }
     }
   }
 };
 
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-medium.json
-var profile_medium_default = {
-  $schema: "../schemas/keystone.medium.schema.json",
+// ../../libs/core-gib/dist/keystone/policy/profiles/sync/sync-profile.staging.json
+var sync_profile_staging_default = {
+  $schema: "../../schemas/sync/sync-keystone.schema.json",
   metadata: {
-    name: "Medium Security Profile",
+    name: "Sync Delegate Profile (Staging)",
     securityLevel: "medium"
   },
   pools: {
@@ -22894,41 +22953,27 @@ var profile_medium_default = {
       algo: "SHA-256",
       rounds: 2,
       behavior: {
-        size: 500,
+        size: 100,
         replenish: "top-up",
-        selectSequentially: 5,
-        selectRandomly: 5,
-        targetBindingCount: 10
+        selectSequentially: 2,
+        selectRandomly: 2,
+        targetBindingCount: 4
       }
     },
     manage: {
       id: "manage",
       allowedVerbs: [
-        "manage"
-      ],
-      algo: "SHA-256",
-      rounds: 2,
-      behavior: {
-        size: 500,
-        replenish: "replace-all",
-        selectSequentially: 5,
-        selectRandomly: 5,
-        targetBindingCount: 10
-      }
-    },
-    revoke: {
-      id: "revoke",
-      allowedVerbs: [
+        "manage",
         "revoke"
       ],
-      algo: "SHA-256",
-      rounds: 10,
+      algo: "SHA-512",
+      rounds: 3,
       behavior: {
-        size: 500,
-        replenish: "delete-all",
-        selectSequentially: 20,
-        selectRandomly: 20,
-        targetBindingCount: 0
+        size: 250,
+        replenish: "replace-all",
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
     },
     connect: {
@@ -22939,11 +22984,11 @@ var profile_medium_default = {
       algo: "SHA-256",
       rounds: 2,
       behavior: {
-        size: 500,
+        size: 100,
         replenish: "top-up",
-        selectSequentially: 5,
-        selectRandomly: 5,
-        targetBindingCount: 10
+        selectSequentially: 2,
+        selectRandomly: 2,
+        targetBindingCount: 4
       }
     },
     sign: {
@@ -22954,22 +22999,22 @@ var profile_medium_default = {
       algo: "SHA-256",
       rounds: 2,
       behavior: {
-        size: 500,
+        size: 100,
         replenish: "top-up",
-        selectSequentially: 5,
-        selectRandomly: 5,
-        targetBindingCount: 10
+        selectSequentially: 2,
+        selectRandomly: 2,
+        targetBindingCount: 4
       }
     }
   }
 };
 
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-low.json
-var profile_low_default = {
-  $schema: "../schemas/keystone.low.schema.json",
+// ../../libs/core-gib/dist/keystone/policy/profiles/sync/sync-profile.prod.json
+var sync_profile_prod_default = {
+  $schema: "../../schemas/sync/sync-keystone.schema.json",
   metadata: {
-    name: "Low Security Profile",
-    securityLevel: "low"
+    name: "Sync Delegate Profile (Prod)",
+    securityLevel: "high"
   },
   pools: {
     sync: {
@@ -22977,44 +23022,30 @@ var profile_low_default = {
       allowedVerbs: [
         "sync"
       ],
-      algo: "SHA-256",
-      rounds: 1,
+      algo: "SHA-512",
+      rounds: 4,
       behavior: {
-        size: 100,
+        size: 500,
         replenish: "top-up",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 8
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
     },
     manage: {
       id: "manage",
       allowedVerbs: [
-        "manage"
-      ],
-      algo: "SHA-256",
-      rounds: 2,
-      behavior: {
-        size: 100,
-        replenish: "replace-all",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 8
-      }
-    },
-    revoke: {
-      id: "revoke",
-      allowedVerbs: [
+        "manage",
         "revoke"
       ],
-      algo: "SHA-256",
-      rounds: 5,
+      algo: "SHA-512",
+      rounds: 6,
       behavior: {
-        size: 100,
-        replenish: "delete-all",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 0
+        size: 1e3,
+        replenish: "replace-all",
+        selectSequentially: 8,
+        selectRandomly: 8,
+        targetBindingCount: 10
       }
     },
     connect: {
@@ -23022,14 +23053,14 @@ var profile_low_default = {
       allowedVerbs: [
         "connect"
       ],
-      algo: "SHA-256",
-      rounds: 1,
+      algo: "SHA-512",
+      rounds: 4,
       behavior: {
-        size: 100,
+        size: 500,
         replenish: "top-up",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 8
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
     },
     sign: {
@@ -23037,14 +23068,14 @@ var profile_low_default = {
       allowedVerbs: [
         "sign"
       ],
-      algo: "SHA-256",
-      rounds: 2,
+      algo: "SHA-512",
+      rounds: 4,
       behavior: {
-        size: 100,
+        size: 500,
         replenish: "top-up",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 8
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
     }
   }
@@ -23136,132 +23167,6 @@ var profile_session_default = {
   }
 };
 
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-test.json
-var profile_test_default = {
-  $schema: "../schemas/keystone.low.schema.json",
-  metadata: {
-    name: "Domain Identity Profile",
-    securityLevel: "low"
-  },
-  pools: {
-    manage: {
-      id: "manage",
-      allowedVerbs: [
-        "manage",
-        "revoke"
-      ],
-      algo: "SHA-256",
-      rounds: 1,
-      behavior: {
-        size: 10,
-        replenish: "replace-all",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    }
-  }
-};
-
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-domain.json
-var profile_domain_default = {
-  $schema: "../schemas/keystone.high.schema.json",
-  metadata: {
-    name: "Domain Identity Profile",
-    securityLevel: "high"
-  },
-  pools: {
-    manage: {
-      id: "manage",
-      allowedVerbs: [
-        "manage",
-        "revoke"
-      ],
-      algo: "SHA-512",
-      rounds: 6,
-      behavior: {
-        size: 2e3,
-        replenish: "replace-all",
-        selectSequentially: 12,
-        selectRandomly: 12,
-        targetBindingCount: 16
-      }
-    }
-  }
-};
-
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-sync.json
-var profile_sync_default = {
-  $schema: "../schemas/keystone.low.schema.json",
-  metadata: {
-    name: "Sync Delegate Profile",
-    securityLevel: "low"
-  },
-  pools: {
-    sync: {
-      id: "sync",
-      allowedVerbs: [
-        "sync"
-      ],
-      algo: "SHA-256",
-      rounds: 1,
-      behavior: {
-        size: 10,
-        replenish: "top-up",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    },
-    manage: {
-      id: "manage",
-      allowedVerbs: [
-        "manage",
-        "revoke"
-      ],
-      algo: "SHA-256",
-      rounds: 2,
-      behavior: {
-        size: 10,
-        replenish: "replace-all",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    },
-    connect: {
-      id: "connect",
-      allowedVerbs: [
-        "connect"
-      ],
-      algo: "SHA-256",
-      rounds: 1,
-      behavior: {
-        size: 10,
-        replenish: "top-up",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    },
-    sign: {
-      id: "default",
-      allowedVerbs: [
-        "sign"
-      ],
-      algo: "SHA-256",
-      rounds: 2,
-      behavior: {
-        size: 10,
-        replenish: "top-up",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    }
-  }
-};
-
 // ../../libs/core-gib/dist/keystone/policy/keystone-profile-builder.mjs
 var KeystoneProfileBuilder = class _KeystoneProfileBuilder {
   _template;
@@ -23274,34 +23179,38 @@ var KeystoneProfileBuilder = class _KeystoneProfileBuilder {
     this._template = JSON.parse(JSON.stringify(template));
   }
   static buildKeystone(profileName) {
-    if (profileName === "test") {
-      throw new Error(`Security Violation: Keystone profile 'test' is prohibited when NODE_ENV=production. (E: 8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d)`);
+    if (!profileName || typeof profileName !== "string") {
+      throw new Error(`Profile name is required for KeystoneProfileBuilder. (E: 9a8b7c6d5e4f3210987654321fedcba0)`);
+    }
+    const isDevProfile = profileName.endsWith(".dev") || profileName.startsWith("test");
+    if (isDevProfile) {
+      throw new Error(`Security Violation: Development keystone profile '${profileName}' is prohibited when NODE_ENV=production. (E: 8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d)`);
     }
     let selected;
     switch (profileName) {
-      case "high":
-        selected = profile_high_default;
+      case "primary-profile.dev":
+        selected = primary_profile_dev_default;
         break;
-      case "medium":
-        selected = profile_medium_default;
+      case "primary-profile.staging":
+        selected = primary_profile_staging_default;
         break;
-      case "low":
-        selected = profile_low_default;
+      case "primary-profile.prod":
+        selected = primary_profile_prod_default;
         break;
-      case "session":
-        selected = profile_session_default;
+      case "sync-profile.dev":
+        selected = sync_profile_dev_default;
         break;
-      case "test":
-        selected = profile_test_default;
+      case "sync-profile.staging":
+        selected = sync_profile_staging_default;
         break;
-      case "domain":
-        selected = profile_domain_default;
+      case "sync-profile.prod":
+        selected = sync_profile_prod_default;
         break;
-      case "sync":
-        selected = profile_sync_default;
+      case "session":
+        selected = profile_session_default;
         break;
       default:
-        throw new Error(`Unknown profile name: ${profileName} (E: fc10a8ad482ef2bda871ac567d268d26)`);
+        throw new Error(`Unknown keystone profile name: '${profileName}' (E: fc10a8ad482ef2bda871ac567d268d26)`);
     }
     return new _KeystoneProfileBuilder(selected);
   }
@@ -23534,7 +23443,11 @@ var SsoLoginHandler = class _SsoLoginHandler extends ServeGibHandlerBase {
         const tempId = await getUUID();
         const tempDomainMetaspace = await bootstrapDomainMetaspace(`temp^${tempId}`, reqCtx.dataDir);
         const tempSpace = await tempDomainMetaspace.getLocalUserSpace({ lock: false });
-        const primaryBuilder = KeystoneProfileBuilder.buildKeystone("domain").withUsername(username).withEmails([email]).withDetails({
+        const primaryProfileName = "primary-profile.dev";
+        if (!primaryProfileName || !primaryProfileName.trim()) {
+          throw new Error('KEYSTONE_PROFILE_CUSTODIAN_PRIMARY environment variable is missing. Expected valid profile name like "primary-profile.dev" or "primary-profile.prod". (E: 2b3c4d5e6f7890123456789abcdef2)');
+        }
+        const primaryBuilder = KeystoneProfileBuilder.buildKeystone(primaryProfileName.trim()).withUsername(username).withEmails([email]).withDetails({
           client: "space-gib-server",
           role: "custodian-primary",
           custodianProvider: providerId
@@ -23655,7 +23568,11 @@ var KeystoneCustodianGenesisHandler = class _KeystoneCustodianGenesisHandler ext
         isNewIdentity = true;
         console.log(`${lc2} Creating new custodian primary identity for ${normEmail} (I: f123456789abcdef0123456789b0006)`);
         const defaultUsername = username || normEmail.split("@")[0];
-        const primaryBuilder = KeystoneProfileBuilder.buildKeystone("sync").withUsername(defaultUsername).withDescription(`Full Custodian Primary Identity for ${normEmail}`).withDetails({
+        const primaryProfileName = "primary-profile.dev";
+        if (!primaryProfileName || !primaryProfileName.trim()) {
+          throw new Error('KEYSTONE_PROFILE_CUSTODIAN_PRIMARY environment variable is missing. Expected valid profile name like "primary-profile.dev" or "primary-profile.prod". (E: 1a2b3c4d5e6f7890123456789abcdef1)');
+        }
+        const primaryBuilder = KeystoneProfileBuilder.buildKeystone(primaryProfileName.trim()).withUsername(defaultUsername).withDescription(`Full Custodian Primary Identity for ${normEmail}`).withDetails({
           emails: [normEmail],
           custodyMode: "full"
         });
@@ -24010,26 +23927,7 @@ var EmailOutboundHandler = class _EmailOutboundHandler extends ServeGibHandlerBa
   sender;
   constructor(options = {}) {
     super();
-    if (options.sender) {
-      this.sender = options.sender;
-    } else {
-      const isProd = true;
-      const mode = (process.env.EMAIL_MODE || (isProd ? "aws" : "mock")).toLowerCase();
-      if (mode === "aws") {
-        this.sender = new EmailSenderAws({
-          accessKeyId: process.env.AWS_ACCESS_KEY_ID || "",
-          secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || "",
-          region: process.env.AWS_REGION || "us-east-1"
-        });
-      } else if (mode === "mock") {
-        if (isProd) {
-          throw new Error("EMAIL_MODE=mock is prohibited when NODE_ENV=production. (E: 897a6b5c4d3e2f10987654321fedcba0)");
-        }
-        this.sender = new EmailSenderMock();
-      } else {
-        throw new Error(`Unsupported EMAIL_MODE '${mode}'. Must be 'aws' or 'mock'. (E: 987a6b5c4d3e2f10987654321fedcba1)`);
-      }
-    }
+    this.sender = options.sender || createDefaultEmailSender();
   }
   async handleRouteImpl(reqCtx) {
     const lc2 = `${this.lc}[${this.handleRouteImpl.name}]`;
@@ -24071,26 +23969,7 @@ var EmailVerificationCodeHandler = class _EmailVerificationCodeHandler extends S
   sender;
   constructor(options = {}) {
     super();
-    if (options.sender) {
-      this.sender = options.sender;
-    } else {
-      const isProd = true;
-      const mode = (process.env.EMAIL_MODE || (isProd ? "aws" : "mock")).toLowerCase();
-      if (mode === "aws") {
-        this.sender = new EmailSenderAws({
-          accessKeyId: process.env.AWS_ACCESS_KEY_ID || "",
-          secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || "",
-          region: process.env.AWS_REGION || "us-east-1"
-        });
-      } else if (mode === "mock") {
-        if (isProd) {
-          throw new Error("EMAIL_MODE=mock is prohibited when NODE_ENV=production. (E: 897a6b5c4d3e2f10987654321fedcba0)");
-        }
-        this.sender = new EmailSenderMock();
-      } else {
-        throw new Error(`Unsupported EMAIL_MODE '${mode}'. Must be 'aws' or 'mock'. (E: 987a6b5c4d3e2f10987654321fedcba1)`);
-      }
-    }
+    this.sender = options.sender || createDefaultEmailSender();
   }
   async handleRouteImpl(reqCtx) {
     const lc2 = `${this.lc}[${this.handleRouteImpl.name}]`;
@@ -29566,16 +29445,25 @@ async function main() {
   try {
     console.log(`${lc2} starting...`);
     console.log(`${lc2} dataDir: ${DATA_DIR}`);
-    if ("domain".toLowerCase() === "test") {
+    const custodianPrimaryProfile = "primary-profile.dev".trim();
+    if (!custodianPrimaryProfile) {
+      throw new Error(`${lc2} Fatal Error: KEYSTONE_PROFILE_CUSTODIAN_PRIMARY environment variable is missing or blank. (E: 8a9b0c1d2e3f4567890123456789abcd)`);
+    }
+    const isProdEnv = true;
+    if (isProdEnv && !custodianPrimaryProfile.endsWith(".prod")) {
+      throw new Error(`${lc2} Security Violation: Non-production keystone profile '${custodianPrimaryProfile}' is prohibited when NODE_ENV=production. (E: 9b0c1d2e3f4567890123456789abcdef)`);
+    }
+    console.log(`${lc2} KEYSTONE_PROFILE_CUSTODIAN_PRIMARY: ${custodianPrimaryProfile} (I: 961014e2dd082293b83b917835c97e26)`);
+    if (custodianPrimaryProfile.endsWith(".dev")) {
       console.warn(`
 ==========================================================
-\u26A0\uFE0F WARNING: KEYSTONE_PROFILE IS SET TO 'test'!
-ALL GENERATED KEYSTONES USE LOW-SECURITY TEST PARAMETERS (12 CHALLENGES).
+\u26A0\uFE0F WARNING: CUSTODIAN KEYSTONE PROFILE IS SET TO DEVELOPMENT ('${custodianPrimaryProfile}')!
+CUSTODIAL KEYSTONES WILL USE LOW-SECURITY DEV PARAMETERS.
 FOR LOCAL TESTING ONLY \u2014 DO NOT USE FOR REAL SECRETS OR PRODUCTION DATA!
 ==========================================================
  (W: 890123456789abcdef0123456789a123)`);
-    } else {
-      console.log(`process.env.KEYSTONE_PROFILE: ${"domain"} (I: 961014e2dd082293b83b917835c97e26)`);
+    } else if (custodianPrimaryProfile.endsWith(".staging")) {
+      console.info(`${lc2} \u2139\uFE0F STAGING CUSTODIAN KEYSTONE PROFILE ACTIVE ('${custodianPrimaryProfile}')`);
     }
     const syncUpgradeHandler = new SyncUpgradeHandler();
     const serveGib = new ServeGib_V1({
@@ -29606,4 +29494,3 @@ FOR LOCAL TESTING ONLY \u2014 DO NOT USE FOR REAL SECRETS OR PRODUCTION DATA!
   }
 }
 main();
-//# sourceMappingURL=server.mjs.map