@ibgib/space-gib 0.0.16 → 0.0.18

package/dist/server/server.mjs

@@ -12,6 +12,7 @@ var ERROR_MSG_LOCATION_ONLY_REGEXP = /^(\[.+\]).+$/;
 var HEXADECIMAL_HASH_STRING_REGEXP_32 = /^[0-9a-fA-F]{32}$/;
 var HEXADECIMAL_HASH_STRING_REGEXP_64 = /^[0-9a-fA-F]{64}$/;
 var DEFAULT_DATA_PATH_DELIMITER = "/";
+var ONLY_HAS_NON_ALPHANUMERICS = "_nonalphanumerics_";
 
 // ../../libs/helper-gib/dist/helpers/utils-helper.mjs
 var logalot = HELPER_LOG_A_LOT || false;
@@ -307,6 +308,99 @@ async function getIdPool({ n }) {
     }
   }
 }
+function getSaferSubstring({ text, length, keepLiterals = ["-"], replaceMap }) {
+  const lc2 = `[${getSaferSubstring.name}]`;
+  try {
+    if (logalot) {
+      console.log(`${lc2} starting... (I: 27437e312e5aa621adfebb84e059c822)`);
+    }
+    if (!text) {
+      throw new Error(`text required (E: 87e0493613c8b30dfade83e1d2862a22)`);
+    }
+    let saferText = text;
+    let tokenToKeepMap = {};
+    keepLiterals = keepLiterals ?? [];
+    for (let i = 0; i < keepLiterals.length; i++) {
+      const keep = keepLiterals[i];
+      let tmpToken;
+      do {
+        tmpToken = pickRandom_Letters({ count: 10 });
+      } while (tmpToken.includes(keep) || keep.includes(tmpToken) || text.includes(tmpToken));
+      if (saferText.includes(keep)) {
+        tokenToKeepMap[tmpToken] = keep;
+        while (saferText.includes(keep)) {
+          saferText = saferText.replace(keep, tmpToken);
+        }
+      }
+    }
+    if (replaceMap && Object.keys(replaceMap).length > 0) {
+      for (let i = 0; i < Object.keys(replaceMap).length; i++) {
+        const toReplace = Object.keys(replaceMap)[i];
+        const replaceWith = replaceMap[toReplace];
+        while (saferText.includes(toReplace)) {
+          saferText = saferText.replace(toReplace, replaceWith);
+        }
+      }
+    }
+    saferText = saferText.replace(/\W/g, "");
+    const tokens = Object.keys(tokenToKeepMap);
+    for (let i = 0; i < tokens.length; i++) {
+      const token = tokens[i];
+      while (saferText.includes(token)) {
+        saferText = saferText.replace(token, tokenToKeepMap[token]);
+      }
+    }
+    if (length && length > 0) {
+      if (saferText.length > length) {
+        if (logalot) {
+          console.log(`${lc2} curtailing length (I: d7a28e05daa5979c7686b4c1cf519b23)`);
+        }
+        saferText = saferText.substring(0, length);
+      }
+    }
+    if (saferText.length === 0) {
+      saferText = ONLY_HAS_NON_ALPHANUMERICS;
+    }
+    return saferText;
+  } catch (error) {
+    console.error(`${lc2} ${error.message}`);
+    throw error;
+  } finally {
+    if (logalot) {
+      console.log(`${lc2} complete.`);
+    }
+  }
+}
+function pickRandom({ x }) {
+  if ((x ?? []).length === 0) {
+    return void 0;
+  }
+  let randomIndex = Math.floor(Math.random() * x.length);
+  return x[randomIndex];
+}
+function pickRandom_Letters({ count }) {
+  const lc2 = `${pickRandom_Letters.name}]`;
+  try {
+    if (!Number.isInteger(count)) {
+      throw new Error(`count required to be a number. (E: c0a21d884ebd9afc4b2e8025207e0522)`);
+    }
+    let result = "";
+    for (let i = 0; i < count; i++) {
+      result += pickRandom({ x: "a b c d e f g h i j k l m n o p q r s t u v w x y z".split(" ") });
+    }
+    if (result.length !== count) {
+      throw new Error(`${lc2} (UNEXPECTED) result.length !== count ? (E: 9bec4ec8f78610d8055e565415392a22)`);
+    }
+    return result;
+  } catch (error) {
+    console.error(`${lc2} ${error.message}`);
+    throw error;
+  } finally {
+    if (logalot) {
+      console.log(`${lc2} complete.`);
+    }
+  }
+}
 function mergeMapsOrArrays_Naive({ dominant, recessive }) {
   const lc2 = `[${mergeMapsOrArrays_Naive.name}]`;
   try {
@@ -1358,7 +1452,7 @@ function patch(obj, patchInfo) {
 
 // ../../libs/ts-gib/dist/V1/transforms/rel8.mjs
 async function rel8(opts) {
-  const { noTimestamp, dna, linkedRel8ns, rel8nsToAddByAddr, rel8nsToRemoveByAddr, type = "rel8" } = opts;
+  const { noTimestamp, dna, linkedRel8ns, rel8nsToAddByAddr, rel8nsToRemoveByAddr, rel8nsToReplaceByAddr, type = "rel8" } = opts;
   let src = opts.src;
   const lc2 = "[rel8_v1]";
   if (type !== "rel8") {
@@ -1390,8 +1484,9 @@ async function rel8(opts) {
   }
   const isAdding = rel8nsToAddByAddr && Object.keys(rel8nsToAddByAddr).length > 0;
   const isRemoving = rel8nsToRemoveByAddr && Object.keys(rel8nsToRemoveByAddr).length > 0;
-  if (!(isAdding || isRemoving)) {
-    throw new Error(`${lc2} gotta provide relations to either add or remove.`);
+  const isReplacing = rel8nsToReplaceByAddr && Object.keys(rel8nsToReplaceByAddr).length > 0;
+  if (!(isAdding || isRemoving || isReplacing)) {
+    throw new Error(`${lc2} gotta provide relations to add, remove, or replace.`);
   }
   const srcAddr = getIbGibAddr({ ib: src.ib, gib: src.gib });
   if (opts.srcAddr && srcAddr !== opts.srcAddr) {
@@ -1411,6 +1506,11 @@ async function rel8(opts) {
       throw new Error(`${lc2} Invalid remove rel8n attempt. Must be valid ibGibs. Did you include a delimiter (^)?`);
     }
   });
+  Object.keys(rel8nsToReplaceByAddr || {}).map((x) => (rel8nsToReplaceByAddr || {})[x]).forEach((replacements) => {
+    if (!(replacements && replacements.every((r) => r && fnValidIbGibAddr(r.oldAddr) && fnValidIbGibAddr(r.newAddr)))) {
+      throw new Error(`${lc2} Invalid replace rel8n attempt. Must be valid ibGibs with oldAddr and newAddr. Did you include a delimiter (^)?`);
+    }
+  });
   let dto = { ib: src.ib, gib: src.gib };
   if (src.data && Object.keys(src.data).length > 0) {
     dto.data = src.data;
@@ -1443,6 +1543,28 @@ async function rel8(opts) {
     data.timestampMs = date.getMilliseconds();
   }
   const rel8ns = clone(src.rel8ns || {});
+  Object.keys(rel8nsToReplaceByAddr || {}).forEach((rel8nName) => {
+    if (FORBIDDEN_ADD_RENAME_REMOVE_REL8N_NAMES.includes(rel8nName)) {
+      throw new Error(`${lc2} Cannot manually replace relationship: ${rel8nName}.`);
+    }
+    const existingRel8d = rel8ns[rel8nName] || [];
+    const replacements = rel8nsToReplaceByAddr[rel8nName] || [];
+    const updatedRel8d = [...existingRel8d];
+    for (const replacement of replacements) {
+      const { oldAddr, newAddr } = replacement;
+      let found = false;
+      for (let i = 0; i < updatedRel8d.length; i++) {
+        if (updatedRel8d[i] === oldAddr) {
+          updatedRel8d[i] = newAddr;
+          found = true;
+        }
+      }
+      if (!found) {
+        throw new Error(`${lc2} Cannot replace oldAddr '${oldAddr}' in rel8n '${rel8nName}' - oldAddr not found in existing relationships.`);
+      }
+    }
+    rel8ns[rel8nName] = updatedRel8d;
+  });
   Object.keys(rel8nsToAddByAddr || {}).forEach((rel8nName) => {
     if (FORBIDDEN_ADD_RENAME_REMOVE_REL8N_NAMES.includes(rel8nName)) {
       throw new Error(`${lc2} Cannot manually add relationship: ${rel8nName}.`);
@@ -14497,7 +14619,6 @@ var MetaspaceBase = class _MetaspaceBase {
         console.timeLog(timerName);
       }
       await this.initializeSpecialIbGibs_required({ timerName });
-      await this.initializeSpecialIbGibs_outerspaces({ timerName });
       await this.initializeSpecialIbGibs_other({ timerName });
       if (logalot33) {
         console.timeEnd(timerName);
@@ -14531,26 +14652,10 @@ var MetaspaceBase = class _MetaspaceBase {
       if (logalot33) {
         console.timeLog(timerName);
       }
-      await this.getSpecialIbGib({ type: SpecialIbGibType.aliases, initialize: true });
-      if (logalot33) {
-        console.timeLog(timerName);
-      }
-      await this.getSpecialIbGib({ type: "robbots", initialize: true });
-      if (logalot33) {
-        console.timeLog(timerName);
-      }
       await this.getSpecialIbGib({ type: "apps", initialize: true });
       if (logalot33) {
         console.timeLog(timerName);
       }
-      await this.getSpecialIbGib({ type: "secrets", initialize: true });
-      if (logalot33) {
-        console.timeLog(timerName);
-      }
-      await this.getSpecialIbGib({ type: "encryptions", initialize: true });
-      if (logalot33) {
-        console.timeLog(timerName);
-      }
     } catch (error) {
       console.error(`${lc2} ${error.message}`);
       throw error;
@@ -20340,7 +20445,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
     }
   }
   /**
-   * Evolve the keystone by rotating the primary user manage pool (`manage`) to a new master secret (passphrase).
+   * Evolve the keystone by rotating the primary user manage pool (`manage`) to a new master secret (password).
    * This creates a new frame signed by the specified `signingPoolId` using `signingSecret`.
    *
    * Supports recovery (signing via `custodian-manage` using the custodian secret) and normal rotation
@@ -20491,7 +20596,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
     }
   }
   /**
-   * Verifies if a candidate signing secret (passphrase) is correct for a specific challenge pool.
+   * Verifies if a candidate signing secret (password) is correct for a specific challenge pool.
    * Does not mutate any state.
    */
   async verifySigningSecret({ keystoneIbGib, signingSecret, poolId }) {
@@ -20888,12 +20993,21 @@ async function savePendingCodeRecord({ pendingDir, code, maxAttempts = 5, ttlMs
   await fs2.writeFile(codeFilePath, JSON.stringify(record, null, 2), "utf-8");
 }
 function createDefaultEmailSender() {
+  const rawMode = process.env.EMAIL_MODE;
+  if (!rawMode || !rawMode.trim()) {
+    throw new Error('EMAIL_MODE environment variable is missing. Expected "aws" or "mock". (E: 7a8b9c0d1e2f3456789abcdef0123456)');
+  }
+  const mode = rawMode.trim().toLowerCase();
   const isProd = true;
-  const mode = (process.env.EMAIL_MODE || (isProd ? "aws" : "mock")).toLowerCase();
   if (mode === "aws") {
+    const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+    const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+    if (!accessKeyId || !secretAccessKey) {
+      throw new Error("EMAIL_MODE=aws requires AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables. (E: 5e6f7890123456789abcdef5a6b7c8d9)");
+    }
     return new EmailSenderAws({
-      accessKeyId: process.env.AWS_ACCESS_KEY_ID || "",
-      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || "",
+      accessKeyId,
+      secretAccessKey,
       region: process.env.AWS_REGION || "us-east-1"
     });
   } else if (mode === "mock") {
@@ -22792,57 +22906,124 @@ function createPoolConfigFromJson({ template, salt }) {
   }).forVerbs(template.allowedVerbs).build();
 }
 
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-high.json
-var profile_high_default = {
-  $schema: "../schemas/keystone.high.schema.json",
+// ../../libs/core-gib/dist/keystone/policy/profiles/primary/primary-profile.dev.json
+var primary_profile_dev_default = {
+  $schema: "../../schemas/primary/primary-keystone.schema.json",
   metadata: {
-    name: "High Security Profile",
-    securityLevel: "high"
+    name: "Primary Identity Profile (Dev)",
+    securityLevel: "low"
   },
   pools: {
-    sync: {
-      id: "sync",
+    manage: {
+      id: "manage",
       allowedVerbs: [
-        "sync"
+        "manage",
+        "revoke"
+      ],
+      algo: "SHA-256",
+      rounds: 1,
+      behavior: {
+        size: 10,
+        replenish: "replace-all",
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
+      }
+    }
+  }
+};
+
+// ../../libs/core-gib/dist/keystone/policy/profiles/primary/primary-profile.staging.json
+var primary_profile_staging_default = {
+  $schema: "../../schemas/primary/primary-keystone.schema.json",
+  metadata: {
+    name: "Primary Identity Profile (Staging)",
+    securityLevel: "medium"
+  },
+  pools: {
+    manage: {
+      id: "manage",
+      allowedVerbs: [
+        "manage",
+        "revoke"
       ],
       algo: "SHA-512",
-      rounds: 4,
+      rounds: 3,
       behavior: {
-        size: 2e3,
-        replenish: "top-up",
-        selectSequentially: 10,
-        selectRandomly: 10,
-        targetBindingCount: 16
+        size: 500,
+        replenish: "replace-all",
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
-    },
+    }
+  }
+};
+
+// ../../libs/core-gib/dist/keystone/policy/profiles/primary/primary-profile.prod.json
+var primary_profile_prod_default = {
+  $schema: "../../schemas/primary/primary-keystone.schema.json",
+  metadata: {
+    name: "Primary Identity Profile (Prod)",
+    securityLevel: "high"
+  },
+  pools: {
     manage: {
       id: "manage",
       allowedVerbs: [
-        "manage"
+        "manage",
+        "revoke"
       ],
       algo: "SHA-512",
-      rounds: 4,
+      rounds: 6,
       behavior: {
         size: 2e3,
         replenish: "replace-all",
-        selectSequentially: 10,
-        selectRandomly: 10,
+        selectSequentially: 12,
+        selectRandomly: 12,
         targetBindingCount: 16
       }
+    }
+  }
+};
+
+// ../../libs/core-gib/dist/keystone/policy/profiles/sync/sync-profile.dev.json
+var sync_profile_dev_default = {
+  $schema: "../../schemas/sync/sync-keystone.schema.json",
+  metadata: {
+    name: "Sync Delegate Profile (Dev)",
+    securityLevel: "low"
+  },
+  pools: {
+    sync: {
+      id: "sync",
+      allowedVerbs: [
+        "sync"
+      ],
+      algo: "SHA-256",
+      rounds: 1,
+      behavior: {
+        size: 10,
+        replenish: "top-up",
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
+      }
     },
-    revoke: {
-      id: "revoke",
+    manage: {
+      id: "manage",
       allowedVerbs: [
+        "manage",
         "revoke"
       ],
-      algo: "SHA-512",
-      rounds: 20,
+      algo: "SHA-256",
+      rounds: 2,
       behavior: {
-        size: 2e3,
-        replenish: "delete-all",
-        selectSequentially: 50,
-        selectRandomly: 50,
-        targetBindingCount: 0
+        size: 10,
+        replenish: "replace-all",
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
       }
     },
     connect: {
@@ -22850,14 +23031,14 @@ var profile_high_default = {
       allowedVerbs: [
         "connect"
       ],
-      algo: "SHA-512",
-      rounds: 4,
+      algo: "SHA-256",
+      rounds: 1,
       behavior: {
-        size: 2e3,
+        size: 10,
         replenish: "top-up",
-        selectSequentially: 10,
-        selectRandomly: 10,
-        targetBindingCount: 16
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
       }
     },
     sign: {
@@ -22865,24 +23046,24 @@ var profile_high_default = {
       allowedVerbs: [
         "sign"
       ],
-      algo: "SHA-512",
-      rounds: 4,
+      algo: "SHA-256",
+      rounds: 2,
       behavior: {
-        size: 2e3,
+        size: 10,
         replenish: "top-up",
-        selectSequentially: 10,
-        selectRandomly: 10,
-        targetBindingCount: 16
+        selectSequentially: 1,
+        selectRandomly: 1,
+        targetBindingCount: 2
       }
     }
   }
 };
 
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-medium.json
-var profile_medium_default = {
-  $schema: "../schemas/keystone.medium.schema.json",
+// ../../libs/core-gib/dist/keystone/policy/profiles/sync/sync-profile.staging.json
+var sync_profile_staging_default = {
+  $schema: "../../schemas/sync/sync-keystone.schema.json",
   metadata: {
-    name: "Medium Security Profile",
+    name: "Sync Delegate Profile (Staging)",
     securityLevel: "medium"
   },
   pools: {
@@ -22894,41 +23075,27 @@ var profile_medium_default = {
       algo: "SHA-256",
       rounds: 2,
       behavior: {
-        size: 500,
+        size: 100,
         replenish: "top-up",
-        selectSequentially: 5,
-        selectRandomly: 5,
-        targetBindingCount: 10
+        selectSequentially: 2,
+        selectRandomly: 2,
+        targetBindingCount: 4
       }
     },
     manage: {
       id: "manage",
       allowedVerbs: [
-        "manage"
-      ],
-      algo: "SHA-256",
-      rounds: 2,
-      behavior: {
-        size: 500,
-        replenish: "replace-all",
-        selectSequentially: 5,
-        selectRandomly: 5,
-        targetBindingCount: 10
-      }
-    },
-    revoke: {
-      id: "revoke",
-      allowedVerbs: [
+        "manage",
         "revoke"
       ],
-      algo: "SHA-256",
-      rounds: 10,
+      algo: "SHA-512",
+      rounds: 3,
       behavior: {
-        size: 500,
-        replenish: "delete-all",
-        selectSequentially: 20,
-        selectRandomly: 20,
-        targetBindingCount: 0
+        size: 250,
+        replenish: "replace-all",
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
     },
     connect: {
@@ -22939,11 +23106,11 @@ var profile_medium_default = {
       algo: "SHA-256",
       rounds: 2,
       behavior: {
-        size: 500,
+        size: 100,
         replenish: "top-up",
-        selectSequentially: 5,
-        selectRandomly: 5,
-        targetBindingCount: 10
+        selectSequentially: 2,
+        selectRandomly: 2,
+        targetBindingCount: 4
       }
     },
     sign: {
@@ -22954,22 +23121,22 @@ var profile_medium_default = {
       algo: "SHA-256",
       rounds: 2,
       behavior: {
-        size: 500,
+        size: 100,
         replenish: "top-up",
-        selectSequentially: 5,
-        selectRandomly: 5,
-        targetBindingCount: 10
+        selectSequentially: 2,
+        selectRandomly: 2,
+        targetBindingCount: 4
       }
     }
   }
 };
 
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-low.json
-var profile_low_default = {
-  $schema: "../schemas/keystone.low.schema.json",
+// ../../libs/core-gib/dist/keystone/policy/profiles/sync/sync-profile.prod.json
+var sync_profile_prod_default = {
+  $schema: "../../schemas/sync/sync-keystone.schema.json",
   metadata: {
-    name: "Low Security Profile",
-    securityLevel: "low"
+    name: "Sync Delegate Profile (Prod)",
+    securityLevel: "high"
   },
   pools: {
     sync: {
@@ -22977,44 +23144,30 @@ var profile_low_default = {
       allowedVerbs: [
         "sync"
       ],
-      algo: "SHA-256",
-      rounds: 1,
+      algo: "SHA-512",
+      rounds: 4,
       behavior: {
-        size: 100,
+        size: 500,
         replenish: "top-up",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 8
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
     },
     manage: {
       id: "manage",
       allowedVerbs: [
-        "manage"
-      ],
-      algo: "SHA-256",
-      rounds: 2,
-      behavior: {
-        size: 100,
-        replenish: "replace-all",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 8
-      }
-    },
-    revoke: {
-      id: "revoke",
-      allowedVerbs: [
+        "manage",
         "revoke"
       ],
-      algo: "SHA-256",
-      rounds: 5,
+      algo: "SHA-512",
+      rounds: 6,
       behavior: {
-        size: 100,
-        replenish: "delete-all",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 0
+        size: 1e3,
+        replenish: "replace-all",
+        selectSequentially: 8,
+        selectRandomly: 8,
+        targetBindingCount: 10
       }
     },
     connect: {
@@ -23022,14 +23175,14 @@ var profile_low_default = {
       allowedVerbs: [
         "connect"
       ],
-      algo: "SHA-256",
-      rounds: 1,
+      algo: "SHA-512",
+      rounds: 4,
       behavior: {
-        size: 100,
+        size: 500,
         replenish: "top-up",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 8
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
     },
     sign: {
@@ -23037,14 +23190,14 @@ var profile_low_default = {
       allowedVerbs: [
         "sign"
       ],
-      algo: "SHA-256",
-      rounds: 2,
+      algo: "SHA-512",
+      rounds: 4,
       behavior: {
-        size: 100,
+        size: 500,
         replenish: "top-up",
-        selectSequentially: 3,
-        selectRandomly: 3,
-        targetBindingCount: 8
+        selectSequentially: 4,
+        selectRandomly: 4,
+        targetBindingCount: 6
       }
     }
   }
@@ -23136,132 +23289,6 @@ var profile_session_default = {
   }
 };
 
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-test.json
-var profile_test_default = {
-  $schema: "../schemas/keystone.low.schema.json",
-  metadata: {
-    name: "Domain Identity Profile",
-    securityLevel: "low"
-  },
-  pools: {
-    manage: {
-      id: "manage",
-      allowedVerbs: [
-        "manage",
-        "revoke"
-      ],
-      algo: "SHA-256",
-      rounds: 1,
-      behavior: {
-        size: 10,
-        replenish: "replace-all",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    }
-  }
-};
-
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-domain.json
-var profile_domain_default = {
-  $schema: "../schemas/keystone.high.schema.json",
-  metadata: {
-    name: "Domain Identity Profile",
-    securityLevel: "high"
-  },
-  pools: {
-    manage: {
-      id: "manage",
-      allowedVerbs: [
-        "manage",
-        "revoke"
-      ],
-      algo: "SHA-512",
-      rounds: 6,
-      behavior: {
-        size: 2e3,
-        replenish: "replace-all",
-        selectSequentially: 12,
-        selectRandomly: 12,
-        targetBindingCount: 16
-      }
-    }
-  }
-};
-
-// ../../libs/core-gib/dist/keystone/policy/profiles/profile-sync.json
-var profile_sync_default = {
-  $schema: "../schemas/keystone.low.schema.json",
-  metadata: {
-    name: "Sync Delegate Profile",
-    securityLevel: "low"
-  },
-  pools: {
-    sync: {
-      id: "sync",
-      allowedVerbs: [
-        "sync"
-      ],
-      algo: "SHA-256",
-      rounds: 1,
-      behavior: {
-        size: 10,
-        replenish: "top-up",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    },
-    manage: {
-      id: "manage",
-      allowedVerbs: [
-        "manage",
-        "revoke"
-      ],
-      algo: "SHA-256",
-      rounds: 2,
-      behavior: {
-        size: 10,
-        replenish: "replace-all",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    },
-    connect: {
-      id: "connect",
-      allowedVerbs: [
-        "connect"
-      ],
-      algo: "SHA-256",
-      rounds: 1,
-      behavior: {
-        size: 10,
-        replenish: "top-up",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    },
-    sign: {
-      id: "default",
-      allowedVerbs: [
-        "sign"
-      ],
-      algo: "SHA-256",
-      rounds: 2,
-      behavior: {
-        size: 10,
-        replenish: "top-up",
-        selectSequentially: 1,
-        selectRandomly: 1,
-        targetBindingCount: 2
-      }
-    }
-  }
-};
-
 // ../../libs/core-gib/dist/keystone/policy/keystone-profile-builder.mjs
 var KeystoneProfileBuilder = class _KeystoneProfileBuilder {
   _template;
@@ -23274,34 +23301,38 @@ var KeystoneProfileBuilder = class _KeystoneProfileBuilder {
     this._template = JSON.parse(JSON.stringify(template));
   }
   static buildKeystone(profileName) {
-    if (profileName === "test") {
-      throw new Error(`Security Violation: Keystone profile 'test' is prohibited when NODE_ENV=production. (E: 8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d)`);
+    if (!profileName || typeof profileName !== "string") {
+      throw new Error(`Profile name is required for KeystoneProfileBuilder. (E: 9a8b7c6d5e4f3210987654321fedcba0)`);
+    }
+    const isDevProfile = profileName.endsWith(".dev") || profileName.startsWith("test");
+    if (isDevProfile) {
+      throw new Error(`Security Violation: Development keystone profile '${profileName}' is prohibited when NODE_ENV=production. (E: 8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d)`);
     }
     let selected;
     switch (profileName) {
-      case "high":
-        selected = profile_high_default;
+      case "primary-profile.dev":
+        selected = primary_profile_dev_default;
         break;
-      case "medium":
-        selected = profile_medium_default;
+      case "primary-profile.staging":
+        selected = primary_profile_staging_default;
         break;
-      case "low":
-        selected = profile_low_default;
+      case "primary-profile.prod":
+        selected = primary_profile_prod_default;
         break;
-      case "session":
-        selected = profile_session_default;
+      case "sync-profile.dev":
+        selected = sync_profile_dev_default;
         break;
-      case "test":
-        selected = profile_test_default;
+      case "sync-profile.staging":
+        selected = sync_profile_staging_default;
         break;
-      case "domain":
-        selected = profile_domain_default;
+      case "sync-profile.prod":
+        selected = sync_profile_prod_default;
         break;
-      case "sync":
-        selected = profile_sync_default;
+      case "session":
+        selected = profile_session_default;
         break;
       default:
-        throw new Error(`Unknown profile name: ${profileName} (E: fc10a8ad482ef2bda871ac567d268d26)`);
+        throw new Error(`Unknown keystone profile name: '${profileName}' (E: fc10a8ad482ef2bda871ac567d268d26)`);
     }
     return new _KeystoneProfileBuilder(selected);
   }
@@ -23513,7 +23544,8 @@ var SsoLoginHandler = class _SsoLoginHandler extends ServeGibHandlerBase {
         return this.error(400, `No email address returned from SSO provider ${providerId} (E: 3c3d4e5f67890123c4d5e6f789012345)`);
       }
       const email = userInfo.email.trim().toLowerCase();
-      const username = userInfo.name || email.split("@")[0];
+      const rawSSOName = userInfo.name || "";
+      const username = getSaferSubstring({ text: rawSSOName || email.split("@")[0], length: 62, keepLiterals: ["_", "-"] });
       const ssoConfig = loadSsoServerConfig();
       const serverSecret = ssoConfig.ssoServerKdfSecret;
       const primarySecret = await hash({ s: `${serverSecret}_custodian_${email}` });
@@ -23526,18 +23558,26 @@ var SsoLoginHandler = class _SsoLoginHandler extends ServeGibHandlerBase {
         primaryTjpAddr = existingLookup.primaryTjpAddr;
         const domainMetaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
         const space = await domainMetaspace.getLocalUserSpace({ lock: false });
-        const latestPrimaryAddr = await domainMetaspace.getLatestAddr({ addr: primaryTjpAddr, space }) ?? primaryTjpAddr;
-        const getRes = await domainMetaspace.get({ addrs: [latestPrimaryAddr], space });
-        primaryKeystone = getRes.ibGibs?.[0];
+        const keystoneService = new KeystoneService_V1();
+        primaryKeystone = await keystoneService.getLatestKeystone({
+          addr: primaryTjpAddr,
+          metaspace: domainMetaspace,
+          space
+        });
       } else {
         isNewIdentity = true;
         const tempId = await getUUID();
         const tempDomainMetaspace = await bootstrapDomainMetaspace(`temp^${tempId}`, reqCtx.dataDir);
         const tempSpace = await tempDomainMetaspace.getLocalUserSpace({ lock: false });
-        const primaryBuilder = KeystoneProfileBuilder.buildKeystone("domain").withUsername(username).withEmails([email]).withDetails({
+        const primaryProfileName = "primary-profile.dev";
+        if (!primaryProfileName || !primaryProfileName.trim()) {
+          throw new Error('KEYSTONE_PROFILE_CUSTODIAN_PRIMARY environment variable is missing. Expected valid profile name like "primary-profile.dev" or "primary-profile.prod". (E: 2b3c4d5e6f7890123456789abcdef2)');
+        }
+        const primaryBuilder = KeystoneProfileBuilder.buildKeystone(primaryProfileName.trim()).withUsername(username).withEmails([email]).withDetails({
           client: "space-gib-server",
           role: "custodian-primary",
-          custodianProvider: providerId
+          custodianProvider: providerId,
+          [`rawSSOName-${providerId}`]: rawSSOName
         });
         const configs = await primaryBuilder.compileConfigs();
         const keystoneService = new KeystoneService_V1();
@@ -23647,15 +23687,22 @@ var KeystoneCustodianGenesisHandler = class _KeystoneCustodianGenesisHandler ext
         const metaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
         const space = await metaspace.getLocalUserSpace({ lock: false });
         if (space) {
-          const latestAddr = await metaspace.getLatestAddr({ addr: primaryTjpAddr, space }) ?? primaryTjpAddr;
-          const getRes = await metaspace.get({ addrs: [latestAddr], space });
-          primaryKeystone = getRes.ibGibs?.[0];
+          const keystoneService = new KeystoneService_V1();
+          primaryKeystone = await keystoneService.getLatestKeystone({
+            addr: primaryTjpAddr,
+            metaspace,
+            space
+          });
         }
       } else {
         isNewIdentity = true;
         console.log(`${lc2} Creating new custodian primary identity for ${normEmail} (I: f123456789abcdef0123456789b0006)`);
         const defaultUsername = username || normEmail.split("@")[0];
-        const primaryBuilder = KeystoneProfileBuilder.buildKeystone("sync").withUsername(defaultUsername).withDescription(`Full Custodian Primary Identity for ${normEmail}`).withDetails({
+        const primaryProfileName = "primary-profile.dev";
+        if (!primaryProfileName || !primaryProfileName.trim()) {
+          throw new Error('KEYSTONE_PROFILE_CUSTODIAN_PRIMARY environment variable is missing. Expected valid profile name like "primary-profile.dev" or "primary-profile.prod". (E: 1a2b3c4d5e6f7890123456789abcdef1)');
+        }
+        const primaryBuilder = KeystoneProfileBuilder.buildKeystone(primaryProfileName.trim()).withUsername(defaultUsername).withDescription(`Full Custodian Primary Identity for ${normEmail}`).withDetails({
           emails: [normEmail],
           custodyMode: "full"
         });
@@ -23812,9 +23859,11 @@ var KeystoneCustodianRegisterDelegateHandler = class _KeystoneCustodianRegisterD
       if (!space) {
         return this.error(500, `Could not load domain space for primary identity ${custodianReqs.primaryTjpAddr}`);
       }
-      const latestPrimaryAddr = await metaspace.getLatestAddr({ addr: custodianReqs.primaryTjpAddr, space }) ?? custodianReqs.primaryTjpAddr;
-      const getRes = await metaspace.get({ addrs: [latestPrimaryAddr], space });
-      const parentKeystone = getRes.ibGibs?.[0];
+      const parentKeystone = await keystoneService.getLatestKeystone({
+        addr: custodianReqs.primaryTjpAddr,
+        metaspace,
+        space
+      });
       if (!parentKeystone) {
         return this.error(404, `Primary identity keystone not found for address ${custodianReqs.primaryTjpAddr}`);
       }
@@ -24010,26 +24059,7 @@ var EmailOutboundHandler = class _EmailOutboundHandler extends ServeGibHandlerBa
   sender;
   constructor(options = {}) {
     super();
-    if (options.sender) {
-      this.sender = options.sender;
-    } else {
-      const isProd = true;
-      const mode = (process.env.EMAIL_MODE || (isProd ? "aws" : "mock")).toLowerCase();
-      if (mode === "aws") {
-        this.sender = new EmailSenderAws({
-          accessKeyId: process.env.AWS_ACCESS_KEY_ID || "",
-          secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || "",
-          region: process.env.AWS_REGION || "us-east-1"
-        });
-      } else if (mode === "mock") {
-        if (isProd) {
-          throw new Error("EMAIL_MODE=mock is prohibited when NODE_ENV=production. (E: 897a6b5c4d3e2f10987654321fedcba0)");
-        }
-        this.sender = new EmailSenderMock();
-      } else {
-        throw new Error(`Unsupported EMAIL_MODE '${mode}'. Must be 'aws' or 'mock'. (E: 987a6b5c4d3e2f10987654321fedcba1)`);
-      }
-    }
+    this.sender = options.sender || createDefaultEmailSender();
   }
   async handleRouteImpl(reqCtx) {
     const lc2 = `${this.lc}[${this.handleRouteImpl.name}]`;
@@ -24071,26 +24101,7 @@ var EmailVerificationCodeHandler = class _EmailVerificationCodeHandler extends S
   sender;
   constructor(options = {}) {
     super();
-    if (options.sender) {
-      this.sender = options.sender;
-    } else {
-      const isProd = true;
-      const mode = (process.env.EMAIL_MODE || (isProd ? "aws" : "mock")).toLowerCase();
-      if (mode === "aws") {
-        this.sender = new EmailSenderAws({
-          accessKeyId: process.env.AWS_ACCESS_KEY_ID || "",
-          secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY || "",
-          region: process.env.AWS_REGION || "us-east-1"
-        });
-      } else if (mode === "mock") {
-        if (isProd) {
-          throw new Error("EMAIL_MODE=mock is prohibited when NODE_ENV=production. (E: 897a6b5c4d3e2f10987654321fedcba0)");
-        }
-        this.sender = new EmailSenderMock();
-      } else {
-        throw new Error(`Unsupported EMAIL_MODE '${mode}'. Must be 'aws' or 'mock'. (E: 987a6b5c4d3e2f10987654321fedcba1)`);
-      }
-    }
+    this.sender = options.sender || createDefaultEmailSender();
   }
   async handleRouteImpl(reqCtx) {
     const lc2 = `${this.lc}[${this.handleRouteImpl.name}]`;
@@ -24814,7 +24825,7 @@ function isGraftInfo(ibGib) {
 }
 
 // ../../libs/core-gib/dist/sync/sync-helpers.mjs
-var logalot62 = GLOBAL_LOG_A_LOT3;
+var logalot62 = GLOBAL_LOG_A_LOT3 || true;
 async function getSyncIb({ data }) {
   const lc2 = `[${getSyncIb.name}]`;
   try {
@@ -24933,11 +24944,6 @@ ${pretty(sagaIbGib)} (I: 2a35685bfe038f63182c7db39b44c826)`);
       });
       resGraphs.push(graph);
     }
-    if (logalot62) {
-      console.log(`${lc2} resGraphs:...
-  ${pretty(resGraphs).split("\n").join("\n  ")}
-...(I: d8e11827d88a3454d887ff05fb4ff526)`);
-    }
     return resGraphs;
   } catch (error) {
     console.error(`${lc2} ${extractErrorMsg(error)}`);
@@ -25196,7 +25202,7 @@ async function deriveSessionSecret({ senderSecret, sagaId }) {
 }
 
 // ../../libs/core-gib/dist/sync/sync-saga-context/sync-saga-context-helpers.mjs
-var logalot63 = GLOBAL_LOG_A_LOT3;
+var logalot63 = GLOBAL_LOG_A_LOT3 || true;
 async function getSyncSagaContextIb({ data }) {
   const lc2 = `[${getSyncSagaContextIb.name}]`;
   try {
@@ -27194,7 +27200,7 @@ var GraftStrategyService = class _GraftStrategyService {
 };
 
 // ../../libs/core-gib/dist/sync/sync-saga-coordinator.mjs
-var logalot71 = GLOBAL_LOG_A_LOT3;
+var logalot71 = GLOBAL_LOG_A_LOT3 || true;
 var logalotControlDomain = false;
 var lcControlDomain = "[ControlDomain]";
 var SyncSagaCoordinator = class _SyncSagaCoordinator {
@@ -29566,16 +29572,25 @@ async function main() {
   try {
     console.log(`${lc2} starting...`);
     console.log(`${lc2} dataDir: ${DATA_DIR}`);
-    if ("domain".toLowerCase() === "test") {
+    const custodianPrimaryProfile = "primary-profile.dev".trim();
+    if (!custodianPrimaryProfile) {
+      throw new Error(`${lc2} Fatal Error: KEYSTONE_PROFILE_CUSTODIAN_PRIMARY environment variable is missing or blank. (E: 8a9b0c1d2e3f4567890123456789abcd)`);
+    }
+    const isProdEnv = true;
+    if (isProdEnv && !custodianPrimaryProfile.endsWith(".prod")) {
+      throw new Error(`${lc2} Security Violation: Non-production keystone profile '${custodianPrimaryProfile}' is prohibited when NODE_ENV=production. (E: 9b0c1d2e3f4567890123456789abcdef)`);
+    }
+    console.log(`${lc2} KEYSTONE_PROFILE_CUSTODIAN_PRIMARY: ${custodianPrimaryProfile} (I: 961014e2dd082293b83b917835c97e26)`);
+    if (custodianPrimaryProfile.endsWith(".dev")) {
       console.warn(`
 ==========================================================
-\u26A0\uFE0F WARNING: KEYSTONE_PROFILE IS SET TO 'test'!
-ALL GENERATED KEYSTONES USE LOW-SECURITY TEST PARAMETERS (12 CHALLENGES).
+\u26A0\uFE0F WARNING: CUSTODIAN KEYSTONE PROFILE IS SET TO DEVELOPMENT ('${custodianPrimaryProfile}')!
+CUSTODIAL KEYSTONES WILL USE LOW-SECURITY DEV PARAMETERS.
 FOR LOCAL TESTING ONLY \u2014 DO NOT USE FOR REAL SECRETS OR PRODUCTION DATA!
 ==========================================================
  (W: 890123456789abcdef0123456789a123)`);
-    } else {
-      console.log(`process.env.KEYSTONE_PROFILE: ${"domain"} (I: 961014e2dd082293b83b917835c97e26)`);
+    } else if (custodianPrimaryProfile.endsWith(".staging")) {
+      console.info(`${lc2} \u2139\uFE0F STAGING CUSTODIAN KEYSTONE PROFILE ACTIVE ('${custodianPrimaryProfile}')`);
     }
     const syncUpgradeHandler = new SyncUpgradeHandler();
     const serveGib = new ServeGib_V1({
@@ -29606,4 +29621,3 @@ FOR LOCAL TESTING ONLY \u2014 DO NOT USE FOR REAL SECRETS OR PRODUCTION DATA!
   }
 }
 main();
-//# sourceMappingURL=server.mjs.map