@ibgib/space-gib 0.0.20 → 0.0.21

package/dist/client/index.html

@@ -294,7 +294,7 @@
       <p class="footer-text">
         <span>© ibgib contributors</span> ·
         <a href="https://ibgib.space" class="footer-link">ibgib.space</a> ·
-        <a href="https://github.com/ibgib" class="footer-link" target="_blank" rel="noopener">GitHub</a>
+        <a href="/privacy" class="footer-link" target="_blank" rel="noopener">Privacy Policy</a>
       </p>
     </footer>
 

package/dist/client/index.mjs

@@ -1,4 +1,4 @@
-import{$a as Sa,$b as pt,A as Ea,Ba as ft,D as Et,E as wt,F as Fe,Hb as D,Ia as ve,J as U,Jb as _a,Ka as wa,Kb as Ga,Lb as Ca,Mb as Ye,Oc as $a,Pc as Ta,Rb as he,Rc as Ba,Sb as Qe,Sc as He,Ub as Le,Uc as V,Vb as et,Vc as Na,Wb as Ht,Wc as La,Xa as Je,Xb as Aa,Xc as ka,Yb as va,Yc as Da,_b as Wt,_c as Oa,a as g,ac as mt,bc as Q,bd as Pa,c as dt,d as lt,e as Re,eb as Ze,ec as ye,f as jt,fb as Xe,g as oe,gd as xa,h as ae,hb as ge,hd as St,i as ua,ib as bt,j as y,jb as Ia,kb as Kt,lb as Ne,r as W,tb as Xt,ub as Yt,w as p,ya as se,z as ya,za as Ge}from"./chunk-3RNUFRNV.mjs";var It="sync",ie="syncmsg",qt="@payloadAddrsDomain",zn="init",Jn="ack",Zn="delta",Qn="commit",H={init:zn,ack:Jn,delta:Zn,commit:Qn},$r=Object.values(H),er="abort",tr="optimistic-graft-longest-common-subsequence",Se={abort:er,optimisticWithLCS:tr},We=Object.values(Se);function _t(r){return We.includes(r)}g(_t,"isValidSyncConflictStrategy");var ar="push",nr="pull",rr="sync",zt={push:ar,pull:nr,sync:rr},kr=Object.values(zt);var or="sender",sr="receiver",Gt={sender:or,receiver:sr},Dr=Object.values(Gt);var tt="graftinfo",$e=tt,Ra="latestcommonaddr",Me="base",ke="orphan",Fa="dnaapplied",ir="longest-common-subsequence",Jt={lcs:ir},xr=Object.values(Jt);var gt=!1;async function cr({data:r}){if(!r.conflictStrategy)throw new Error("(UNEXPECTED) data.conflictStrategy required for GraftInfoIb (E: 2c0968a0dac8d0ab3d67da9756d6df26)");if(!_t(r.conflictStrategy))throw new Error(`invalid data.conflictStrategy (${r.conflictStrategy}). valid conflict strategies: ${We} (E: 41e2680089786d4d28046b4c0884bd26)`);return[tt,r.conflictStrategy].join(" ")}g(cr,"getGraftInfoIb");async function Zt({conflictStrategy:r,details:t,addlGraftDetails:e,latestCommonFrameAddr:a,baseAddrsSinceLCA:s,orphanAddrsSinceLCA:i,dnaAddrsApplied:o}){let c=`[${Zt.name}]`;try{if(gt&&console.log(`${c} starting... (I: 0030f62cbae28cf5882f87981edc3826)`),s.length===0)throw new Error("(UNEXPECTED) baseAddrsSinceLCA empty? (E: 005f8449a9236d445902a148f59fc826)");if(i.length===0)throw new Error("(UNEXPECTED) orphanAddrsSinceLCA empty? (E: 19e4082e82c67759c880392aca186826)");let d={conflictStrategy:r,description:t};e&&(d.addlGraftDetails=e);let l={[Ra]:[a],[Me]:s.concat(),[ke]:i.concat(),[Fa]:o.concat()},f=await cr({data:d});return await U.stone({parentPrimitiveIb:tt,ib:f,data:d,rel8ns:l,uuid:!0})}catch(d){throw console.error(`${c} ${y(d)}`),d}finally{gt&&console.log(`${c} complete.`)}}g(Zt,"createGraftInfo");async function Ma({textA:r,textB:t}){if(r===t)return r;if(r==="")return t;if(t==="")return r;function e(l,f){let b=l.length,m=f.length,h=Array(b+1).fill(0).map(()=>Array(m+1).fill(0));for(let G=1;G<=b;G++)for(let A=1;A<=m;A++)l[G-1]===f[A-1]?h[G][A]=h[G-1][A-1]+1:h[G][A]=Math.max(h[G-1][A],h[G][A-1]);let u=b,S=m,C=[];for(;u>0&&S>0;)l[u-1]===f[S-1]?(C.unshift({line:l[u-1],indexA:u-1,indexB:S-1}),u--,S--):h[u-1][S]>h[u][S-1]?u--:S--;return C}g(e,"longestCommonSubsequence");let a=r.split(`
+import{$a as Sa,$b as pt,$c as Oa,A as Ea,Ba as ft,D as Et,E as wt,F as Fe,Hb as D,Ia as ve,J as U,Jb as _a,Ka as wa,Kb as Ga,Lb as Ca,Mb as Ye,Pc as $a,Qc as Ta,Rb as he,Sb as Qe,Sc as Ba,Tc as He,Ub as Le,Vb as et,Vc as V,Wb as Ht,Wc as Na,Xa as Je,Xb as Aa,Xc as La,Yb as va,Yc as ka,Zc as Da,_b as Wt,a as g,ac as mt,bc as Q,c as dt,cd as Pa,d as lt,e as Re,eb as Ze,ec as ye,f as jt,fb as Xe,g as oe,h as ae,hb as ge,hd as xa,i as ua,ib as bt,id as St,j as y,jb as Ia,kb as Kt,lb as Ne,r as W,tb as Xt,ub as Yt,w as p,ya as se,z as ya,za as Ge}from"./chunk-M2IO3EMM.mjs";var It="sync",ie="syncmsg",qt="@payloadAddrsDomain",zn="init",Jn="ack",Zn="delta",Qn="commit",H={init:zn,ack:Jn,delta:Zn,commit:Qn},$r=Object.values(H),er="abort",tr="optimistic-graft-longest-common-subsequence",Se={abort:er,optimisticWithLCS:tr},We=Object.values(Se);function _t(r){return We.includes(r)}g(_t,"isValidSyncConflictStrategy");var ar="push",nr="pull",rr="sync",zt={push:ar,pull:nr,sync:rr},kr=Object.values(zt);var or="sender",sr="receiver",Gt={sender:or,receiver:sr},Dr=Object.values(Gt);var tt="graftinfo",$e=tt,Ra="latestcommonaddr",Me="base",ke="orphan",Fa="dnaapplied",ir="longest-common-subsequence",Jt={lcs:ir},xr=Object.values(Jt);var gt=!1;async function cr({data:r}){if(!r.conflictStrategy)throw new Error("(UNEXPECTED) data.conflictStrategy required for GraftInfoIb (E: 2c0968a0dac8d0ab3d67da9756d6df26)");if(!_t(r.conflictStrategy))throw new Error(`invalid data.conflictStrategy (${r.conflictStrategy}). valid conflict strategies: ${We} (E: 41e2680089786d4d28046b4c0884bd26)`);return[tt,r.conflictStrategy].join(" ")}g(cr,"getGraftInfoIb");async function Zt({conflictStrategy:r,details:t,addlGraftDetails:e,latestCommonFrameAddr:a,baseAddrsSinceLCA:s,orphanAddrsSinceLCA:i,dnaAddrsApplied:o}){let c=`[${Zt.name}]`;try{if(gt&&console.log(`${c} starting... (I: 0030f62cbae28cf5882f87981edc3826)`),s.length===0)throw new Error("(UNEXPECTED) baseAddrsSinceLCA empty? (E: 005f8449a9236d445902a148f59fc826)");if(i.length===0)throw new Error("(UNEXPECTED) orphanAddrsSinceLCA empty? (E: 19e4082e82c67759c880392aca186826)");let d={conflictStrategy:r,description:t};e&&(d.addlGraftDetails=e);let l={[Ra]:[a],[Me]:s.concat(),[ke]:i.concat(),[Fa]:o.concat()},f=await cr({data:d});return await U.stone({parentPrimitiveIb:tt,ib:f,data:d,rel8ns:l,uuid:!0})}catch(d){throw console.error(`${c} ${y(d)}`),d}finally{gt&&console.log(`${c} complete.`)}}g(Zt,"createGraftInfo");async function Ma({textA:r,textB:t}){if(r===t)return r;if(r==="")return t;if(t==="")return r;function e(l,f){let b=l.length,m=f.length,h=Array(b+1).fill(0).map(()=>Array(m+1).fill(0));for(let G=1;G<=b;G++)for(let A=1;A<=m;A++)l[G-1]===f[A-1]?h[G][A]=h[G-1][A-1]+1:h[G][A]=Math.max(h[G-1][A],h[G][A-1]);let u=b,S=m,C=[];for(;u>0&&S>0;)l[u-1]===f[S-1]?(C.unshift({line:l[u-1],indexA:u-1,indexB:S-1}),u--,S--):h[u-1][S]>h[u][S-1]?u--:S--;return C}g(e,"longestCommonSubsequence");let a=r.split(`
 `),s=t.split(`
 `),i=e(a,s),o=[],c=0,d=0;for(let l of i){for(;c<l.indexA;)o.push(a[c]),c++;for(;d<l.indexB;)o.push(s[d]),d++;o.push(l.line),c++,d++}for(;c<a.length;)o.push(a[c]),c++;for(;d<s.length;)o.push(s[d]),d++;return o.join(`
 `)}g(Ma,"mergeTextByLongestCommonSubsequence");function Qt(r){let t=`[${Qt.name}]`;try{if(gt&&console.log(`${t} starting... (I: fe9adfe1a3175d87982507c8851f5826)`),!r)throw new Error("(UNEXPECTED) not a graft info, ibGib falsy? (E: bf06cdd700788e777f72fe5a5bdb0e26)");if(!r.data)throw new Error("not a graft info, ibGib.data falsy (E: 5e1b28843ec8571a7623046a06195826)");if(!r.ib.startsWith(tt))throw new Error(`not graft info, ibgib.ib does not start with ${tt} (E: cec6a8e25ff8746aef813e38cbebce26)`);return!0}catch(e){return gt&&console.error(`${t} ${y(e)}`),!1}finally{gt&&console.log(`${t} complete.`)}}g(Qt,"isGraftInfo");var ee=!1;async function ea({data:r}){let t=`[${ea.name}]`;try{return[It,r.uuid].join(" ")}catch(e){throw console.error(`${t} ${y(e)}`),e}}g(ea,"getSyncIb");async function Va(){return`tmp_sync_space_${(await oe()).substring(0,8)}`}g(Va,"getTempSpaceName");async function at({olderAddr:r,newerAddr:t,space:e}){let a=`[${at.name}]`;try{if(ee&&console.log(`${a} starting... (I: 4b3548cbc9a2eb749f447ed82fdcf826)`),r===t)return!0;let s,i=await se({space:e,addr:t});if(i.success&&i.ibGibs?.length===1)s=i.ibGibs[0];else throw new Error(`couldn't get newerAddr (${t}) from space (${e.ib}). (E: 36c758c22b181b2c89a1cd28937a6826)`);if(!s.rel8ns)return console.warn(`${a} newerIbGib.rel8ns falsy? newerAddr: ${t}. (W: 6f920811f7080281189f767813814826)`),!1;let o=s.rel8ns.past??[];if(o.length===0)return!1;if(o.includes(r))return!0;let c=o[0];return await at({olderAddr:r,newerAddr:c,space:e})}catch(s){throw console.error(`${a} ${y(s)}`),s}finally{ee&&console.log(`${a} complete.`)}}g(at,"isPastFrame");async function Ct({sagaIbGib:r,localSpace:t}){let e=`[${Ct.name}]`,a=g(async c=>{let d=await se({space:t,addrs:c});if(d.success&&d.ibGibs?.length===c.length)return d.ibGibs;{let l=d.rawResultIbGib;throw l.data?new Error(`(UNEXPECTED) couldn't find addrs? addrsNotFound: ${l.data.addrsNotFound}? space.ib: ${t.ib} (E: 43b7b5a6ad982715c8f3eed69bfa0d26)`):new Error("(UNEXPECTED) resGet.rawResultIbGib.data falsy? (E: c26c681d2f831fc537ba6f48fee36d26)")}},"fnGet"),s=await At({sagaIbGib:r});if(s.length>0)throw new Error(`invalid sync sagaIbGib. validationErrors: ${s} (E: 19f9e8c9643858ff41312b62293d2126)`);if(!r.rel8ns)throw new Error("(UNEXPECTED) validated sagaIbGib.rel8ns falsy? (E: 73af48be8bbf271ec5cf78187ce8c826)");let i=r.rel8ns[ie],o=await a(i);return{sagaIbGib:r,msgStones:o}}g(Ct,"getSyncSagaFrameDependencyGraph");async function nt({sagaIbGib:r,space:t}){let e=`[${nt.name}]`;try{if(ee&&console.log(`${e} starting... (I: 1ea3f804dd07d1e917a2afaaad497826)`),!r.data)throw new Error("(UNEXPECTED) sagaIbGib.data falsy? (E: fe0a0d0965e87ac852fe7ba4710cc826)");if(!r.rel8ns)throw new Error("(UNEXPECTED) sagaIbGib.rel8ns falsy? (E: b79ff82a732346bdf8a9e1eb9ac96826)");let a=p({ibGib:r}),s=r.rel8ns.past&&r.rel8ns.past.length>0?[...r.rel8ns.past,a]:[a],i=[];for(let o of s){let c,d=await se({addr:o,space:t});if(d.success&&d.ibGibs&&d.ibGibs.length===1)c=d.ibGibs[0];else throw ee&&console.log(`${e} failed getting full history of sagaIbGib:

package/dist/client/privacy.html

@@ -0,0 +1,288 @@
+<!DOCTYPE html>
+<html lang="en-US">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Privacy Policy · ibgib.space</title>
+  <link rel="stylesheet" type="text/css" href="/style.css">
+  <style>
+    html, body {
+      height: auto !important;
+      min-height: 100% !important;
+      overflow-y: auto !important;
+      overflow-x: hidden !important;
+    }
+    body {
+      background: #11111b;
+      color: #cdd6f4;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      margin: 0;
+      padding: 0;
+      line-height: 1.6;
+    }
+    .page-container {
+      max-width: 860px;
+      margin: 0 auto;
+      padding: 2.5rem 1.5rem 4rem;
+    }
+    .header-bar {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      padding-bottom: 1.5rem;
+      margin-bottom: 2rem;
+      border-bottom: 1px solid rgba(255, 255, 255, 0.1);
+    }
+    .brand-link {
+      color: #89b4fa;
+      text-decoration: none;
+      font-weight: 700;
+      font-size: 1.2rem;
+      display: flex;
+      align-items: center;
+      gap: 0.5rem;
+    }
+    .back-link {
+      color: #a6adc8;
+      text-decoration: none;
+      font-size: 0.9rem;
+      padding: 0.4rem 0.8rem;
+      border-radius: 6px;
+      background: rgba(255, 255, 255, 0.05);
+      transition: all 0.2s;
+    }
+    .back-link:hover {
+      color: #ffffff;
+      background: rgba(255, 255, 255, 0.1);
+    }
+    .policy-title {
+      font-size: 2.2rem;
+      color: #ffffff;
+      margin-top: 0;
+      margin-bottom: 0.5rem;
+    }
+    .policy-h2 {
+      font-size: 1.4rem;
+      color: #50fa7b;
+      margin-top: 2rem;
+      margin-bottom: 0.75rem;
+      border-bottom: 1px solid rgba(255, 255, 255, 0.08);
+      padding-bottom: 0.3rem;
+    }
+    .policy-h3 {
+      font-size: 1.1rem;
+      color: #89b4fa;
+      margin-top: 1.5rem;
+      margin-bottom: 0.5rem;
+    }
+    p, li {
+      color: #cdd6f4;
+      font-size: 0.95rem;
+    }
+    ul, ol {
+      padding-left: 1.5rem;
+      margin: 0.5rem 0 1rem;
+    }
+    li {
+      margin-bottom: 0.35rem;
+    }
+    code {
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: 0.85em;
+      background: rgba(255, 255, 255, 0.08);
+      padding: 0.15rem 0.35rem;
+      border-radius: 4px;
+      color: #f5c2e7;
+    }
+    code.math {
+      color: #89dceb;
+    }
+    a {
+      color: #89b4fa;
+      text-decoration: underline;
+    }
+    a:hover {
+      color: #b4befe;
+    }
+    .divider {
+      border: 0;
+      border-top: 1px solid rgba(255, 255, 255, 0.1);
+      margin: 2rem 0;
+    }
+    .alert-box {
+      display: flex;
+      gap: 0.75rem;
+      padding: 1rem 1.25rem;
+      border-radius: 8px;
+      margin: 1.25rem 0;
+      align-items: flex-start;
+    }
+    .alert-warning {
+      background: rgba(249, 226, 175, 0.08);
+      border: 1px solid rgba(249, 226, 175, 0.3);
+      color: #f9e2af;
+    }
+    .alert-important {
+      background: rgba(137, 180, 250, 0.08);
+      border: 1px solid rgba(137, 180, 250, 0.3);
+      color: #89b4fa;
+    }
+    .alert-note {
+      background: rgba(180, 190, 254, 0.08);
+      border: 1px solid rgba(180, 190, 254, 0.3);
+      color: #b4befe;
+    }
+    .alert-icon {
+      font-size: 1.2rem;
+      line-height: 1.2;
+    }
+    .alert-body {
+      font-size: 0.88rem;
+      line-height: 1.45;
+      color: #cdd6f4;
+    }
+    .footer-bar {
+      margin-top: 3.5rem;
+      padding-top: 1.5rem;
+      border-top: 1px solid rgba(255, 255, 255, 0.1);
+      font-size: 0.85rem;
+      color: #a6adc8;
+      display: flex;
+      justify-content: space-between;
+      flex-wrap: wrap;
+      gap: 1rem;
+    }
+  </style>
+</head>
+<body>
+  <div class="page-container">
+    <header class="header-bar">
+      <a href="/" class="brand-link">
+        <span>◈</span>
+        <span>🌌 space-gib 🌌</span>
+      </a>
+      <a href="/" class="back-link">← Return to App</a>
+    </header>
+
+    <main>
+      <h1 class="policy-title">Privacy Policy</h1>
+<p><strong>Status</strong>: DRAFT (Active Development)  </p>
+<p><strong>Effective Date</strong>: August 21, 2026  </p>
+<p><strong>Last Updated</strong>: August 21, 2026  </p>
+<div class="alert-box alert-warning"><div class="alert-icon">⚠️</div><div class="alert-body"><strong>Draft Notice &amp; Active Development Disclaimer</strong>:<br>This Privacy Policy is currently in <strong>draft status</strong>. The <code>ibGib</code> platform, underlying cryptographic keystone engine, and decentralized data graph architecture are under <strong>active research and development</strong>. This document expresses our architectural intent, privacy commitments, and operational principles; however, as the technology is actively evolving, certain features, administrative tooling, and data workflows described herein may be experimental, partially implemented, or subject to change.</div></div>
+<hr class="divider">
+<h2 class="policy-h2">1. Introduction &amp; Overview</h2>
+<p>Welcome to <strong>ibGib</strong>. We are committed to transparency, cryptographic self-sovereignty, and user privacy. </p>
+<p>This Privacy Policy explains how <code>ibGib</code> (including <code>ibgib.space</code>, <code>ibgib.com</code>, and related open-source applications in this monorepo) collects, uses, stores, and protects your information when you interact with our network, services, and applications. </p>
+<div class="alert-box alert-important"><div class="alert-icon">ℹ️</div><div class="alert-body"><strong>Summary for Everyone</strong>:<br>* <strong>Public Directory</strong>: Just like a public PGP key or public DNS record, your chosen <strong>username</strong>, <strong>registered email address</strong>, and <strong>identity keystone</strong> are part of the public graph so people and your devices can find and authenticate you.<br>* <strong>No Passwords on the Wire</strong>: Your master passphrase, biometric data (Touch ID / Face ID / Windows Hello), and physical security keys (YubiKeys) <strong>never</strong> leave your local device.<br>* <strong>No Data Selling</strong>: We do <strong>not</strong> sell, rent, monetize, or share your personal data with third-party advertisers or data brokers.<br>* <strong>Standard Transport Security</strong>: All communications between your devices and our servers operate over industry-standard <strong>TLS 1.3 / HTTPS</strong> encryption.</div></div>
+<hr class="divider">
+<h2 class="policy-h2">2. Categories of Information We Collect</h2>
+<h3 class="policy-h3">A. Identity &amp; Public Directory Data</h3>
+<p>When you create an account or link authentication methods, the following information is recorded in your identity keystone:</p>
+<ul>
+<li><strong>Chosen Username</strong>: A human-readable identifier (e.g. <code>alice</code>).</li>
+<li><strong>Registered Email Address</strong>: Provided during account creation or SSO linking to enable account discovery, verification, and recovery.</li>
+<li><strong>Public Keystone DAG Addresses &amp; Challenge Hashes</strong>: Cryptographic addresses and mathematical challenge hashes (<code class="math">H = \text{Hash}(S)</code>) that define your identity's evolution timeline.</li>
+<li><strong>Registered Device Delegate Tags</strong>: Public labels for devices authorized to sync on your behalf (e.g. <code>pwd-alice-desk-a9a0</code>, <code>passkey-mobile-b4c1</code>).</li>
+</ul>
+<h3 class="policy-h3">B. Technical, Connection &amp; Log Data</h3>
+<p>When accessing our hosted web nodes, standard operational connection data may be logged:</p>
+<ul>
+<li><strong>Internet Protocol (IP) Address</strong> and approximate geographic origin.</li>
+<li><strong>HTTP/TLS Request Metadata</strong>: Date/time of request, HTTP status code, URL path, and TLS cipher suite.</li>
+<li><strong>User-Agent Strings</strong>: Browser type, operating system, and client application version.</li>
+<li><strong>Retention</strong>: Operational and access logs are retained for a bounded window (typically <strong>30 to 90 days</strong>) strictly for system reliability, rate limiting, intrusion detection, and security forensics, after which they are automatically rotated and deleted.</li>
+</ul>
+<h3 class="policy-h3">C. Workspace &amp; Application Data</h3>
+<ul>
+<li><strong>User-Created Content</strong>: Notes, comments, graph nodes, and files stored within your tenant workspace.</li>
+<li><strong>Storage Status</strong>: Workspace data is stored in tenant-isolated domain spaces. Data in transit is encrypted via TLS 1.3. Data at rest on the server is currently stored unencrypted within your isolated space directory (client-side data encryption is planned as a future capability).</li>
+</ul>
+<hr class="divider">
+<h2 class="policy-h2">3. Public Directory Nature of Identity Keystones</h2>
+<div class="alert-box alert-warning"><div class="alert-icon">⚠️</div><div class="alert-body"><strong>Experimental Architecture Notice</strong>:<br>Identity Keystones are built on an innovative Zero-Knowledge Proof (ZKP) Distributed Ledger Technology (DLT) architecture. While designed to eliminate reliance on central certificate authorities, this technology is experimental. See <a href="#7-security-architecture--experimental-protocol-notice" target="_blank" rel="noopener">Section 7</a> for detailed security context.</div></div>
+<h3 class="policy-h3">Innovative ZKP DLT vs. Conventional PKI</h3>
+<p><code>ibGib</code> is built upon public-key cryptographic principles, but <strong>is not conventional Public Key Infrastructure (PKI)</strong>:</p>
+<ul>
+<li>Instead of relying on asymmetric digital signatures (RSA, ECDSA) and centralized X.509 Certificate Authorities (CAs), <code>ibGib</code> identities utilize a <strong>Zero-Knowledge Proof (ZKP) Distributed Ledger Technology (DLT)</strong> architecture with symmetric hash-reveal challenge-response pools.</li>
+<li><strong>Public by Design</strong>: Identity Keystones function as public directory records. Anyone on the network who knows your username or email address can query the server to retrieve your public keystone.</li>
+<li><strong>Zero Secret Exposure</strong>: Public keystones contain only public challenge hashes (<code class="math">H</code>). Revealing a challenge hash gives an observer zero ability to compute your private secret pre-image (<code class="math">S</code>) or act on your behalf.</li>
+<li><strong>Biometric &amp; Password Isolation</strong>:</li>
+<li>Passwords, PINs, and passphrase pre-images are processed strictly inside your local browser memory and discarded.</li>
+<li>Hardware biometrics (fingerprints, facial recognition) and security keys operate exclusively within your device's hardware Secure Enclave / TPM via the W3C WebAuthn standard. Raw biometric data is never transmitted over the network or accessible to our servers.</li>
+</ul>
+<hr class="divider">
+<h2 class="policy-h2">4. How We Use Your Information</h2>
+<p>We process personal and cryptographic data solely for the following legitimate purposes:</p>
+<ol>
+<li><strong>Identity Resolution &amp; Discovery</strong>: Matching incoming authentication requests and email lookups to the correct tenant domain space.</li>
+<li><strong>Cryptographic Multi-Device Authorization</strong>: Permitting your devices to authorize scoped synchronization claims via local device sync delegates (<code class="math">D_{\text{device}}</code>), while the native ibGib sync engine executes graph synchronization.</li>
+<li><strong>Account Verification &amp; Sign-In</strong>: Sending one-time 6-digit verification codes (OTP) to confirm email ownership and authenticate sign-ins.</li>
+<li><strong>Security &amp; Abuse Prevention</strong>: Enforcing rate limits, detecting brute-force attacks, and preventing server abuse.</li>
+</ol>
+<p>We do <strong>not</strong> use your data for profiling, automated decision-making, or third-party targeted advertising.</p>
+<hr class="divider">
+<h2 class="policy-h2">5. Third-Party Service Providers</h2>
+<p>We utilize minimal third-party services essential to core platform functionality:</p>
+<ul>
+<li><strong>Single Sign-On (SSO) Authentication (Optional)</strong>:</li>
+<li><strong>Google OAuth2</strong>: Currently supported for single-tap passwordless account creation and sign-in. When linking Google, we receive verified identity tokens (such as your verified email address and provider user ID) to authenticate your identity. We do not receive or store your Google password.</li>
+<li><strong>Future Providers</strong>: We plan to introduce additional OAuth2 providers (such as GitHub and others) in future updates.</li>
+<li><strong>Transactional Email &amp; Hosting Infrastructure</strong>:</li>
+<li><strong>Transactional Email</strong>: We send emails strictly for transactional account confirmation, sign-in verification codes, and security notices. We never send marketing, newsletter, or promotional spam emails.</li>
+<li><strong>Cloud Server &amp; Storage Nodes</strong>: Web nodes, domain space storage, and network routing are hosted on secure cloud infrastructure located in the United States.</li>
+</ul>
+<hr class="divider">
+<h2 class="policy-h2">6. Immutable Timeline Integrity, Revocations &amp; Data Deletion</h2>
+<h3 class="policy-h3">Cryptographic Timeline Integrity</h3>
+<p><code>ibGib</code> is built on an <strong>append-only, directed acyclic graph (DAG) architecture</strong>. Similar to version control systems (like Git) and cryptographic ledgers (like Bitcoin), timeline records are mathematically linked using cryptographic hashes to ensure data integrity and tamper-evidence. Just as past blocks in a blockchain cannot be modified without destroying cryptographic integrity, historical keystone frames remain part of the verifiable audit chain.</p>
+<h3 class="policy-h3">Revocations &amp; Tombstones</h3>
+<p>When you modify your identity permissions—such as unlinking a Google SSO provider or revoking a lost device passkey:</p>
+<ul>
+<li>The system publishes a cryptographically signed <strong>tombstone evolution frame</strong> (<code class="math">n \to n+1</code>).</li>
+<li>This frame officially revokes that authority and unlinks the provider from server-side reverse lookup indices.</li>
+</ul>
+<h3 class="policy-h3">Content Takedowns &amp; Full Account Erasure</h3>
+<ol>
+<li><strong>Content &amp; Asset Takedowns</strong>: Standalone content nodes and binary file payloads can be unlinked, de-indexed, or removed from server storage upon authorized request or valid legal takedown without compromising structural timeline history.</li>
+<li><strong>Complete Tenant Erasure</strong>: If you request complete account deletion, your entire tenant domain space (including all hosted keystones, delegate frames, and stored data) and reverse email index entries will be permanently purged and removed from server storage.</li>
+<li><strong>Local Device Data Control</strong>: You maintain full control over all data stored locally on your physical devices. You may clear your local cryptographic tokens, delegates, and cached workspace data at any time via the application settings or by clearing your browser's IndexedDB / local storage.</li>
+</ol>
+<hr class="divider">
+<h2 class="policy-h2">7. Security Architecture &amp; Experimental Protocol Notice</h2>
+<h3 class="policy-h3">Innovative &amp; Experimental Nature</h3>
+<p>Identity Keystones, multi-pool challenge-response mechanisms, and decentralized sync delegates represent innovative, experimental cryptographic protocols. While we apply diligent best efforts in cryptanalysis and utilize industry-standard, proven cryptographic primitives (such as SHA-256, SHA-512, AES, and WebAuthn PRF), the composite architecture is actively evolving. Users should evaluate this platform understanding its experimental research nature.</p>
+<h3 class="policy-h3">Conventional Security Foundations</h3>
+<p>All communications, API endpoints, and authentication exchanges between your client devices and our server infrastructure operate strictly over industry-standard <strong>TLS 1.3 / HTTPS</strong> encryption. Server-side data isolation, atomic file indexing, and timing side-channel protections are implemented following standard enterprise security practices.</p>
+<hr class="divider">
+<h2 class="policy-h2">8. Your Privacy Rights (Texas TDPSA &amp; US State Privacy Laws)</h2>
+<p>If you are a resident of Texas (governed by the <strong>Texas Data Privacy and Security Act - TDPSA</strong>) or other jurisdictions with applicable privacy legislation, you have the following rights regarding your personal data:</p>
+<ul>
+<li><strong>Right to Know / Access</strong>: You have the right to confirm whether we process your personal data and to access such data.</li>
+<li><strong>Right to Correct</strong>: You have the right to correct inaccuracies in your personal data.</li>
+<li><strong>Right to Delete</strong>: You have the right to request deletion of personal data provided by or obtained about you.</li>
+<li><strong>Right to Data Portability</strong>: You have the right to obtain a copy of your personal data in a portable and readily usable format.</li>
+<li><strong>Right to Opt-Out of Sale / Targeted Advertising</strong>: We do <strong>not</strong> sell your personal data or process it for targeted advertising, so no opt-out is necessary.</li>
+<li><strong>Right to Non-Discrimination</strong>: We will never discriminate against you, deny services, or alter pricing for exercising your privacy rights.</li>
+</ul>
+<h3 class="policy-h3">How to Exercise Your Rights</h3>
+<p>To submit a privacy inquiry, request data export, or request permanent deletion of your tenant domain space, please contact us using the information in Section 9 below. We will verify your identity (using your registered email or cryptographic keystone proof) and respond within the statutory timeframe (typically 45 days).</p>
+<hr class="divider">
+<h2 class="policy-h2">9. Contact Information &amp; Policy Updates</h2>
+<h3 class="policy-h3">Contact Us</h3>
+<p>If you have questions, comments, or requests regarding this Privacy Policy or our data handling practices, please reach out to us:</p>
+<ul>
+<li><strong>Open-Source Packages</strong>: Published on <strong>npm</strong> under the <code>@ibgib</code> scope.</li>
+<li><strong>Email / Privacy Inquiries</strong>: <code>ibgib.info@gmail.com</code></li>
+</ul>
+<h3 class="policy-h3">Updates to This Policy</h3>
+<p>We may update this Privacy Policy from time to time to reflect architectural advancements, legal requirements, or operational changes. When changes are made, the "Last Updated" date at the top of this document will be updated. We encourage you to review this policy periodically.</p>
+    </main>
+
+    <footer class="footer-bar">
+      <span>© ibgib contributors</span>
+      <span><a href="https://ibgib.space">ibgib.space</a> · <a href="https://github.com/ibgib" target="_blank" rel="noopener">GitHub</a></span>
+    </footer>
+  </div>
+</body>
+</html>

package/dist/client/script.mjs

@@ -1 +1 @@
-import{p as e}from"./chunk-TVMLARYE.mjs";import"./chunk-3RNUFRNV.mjs";console.log("space-gib early script executing...");e();
+import{p as e}from"./chunk-7YXHRAEW.mjs";import"./chunk-M2IO3EMM.mjs";console.log("space-gib early script executing...");e();

package/dist/server/server.mjs

@@ -18136,6 +18136,9 @@ var StaticFileHandler = class _StaticFileHandler extends ServeGibHandlerBase {
       if (existsSync3(filePath) && statSync(filePath).isDirectory()) {
         filePath = join6(filePath, "index.html");
       }
+      if (!existsSync3(filePath) && existsSync3(filePath + ".html")) {
+        filePath = filePath + ".html";
+      }
       if (!existsSync3(filePath)) {
         filePath = join6(this.clientDir, "index.html");
       }
@@ -20960,7 +20963,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
    * Requires the Master Secret to authorize the change via a pool containing
    * the 'manage' verb.
    */
-  async addPools({ latestKeystone, masterSecret, newPools, frameDetails, dataToPatch, metaspace, space }) {
+  async addPools({ latestKeystone, masterSecret, signingPoolId, newPools, frameDetails, dataToPatch, metaspace, space }) {
     const lc2 = `${this.lc}[${this.addPools.name}]`;
     try {
       if (logalot46) {
@@ -20978,6 +20981,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
       }
       const adminPool = resolveTargetPool({
         pools: prevData.challengePools,
+        poolId: signingPoolId,
         verb: KEYSTONE_VERB_MANAGE
       });
       if (logalot46) {
@@ -21057,7 +21061,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
    * Requires the Master Secret to authorize the change via a pool containing
    * the 'manage' verb (the administrative manage pool).
    */
-  async removePools({ latestKeystone, masterSecret, poolIds, frameDetails, dataToPatch, metaspace, space }) {
+  async removePools({ latestKeystone, masterSecret, signingPoolId, poolIds, frameDetails, dataToPatch, metaspace, space }) {
     const lc2 = `${this.lc}[${this.removePools.name}]`;
     try {
       if (logalot46) {
@@ -21075,6 +21079,7 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
       }
       const adminPool = resolveTargetPool({
         pools: prevData.challengePools,
+        poolId: signingPoolId,
         verb: KEYSTONE_VERB_MANAGE
       });
       if (logalot46) {

package/generate-privacy-html.js

@@ -0,0 +1,208 @@
+/**
+ * generate-privacy-html.js
+ *
+ * Build-time script that reads canonical `docs/PRIVACY_POLICY.md` and generates
+ * a styled, standalone `src/client/privacy.html` page for space-gib using `@ibgib/helper-gib`.
+ *
+ * Run: node generate-privacy-html.js
+ */
+
+import * as pathUtils from 'path';
+import { readFile, writeFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+import { convertMarkdownToHtml } from '@ibgib/helper-gib/dist/helpers/markdown-helper.mjs';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = pathUtils.dirname(__filename);
+
+const lc = `[${import.meta.url}]`;
+console.log(`${lc} starting...`);
+
+const privacyMdPath = pathUtils.resolve(__dirname, '../../docs/PRIVACY_POLICY.md');
+const outputHtmlPath = pathUtils.resolve(__dirname, './src/client/privacy.html');
+
+const mdContent = await readFile(privacyMdPath, { encoding: 'utf8' });
+
+const bodyHtml = convertMarkdownToHtml(mdContent, { linkTarget: '_blank', linkRel: 'noopener' });
+
+const fullHtml = `<!DOCTYPE html>
+<html lang="en-US">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Privacy Policy · ibgib.space</title>
+  <link rel="stylesheet" type="text/css" href="/style.css">
+  <style>
+    html, body {
+      height: auto !important;
+      min-height: 100% !important;
+      overflow-y: auto !important;
+      overflow-x: hidden !important;
+    }
+    body {
+      background: #11111b;
+      color: #cdd6f4;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      margin: 0;
+      padding: 0;
+      line-height: 1.6;
+    }
+    .page-container {
+      max-width: 860px;
+      margin: 0 auto;
+      padding: 2.5rem 1.5rem 4rem;
+    }
+    .header-bar {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      padding-bottom: 1.5rem;
+      margin-bottom: 2rem;
+      border-bottom: 1px solid rgba(255, 255, 255, 0.1);
+    }
+    .brand-link {
+      color: #89b4fa;
+      text-decoration: none;
+      font-weight: 700;
+      font-size: 1.2rem;
+      display: flex;
+      align-items: center;
+      gap: 0.5rem;
+    }
+    .back-link {
+      color: #a6adc8;
+      text-decoration: none;
+      font-size: 0.9rem;
+      padding: 0.4rem 0.8rem;
+      border-radius: 6px;
+      background: rgba(255, 255, 255, 0.05);
+      transition: all 0.2s;
+    }
+    .back-link:hover {
+      color: #ffffff;
+      background: rgba(255, 255, 255, 0.1);
+    }
+    .policy-title {
+      font-size: 2.2rem;
+      color: #ffffff;
+      margin-top: 0;
+      margin-bottom: 0.5rem;
+    }
+    .policy-h2 {
+      font-size: 1.4rem;
+      color: #50fa7b;
+      margin-top: 2rem;
+      margin-bottom: 0.75rem;
+      border-bottom: 1px solid rgba(255, 255, 255, 0.08);
+      padding-bottom: 0.3rem;
+    }
+    .policy-h3 {
+      font-size: 1.1rem;
+      color: #89b4fa;
+      margin-top: 1.5rem;
+      margin-bottom: 0.5rem;
+    }
+    p, li {
+      color: #cdd6f4;
+      font-size: 0.95rem;
+    }
+    ul, ol {
+      padding-left: 1.5rem;
+      margin: 0.5rem 0 1rem;
+    }
+    li {
+      margin-bottom: 0.35rem;
+    }
+    code {
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: 0.85em;
+      background: rgba(255, 255, 255, 0.08);
+      padding: 0.15rem 0.35rem;
+      border-radius: 4px;
+      color: #f5c2e7;
+    }
+    code.math {
+      color: #89dceb;
+    }
+    a {
+      color: #89b4fa;
+      text-decoration: underline;
+    }
+    a:hover {
+      color: #b4befe;
+    }
+    .divider {
+      border: 0;
+      border-top: 1px solid rgba(255, 255, 255, 0.1);
+      margin: 2rem 0;
+    }
+    .alert-box {
+      display: flex;
+      gap: 0.75rem;
+      padding: 1rem 1.25rem;
+      border-radius: 8px;
+      margin: 1.25rem 0;
+      align-items: flex-start;
+    }
+    .alert-warning {
+      background: rgba(249, 226, 175, 0.08);
+      border: 1px solid rgba(249, 226, 175, 0.3);
+      color: #f9e2af;
+    }
+    .alert-important {
+      background: rgba(137, 180, 250, 0.08);
+      border: 1px solid rgba(137, 180, 250, 0.3);
+      color: #89b4fa;
+    }
+    .alert-note {
+      background: rgba(180, 190, 254, 0.08);
+      border: 1px solid rgba(180, 190, 254, 0.3);
+      color: #b4befe;
+    }
+    .alert-icon {
+      font-size: 1.2rem;
+      line-height: 1.2;
+    }
+    .alert-body {
+      font-size: 0.88rem;
+      line-height: 1.45;
+      color: #cdd6f4;
+    }
+    .footer-bar {
+      margin-top: 3.5rem;
+      padding-top: 1.5rem;
+      border-top: 1px solid rgba(255, 255, 255, 0.1);
+      font-size: 0.85rem;
+      color: #a6adc8;
+      display: flex;
+      justify-content: space-between;
+      flex-wrap: wrap;
+      gap: 1rem;
+    }
+  </style>
+</head>
+<body>
+  <div class="page-container">
+    <header class="header-bar">
+      <a href="/" class="brand-link">
+        <span>◈</span>
+        <span>🌌 space-gib 🌌</span>
+      </a>
+      <a href="/" class="back-link">← Return to App</a>
+    </header>
+
+    <main>
+      ${bodyHtml}
+    </main>
+
+    <footer class="footer-bar">
+      <span>© ibgib contributors</span>
+      <span><a href="https://ibgib.space">ibgib.space</a> · <a href="https://github.com/ibgib" target="_blank" rel="noopener">GitHub</a></span>
+    </footer>
+  </div>
+</body>
+</html>`;
+
+await writeFile(outputHtmlPath, fullHtml, { encoding: 'utf8' });
+console.log(`${lc} complete. wrote ${outputHtmlPath}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/space-gib",
-  "version": "0.0.20",
+  "version": "0.0.21",
   "type": "module",
   "description": "ibgib storage and provider service — SaaS at ibgib.space",
   "scripts": {
@@ -12,11 +12,11 @@
     "build:test": "tsc -p tsconfig.test.json"
   },
   "dependencies": {
-    "@ibgib/core-gib": "^0.1.76",
+    "@ibgib/core-gib": "^0.1.77",
     "@ibgib/helper-gib": "^0.0.37",
     "@ibgib/ts-gib": "^0.5.34",
-    "@ibgib/web-gib": "^0.0.62",
-    "@ibgib/node-gib": "^0.0.21"
+    "@ibgib/web-gib": "^0.0.63",
+    "@ibgib/node-gib": "^0.0.22"
   },
   "engines": {
     "node": ">=20.0.0"

package/src/client/AUTO-GENERATED-version.mts

@@ -8,4 +8,4 @@
 /**
  * Version of space-gib, auto-updated by the build process.
  */
-export const AUTO_GENERATED_VERSION = '0.0.20';
+export const AUTO_GENERATED_VERSION = '0.0.21';

package/src/client/index.html

@@ -294,7 +294,7 @@
       <p class="footer-text">
         <span>© ibgib contributors</span> ·
         <a href="https://ibgib.space" class="footer-link">ibgib.space</a> ·
-        <a href="https://github.com/ibgib" class="footer-link" target="_blank" rel="noopener">GitHub</a>
+        <a href="/privacy" class="footer-link" target="_blank" rel="noopener">Privacy Policy</a>
       </p>
     </footer>