@ibgib/space-gib 0.0.8 → 0.0.9

package/dist/client/index.mjs

@@ -1,2 +1,2 @@
-import{Qb as c,Rb as l,Tb as a,a as r,i as e,mb as n,nb as i,qc as s}from"./chunk-SUQ5QJH4.mjs";l(i);var m=n;async function d(){let o=`[${d.name}]`;try{m&&console.log(`${o} starting... (I: 3d893846d02c4ff49181f9b8e586eb74)`),console.time(o),document.addEventListener("DOMContentLoaded",async()=>{try{console.timeLog(o,"DOMContentLoaded fired"),await c(i),console.timeLog(o,"initIbGibStorage complete"),await a("./bootstrap.mjs"),console.timeLog(o,"dynamicallyLoadBootstrapScript complete"),s(),console.timeLog(o,"initDevTools complete"),console.timeEnd(o)}catch(t){throw console.error(`${o} ${e(t)}`),t}})}catch(t){console.timeEnd(o);debugger;throw console.error(`${o} ${e(t)}`),t}finally{m&&console.log(`${o} complete.`)}}r(d,"spinOffStartup");d();
+import{Qb as c,Rb as l,Tb as a,a as r,i as e,mb as n,nb as i,qc as s}from"./chunk-QRMTJE6M.mjs";l(i);var m=n;async function d(){let o=`[${d.name}]`;try{m&&console.log(`${o} starting... (I: 3d893846d02c4ff49181f9b8e586eb74)`),console.time(o),document.addEventListener("DOMContentLoaded",async()=>{try{console.timeLog(o,"DOMContentLoaded fired"),await c(i),console.timeLog(o,"initIbGibStorage complete"),await a("./bootstrap.mjs"),console.timeLog(o,"dynamicallyLoadBootstrapScript complete"),s(),console.timeLog(o,"initDevTools complete"),console.timeEnd(o)}catch(t){throw console.error(`${o} ${e(t)}`),t}})}catch(t){console.timeEnd(o);debugger;throw console.error(`${o} ${e(t)}`),t}finally{m&&console.log(`${o} complete.`)}}r(d,"spinOffStartup");d();
 //# sourceMappingURL=index.mjs.map

package/dist/client/script.mjs

@@ -1,2 +1,2 @@
-import{p as e}from"./chunk-DBHMHCGD.mjs";import"./chunk-SUQ5QJH4.mjs";console.log("space-gib early script executing...");e();
+import{p as e}from"./chunk-ACIGPCQW.mjs";import"./chunk-QRMTJE6M.mjs";console.log("space-gib early script executing...");e();
 //# sourceMappingURL=script.mjs.map

package/dist/server/server.mjs

@@ -17900,6 +17900,15 @@ var KeystoneStrategy_HashRevealV1 = class _KeystoneStrategy_HashRevealV1 extends
     }
   }
 };
+async function deriveDelegateSecret({ masterSecret }) {
+  const salt = await hash({ s: masterSecret, algorithm: HashAlgorithm.sha_512 });
+  return await kdf_recursiveSaltWrap({
+    masterSecret,
+    salt,
+    rounds: 1e3,
+    algorithm: HashAlgorithm.sha_512
+  });
+}
 
 // ../../libs/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs
 var KeystoneStrategyFactory = class _KeystoneStrategyFactory {
@@ -19775,35 +19784,38 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
    * This creates a new frame signed by the specified `signingPoolId` using `signingSecret`.
    *
    * Supports recovery (signing via `custodian-manage` using the custodian secret) and normal rotation
-   * (signing via `manage` using the old password).
+   * (signing via `manage` using the old password). **I DONT THINK THIS IS POSSIBLE. WE WOULD NEED CUSTODIAN MANAGE POOLS ON ALL THE DELEGATES AS WELL**
    *
-   * @param latestKeystone The current tip frame of the keystone.
-   *   - Visibility: Public (Public Merkle frame, safe for ledger).
-   *   - Generator: Client/Server (Constructed locally and synced).
+   * @param signingSecret
    *
-   * @param newMasterSecret The new passphrase/master secret to set for the user's primary pools.
-   *   - Visibility: Private (Confidential secret credential. Must never go over the wire).
-   *   - Generator: Client (From user input in settings).
-   *
-   * @param signingSecret The secret of the pool authorizing this change (either old passphrase or derived custodian secret).
-   *   - Visibility: Private (Confidential secret. Must never go over the wire).
-   *   - Generator: Client/Server (Known only to the signing party).
-   *
-   * @param signingPoolId The ID of the pool used to authorize the rotation (defaults to 'manage').
-   *   - Visibility: Public (Non-sensitive ID string).
-   *   - Generator: Client/Server (From pool configuration).
+   * @param signingPoolId
    */
-  async changePassword({ latestKeystone, newMasterSecret, signingSecret, signingPoolId = POOL_ID_MANAGE, poolIds, frameDetails, metaspace, space }) {
+  async changePassword({ keystoneIbGib, keystoneAddr, newMasterSecret, signingSecret, signingPoolId = POOL_ID_MANAGE, poolIds, frameDetails, metaspace, space }) {
     const lc2 = `${this.lc}[${this.changePassword.name}]`;
     try {
       if (logalot41) {
-        console.log(`${lc2} starting...`);
+        console.log(`${lc2} starting... (I: 9e3ff83ebd74511f9dad784a1020d926)`);
+      }
+      if (!keystoneIbGib && !keystoneAddr) {
+        throw new Error(`Either keystoneIbGib or keystoneAddr required. (E: d1b8c8cb75f2c022284e69b8c30af826)`);
+      }
+      if (keystoneIbGib && keystoneAddr) {
+        const checkAddr = getIbGibAddr({ ibGib: keystoneIbGib });
+        if (checkAddr !== keystoneAddr) {
+          throw new Error(`(UNEXPECTED) both keystoneIbGib (addr: ${checkAddr}) and keystoneAddr (${keystoneAddr}) provided, but the addrs are unequal? Note that only one is required for this function, but if both are provided the addrs must match exactly. (E: c5574f7e353a48b0bba94a1862af4e26)`);
+        }
       }
+      keystoneAddr ??= getIbGibAddr({ ibGib: keystoneIbGib });
+      const latestKeystone = await this.getLatestKeystone({
+        addr: keystoneAddr,
+        metaspace,
+        space
+      });
       if (!latestKeystone.data) {
-        throw new Error(`latestKeystone.data falsy`);
+        throw new Error(`latestKeystone.data falsy (E: 22e498eb8308a33e68b812d8d3905826)`);
       }
       if (latestKeystone.data.revocationInfo) {
-        throw new Error(`Keystone has been revoked. Cannot change password. (E: 8599f8f51c78d722252ddb2894fdbe25)`);
+        throw new Error(`Keystone has been revoked. Cannot change password. (E: 726298617e8508b3c83b5e985a03e826)`);
       }
       const prevPools = latestKeystone.data.challengePools;
       const signingPool = prevPools.find((p) => p.id === signingPoolId);
@@ -19878,17 +19890,44 @@ var KeystoneService_V1 = class _KeystoneService_V1 {
         proofs: [proof],
         frameDetails,
         checkpointDetails,
-        ...latestKeystone.data.delegates ? { delegates: latestKeystone.data.delegates } : {}
+        ...latestKeystone.data.delegates ? { delegates: latestKeystone.data.delegates } : void 0
       };
-      return await evolvePersistAndRegisterKeystone({
+      const newKeystoneIbGib = await evolvePersistAndRegisterKeystone({
         prevIbGib: latestKeystone,
         newData,
         metaspace,
         space
       });
+      const newDelegates = [];
+      if ((poolIds ?? []).length === 0) {
+        const delegateSigningSecret = await deriveDelegateSecret({ masterSecret: signingSecret });
+        const delegateNewMasterSecret = await deriveDelegateSecret({ masterSecret: newMasterSecret });
+        const delegateTjpAddrs = Object.keys(latestKeystone.data.delegates ?? {});
+        for (const delegateTjpAddr of delegateTjpAddrs) {
+          const { newKeystone: newDelegate, newDelegates: newDelegatesSecondOrder } = await this.changePassword({
+            keystoneAddr: delegateTjpAddr,
+            metaspace,
+            space,
+            newMasterSecret: delegateNewMasterSecret,
+            signingSecret: delegateSigningSecret,
+            signingPoolId,
+            poolIds: void 0,
+            frameDetails
+          });
+          if (newDelegatesSecondOrder && newDelegatesSecondOrder.length > 0) {
+            throw new Error(`(UNEXPECTED) Delegate keystone has its own delegate(s)? ATOW (07/20/2026) second order delegates are not supported. (E: de45a7b7d9b8f61f6e58158269acba26)`);
+          }
+          newDelegates.push(newDelegate);
+        }
+      }
+      return { newKeystone: newKeystoneIbGib, newDelegates: newDelegates.length > 0 ? newDelegates : void 0 };
     } catch (error) {
       console.error(`${lc2} ${extractErrorMsg(error)}`);
       throw error;
+    } finally {
+      if (logalot41) {
+        console.log(`${lc2} complete.`);
+      }
     }
   }
   /**
@@ -20080,17 +20119,31 @@ async function validateAndRegisterPostKeystones({ ibGibs, metaspace, space }) {
     }
   }
 }
-async function validateAndRegisterEvolveKeystone({ domainAddr, keystoneIbGib, relatedIbGibs = [], metaspace, space }) {
+async function validateAndRegisterEvolveKeystone({ domainAddr, keystoneIbGib, relatedKeystoneIbGibs = [], metaspace, space }) {
   const lc2 = `[${validateAndRegisterEvolveKeystone.name}]`;
   try {
     if (logalot42) {
       console.log(`${lc2} starting... (I: 42b826a690881cd5a8fe520cbdfad826)`);
     }
-    const addr = getIbGibAddr({ ibGib: keystoneIbGib });
     const intrinsicErrors = await validateIbGibIntrinsically({ ibGib: keystoneIbGib });
     if (intrinsicErrors && intrinsicErrors.length > 0) {
       throw new Error(`Intrinsic keystone validation failed: ${intrinsicErrors.join(", ")} (E: 38ea984585edc6ee88d2a698c7895826)`);
     }
+    const proofs = keystoneIbGib.data?.proofs ?? [];
+    if (proofs.length === 0) {
+      throw new Error("No proofs found in evolved keystone data (E: 399f8f51c78d722252ddb2894fdbe25)");
+    }
+    if (proofs.length !== 1) {
+      throw new Error(`evolving keystone with proofs.length !== 1? (E: 14e058a34964dcd7181395382cc60826)`);
+    }
+    const claim = proofs[0].claim;
+    if (!claim) {
+      throw new Error(`proof.claim is falsy (E: 54be88be2c975ef18e571a4286928826)`);
+    }
+    const verb = claim.verb;
+    if (!verb) {
+      throw new Error(`claim.verb is falsy (E: 92cf38af58db2cd90e7132b8940fe326)`);
+    }
     const keystoneService = new KeystoneService_V1();
     let parentKeystone;
     try {
@@ -20108,132 +20161,185 @@ async function validateAndRegisterEvolveKeystone({ domainAddr, keystoneIbGib, re
       throw new Error(`Incoming keystone does not have a TJP address (E: d288fae39b7d825d)`);
     }
     const isDelegate = incomingTjpAddr !== parentTjpAddr;
-    let prevIbGib;
-    if (isDelegate) {
-      const delegateInfo = parentKeystone.data?.delegates?.[incomingTjpAddr];
-      if (!delegateInfo) {
-        throw new Error(`Incoming delegate keystone (${incomingTjpAddr}) is not registered under parent Domain Identity (${parentTjpAddr}) (E: c288fae39b7d82fe)`);
-      }
-      const allowedVerbs = delegateInfo.allowedVerbs ?? [];
-      if (!allowedVerbs.includes(KEYSTONE_VERB_SYNC)) {
-        throw new Error(`Incoming delegate keystone is not authorized for sync. Allowed verbs: ${allowedVerbs.join(", ")} (E: a288fae39b7d82ff)`);
-      }
-      const delegateLatestAddr = await metaspace.getLatestAddr({
-        addr: incomingTjpAddr,
-        space
-      });
-      if (delegateLatestAddr) {
-        const resGet = await metaspace.get({ addr: delegateLatestAddr, space });
-        if (resGet.success && resGet.ibGibs && resGet.ibGibs.length > 0) {
-          prevIbGib = resGet.ibGibs[0];
-        }
-      }
-    } else {
-      prevIbGib = parentKeystone;
-    }
-    if (prevIbGib) {
-      const validationErrors = await keystoneService.validate({
-        currentIbGib: keystoneIbGib,
-        prevIbGib
-      });
-      if (validationErrors && validationErrors.length > 0) {
-        throw new Error(`Keystone evolution validation failed: ${validationErrors.join(", ")} (E: 5212f8492ac839953842631834bcd826)`);
-      }
-    } else {
-      const validationErrors = await keystoneService.validateKeystoneGraph({
-        keystoneIbGib,
-        getLatest: false,
-        invalidIfMoreRecentKeystoneFoundInSpace: false,
-        space
-      });
-      if (validationErrors && validationErrors.length > 0) {
-        throw new Error(`Keystone graph validation failed: ${validationErrors.join(", ")} (E: 3a288fae39b7d82e)`);
-      }
-    }
-    const proofs = keystoneIbGib.data?.proofs ?? [];
-    if (proofs.length === 0) {
-      throw new Error("No proofs found in evolved keystone data");
-    }
-    const poolIds = /* @__PURE__ */ new Set();
-    for (const proof of proofs) {
-      for (const solution of proof.solutions || []) {
-        if (solution.poolId) {
-          poolIds.add(solution.poolId);
-        }
-      }
-    }
-    if (poolIds.size > 1) {
-      throw new Error(`Multiple pools evolved (${Array.from(poolIds).join(", ")}). Only one pool evolution allowed at a time. (E: 4a9b28ae33e8e3eb4ddbad981aa7b126)`);
-    }
-    if (proofs.length !== 1) {
-      throw new Error(`evolving keystone with proofs.length !== 1? (E: 14e058a34964dcd7181395382cc60826)`);
-    }
-    const claim = proofs[0].claim;
-    if (!claim) {
-      throw new Error(`proof.claim is falsy (E: 54be88be2c975ef18e571a4286928826)`);
+    switch (verb) {
+      case KEYSTONE_VERB_MANAGE:
+        await validateManageEvolveKeystone({
+          keystoneIbGib,
+          relatedKeystoneIbGibs,
+          parentKeystone,
+          isDelegate,
+          domainAddr,
+          metaspace,
+          space
+        });
+        break;
+      case KEYSTONE_VERB_SYNC:
+        await validateSyncEvolveKeystone({
+          keystoneIbGib,
+          relatedKeystoneIbGibs,
+          parentKeystone,
+          isDelegate,
+          domainAddr,
+          metaspace,
+          space
+        });
+        break;
+      default:
+        throw new Error(`Unsupported keystone evolution verb: ${verb} (E: eca4681b05486d1f784c0cb815ef9926)`);
     }
-    const { verb } = claim;
-    if (!verb) {
-      throw new Error(`claim.verb is falsy (E: 92cf38af58db2cd90e7132b8940fe326)`);
+  } catch (error) {
+    console.error(`${lc2} ${extractErrorMsg(error)}`);
+    throw error;
+  } finally {
+    if (logalot42) {
+      console.log(`${lc2} complete.`);
     }
-    if (verb === "manage") {
-      const prevDelegates = prevIbGib?.data?.delegates ?? {};
-      const currDelegates = keystoneIbGib.data?.delegates ?? {};
-      for (const [delegateTjpAddr, delegateInfo] of Object.entries(currDelegates)) {
-        if (!prevDelegates[delegateTjpAddr]) {
-          const delegateAddr = delegateInfo.delegateAddr;
-          const delegateIbGib = relatedIbGibs.find((ibGib) => getIbGibAddr({ ibGib }) === delegateAddr);
-          if (!delegateIbGib) {
-            throw new Error(`Evolved delegate keystone ${delegateAddr} must be provided in relatedIbGibs (E: 1fe5a68438e288ab4e86c90d81d142826)`);
+  }
+}
+async function validateManageEvolveKeystone({ keystoneIbGib, relatedKeystoneIbGibs, parentKeystone, isDelegate, domainAddr, metaspace, space }) {
+  const lc2 = `[validateManageEvolveKeystone]`;
+  const keystoneService = new KeystoneService_V1();
+  const transitionErrors = await keystoneService.validate({
+    currentIbGib: keystoneIbGib,
+    prevIbGib: parentKeystone
+  });
+  if (transitionErrors && transitionErrors.length > 0) {
+    throw new Error(`Parent Domain Identity evolution validation failed: ${transitionErrors.join(", ")} (E: 5212f8492ac839953842631834bcd826)`);
+  }
+  const proof = keystoneIbGib.data?.proofs?.[0];
+  const claim = proof?.claim;
+  const claimType = claim?.details?.type;
+  const prevDelegates = parentKeystone.data?.delegates ?? {};
+  const currDelegates = keystoneIbGib.data?.delegates ?? {};
+  switch (claimType) {
+    case KEYSTONE_CLAIM_TYPE_CHANGE_PASSWORD:
+    case KEYSTONE_CLAIM_TYPE_ADD_POOL:
+    case KEYSTONE_CLAIM_TYPE_REMOVE_POOL:
+    case KEYSTONE_CLAIM_TYPE_REPLACE_POOL:
+    default:
+      for (const related of relatedKeystoneIbGibs) {
+        const ibIsValid = await validateKeystoneIb({ ib: related.ib });
+        if (!ibIsValid) {
+          throw new Error(`Invalid related keystone ibgib. related.ib (${related.ib}) is not a valid keystone ib. (E: 89dff2f48fa8c33b449081e2478c6826)`);
+        }
+        const relatedTjp = getTjpAddr({ ibGib: related });
+        if (!relatedTjp) {
+          throw new Error(`Related keystone in relatedKeystoneIbGibs is missing a TJP address (E: 2fe5a68438e288ab4e86c90d81d142826)`);
+        }
+        const relatedAddr = getIbGibAddr({ ibGib: related });
+        const delegateInfo = currDelegates[relatedTjp];
+        if (!delegateInfo) {
+          throw new Error(`Related keystone (${relatedTjp}) is not a registered delegate under parent Domain Identity (E: 3fe5a68438e288ab4e86c90d81d142826)`);
+        }
+        const delegateIsNewlyRegistered = !prevDelegates[relatedTjp];
+        if (delegateIsNewlyRegistered) {
+          const delegateKeystone = related;
+          if (delegateKeystone.data?.n !== 0) {
+            throw new Error(`Newly registered delegate keystone (${relatedAddr}) has data.n !== 0 (${delegateKeystone.data?.n}). Registering non-genesis delegate keystones is not supported at this time. (E: 4cdd0dee42d7d437ef6af698150cfe26)`);
           }
-          const delegateErrors = await keystoneService.validateGenesisKeystone({ keystoneIbGib: delegateIbGib });
-          if (delegateErrors && delegateErrors.length > 0) {
-            throw new Error(`Genesis validation failed for delegate keystone ${delegateAddr}: ${delegateErrors.join(", ")} (E: d8afdc1dbed48c000455b35585dc26826)`);
+          const genesisErrors = await keystoneService.validateGenesisKeystone({
+            keystoneIbGib: delegateKeystone
+          });
+          if (genesisErrors && genesisErrors.length > 0) {
+            throw new Error(`Genesis validation failed for new delegate keystone ${relatedAddr}: ${genesisErrors.join(", ")} (E: d8afdc1dbed48c000455b35585dc26826)`);
+          }
+        } else {
+          let prevDelegateTip;
+          try {
+            prevDelegateTip = await keystoneService.getLatestKeystone({
+              addr: relatedTjp,
+              metaspace,
+              space
+            });
+          } catch (err) {
+            throw new Error(`Could not find previous delegate tip for ${relatedTjp} in space: ${extractErrorMsg(err)} (E: 5fe5a68438e288ab4e86c90d81d142826)`);
+          }
+          const evolutionErrors = await keystoneService.validate({
+            currentIbGib: related,
+            prevIbGib: prevDelegateTip
+          });
+          if (evolutionErrors && evolutionErrors.length > 0) {
+            throw new Error(`Evolution transition validation failed for delegate keystone ${relatedAddr}: ${evolutionErrors.join(", ")} (E: 6fe5a68438e288ab4e86c90d81d142826)`);
           }
         }
       }
-      await metaspace.put({ ibGibs: [keystoneIbGib, ...relatedIbGibs], space });
-      await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
-      for (const related of relatedIbGibs) {
-        if (related.ib?.startsWith("keystone")) {
-          await metaspace.registerNewIbGib({ ibGib: related, space });
-        }
-      }
-      return;
-    }
-    if (verb !== "sync") {
-      throw new Error(`non-sync/non-manage keystone evolution not yet implemented (E: eca4681b05486d1f784c0cb815ef9926)`);
-    }
-    if (!isDelegate) {
-      throw new Error(`Root Domain Identity (${parentTjpAddr}) is not allowed to sync directly. A delegate must be used. (E: 2c88fae39b7d82fd)`);
-    }
-    const sAddr = claim.target;
-    if (!sAddr) {
-      throw new Error("No target address found in sync claim");
-    }
-    const sIbGib = relatedIbGibs.find((ibGib) => getIbGibAddr({ ibGib }) === sAddr);
-    if (!sIbGib) {
-      throw new Error(`Session keystone ${sAddr} must be provided in relatedIbGibs (E: fe5a68438e288ab4e86c90d81d142826)`);
-    }
-    const sIntrinsicErrors = await validateIbGibIntrinsically({ ibGib: sIbGib });
-    if (sIntrinsicErrors && sIntrinsicErrors.length > 0) {
-      throw new Error(`Intrinsic validation failed for S^Stjp: ${sIntrinsicErrors.join(", ")} (E: 802d8350c3cccbd7184dd43866c05526)`);
+      break;
+  }
+  await metaspace.put({ ibGibs: [keystoneIbGib, ...relatedKeystoneIbGibs], space });
+  await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
+  for (const related of relatedKeystoneIbGibs) {
+    if (related.ib?.startsWith("keystone")) {
+      await metaspace.registerNewIbGib({ ibGib: related, space });
     }
-    const sGenesisErrors = await keystoneService.validateGenesisKeystone({ keystoneIbGib: sIbGib });
-    if (sGenesisErrors && sGenesisErrors.length > 0) {
-      throw new Error(`Genesis validation failed for S^Stjp: ${sGenesisErrors.join(", ")} (E: 8afdc1dbed48c000455b35585dc26826)`);
+  }
+}
+async function validateSyncEvolveKeystone({ keystoneIbGib, relatedKeystoneIbGibs, parentKeystone, isDelegate, domainAddr, metaspace, space }) {
+  const lc2 = `[validateSyncEvolveKeystone]`;
+  const keystoneService = new KeystoneService_V1();
+  if (!isDelegate) {
+    throw new Error(`Root Domain Identity (${domainAddr}) is not allowed to sync directly. A delegate must be used. (E: 2c88fae39b7d82fd)`);
+  }
+  const incomingTjpAddr = getTjpAddr({ ibGib: keystoneIbGib });
+  if (!incomingTjpAddr) {
+    throw new Error(`Incoming delegate keystone missing TJP address (E: d288fae39b7d825e)`);
+  }
+  const delegateInfo = parentKeystone.data?.delegates?.[incomingTjpAddr];
+  if (!delegateInfo) {
+    throw new Error(`Incoming delegate keystone (${incomingTjpAddr}) is not registered under parent Domain Identity (E: c288fae39b7d82fe)`);
+  }
+  const allowedVerbs = delegateInfo.allowedVerbs ?? [];
+  if (!allowedVerbs.includes(KEYSTONE_VERB_SYNC)) {
+    throw new Error(`Incoming delegate keystone is not authorized for sync. Allowed verbs: ${allowedVerbs.join(", ")} (E: a288fae39b7d82ff)`);
+  }
+  let prevDelegateTip;
+  try {
+    prevDelegateTip = await keystoneService.getLatestKeystone({
+      addr: incomingTjpAddr,
+      metaspace,
+      space
+    });
+  } catch (err) {
+  }
+  if (prevDelegateTip) {
+    const validationErrors = await keystoneService.validate({
+      currentIbGib: keystoneIbGib,
+      prevIbGib: prevDelegateTip
+    });
+    if (validationErrors && validationErrors.length > 0) {
+      throw new Error(`Delegate keystone evolution validation failed: ${validationErrors.join(", ")} (E: 5212f8492ac839953842631834bcd827)`);
     }
-    await metaspace.put({ ibGibs: [keystoneIbGib, sIbGib], space });
-    await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
-    await metaspace.registerNewIbGib({ ibGib: sIbGib, space });
-  } catch (error) {
-    console.error(`${lc2} ${extractErrorMsg(error)}`);
-    throw error;
-  } finally {
-    if (logalot42) {
-      console.log(`${lc2} complete.`);
+  } else {
+    const validationErrors = await keystoneService.validateKeystoneGraph({
+      keystoneIbGib,
+      getLatest: false,
+      invalidIfMoreRecentKeystoneFoundInSpace: false,
+      space
+    });
+    if (validationErrors && validationErrors.length > 0) {
+      throw new Error(`Delegate keystone graph validation failed: ${validationErrors.join(", ")} (E: 3a288fae39b7d82f)`);
     }
   }
+  const proof = keystoneIbGib.data?.proofs?.[0];
+  const claim = proof?.claim;
+  const sAddr = claim?.target;
+  if (!sAddr) {
+    throw new Error("No target address found in sync claim");
+  }
+  const sIbGib = relatedKeystoneIbGibs.find((ibGib) => getIbGibAddr({ ibGib }) === sAddr);
+  if (!sIbGib) {
+    throw new Error(`Session keystone ${sAddr} must be provided in relatedKeystoneIbGibs (E: fe5a68438e288ab4e86c90d81d142826)`);
+  }
+  const sIntrinsicErrors = await validateIbGibIntrinsically({ ibGib: sIbGib });
+  if (sIntrinsicErrors && sIntrinsicErrors.length > 0) {
+    throw new Error(`Intrinsic validation failed for S^Stjp: ${sIntrinsicErrors.join(", ")} (E: 802d8350c3cccbd7184dd43866c05526)`);
+  }
+  const sGenesisErrors = await keystoneService.validateGenesisKeystone({ keystoneIbGib: sIbGib });
+  if (sGenesisErrors && sGenesisErrors.length > 0) {
+    throw new Error(`Genesis validation failed for S^Stjp: ${sGenesisErrors.join(", ")} (E: 8afdc1dbed48c000455b35585dc26826)`);
+  }
+  await metaspace.put({ ibGibs: [keystoneIbGib, sIbGib], space });
+  await metaspace.registerNewIbGib({ ibGib: keystoneIbGib, space });
+  await metaspace.registerNewIbGib({ ibGib: sIbGib, space });
 }
 
 // src/server/serve-gib/handlers/api/keystone/keystone-post.handler.mts
@@ -20999,7 +21105,7 @@ var KeystoneEvolveHandler = class _KeystoneEvolveHandler extends ServeGibHandler
       } catch (err) {
         return this.error(400, "Invalid request JSON body: bodyStr does NOT parse. (E: 2f81c8c80a6884ff32b877671e92f326)");
       }
-      const { keystoneIbGib, relatedIbGibs = [] } = parsed;
+      const { keystoneIbGib, relatedKeystoneIbGibs = [] } = parsed;
       if (!keystoneIbGib) {
         return this.error(400, "Invalid request. Body must contain keystoneIbGib (E: e234647f79282982c8012fe8015f5826)");
       }
@@ -21010,7 +21116,7 @@ var KeystoneEvolveHandler = class _KeystoneEvolveHandler extends ServeGibHandler
       await validateAndRegisterEvolveKeystone({
         domainAddr,
         keystoneIbGib,
-        relatedIbGibs,
+        relatedKeystoneIbGibs,
         metaspace: reqCtx.metaspace,
         space
       });