@ibgib/space-gib 0.0.8 → 0.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/space-gib",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "type": "module",
   "description": "ibgib storage and provider service — SaaS at ibgib.space",
   "scripts": {
@@ -12,11 +12,11 @@
     "build:test": "tsc -p tsconfig.test.json"
   },
   "dependencies": {
-    "@ibgib/core-gib": "^0.1.65",
+    "@ibgib/core-gib": "^0.1.66",
     "@ibgib/helper-gib": "^0.0.36",
     "@ibgib/ts-gib": "^0.5.33",
-    "@ibgib/web-gib": "^0.0.51",
-    "@ibgib/node-gib": "^0.0.9"
+    "@ibgib/web-gib": "^0.0.52",
+    "@ibgib/node-gib": "^0.0.10"
   },
   "engines": {
     "node": ">=20.0.0"

package/src/client/AUTO-GENERATED-version.mts

@@ -8,4 +8,4 @@
 /**
  * Version of space-gib, auto-updated by the build process.
  */
-export const AUTO_GENERATED_VERSION = '0.0.8';
+export const AUTO_GENERATED_VERSION = '0.0.9';

package/src/client/api/space-gib-api-bridge.mts

@@ -51,14 +51,39 @@ export class SpaceGibApiBridge {
     }
 
     /**
-     * PUTs an evolved domain keystone and any related ibgibs (e.g. S^Stjp) to the server.
+     * PUTs an evolved domain keystone and any related keystones (e.g., session
+     * keystones or delegate keystones) to the server.
      */
-    public async putEvolveKeystone(
-        domainAddr: string,
-        keystoneIbGib: IbGib_V1,
-        relatedIbGibs: IbGib_V1[] = [],
-        revokeTokens?: Record<string, string>
-    ): Promise<{ success: boolean; message?: string }> {
+    public async putEvolveKeystone({
+        domainAddr,
+        keystoneIbGib,
+        relatedKeystoneIbGibs = [],
+        revokeTokens
+    }: {
+        /**
+         * Address of the root parent domain identity keystone.
+         */
+        domainAddr: string;
+        /**
+         * The main evolved keystone frame being synchronized.
+         */
+        keystoneIbGib: IbGib_V1;
+        /**
+         * Array of other keystone frames related to this evolution.
+         * Distinction in intent:
+         * 1. Ephemeral Session Keystones: Temporary keystones generated to
+         *    authorize a single sync session (under 'sync' claims, targeted via
+         *    claim.target = sAddr).
+         * 2. Persistent Delegate Keystones: Long-lived sub-keystones registered
+         *    in the parent's `delegates` dictionary that are evolved
+         *    concurrently (e.g., during 'manage' password changes).
+         */
+        relatedKeystoneIbGibs?: IbGib_V1[];
+        /**
+         * Optional map of providerId to token to revoke during unlinking.
+         */
+        revokeTokens?: Record<string, string>;
+    }): Promise<{ success: boolean; message?: string }> {
         const lc = `${this.lc}[${this.putEvolveKeystone.name}]`;
         try {
             console.log(`${lc} posting evolved keystone...`);
@@ -70,7 +95,11 @@ export class SpaceGibApiBridge {
                 headers: {
                     'Content-Type': 'application/json',
                 },
-                body: JSON.stringify({ keystoneIbGib, relatedIbGibs, revokeTokens }),
+                body: JSON.stringify({
+                    keystoneIbGib,
+                    relatedKeystoneIbGibs,
+                    revokeTokens
+                }),
             });
 
             const data = await response.json();

package/src/client/components/keystone-creator/keystone-creator.mts

@@ -363,11 +363,11 @@ export class KeystoneCreatorComponentInstance
                 msg: 'Posting evolved domain identity and sync delegate to server...',
                 animationEmoji: '🔄'
             });
-            const resEvolve = await spaceGibApiBridge.putEvolveKeystone(
-                addr,
-                evolvedParentKeystoneIbGib,
-                [delegateKeystoneIbGib]
-            );
+            const resEvolve = await spaceGibApiBridge.putEvolveKeystone({
+                domainAddr: addr,
+                keystoneIbGib: evolvedParentKeystoneIbGib,
+                relatedKeystoneIbGibs: [delegateKeystoneIbGib]
+            });
             if (!resEvolve.success) {
                 this.setStatus(`Delegate registration sync failed: ${resEvolve.message}`, "error");
                 devLog(`✗ Server rejected delegate registration: ${resEvolve.message}`);

package/src/client/components/keystone-details/keystone-details.css

@@ -567,3 +567,45 @@
     pointer-events: none;
     opacity: 0.4;
 }
+
+/* Form Layout for Passphrase Rotation */
+.form-row {
+    display: flex;
+    gap: 1rem;
+    flex-wrap: wrap;
+    margin-top: 0.5rem;
+}
+
+.form-group {
+    flex: 1;
+    min-width: 200px;
+    display: flex;
+    flex-direction: column;
+    gap: 0.4rem;
+}
+
+.form-group label {
+    font-size: 0.75rem;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.03em;
+    color: var(--clr-text-secondary, #8fa08f);
+}
+
+.form-input {
+    padding: 0.65rem 0.8rem;
+    background: rgba(0, 0, 0, 0.35);
+    border: 1px solid var(--border-color-base, rgba(255, 255, 255, 0.08));
+    border-radius: var(--radius-sm, 6px);
+    color: #ffffff;
+    font-family: var(--font-family-base, inherit);
+    font-size: 0.9rem;
+    transition: all 0.2s ease-in-out;
+}
+
+.form-input:focus {
+    outline: none;
+    border-color: var(--clr-accent, #50fa7b);
+    background: rgba(0, 0, 0, 0.5);
+    box-shadow: 0 0 8px rgba(80, 250, 123, 0.15);
+}

package/src/client/components/keystone-details/keystone-details.html

@@ -113,6 +113,30 @@
             <div id="sso-status-msg" class="status-msg hidden"></div>
         </div>
 
+        <!-- Change Passphrase Card -->
+        <div id="change-passphrase-card" class="card">
+            <h3>Change Master Passphrase</h3>
+            <p class="description">Rotate your local master passphrase. This will cryptographically evolve your primary identity and all registered user-owned delegate keystones to the new passphrase.</p>
+            <div class="form-row">
+                <div class="form-group">
+                    <label for="input-current-passphrase">Current Passphrase</label>
+                    <input type="password" id="input-current-passphrase" placeholder="••••••••" class="form-input">
+                </div>
+                <div class="form-group">
+                    <label for="input-new-passphrase">New Passphrase</label>
+                    <input type="password" id="input-new-passphrase" placeholder="••••••••" class="form-input">
+                </div>
+                <div class="form-group">
+                    <label for="input-confirm-passphrase">Confirm New Passphrase</label>
+                    <input type="password" id="input-confirm-passphrase" placeholder="••••••••" class="form-input">
+                </div>
+            </div>
+            <div class="action-row">
+                <button id="btn-change-passphrase" class="action-btn">Update Passphrase</button>
+            </div>
+            <div id="change-passphrase-status" class="status-msg hidden"></div>
+        </div>
+
         <!-- Raw Keystone Timeline Explorer -->
         <div class="card accordion">
             <div id="raw-accordion-header" class="accordion-header">

package/src/client/components/keystone-details/keystone-details.mts

@@ -19,7 +19,7 @@ import {
 import { EVENT_IBGIB_IDENTITY_REQUEST_CHANGE, EVENT_IBGIB_IDENTITY_CHANGED } from "@ibgib/web-gib/dist/ui/ui-constants.mjs";
 import { spaceGibApiBridge } from "../../api/space-gib-api-bridge.mjs";
 import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
-import { toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
+import { getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 
 import { GLOBAL_LOG_A_LOT, APP_CONFIG, } from "../../constants.mjs";
 import { getComponentCtorArg, getIbGibGlobalThis_SpaceGib } from "../../helpers.web.mjs";
@@ -89,6 +89,12 @@ interface KeystoneDetailsElements extends ElementsBase {
     btnLinkGoogleEl: HTMLDivElement;
     btnLinkGithubEl: HTMLDivElement;
     ssoStatusMsgEl: HTMLDivElement;
+    inputCurrentPassphraseEl: HTMLInputElement;
+    inputNewPassphraseEl: HTMLInputElement;
+    inputConfirmPassphraseEl: HTMLInputElement;
+    btnChangePassphraseEl: HTMLButtonElement;
+    changePassphraseStatusEl: HTMLDivElement;
+    changePassphraseCardEl: HTMLDivElement;
 }
 
 export class KeystoneDetailsComponentInstance
@@ -195,6 +201,12 @@ export class KeystoneDetailsComponentInstance
             this.elements.btnLinkGoogleEl = shadow.getElementById('btn-link-google') as HTMLDivElement;
             this.elements.btnLinkGithubEl = shadow.getElementById('btn-link-github') as HTMLDivElement;
             this.elements.ssoStatusMsgEl = shadow.getElementById('sso-status-msg') as HTMLDivElement;
+            this.elements.inputCurrentPassphraseEl = shadow.getElementById('input-current-passphrase') as HTMLInputElement;
+            this.elements.inputNewPassphraseEl = shadow.getElementById('input-new-passphrase') as HTMLInputElement;
+            this.elements.inputConfirmPassphraseEl = shadow.getElementById('input-confirm-passphrase') as HTMLInputElement;
+            this.elements.btnChangePassphraseEl = shadow.getElementById('btn-change-passphrase') as HTMLButtonElement;
+            this.elements.changePassphraseStatusEl = shadow.getElementById('change-passphrase-status') as HTMLDivElement;
+            this.elements.changePassphraseCardEl = shadow.getElementById('change-passphrase-card') as HTMLDivElement;
 
             // ElementBase requires contentEl
             this.elements.contentEl = shadow.getElementById('identity-details-view') as HTMLDivElement;
@@ -233,6 +245,7 @@ export class KeystoneDetailsComponentInstance
         this.elements!.btnSetActiveEl.addEventListener('click', () => this.handleSetActiveIdentity());
         this.elements!.btnLinkGoogleEl.addEventListener('click', () => this.handleSSOClick('google'));
         this.elements!.btnLinkGithubEl.addEventListener('click', () => this.handleSSOClick('github'));
+        this.elements!.btnChangePassphraseEl.addEventListener('click', () => this.handleChangePassphrase());
     }
 
     private toggleAccordion() {
@@ -296,14 +309,23 @@ export class KeystoneDetailsComponentInstance
                 throw new Error(`(UNEXPECTED) space falsy and we couldn't get default local user space from metaspace? (E: fa298edcecbda889cfd7b228fbd57c26)`);
             }
 
-            const resGet = await metaspace.get({ addrs: [this.ibGibAddr], space });
+            let loadAddr = this.ibGibAddr;
+            if (opts?.getLatest) {
+                const latest = await metaspace.getLatestAddr({ addr: this.ibGibAddr, space });
+                if (latest) {
+                    loadAddr = latest;
+                    this.ibGibAddr = latest;
+                }
+            }
+
+            const resGet = await metaspace.get({ addrs: [loadAddr], space });
 
             if (resGet.success && resGet.ibGibs && resGet.ibGibs.length === 1) {
                 this.staticIbGib = resGet.ibGibs[0] as KeystoneIbGib_V1;
             } else {
                 const resIbGib = resGet.rawResultIbGib as any;
                 const addrsNotFound = resIbGib?.data?.addrsNotFound ?? 'unknown';
-                throw new Error(`couldn't find address ${this.ibGibAddr}. addrsNotFound: ${addrsNotFound}? resGet.errorMsg: ${resGet.errorMsg} (E: e0e5c9b7de2837bc902fa88390cd9f26)`);
+                throw new Error(`couldn't find address ${loadAddr}. addrsNotFound: ${addrsNotFound}? resGet.errorMsg: ${resGet.errorMsg} (E: e0e5c9b7de2837bc902fa88390cd9f26)`);
             }
 
             await this.updateFrameDetailsView();
@@ -495,15 +517,17 @@ export class KeystoneDetailsComponentInstance
             // Render Challenge Pools
             this.renderChallengePools(keystone.data?.challengePools || []);
 
-            // Render Delegates & SSO link card (only if this is a primary keystone, hide delegates table & SSO card for delegate/session keystones)
+            // Render Delegates, SSO link, and Passphrase Change cards (only if this is a primary keystone, hide them for delegate/session keystones)
             const details = await this.getKeystoneDetails(this.ibGibAddr);
             if (details.isPrimary) {
                 this.elements.delegatesCardEl.classList.remove('hidden');
                 await this.renderDelegates(keystone.data?.delegates);
                 this.elements.ssoLinkCardEl.classList.remove('hidden');
+                this.elements.changePassphraseCardEl.classList.remove('hidden');
             } else {
                 this.elements.delegatesCardEl.classList.add('hidden');
                 this.elements.ssoLinkCardEl.classList.add('hidden');
+                this.elements.changePassphraseCardEl.classList.add('hidden');
             }
 
             this.updateActiveButtonState();
@@ -633,10 +657,26 @@ export class KeystoneDetailsComponentInstance
             const btnView = document.createElement('button');
             btnView.className = 'action-btn secondary small';
             btnView.textContent = 'View Details';
-            btnView.addEventListener('click', () => {
+            btnView.addEventListener('click', async () => {
+                const lc = `${this.lc}[renderDelegates.click]`;
                 if (info.delegateAddr) {
+                    let addrToLoad = info.delegateAddr;
+                    const metaspace = getIbGibGlobalThis_SpaceGib(APP_CONFIG).metaspace;
+                    if (metaspace) {
+                        const space = await metaspace.getLocalUserSpace({ lock: false });
+                        if (space) {
+                            try {
+                                const latest = await metaspace.getLatestAddr({ addr: delegateTjpAddr, space });
+                                if (latest) {
+                                    addrToLoad = latest;
+                                }
+                            } catch (err) {
+                                console.warn(`${lc} Error resolving latest delegate address: ${extractErrorMsg(err)}`);
+                            }
+                        }
+                    }
                     this.dispatchEvent(new CustomEvent('ibgib-view-keystone-details', {
-                        detail: { addr: info.delegateAddr },
+                        detail: { addr: addrToLoad },
                         bubbles: true,
                         composed: true
                     }));
@@ -874,11 +914,11 @@ export class KeystoneDetailsComponentInstance
 
             // 4. Sync evolved parent keystone back to server
             this.setSSOStatus("Publishing evolved identity keystone to server...", "info");
-            const syncRes = await spaceGibApiBridge.putEvolveKeystone(
-                stateObj.parentTjpAddr,
-                evolvedParent,
-                [] // No outward delegate timelines
-            );
+            const syncRes = await spaceGibApiBridge.putEvolveKeystone({
+                domainAddr: stateObj.parentTjpAddr,
+                keystoneIbGib: evolvedParent,
+                relatedKeystoneIbGibs: [] // No outward delegate timelines
+            });
             if (!syncRes.success) {
                 throw new Error(`Server synchronization rejected: ${syncRes.message}`);
             }
@@ -980,11 +1020,11 @@ export class KeystoneDetailsComponentInstance
 
             // 3. Sync evolved parent keystone back to server
             this.setSSOStatus("Publishing evolved identity keystone to server...", "info");
-            const syncRes = await spaceGibApiBridge.putEvolveKeystone(
-                getIbGibAddr({ ibGib: this.ibGib! }),
-                evolvedParent,
-                [] // No outward delegate timelines
-            );
+            const syncRes = await spaceGibApiBridge.putEvolveKeystone({
+                domainAddr: getIbGibAddr({ ibGib: this.ibGib! }),
+                keystoneIbGib: evolvedParent,
+                relatedKeystoneIbGibs: [] // No outward delegate timelines
+            });
             if (!syncRes.success) {
                 throw new Error(`Server synchronization rejected: ${syncRes.message}`);
             }
@@ -1003,11 +1043,171 @@ export class KeystoneDetailsComponentInstance
             });
 
             this.setSSOStatus(`Successfully unlinked ${providerId}!`, "success");
-            await this.loadIbGib({ getLatest: false });
+            await this.loadIbGib({ getLatest: true });
 
         } catch (error) {
             console.error(`${lc} SSO unlink failed: ${extractErrorMsg(error)}`);
             this.setSSOStatus(`Unlink failed: ${extractErrorMsg(error)}`, "error");
         }
     }
+
+    private setChangePassphraseStatus(msg: string, type: 'info' | 'success' | 'error') {
+        const el = this.elements!.changePassphraseStatusEl;
+        el.textContent = msg;
+        el.className = `status-msg ${type}`;
+        el.classList.remove('hidden');
+    }
+
+    protected async handleChangePassphrase(): Promise<void> {
+        const lc = `${this.lc}[${this.handleChangePassphrase.name}]`;
+        this.setChangePassphraseStatus("Validating entries...", "info");
+
+        try {
+            const currentPassphrase = this.elements!.inputCurrentPassphraseEl.value;
+            const newPassphrase = this.elements!.inputNewPassphraseEl.value;
+            const confirmPassphrase = this.elements!.inputConfirmPassphraseEl.value;
+
+            if (!currentPassphrase) {
+                this.setChangePassphraseStatus("Current passphrase is required.", "error");
+                return;
+            }
+            if (!newPassphrase) {
+                this.setChangePassphraseStatus("New passphrase is required.", "error");
+                return;
+            }
+            if (newPassphrase !== confirmPassphrase) {
+                this.setChangePassphraseStatus("New passphrase and confirmation do not match.", "error");
+                return;
+            }
+
+            const keystoneService = new KeystoneService_V1();
+
+            // 1. Verify current passphrase against parent manage pool
+            const isMatch = await keystoneService.verifySigningSecret({
+                keystoneIbGib: this.ibGib!,
+                signingSecret: currentPassphrase,
+                poolId: 'manage'
+            });
+            if (!isMatch) {
+                this.setChangePassphraseStatus("Incorrect current passphrase.", "error");
+                return;
+            }
+
+            this.setChangePassphraseStatus("Evolving primary identity keystone...", "info");
+
+            const metaspace = getIbGibGlobalThis_SpaceGib(APP_CONFIG).metaspace;
+            if (!metaspace) throw new Error("Metaspace not found");
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) { throw new Error("Local space not found"); }
+
+            // 2. Rotate parent identity
+            debugger; // walk through this...looking for delegate failure
+            const { newKeystone: evolvedParent, newDelegates: evolvedDelegates } = await keystoneService.changePassword({
+                keystoneIbGib: this.ibGib!,
+                newMasterSecret: newPassphrase,
+                signingSecret: currentPassphrase,
+                signingPoolId: 'manage',
+                metaspace,
+                space
+            });
+            debugger; // look at evolvedDelegates
+
+            this.setChangePassphraseStatus("Resolving and rotating delegate keystones...", "info");
+
+            // // 3. Evolve registered delegate keystones (preserving custodian/foreign delegate secrets)
+            // const delegates = this.ibGib!.data?.delegates || {};
+            // const evolvedDelegates: KeystoneIbGib_V1[] = [];
+
+            // for (const delegateInfo of Object.values(delegates)) {
+            //     const delegateAddr = delegateInfo.delegateAddr;
+            //     const delegateKeystone = await keystoneService.getLatestKeystone({
+            //         addr: delegateAddr,
+            //         metaspace,
+            //         space,
+            //     });
+
+            //     // Identify user-owned challenge pools in the delegate that match the old passphrase
+            //     const poolsToRotate: string[] = [];
+            //     for (const pool of delegateKeystone.data?.challengePools ?? []) {
+            //         if (!pool.isForeign) {
+            //             /**
+            //              * WARNING: There is an extreme edge case that if two pools
+            //              * happen to be owned by different parties but share the
+            //              * same secret, this will change the wrong pool's secret
+            //              * also. For V1, this shouldn't matter. But we need a
+            //              * better way of tracking pool ownership for V2 (or even
+            //              * V1 if we have multi-party support). (DO NOT REMOVE
+            //              * THIS COMMENT UNTIL THIS IS ADDRESSED)
+            //              */
+            //             const isPoolMatch = await keystoneService.verifySigningSecret({
+            //                 keystoneIbGib: delegateKeystone,
+            //                 signingSecret: currentPassphrase,
+            //                 poolId: pool.id
+            //             });
+            //             if (isPoolMatch) { poolsToRotate.push(pool.id); }
+            //         }
+            //     }
+
+            //     if (poolsToRotate.length > 0) {
+            //         console.log(`${lc} Rotating pools in delegate ${delegateInfo.delegateTjpAddr}: ${poolsToRotate.join(', ')}`);
+            //         const {newKeystone: evolvedDelegate} = await keystoneService.changePassword({
+            //             keystoneIbGib: delegateKeystone,
+            //             newMasterSecret: newPassphrase,
+            //             signingSecret: currentPassphrase,
+            //             signingPoolId: 'manage',
+            //             poolIds: poolsToRotate,
+            //             metaspace,
+            //             space
+            //         });
+            //         evolvedDelegates.push(evolvedDelegate);
+            //     }
+            // }
+
+            // 4. Sync evolved parent and all evolved delegate keystones atomically
+            this.setChangePassphraseStatus("Syncing evolved keystones to server...", "info");
+            const parentTjp = getIbGibAddr({ ibGib: this.ibGib! }); // is this.ibGib the tjp always? or is it the latest in the keystone line? Does it matter?
+
+            const syncRes = await spaceGibApiBridge.putEvolveKeystone({
+                domainAddr: parentTjp,
+                keystoneIbGib: evolvedParent,
+                relatedKeystoneIbGibs: evolvedDelegates,
+            });
+            if (!syncRes.success) {
+                throw new Error(`Server synchronization rejected: ${syncRes.message}`);
+            }
+
+            // 5. Update index locally
+            this.setChangePassphraseStatus("Updating local indexes...", "info");
+            const newKeystoneIbGibs = [toDto({ ibGib: evolvedParent })];
+            if (evolvedDelegates) {
+                evolvedDelegates.forEach(d => {
+                    newKeystoneIbGibs.push(toDto({ ibGib: d }));
+                });
+            }
+            const rel8nInfos = [
+                {
+                    rel8nName: "keystone",
+                    ibGibs: newKeystoneIbGibs,
+                }
+            ];
+            await updateSpecialIndex({
+                type: "keystones",
+                rel8nInfos,
+                metaspace,
+                space
+            });
+
+            // Clear inputs
+            this.elements!.inputCurrentPassphraseEl.value = "";
+            this.elements!.inputNewPassphraseEl.value = "";
+            this.elements!.inputConfirmPassphraseEl.value = "";
+
+            this.setChangePassphraseStatus("Passphrase updated successfully!", "success");
+            await this.loadIbGib({ getLatest: true });
+
+        } catch (error) {
+            console.error(`${lc} Passphrase rotation failed: ${extractErrorMsg(error)}`);
+            this.setChangePassphraseStatus(`Update failed: ${extractErrorMsg(error)}`, "error");
+        }
+    }
 }

package/src/client/dev-tools/common.mts

@@ -102,11 +102,11 @@ export async function createAndRegisterSyncDelegate({
     const domainAddr = getIbGibAddr({ ibGib: domainI });
 
     // 4. Sync evolved parent and delegate to server
-    const resEvolve = await apiBridge.putEvolveKeystone(
+    const resEvolve = await apiBridge.putEvolveKeystone({
         domainAddr,
-        evolvedDomainI,
-        [delegateKeystone]
-    );
+        keystoneIbGib: evolvedDomainI,
+        relatedKeystoneIbGibs: [delegateKeystone]
+    });
     if (!resEvolve.success) {
         throw new Error(`Server rejected delegate evolution: ${resEvolve.message}`);
     }

package/src/server/serve-gib/handlers/api/keystone/keystone-evolve.handler.mts

@@ -29,9 +29,18 @@ interface EvolveParams extends ParamsWithDomain {
     domainAddr: string;
 }
 
+/**
+ * Body payload for the Keystone Evolve REST API request.
+ */
 interface EvolveBody {
+    /** The main evolved keystone frame. */
     keystoneIbGib: KeystoneIbGib_V1;
-    relatedIbGibs?: IbGib_V1[];
+    /**
+     * Array of other keystone frames related to this evolution.
+     * Ephemeral session keystones for sync, or persistent delegate keystones for manage.
+     */
+    relatedKeystoneIbGibs?: IbGib_V1[];
+    /** Optional map of providerId to token to revoke during unlinking. */
     revokeTokens?: Record<string, string>;
 }
 
@@ -78,7 +87,7 @@ export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase<Evol
                 return this.error(400, 'Invalid request JSON body: bodyStr does NOT parse. (E: 2f81c8c80a6884ff32b877671e92f326)');
             }
 
-            const { keystoneIbGib, relatedIbGibs = [] } = parsed;
+            const { keystoneIbGib, relatedKeystoneIbGibs = [] } = parsed;
             if (!keystoneIbGib) {
                 return this.error(400, 'Invalid request. Body must contain keystoneIbGib (E: e234647f79282982c8012fe8015f5826)');
             }
@@ -92,7 +101,7 @@ export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase<Evol
             await validateAndRegisterEvolveKeystone({
                 domainAddr,
                 keystoneIbGib,
-                relatedIbGibs,
+                relatedKeystoneIbGibs,
                 metaspace: reqCtx.metaspace,
                 space
             });