@ibgib/web-gib 0.0.36 → 0.0.43

package/src/identity/identity-constants.mts

@@ -0,0 +1,107 @@
+/**
+ * @file identity-constants.mts
+ * @description Constants for the ibgib identity layer: pool IDs, verbs, KDF salts,
+ * IndexedDB store names, and default pool configuration presets.
+ *
+ * @see docs/identity/KEYSTONES.md
+ * @see docs/identity/TODO.md#02-identity-constants--verbs
+ */
+
+// ===========================================================================
+// IDENTITY VERBS
+// These extend the base KeystoneVerb set with identity-tier-specific actions.
+// Used as values in KeystoneClaim.verb and KeystonePoolConfig.allowedVerbs.
+// ===========================================================================
+
+/** Evolve META: add a LOCAL keystone to the trusted list. */
+export const IDENTITY_VERB_ADD_DEVICE = 'identity-add-device';
+/** Evolve META: remove a LOCAL keystone from the trusted list. */
+export const IDENTITY_VERB_REMOVE_DEVICE = 'identity-remove-device';
+/** Evolve META: transfer custodianship (custodial → sovereign). */
+export const IDENTITY_VERB_CUSTODY_TRANSFER = 'identity-custody-transfer';
+
+/** Evolve LOCAL: register a new APP-LOCAL keystone. */
+export const IDENTITY_VERB_ADD_APP = 'identity-add-app';
+/** Evolve LOCAL: deregister an APP-LOCAL keystone. */
+export const IDENTITY_VERB_REMOVE_APP = 'identity-remove-app';
+
+/** Evolve APP-LOCAL: establish a SESSION keystone genesis. */
+export const IDENTITY_VERB_ESTABLISH_SESSION = 'identity-establish-session';
+/** Evolve APP-LOCAL: authorize an app-level action. */
+export const IDENTITY_VERB_AUTHORIZE = 'identity-authorize';
+/**
+ * Evolve APP-LOCAL (final frame of old epoch): transition to a new epoch keystone.
+ * Uses `consume` replenish strategy — self-contained, no parent evolution needed.
+ * @see docs/identity/PARADIGM.md#epoch-rotation-handling-keystone-growth
+ */
+export const IDENTITY_VERB_EPOCH_TRANSITION = 'identity-epoch-transition';
+
+// ===========================================================================
+// POOL IDs
+// Conventional pool identifiers for each identity tier's pools.
+// ===========================================================================
+
+/** META keystone: structural changes (add/remove device). */
+export const IDENTITY_POOL_ID_ADD_DEVICE = 'identity-add-device';
+/** META keystone: structural changes (remove device). Separate pool allows tighter policy. */
+export const IDENTITY_POOL_ID_REMOVE_DEVICE = 'identity-remove-device';
+/** META keystone: custody transfer (consume strategy — limited uses). */
+export const IDENTITY_POOL_ID_CUSTODY_TRANSFER = 'identity-custody-transfer';
+
+/** LOCAL keystone: register/deregister app-local keystones. */
+export const IDENTITY_POOL_ID_ADD_APP = 'identity-add-app';
+/** LOCAL keystone: deregister app-local keystones. */
+export const IDENTITY_POOL_ID_REMOVE_APP = 'identity-remove-app';
+
+/** APP-LOCAL keystone: establish session keystones. */
+export const IDENTITY_POOL_ID_APP_SESSION = 'identity-app-session';
+/** APP-LOCAL keystone: general app-level authorization. */
+export const IDENTITY_POOL_ID_APP_AUTHORIZE = 'identity-app-authorize';
+/**
+ * APP-LOCAL keystone: epoch transition pool.
+ * Strategy: consume — self-authenticates epoch rotation without parent evolution.
+ */
+export const IDENTITY_POOL_ID_APP_EPOCH = 'identity-app-epoch';
+
+// ===========================================================================
+// KDF SALTS
+// Used to derive tier-specific MasterSecrets from a root passphrase.
+// Different salt per tier ensures independent secrets even with same passphrase.
+// ===========================================================================
+
+export const IDENTITY_KDF_SALT_META = 'ibgib-identity-meta-v1';
+export const IDENTITY_KDF_SALT_LOCAL = 'ibgib-identity-local-v1';
+/**
+ * APP-LOCAL salt base. Full derivation:
+ * `KDF(MasterSecret_local, IDENTITY_KDF_SALT_APP_LOCAL + appId + deviceSalt)`
+ */
+export const IDENTITY_KDF_SALT_APP_LOCAL = 'ibgib-identity-app-local-v1';
+export const IDENTITY_KDF_SALT_SESSION = 'ibgib-identity-session-v1';
+
+// ===========================================================================
+// INDEXEDDB STORE NAMES
+// ===========================================================================
+
+/** Stores `LocalIdentityContext` — one record per browser profile. */
+export const IDENTITY_IDB_STORE_LOCAL_CONTEXT = 'identity-local-context';
+/** Stores `AppLocalIdentityContext` — one record per appId per browser profile. */
+export const IDENTITY_IDB_STORE_APP_LOCAL_CONTEXT = 'identity-app-local-context';
+/** Cached META keystone chain — periodically refreshed from identity service. */
+export const IDENTITY_IDB_STORE_META_CACHE = 'identity-meta-cache';
+/** LOCAL keystone frames — genesis through current tip. */
+export const IDENTITY_IDB_STORE_LOCAL_CHAIN = 'identity-local-chain';
+/** APP-LOCAL keystone frames — current epoch genesis through tip. */
+export const IDENTITY_IDB_STORE_APP_LOCAL_CHAIN = 'identity-app-local-chain';
+
+// ===========================================================================
+// STALENESS POLICY DEFAULTS (milliseconds)
+// App-level policy: how old can a cached META chain be before re-fetch?
+// @see docs/identity/PARADIGM.md#staleness-policy
+// ===========================================================================
+
+/** Default max age for cached META chain for routine verification. */
+export const IDENTITY_META_CACHE_TTL_NORMAL_MS = 60 * 60 * 1000; // 1 hour
+/** For session establishment: always fetch fresh. */
+export const IDENTITY_META_CACHE_TTL_SESSION_MS = 0;
+/** For offline operation: no TTL (accept whatever is cached). */
+export const IDENTITY_META_CACHE_TTL_OFFLINE_MS = Infinity;

package/src/identity/identity-types.mts

@@ -0,0 +1,250 @@
+/**
+ * @file identity-types.mts
+ * @description Type definitions for the four-tier ibgib identity hierarchy.
+ *
+ * ## Tier Overview
+ * ```
+ * META keystone           → universal identity handle (cross-app, cross-device)
+ * └─ LOCAL keystone       → device/browser-profile-scoped identity
+ *    └─ APP-LOCAL keystone → app-scoped identity (one per app per browser profile)
+ *       └─ SESSION keystone → session-scoped (existing sync protocol)
+ * ```
+ *
+ * @see docs/identity/PARADIGM.md
+ * @see docs/identity/KEYSTONES.md
+ */
+
+import { IbGibAddr } from "@ibgib/ts-gib/dist/types.mjs";
+import { KeystoneData_V1, KeystoneIbGib_V1 } from "@ibgib/core-gib/dist/keystone/keystone-types.mjs";
+
+// ===========================================================================
+// KEYSTONE DATA EXTENSIONS — one per tier
+// ===========================================================================
+
+/**
+ * Data shape for the META keystone tier.
+ *
+ * The META keystone is the user's universal identity — stable across all apps,
+ * devices, and time. Its `tjpGib` is the user's permanent identity handle.
+ *
+ * @see docs/identity/KEYSTONES.md#meta-keystone
+ * @see docs/identity/PARADIGM.md#meta-keystone
+ */
+export interface MetaKeystoneData extends KeystoneData_V1 {
+    /**
+     * List of LOCAL keystone `tjpGib` values currently trusted by this identity.
+     *
+     * This is the **trust register** — an app verifies a user by finding the
+     * LOCAL keystone's tjpGib in this list from the current META frame.
+     *
+     * Mutated by: add-device evolution (append), remove-device evolution (remove).
+     *
+     * @see docs/identity/PARADIGM.md#cross-app-identity
+     */
+    trustedLocalTjpGibs: IbGibAddr[];
+
+    /**
+     * For custodial keystones: the publicly-visible nonce used by the custodian
+     * to re-derive `MasterSecret_user = KDF(server_secret, custodialNonce)`.
+     *
+     * No secrecy requirement — security comes from `server_secret` alone.
+     * Stored here so the custodian needs no separate mapping table.
+     *
+     * Undefined for sovereign (user-held) keystones.
+     *
+     * @see docs/identity/PARADIGM.md#custodianship--the-oauth2-path
+     * @see docs/identity/FLOWS.md#flow-2-first-login--custodial-path-oauth2
+     */
+    custodialNonce?: string;
+}
+
+/**
+ * Data shape for the LOCAL keystone tier.
+ *
+ * Device/browser-profile-scoped identity. Evolves offline. Lives in IndexedDB.
+ * One per browser profile per user.
+ *
+ * @see docs/identity/KEYSTONES.md#local-keystone
+ */
+export interface LocalKeystoneData extends KeystoneData_V1 {
+    /**
+     * Map of registered APP-LOCAL keystones on this browser profile.
+     *
+     * Key: `appId`
+     * Value: the **first epoch** APP-LOCAL keystone `tjpGib` for that app.
+     *
+     * Subsequent epochs are authenticated transitively through the APP-LOCAL
+     * epoch chain — the LOCAL keystone does NOT need to evolve for epoch rotation.
+     *
+     * Mutated by: add-app evolution (set), remove-app evolution (delete).
+     *
+     * @see docs/identity/PARADIGM.md#epoch-rotation-handling-keystone-growth
+     */
+    registeredAppLocals: Record<string, IbGibAddr>;
+}
+
+/**
+ * Data shape for the APP-LOCAL keystone tier.
+ *
+ * App-scoped identity for a specific browser profile + app combination.
+ * Evolves offline. Lives in IndexedDB (client) and app server (synced).
+ * One per app per browser profile per user.
+ *
+ * @see docs/identity/KEYSTONES.md#app-local-keystone
+ */
+export interface AppLocalKeystoneData extends KeystoneData_V1 {
+    /** The app identifier this APP-LOCAL belongs to. */
+    appId: string;
+
+    /**
+     * The LOCAL keystone `tjpGib` this APP-LOCAL is derived from.
+     * Used by verifiers to link APP-LOCAL trust back to LOCAL → META.
+     */
+    localTjpGib: IbGibAddr;
+
+    /**
+     * The META keystone `tjpGib` for this identity.
+     * Stored for reference/display. The authoritative trust chain is
+     * always verified by replaying META → LOCAL → APP-LOCAL.
+     */
+    metaTjpGib: IbGibAddr;
+
+    /**
+     * For epoch-chained APP-LOCAL keystones: the ibgib address of the
+     * **final frame** of the previous epoch. Establishes the transitive
+     * trust chain from the first epoch.
+     *
+     * Undefined for the first epoch (no prior epoch).
+     *
+     * @see docs/identity/PARADIGM.md#epoch-rotation-handling-keystone-growth
+     */
+    prevEpochFinalFrameAddr?: IbGibAddr;
+}
+
+// ===========================================================================
+// BROWSER LOCAL CONTEXT (IndexedDB)
+// ===========================================================================
+
+/**
+ * The browser-local identity context for a user on this browser profile.
+ * Stored in IndexedDB. Reconstructed from keystone chains if lost.
+ *
+ * @see docs/identity/FLOWS.md#flow-3-return-login--same-browser-profile
+ * @see docs/identity/PARTIES.md#party-app-client
+ */
+export interface LocalIdentityContext {
+    /** The user's universal identity handle. Used for cross-app identity. */
+    metaTjpGib: IbGibAddr;
+
+    /** URL of the identity service hosting the user's META keystone. */
+    identityServiceUrl: string;
+
+    /** This browser profile's LOCAL keystone `tjpGib`. */
+    localTjpGib: IbGibAddr;
+}
+
+/**
+ * Per-app identity context for a specific browser profile + app.
+ * Stored in IndexedDB by the app client.
+ *
+ * @see docs/identity/KEYSTONES.md#app-local-keystone
+ */
+export interface AppLocalIdentityContext {
+    /** The user's universal identity handle. */
+    metaTjpGib: IbGibAddr;
+
+    /** This browser profile's LOCAL keystone `tjpGib`. */
+    localTjpGib: IbGibAddr;
+
+    /**
+     * The **current** (possibly epoch-N) APP-LOCAL keystone `tjpGib`.
+     * Updated in-place after each epoch rotation.
+     */
+    appLocalTjpGib: IbGibAddr;
+
+    /** The app identifier. */
+    appId: string;
+}
+
+// ===========================================================================
+// IDENTITY SERVICE (Shared Space) INTERFACE
+// ===========================================================================
+
+/**
+ * The shared identity space — a write-verifying history store.
+ *
+ * NOT an authority. Verifies chain continuity on writes. Serves raw chain
+ * data on reads. Any party can independently verify the chain it returns.
+ *
+ * Initial deployment: hosted on the app's server. Federated by design.
+ *
+ * @see docs/identity/PARADIGM.md#the-shared-identity-space
+ * @see docs/identity/PARTIES.md#party-identity-service
+ */
+export interface IIdentityService {
+    /**
+     * POST a genesis frame — accepted unconditionally if internally valid.
+     * Genesis is self-legitimizing: Alice's identity IS her genesis frame.
+     *
+     * @returns the `tjpGib` (ibgib address of the genesis frame)
+     * @throws if the frame is internally invalid (malformed structure)
+     */
+    postGenesis(frame: KeystoneIbGib_V1): Promise<{ tjpGib: IbGibAddr }>;
+
+    /**
+     * POST an evolution frame.
+     * Verifies chain continuity: revealed solutions must hash-match prior
+     * frame's commitments. Implements CAS: rejects if prior frame is stale.
+     *
+     * @throws `IdentityServiceStaleTipError` if prior frame is no longer tip
+     * @throws `IdentityServiceChainError` if hash pre-images are invalid
+     */
+    postEvolution(frame: KeystoneIbGib_V1): Promise<void>;
+
+    /**
+     * GET the full keystone chain from genesis to current tip.
+     *
+     * Does NOT change state. Safe to call without coordination.
+     */
+    getChain(tjpGib: IbGibAddr): Promise<KeystoneIbGib_V1[]>;
+
+    /**
+     * GET the current tip frame for a keystone.
+     *
+     * Does NOT change state.
+     */
+    getTip(tjpGib: IbGibAddr): Promise<KeystoneIbGib_V1>;
+}
+
+// ===========================================================================
+// MASTERSECRET DERIVATION
+// ===========================================================================
+
+/**
+ * Inputs for deriving a tier-specific MasterSecret from a root passphrase.
+ *
+ * Each tier uses a different salt to ensure independent MasterSecrets
+ * even when the same passphrase is used for all tiers.
+ *
+ * @see docs/identity/KEYSTONES.md for per-tier salt conventions
+ * @see identity-helpers.mts for derivation functions
+ */
+export interface MasterSecretDerivationContext {
+    /** The root passphrase (sovereign path) or server secret (custodial path). */
+    passphrase: string;
+
+    /**
+     * Tier-specific salt (e.g., `IDENTITY_KDF_SALT_META`, `IDENTITY_KDF_SALT_LOCAL`).
+     * @see identity-constants.mts
+     */
+    salt: string;
+
+    /**
+     * Additional device-specific entropy for LOCAL and APP-LOCAL tiers.
+     * Generated once per browser profile and stored in IndexedDB.
+     */
+    deviceSalt?: string;
+
+    /** For APP-LOCAL tier: the app identifier, mixed into derivation. */
+    appId?: string;
+}

package/src/ui/ui-helpers.mts

@@ -2,8 +2,9 @@ import { delay, extractErrorMsg, } from "@ibgib/helper-gib/dist/helpers/utils-he
 
 import { GLOBAL_LOG_A_LOT } from "../constants.mjs";
 import { UIThemeInfo } from "./ui-types.mjs";
-import { storageGet } from "../storage/storage-helpers.web.mjs";
+import { storageGet, storagePut } from "../storage/storage-helpers.web.mjs";
 import { UI_THEME_INFO_KEY } from "./ui-constants.mjs";
+import type { getGlobalDbName, getGlobalStoreName } from "../helpers.web.mjs";
 
 const logalot = GLOBAL_LOG_A_LOT;
 
@@ -182,6 +183,18 @@ export async function showFullscreenDialog(opts: {
     }
 }
 
+/**
+ * Gets {@link UIThemeInfo} if it exists in the db ({@link dbName}) and store
+ * ({@link storeName}) at the given {@link key}.
+ *
+ * Used with libs\web-gib\src\api\commands\ui\update-css-variables.mts
+ *
+ * @see {@link putUIInfoInStore}
+ * @see {@link UI_THEME_INFO_KEY}
+ * @see {@link putUIInfoInStore}
+ * @see {@link getGlobalDbName}
+ * @see {@link getGlobalStoreName}
+ */
 export async function getExistingUIInfo({
     dbName,
     storeName,
@@ -220,3 +233,46 @@ export async function getExistingUIInfo({
         if (logalot) { console.log(`${lc} complete.`); }
     }
 }
+
+/**
+ * Complementing {@link getExistingUIInfo}, this puts {@link newUIInfo} in the
+ * db ({@link dbName}) and into the store ({@link storeName}) at the given
+ * {@link key}.
+ *
+ * Used with libs\web-gib\src\api\commands\ui\update-css-variables.mts
+ *
+ * @see {@link getExistingUIInfo}
+ * @see {@link UI_THEME_INFO_KEY}
+ * @see {@link putUIInfoInStore}
+ * @see {@link getGlobalDbName}
+ * @see {@link getGlobalStoreName}
+ */
+export async function putUIInfoInStore({
+    dbName,
+    storeName,
+    key = UI_THEME_INFO_KEY,
+    newUIInfo,
+}: {
+    dbName: string,
+    storeName: string,
+    key?: string,
+    newUIInfo: UIThemeInfo,
+}): Promise<void> {
+    const lc = `[${putUIInfoInStore.name}]`;
+    try {
+        if (logalot) { console.log(`${lc} starting... (I: 79c9ee707e426fd8c861c4ff4cf16826)`); }
+
+        await storagePut({
+            dbName,
+            storeName,
+            key,
+            value: JSON.stringify(newUIInfo),
+        });
+
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    } finally {
+        if (logalot) { console.log(`${lc} complete.`); }
+    }
+};

package/tools/auto-generated-agent-skills/skills/ibgib-create-app-core/SKILL.md

@@ -2,9 +2,9 @@
 name: ibgib-create-app-core
 description: >
   Scaffolds the foundational ibgib bootstrap flow and global state management.
-  Generates the 7 foundational files (index.html, index.mts, bootstrap.mts,
-  constants.mts, types.mts, helpers.web.mts, and style.css) required for an
-  ibgib app to boot. Supports both greenfield and brownfield projects.
+  Generates the 8 foundational files (index.html, index.mts, script.mts,
+  bootstrap.mts, constants.mts, types.mts, helpers.web.mts, and style.css)
+  required for an ibgib app to boot. Supports both greenfield and brownfield projects.
 ---
 
 # Skill: ibgib-create-app-core
@@ -62,13 +62,14 @@ Apply token substitutions to templates in `templates/` and write to the target d
 
 | Template file | Output file |
 |---|---|
-| `templates/index.html.template` | `index.html` |
-| `templates/index.mts.template` | `index.mts` |
-| `templates/bootstrap.mts.template` | `bootstrap.mts` |
-| `templates/constants.mts.template` | `constants.mts` |
-| `templates/types.mts.template` | `types.mts` |
-| `templates/helpers.web.mts.template` | `helpers.web.mts` |
-| `templates/style.css.template` | `style.css` (if missing) |
+| templates/index.html.template | `index.html` |
+| templates/index.mts.template | `index.mts` |
+| templates/script.mts.template | `script.mts` |
+| templates/bootstrap.mts.template | `bootstrap.mts` |
+| templates/constants.mts.template | `constants.mts` |
+| templates/types.mts.template | `types.mts` |
+| templates/helpers.web.mts.template | `helpers.web.mts` |
+| templates/style.css.template | `style.css` (if missing) |
 
 ### 3. Replace `genuuid` placeholders
 

package/tools/auto-generated-agent-skills/skills/ibgib-create-app-core/templates/constants.mts.template

@@ -1,7 +1,7 @@
 import { tagTextToIb } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { ZERO_SPACE_ID } from "@ibgib/core-gib/dist/witness/space/space-constants.mjs";
 
-import { IbGibAmbientContextConfig } from "./types.mjs";
+import { IbGibAmbientContextConfig } from "@ibgib/web-gib/dist/app-bootstrap/types.mjs";
 
 // ---------------------------------------------------------------------------
 // Logging / debug

package/tools/auto-generated-agent-skills/skills/ibgib-create-app-core/templates/helpers.web.mts.template

@@ -18,11 +18,11 @@ import { delay } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 
 import { GLOBAL_LOG_A_LOT } from "./constants.mjs";
 import { AUTO_GENERATED_VERSION } from "./AUTO-GENERATED-version.mjs";
-import {
+import { IbGibGlobalThis_{{APP_CLASSNAME_PREFIX}} } from "./types.mjs";
+import { 
     IbGibAmbientContextConfig,
-    IbGibGlobalThis_{{APP_CLASSNAME_PREFIX}},
     IbGibGlobalThis_Common,
-} from "./types.mjs";
+} from "@ibgib/web-gib/dist/app-bootstrap/types.mjs";
 
 const logalot = GLOBAL_LOG_A_LOT;
 

package/tools/auto-generated-agent-skills/skills/ibgib-create-app-core/templates/index.html.template

@@ -12,6 +12,7 @@
   <meta name="ibgib-app-id" content="{{APP_UUID}}" />
   <title>{{APP_HUMAN_NAME}}</title>
   <link rel="stylesheet" type="text/css" href="style.css">
+  <script type="module" src="script.mjs" defer></script>
   <script type="module" src="index.mjs" defer></script>
 </head>
 

package/tools/auto-generated-agent-skills/skills/ibgib-create-app-core/templates/index.mts.template

@@ -20,7 +20,7 @@ const logalot = GLOBAL_LOG_A_LOT;
  * Sequence:
  *   1. Init IndexedDB storage
  *   2. (Optional) trigger shell / router
- *   3. Dynamically import bootstrap.mts — the heavy ibgib graph loads here
+ *   3. Dynamically import bootstrap.mjs — the heavy ibgib graph loads here
  */
 async function spinOffStartup(): Promise<void> {
     const lc = `[${spinOffStartup.name}]`;

package/tools/auto-generated-agent-skills/skills/ibgib-create-app-core/templates/script.mts.template

@@ -0,0 +1,17 @@
+/**
+ * script.mts
+ *
+ * Early initialization script for the {{APP_HUMAN_NAME}} app.
+ *
+ * This script is intended to run as soon as the HTML document is parsed,
+ * allowing UI Shell logic (like menus and panels) to be interactive
+ * immediately, without waiting for the heavier ibgib engine bootstrap.
+ */
+
+// import { get{{APP_CLASSNAME_PREFIX}}ShellSvc } from "./ui/shell/{{APP_DIR_NAME}}-shell-service.mjs";
+
+// Early init of UI Shell logic so the burger menu responds immediately.
+// Modules execute after the HTML document has been parsed, so elements are ready.
+// get{{APP_CLASSNAME_PREFIX}}ShellSvc();
+
+console.log('{{APP_HUMAN_NAME}} early script executing...');

package/tools/auto-generated-agent-skills/skills/ibgib-create-app-core/templates/types.mts.template

@@ -1,118 +1,4 @@
-import { CommentData_V1 } from "@ibgib/core-gib/dist/common/comment/comment-types.mjs";
-import { MetaspaceService } from "@ibgib/core-gib/dist/witness/space/metaspace/metaspace-types.mjs";
-import { RCLIArgInfo } from "@ibgib/helper-gib/dist/rcli/rcli-types.mjs";
-import { IbGibRel8ns_V1, IbGib_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
-import { LiveProxyIbGib } from "@ibgib/web-gib/dist/witness/live-proxy-ibgib/live-proxy-ibgib-one-file.mjs";
-import { IbGibGlobalThisInfo } from "@ibgib/web-gib/dist/types.mjs";
-
-// ---------------------------------------------------------------------------
-// App-level ambient context config
-// ---------------------------------------------------------------------------
-
-/**
- * Configuration for the application's global state and storage substrates.
- */
-export interface IbGibAmbientContextConfig {
-    /** Target IndexedDB database name */
-    dbName: string;
-    /** Primary object store name */
-    storeName: string;
-    /** Additional stores that need to be initialized (e.g., zero space ID) */
-    additionalStoreNames?: string[];
-    /** The IndexedDB key under which the AI API key is persisted */
-    apiKeyName: string;
-}
-
-// ---------------------------------------------------------------------------
-// Bootstrap request comment (RCLI plumbing)
-// ---------------------------------------------------------------------------
-
-export interface RequestCommentData_V1 extends CommentData_V1 {
-    args: string[];
-    interpretedArgInfos: RCLIArgInfo[];
-}
-
-export interface RequestCommentRel8ns_V1 extends IbGibRel8ns_V1 {}
-
-/**
- * Special Comment that acts as a "request" — the command analog from RCLI.
- */
-export interface RequestCommentIbGib_V1
-    extends IbGib_V1<RequestCommentData_V1, RequestCommentRel8ns_V1> {
-    oneOff: boolean;
-}
-
-// ---------------------------------------------------------------------------
-// Space shim (RCLI pathing compat)
-// ---------------------------------------------------------------------------
-
-export interface SpaceShimGlobalInfo {
-    initialCwd: string;
-    cwd: string;
-}
-
-// ---------------------------------------------------------------------------
-// Identity (optional — only populate if the app uses identity)
-// ---------------------------------------------------------------------------
-
-/**
- * Framework-level identity interface.
- *
- * ## notes
- *
- * The implementation is entirely consumer-supplied. The framework only defines
- * the shape of the slot so that shells and components can react to auth state
- * without being coupled to a specific identity mechanism.
- *
- * For ibgib apps, the typical implementation will be keystone-based (a
- * Merkle DAG proof of identity), not token-based.
- */
-export interface IbGibIdentityContext {
-    /** Whether identity resolution has completed (does not imply authenticated). */
-    resolved: boolean;
-    /** Whether the user has a verified identity in this session. */
-    authenticated: boolean;
-    /**
-     * App-specific identity payload.
-     * For ibgib: typically includes keystoneAddr, userIbGibAddr, etc.
-     */
-    data?: Record<string, any>;
-}
-
-// ---------------------------------------------------------------------------
-// GlobalThis state
-// ---------------------------------------------------------------------------
-
-/**
- * Base layer: fields shared across ALL ibgib web apps.
- *
- * NOTE: This is a superset of IbGibGlobalThisInfo from @ibgib/web-gib.
- * Intended to be upstreamed eventually.
- */
-export interface IbGibGlobalThis_Common extends IbGibGlobalThisInfo {
-    bootstrapStarted?: boolean;
-    bootstrapPromise?: Promise<void>;
-    chronologysComponent?: any;
-}
-
-/**
- * Mid-layer: fields shared by any app that uses the ibgib App witness pattern.
- *
- * NOTE: Intended to be upstreamed into @ibgib/web-gib as IbGibGlobalThis_IbGibApp.
- */
-export interface IbGibGlobalThis_IbGibApp extends IbGibGlobalThis_Common {
-    version?: string;
-    spaceShim: { [spaceId: string]: SpaceShimGlobalInfo };
-    verbose?: boolean;
-    fnDefaultGetAPIKey: () => Promise<string>;
-    initialCommentIbGib?: IbGib_V1;
-    initialCommentIbGibProxy?: LiveProxyIbGib;
-    /**
-     * Optional. Populated by the consumer's resolveIdentity() callback.
-     * Undefined = identity not configured. Null = unresolved/unauthenticated.
-     */
-    identity?: IbGibIdentityContext | null;
-}
+import { IbGibGlobalThis_IbGibApp } from "@ibgib/web-gib/dist/app-bootstrap/types.mjs";
 
 // ---------------------------------------------------------------------------
 // App-specific globalThis — add only what this app uniquely needs below

package/tools/auto-generated-agent-skills/skills/ibgib-create-app-witness/templates/witness/app/app-v1.mts.template

@@ -17,7 +17,7 @@ import {
     isRequestComment,
 } from './{{APP_DIR_NAME}}-helper.mjs';
 import { PARAM_INFO_INTERACTIVE, {{APP_CLASSNAME_PREFIX}}Command } from './{{APP_DIR_NAME}}-constants.mjs';
-import { RequestCommentData_V1, RequestCommentIbGib_V1 } from '../../../types.mjs';
+import { RequestCommentData_V1, RequestCommentIbGib_V1 } from "@ibgib/web-gib/dist/app-bootstrap/types.mjs";
 
 const logalot = GLOBAL_LOG_A_LOT;
 

package/tools/auto-generated-agent-skills/skills/ibgib-create-app-witness/templates/witness/app/helper.mts.template

@@ -7,7 +7,7 @@ import { TransformResult } from '@ibgib/ts-gib/dist/types.mjs';
 import { isComment } from '@ibgib/core-gib/dist/common/comment/comment-helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
 
-import { RequestCommentData_V1, RequestCommentIbGib_V1 } from '../../../types.mjs';
+import { RequestCommentData_V1, RequestCommentIbGib_V1 } from "@ibgib/web-gib/dist/app-bootstrap/types.mjs";
 
 /**
  * Validates that no duplicate parameter identifiers exist in the config.