@ibgib/web-gib 0.0.55 → 0.0.57

package/src/identity/sso/{sso-custodian-service.mts → sso-custodian-service.mts.bak}

@@ -1,20 +1,17 @@
 import { createPublicKey, verify } from 'node:crypto';
+
 import { hash, HashAlgorithm, extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { kdf_recursiveSaltWrap } from '@ibgib/core-gib/dist/keystone/kdf/kdf-helpers.mjs';
 import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
-import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
-import { KeystoneIbGib_V1, KeystoneChallengePool, KeystonePoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
-import { POOL_ID_CUSTODIAN_MANAGE, KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE, POOL_ID_MANAGE, KEYSTONE_POOL_ID_REGEXP } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
-import { createStandardPoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
+import { KeystoneChallengePool, KeystonePoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE, POOL_ID_MANAGE, KEYSTONE_POOL_ID_REGEXP } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
 import { generateOpaqueChallengeId } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
 import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs';
 import { MetaspaceService } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-types.mjs';
 import { IbGibSpaceAny } from '@ibgib/core-gib/dist/witness/space/space-base-v1.mjs';
-import { 
-    SsoServerConfig, 
-    SsoProviderId, 
-    OAuthUserInfo, 
-    SsoProviderServerConfig,
+
+import {
+    SsoServerConfig, SsoProviderId, OAuthUserInfo, SsoProviderServerConfig,
     SsoProviderClientConfig
 } from './sso-types.mjs';
 
@@ -37,7 +34,7 @@ interface JwksResponse {
  */
 export class SsoCustodianService {
     private lc = `[${SsoCustodianService.name}]`;
-    
+
     // In-memory cache for JSON Web Key Sets (JWKS) per provider
     private jwksCache: Map<SsoProviderId, { keys: JwkKey[]; expiresAt: number }> = new Map();
     private jwksTtlMs = 24 * 60 * 60 * 1000; // Cache certs for 24 hours
@@ -47,19 +44,19 @@ export class SsoCustodianService {
      *   - Visibility: Private (Contains high-entropy secrets like `ssoServerKdfSecret` and `sessionSecret`).
      *   - Generator: Server (Bootstrapped from node environment variables on server initialization).
      */
-    constructor(private config: SsoServerConfig) {}
+    constructor(private config: SsoServerConfig) { }
 
     /**
      * Exchanges an authorization code for an OAuth2 token and retrieves normalized user info.
-     * 
+     *
      * @param providerId The string identifier of the OAuth provider (e.g. 'google' or 'github').
      *   - Visibility: Public (Non-sensitive metadata string).
      *   - Generator: Client (Sent from browser UI selection).
-     * 
+     *
      * @param code The temporary authorization code returned by the OAuth provider.
      *   - Visibility: Private (Confidential short-lived bearer credential. Must be kept private).
      *   - Generator: Provider (Created by provider's OAuth page and sent to client redirect URI).
-     * 
+     *
      * @param redirectUri The redirect URI registered in the provider portal.
      *   - Visibility: Public (Configuration URL).
      *   - Generator: Client/Server (Derived from environmental configuration and sent by client).
@@ -97,7 +94,7 @@ export class SsoCustodianService {
     /**
      * Directly validates a Google ID Token (JWT) locally and returns normalized user info.
      * Useful for client-side authentication handshakes.
-     * 
+     *
      * @param idToken The raw base64-encoded signed JSON Web Token (JWT) ID token returned by Google.
      *   - Visibility: Private (Sensitive bearer credential containing signature and claims. Must be kept private).
      *   - Generator: Provider (Generated and signed cryptographically by Google authentication servers).
@@ -125,6 +122,10 @@ export class SsoCustodianService {
             throw new Error(`Google JWT is missing subject claim ('sub'). (E: s28900abfefd23e89cfa1f89)`);
         }
 
+        if (payload.email && payload.email_verified !== true && (payload.email_verified as any) !== 'true') {
+            throw new Error(`Google email is not verified: ${payload.email}. (E: v28900abfefd23e89cfb2f90)`);
+        }
+
         return {
             providerKey: `google:${payload.sub}`,
             providerId: 'google',
@@ -137,22 +138,22 @@ export class SsoCustodianService {
 
     /**
      * Internal: Exchange authorization code for access token / ID token.
-     * 
+     *
      * @param providerConfig Server configuration settings for the specific provider.
      *   - Visibility: Private (Contains provider client secrets. Must stay server-side).
      *   - Generator: Server (Configured from node environment variables).
-     * 
+     *
      * @param code The temporary authorization code to exchange.
      *   - Visibility: Private (Short-lived credential. Must be kept private).
      *   - Generator: Provider (Via OAuth flow).
-     * 
+     *
      * @param redirectUri The redirect URI registered for the exchange.
      *   - Visibility: Public (Configuration URL).
      *   - Generator: Client/Server (From app configuration).
      */
     private async exchangeCodeForTokens(
-        providerConfig: SsoProviderServerConfig, 
-        code: string, 
+        providerConfig: SsoProviderServerConfig,
+        code: string,
         redirectUri: string
     ): Promise<any> {
         const body = new URLSearchParams({
@@ -188,17 +189,17 @@ export class SsoCustodianService {
 
     /**
      * Internal: Fetch GitHub user profile and normalize.
-     * 
+     *
      * @param providerConfig Server configuration settings for GitHub.
      *   - Visibility: Private (Contains GitHub client secret).
      *   - Generator: Server (From environment config).
-     * 
+     *
      * @param accessToken The active OAuth2 access token to authorize the API call.
      *   - Visibility: Private (Bearer token. Must be kept private).
      *   - Generator: Provider (GitHub token endpoint).
      */
     private async fetchAndNormalizeGithubUser(
-        providerConfig: SsoProviderServerConfig, 
+        providerConfig: SsoProviderServerConfig,
         accessToken: string
     ): Promise<OAuthUserInfo> {
         const res = await fetch(providerConfig.userInfoUrl, {
@@ -214,18 +215,44 @@ export class SsoCustodianService {
         }
 
         const rawUser = await res.json();
-        
+
         if (!rawUser.id) {
             throw new Error(`GitHub user info response missing 'id' field.`);
         }
 
         const sub = String(rawUser.id);
+        let email = rawUser.email || undefined;
+
+        // If email is missing or private, fetch /user/emails to extract primary verified email
+        if (!email) {
+            try {
+                const emailsRes = await fetch('https://api.github.com/user/emails', {
+                    headers: {
+                        'Authorization': `Bearer ${accessToken}`,
+                        'User-Agent': 'space-gib-auth-agent'
+                    }
+                });
+                if (emailsRes.ok) {
+                    const emailsList: any[] = await emailsRes.json();
+                    const primaryVerified = emailsList.find((e: any) => e.verified && e.primary) || emailsList.find((e: any) => e.verified);
+                    if (primaryVerified?.email) {
+                        email = primaryVerified.email;
+                    }
+                }
+            } catch (err) {
+                console.warn(`[${this.fetchAndNormalizeGithubUser.name}] Could not fetch GitHub /user/emails fallback: ${extractErrorMsg(err)}`);
+            }
+        }
+
+        if (!email) {
+            throw new Error(`Your GitHub account does not have a verified primary email address. Please verify your primary email on GitHub and try again. (E: e28900abfefd23e89cfc3f01)`);
+        }
 
         return {
             providerKey: `github:${sub}`,
             providerId: 'github',
             sub,
-            email: rawUser.email || undefined,
+            email,
             name: rawUser.name || rawUser.login || undefined,
             picture: rawUser.avatar_url || undefined
         };
@@ -233,11 +260,11 @@ export class SsoCustodianService {
 
     /**
      * Internal: Decodes and cryptographically verifies a JWT signature using JWKS public keys.
-     * 
+     *
      * @param token The raw base64-encoded JWT token to verify.
      *   - Visibility: Private (Sensitive token. Must be kept private).
      *   - Generator: Provider (Google / OIDC server).
-     * 
+     *
      * @param providerConfig The target provider server settings containing `jwksUrl`.
      *   - Visibility: Private (Contains secrets).
      *   - Generator: Server (From environment config).
@@ -299,7 +326,7 @@ export class SsoCustodianService {
 
     /**
      * Internal: Retrieves JWKS keys from cache or fetches them from the provider's jwksUrl.
-     * 
+     *
      * @param providerConfig The provider config containing the target `jwksUrl`.
      *   - Visibility: Private (Contains client secrets).
      *   - Generator: Server (From environment config).
@@ -307,7 +334,7 @@ export class SsoCustodianService {
     private async getJwksKeys(providerConfig: SsoProviderServerConfig): Promise<JwkKey[]> {
         const providerId = providerConfig.providerId;
         const cached = this.jwksCache.get(providerId);
-        
+
         if (cached && cached.expiresAt > Date.now()) {
             return cached.keys;
         }
@@ -337,11 +364,11 @@ export class SsoCustodianService {
     /**
      * Derives a server-delegate master secret deterministically using the server's private KDF secret,
      * the providerKey, and the user's public nonce.
-     * 
+     *
      * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
      *   - Visibility: Public (Identifier saved on parent's delegate claim, safe for log/ledger storage).
      *   - Generator: Provider/Server (Derived by mapping provider user sub ID after authentication).
-     * 
+     *
      * @param userNonce The public, high-entropy nonce generated by the client to salt the KDF derivation.
      *   - Visibility: Public (Salt value stored on parent's delegate claim, safe for ledger storage).
      *   - Generator: Client (Generated offline on user's device).
@@ -362,11 +389,11 @@ export class SsoCustodianService {
     /**
      * Creates a public custodian challenge pool (custodian-manage) derived deterministically
      * from the server's private KDF secret, providerKey, and userNonce.
-     * 
+     *
      * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
      *   - Visibility: Public (Mapped identifier, safe for ledger).
      *   - Generator: Provider/Server (Derived after successful token exchange).
-     * 
+     *
      * @param userNonce The public, high-entropy nonce.
      *   - Visibility: Public (Derivation salt, safe for ledger).
      *   - Generator: Client (Generated on user's device).
@@ -412,7 +439,7 @@ export class SsoCustodianService {
 
         // 4. Derive delegate secrets
         const custodianSecret = await this.deriveServerDelegateSecret(providerKey, userNonce);
-        
+
         const poolSalt = await hash({
             s: `${providerKey}:${userNonce}:salt`,
             algorithm: HashAlgorithm.sha_256
@@ -460,14 +487,14 @@ export class SsoCustodianService {
 
     /**
      * Maps private server configuration to safe public client configurations.
-     * 
+     *
      * @param hostUrl The root URL host address of the server (e.g. `https://space-gib.localhost` or `https://ibgib.space`).
      *   - Visibility: Public (Non-sensitive hostname configuration).
      *   - Generator: Server (Extracted from the HTTP request context headers/protocol).
      */
     getSsoClientConfigs(hostUrl: string): SsoProviderClientConfig[] {
         const configs: SsoProviderClientConfig[] = [];
-        
+
         if (this.config.providers.google) {
             configs.push({
                 providerId: 'google',
@@ -477,7 +504,7 @@ export class SsoCustodianService {
                 scope: 'openid email profile'
             });
         }
-        
+
         if (this.config.providers.github) {
             configs.push({
                 providerId: 'github',
@@ -487,7 +514,7 @@ export class SsoCustodianService {
                 scope: 'read:user user:email'
             });
         }
-        
+
         return configs;
     }
 

package/src/identity/sso/{sso-custodian-service.respec.mts → sso-custodian-service.respec.mts.bak}

@@ -1,10 +1,11 @@
 import { generateKeyPairSync, createSign } from 'node:crypto';
-import { 
-    respecfully, 
-    ifWeMight, 
-    iReckon, 
-    firstOfAll, 
-    lastOfAll 
+import {
+    respecfully,
+    ifWeMight,
+    iReckon,
+    firstOfAll,
+    lastOfAll,
+    ifWe
 } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
 import { SsoCustodianService } from './sso-custodian-service.mjs';
 import { SsoServerConfig } from './sso-types.mjs';
@@ -24,7 +25,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
             modulusLength: 2048
         });
         mockPrivateKey = privateKey;
-        
+
         // Export public key as JWK
         mockPublicKeyJwk = publicKey.export({ format: 'jwk' });
         mockPublicKeyJwk.kid = 'mock-kid-123';
@@ -58,7 +59,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         }
     });
 
-    await ifWeMight(sir, 'verify dynamic RSA RS256 JWT signature successfully', async () => {
+    await ifWe(sir, 'verify dynamic RSA RS256 JWT signature successfully', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'mock-kdf-secret',
             sessionSecret: 'mock-session-secret',
@@ -106,7 +107,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         iReckon(sir, decodedPayload.name).isGonnaBe('John Doe');
     });
 
-    await ifWeMight(sir, 'fail validation if JWT has invalid signature', async () => {
+    await ifWe(sir, 'fail validation if JWT has invalid signature', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'mock-kdf-secret',
             sessionSecret: 'mock-session-secret',
@@ -154,7 +155,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         iReckon(sir, verifyError.message).includes('Cryptographic signature verification failed');
     });
 
-    await ifWeMight(sir, 'derive server-delegate secret deterministically', async () => {
+    await ifWe(sir, 'derive server-delegate secret deterministically', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
             sessionSecret: 'session-secret-123',
@@ -179,7 +180,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         iReckon(sir, secret1_a.length).isGonnaBe(128); // sha512 output in hex/base64 wrap
     });
 
-    await ifWeMight(sir, 'create custodian challenge pool successfully', async () => {
+    await ifWe(sir, 'create custodian challenge pool successfully', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
             sessionSecret: 'session-secret-123',
@@ -234,16 +235,16 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         iReckon(sir, custodianPool.id).willEqual('custodian-manage-google');
         iReckon(sir, custodianPool.isForeign).isGonnaBeTrue();
         iReckon(sir, custodianPool.metadata?.providerKey).willEqual(key);
-        
+
         // Replicated behavior size from parent manage pool config
         iReckon(sir, custodianPool.config.behavior.size).willEqual(userManageConfig.behavior.size);
-        
+
         // Structural validation of challenges
         const challengesCount = Object.keys(custodianPool.challenges).length;
         iReckon(sir, challengesCount).willEqual(custodianPool.config.behavior.size);
     });
 
-    await ifWeMight(sir, 'revoke tokens successfully, making the correct http fetch calls', async () => {
+    await ifWe(sir, 'revoke tokens successfully, making the correct http fetch calls', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
             sessionSecret: 'session-secret-123',

package/src/ui/component/identity/add-device/add-device.html

@@ -1,16 +1,15 @@
 <div id="container" class="component-container">
-    <h2 id="title">Add New Device (Pairing)</h2>
+    <h2 id="title">Sign In New Device</h2>
     <div class="content">
-        <p>Pair this device to your existing primary identity timeline.</p>
+        <p>Sign in on this device to add it to an existing account.</p>
 
         <div class="input-group">
-            <label for="input-identifier">Username or Email</label>
-            <input type="text" id="input-identifier" placeholder="Enter registered username or email..."
-                class="text-input">
+            <label for="input-identifier">Email</label>
+            <input type="text" id="input-identifier" placeholder="Enter registered email..." class="text-input">
         </div>
 
         <div class="input-group">
-            <label for="input-device-tag">Device Tag / Name *</label>
+            <label for="input-device-tag">Device Name</label>
             <input type="text" id="input-device-tag" placeholder="e.g. laptop, phone, living-room..."
                 class="text-input">
         </div>
@@ -29,7 +28,7 @@
         </div>
 
         <div class="action-row">
-            <button id="btn-add-device" class="action-btn">Pair & Add Device</button>
+            <button id="btn-add-device" class="action-btn">Sign In</button>
         </div>
 
         <div class="switch-workflow" style="margin-top: 1.2rem; text-align: center; font-size: 0.9rem; color: #a6adc8;">

package/src/ui/component/identity/add-device/add-device.mts

@@ -2,30 +2,29 @@ import thisCss from "./add-device.css";
 import thisHtml from "./add-device.html";
 import commonComponentStylesCss from "../../common-component-styles.css";
 
-import { delay, extractErrorMsg, getUUID } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { delay, extractErrorMsg, } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 import { IbGibAddr } from "@ibgib/ts-gib/dist/types.mjs";
 import { IbGib_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
 import { getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
-import { getGibInfo } from "@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs";
 import { KeystoneService_V1 } from "@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs";
 import { KeystoneProfileBuilder } from "@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs";
 import { KeystoneIbGib_V1 } from "@ibgib/core-gib/dist/keystone/keystone-types.mjs";
 import { KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT, KEYSTONE_USERNAME_REGEXP } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
 import { deriveDelegateSecret } from "@ibgib/core-gib/dist/keystone/strategy/hash-reveal-v1/hash-reveal-v1.mjs";
-import { getTimelinesGroupedByTjp, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
+import { getTimelinesGroupedByTjp, getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
-import { getApiBridge } from "../../../../api/ibgib-api-bridge.mjs";
 
+import { getApiBridge } from "../../../../api/ibgib-api-bridge.mjs";
 import { getGlobalMetaspace_waitIfNeeded } from "../../../../helpers.mjs";
-import {
-    IbGibDynamicComponentMetaBase, IbGibFormInstanceBase,
-} from "../../ibgib-dynamic-component-bases.mjs";
+import { IbGibDynamicComponentMetaBase, IbGibFormInstanceBase, } from "../../ibgib-dynamic-component-bases.mjs";
 import {
     ElementsBase, IbGibDynamicComponentInstance,
     IbGibDynamicComponentInstanceInitOpts,
 } from "../../component-types.mjs";
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
-import { EVENT_IBGIB_IDENTITY_REQUEST_CHANGE, EVENT_IBGIB_UI_MESSAGE } from "../../../ui-constants.mjs";
+import {
+    EVENT_IBGIB_IDENTITY_REQUEST_CHANGE, EVENT_IBGIB_UI_MESSAGE
+} from "../../../ui-constants.mjs";
 
 export const ADD_DEVICE_COMPONENT_NAME = 'ibgib-add-device';
 
@@ -162,7 +161,7 @@ export class AddDeviceComponentInstance
             this.elements!.inputIdentifier.value = identifier;
             if (!identifier) {
                 this.elements!.inputIdentifier.classList.add('invalid');
-                this.setStatus("Please enter a registered username or email.", "error");
+                this.setStatus("Please enter a registered email.", "error");
                 return;
             }
 
@@ -170,7 +169,7 @@ export class AddDeviceComponentInstance
             this.elements!.inputDeviceTag.value = deviceTag;
             if (!deviceTag || !KEYSTONE_USERNAME_REGEXP.test(deviceTag)) {
                 this.elements!.inputDeviceTag.classList.add('invalid');
-                this.setStatus("Please enter a valid Device Tag / Name (e.g. 'work-laptop').", "error");
+                this.setStatus("Please enter a valid Device Name (e.g. 'work-laptop').", "error");
                 return;
             }
 
@@ -194,7 +193,6 @@ export class AddDeviceComponentInstance
             const space = await metaspace.getLocalUserSpace({});
             if (!space) { throw new Error("No default space found in metaspace."); }
 
-            const keystoneService = new KeystoneService_V1();
 
             // 1a. First attempt to locate primary identity keystone locally in space
             const keystonesIndex = await metaspace.getSpecialIbGib({
@@ -225,7 +223,7 @@ export class AddDeviceComponentInstance
                 if (resLookup.success && resLookup.primaryKeystoneIbGib) {
                     const fetchedKeystone = resLookup.primaryKeystoneIbGib as KeystoneIbGib_V1;
                     const domainAddr = resLookup.tjpAddr || getIbGibAddr({ ibGib: fetchedKeystone });
-                    
+
                     // Fetch full domain graph from server so local space has all historical keystone frames
                     const resGraph = await getApiBridge().getKeystoneGraph(domainAddr);
                     if (resGraph.success && resGraph.graph) {
@@ -276,6 +274,8 @@ export class AddDeviceComponentInstance
                 animationEmoji: '🔑'
             });
 
+            const primaryTjpAddr = getTjpAddr({ ibGib: primaryKeystone, defaultIfNone: 'incomingAddr' });
+            if (!primaryTjpAddr) { throw new Error(`(UNEXPECTED) primaryTjpAddr falsy? couldn't get tjpAddr from primaryKeystone? (E: bc8cc8678e1ce4194ab02646160fde26)`); }
             const delegateSecret = await deriveDelegateSecret({ masterSecret });
             const delegateBuilder = KeystoneProfileBuilder.buildKeystone('sync')
                 .withUsername(`${primaryUsername}-sync-${deviceTag}`)
@@ -283,10 +283,12 @@ export class AddDeviceComponentInstance
                 .withDetails({
                     client: 'space-gib-web',
                     role: 'sync-delegate',
-                    deviceTag
+                    deviceTag,
+                    primaryTjpAddr,
                 });
             const delegateConfigs = await delegateBuilder.compileConfigs();
 
+            const keystoneService = new KeystoneService_V1();
             const delegateKeystone = await keystoneService.genesis({
                 masterSecret: delegateSecret,
                 configs: delegateConfigs,
@@ -331,11 +333,10 @@ export class AddDeviceComponentInstance
                 animationEmoji: '🔄'
             });
 
-            const primaryTjpAddr = getGibInfo({ ibGibAddr: getIbGibAddr({ ibGib: primaryKeystone }) }).tjpGib;
-            const domainAddr = primaryTjpAddr ? getIbGibAddr({ ibGib: primaryKeystone }) : getIbGibAddr({ ibGib: primaryKeystone });
+            // const domainAddr = primaryTjpAddr ? getIbGibAddr({ ibGib: primaryKeystone }) : getIbGibAddr({ ibGib: primaryKeystone });
 
             const resEvolve = await getApiBridge().putEvolveKeystone({
-                domainAddr,
+                domainAddr: primaryTjpAddr,
                 keystoneIbGib: evolvedPrimaryKeystone,
                 relatedKeystoneIbGibs: [delegateKeystone]
             });

package/src/ui/component/identity/keystone-creator/keystone-creator.css

@@ -94,4 +94,23 @@ h2 {
     font-size: 0.8rem;
     color: var(--clr-warn, #f38ba8);
     margin: 0.5rem 0 0;
+}
+
+input::placeholder {
+    color: rgba(255, 255, 255, 0.35);
+    opacity: 1;
+}
+
+.section-code-verification {
+    margin-top: 1.5rem;
+    padding: 1.25rem;
+    border: 2px dashed #f59e0b;
+    background: rgba(245, 158, 11, 0.05);
+    box-shadow: 0 0 15px rgba(245, 158, 11, 0.2);
+    border-radius: 12px;
+    transition: all 0.3s ease;
+}
+
+.section-code-verification.hidden {
+    display: none;
 }

package/src/ui/component/identity/keystone-creator/keystone-creator.html

@@ -41,6 +41,16 @@
             <p id="status-text" class="status-msg"></p>
         </div>
 
+        <div id="section-code-verification" class="input-group hidden" style="margin-top: 1.5rem; padding: 1rem; border: 1px dashed #89b4fa; border-radius: 8px; background: rgba(137, 180, 250, 0.05);">
+            <label for="input-verify-code" style="font-weight: bold; color: #89b4fa;">✉️ Enter 6-Digit Email Verification Code</label>
+            <p style="font-size: 0.82rem; color: #a6adc8; margin-top: 0.25rem; margin-bottom: 0.75rem;">A 6-digit verification code was sent to your email. Enter it below to activate your identity:</p>
+            <div style="display: flex; gap: 0.5rem; flex-wrap: wrap; align-items: center;">
+                <input type="text" id="input-verify-code" maxlength="6" placeholder="123456" class="text-input" style="font-family: monospace; font-size: 1.2rem; letter-spacing: 4px; text-align: center; max-width: 160px;">
+                <button id="btn-submit-code" class="action-btn" style="white-space: nowrap;">Verify Code</button>
+                <button id="btn-resend-code" class="action-btn" style="white-space: nowrap; background: #45475a; color: #cdd6f4;">Resend Code</button>
+            </div>
+        </div>
+
         <div id="result-area" class="result-area collapsed">
             <h3>New Keystone Generated!</h3>
             <p class="address-label">Address:</p>