@ibgib/web-gib 0.0.60 → 0.0.62

package/dist/identity/device-delegate-helper.mjs

@@ -0,0 +1,190 @@
+/**
+ * @module identity/device-delegate-helper
+ *
+ * Client-side helper functions for deriving, retrieving, persisting, and clearing local
+ * cryptographic device delegate signing tokens ($S_D$) in IndexedDB.
+ *
+ * Applicable symmetrically to Sovereign, Custodial, and Hybrid identities.
+ */
+import { extractErrorMsg, getSaferSubstring } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { deriveDeviceDelegateSecret, deriveDelegateSecret, createSyncDelegateKeystone } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
+import { generateDefaultDeviceTag } from "../util/device-helper.mjs";
+import { storageGet, storagePut, storageDelete } from "../storage/storage-helpers.web.mjs";
+import { getGlobalDbName, getGlobalStoreName } from "../helpers.web.mjs";
+export { generateDefaultDeviceTag };
+export const DEVICE_DELEGATE_SECRET_PREFIX = 'ibgib_device_delegate_secret_';
+/**
+ * Builds the IndexedDB storage key for a device delegate secret given its primary identity TJP address.
+ */
+export function getDeviceDelegateSecretKey({ primaryTjpAddr }) {
+    if (!primaryTjpAddr) {
+        throw new Error('primaryTjpAddr is required to get device delegate secret key (E: 1a2b3c4d5e6f7890123456789a000101)');
+    }
+    return `${DEVICE_DELEGATE_SECRET_PREFIX}${primaryTjpAddr}`;
+}
+/**
+ * Retrieves the stored device delegate secret for the given primary identity from IndexedDB, if present.
+ */
+export async function getDeviceDelegateSecret({ primaryTjpAddr, }) {
+    const lc = `[${getDeviceDelegateSecret.name}]`;
+    try {
+        if (!primaryTjpAddr) {
+            throw new Error('primaryTjpAddr is required to get device delegate secret (E: 2a2b3c4d5e6f7890123456789a000102)');
+        }
+        const dbName = getGlobalDbName();
+        const storeName = getGlobalStoreName();
+        const key = getDeviceDelegateSecretKey({ primaryTjpAddr });
+        return await storageGet({ dbName, storeName, key });
+    }
+    catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+}
+/**
+ * Persists a device delegate secret for the given primary identity into IndexedDB.
+ */
+export async function setDeviceDelegateSecret({ primaryTjpAddr, delegateSecret, }) {
+    const lc = `[${setDeviceDelegateSecret.name}]`;
+    try {
+        if (!primaryTjpAddr) {
+            throw new Error('primaryTjpAddr is required to set device delegate secret (E: 3a2b3c4d5e6f7890123456789a000103)');
+        }
+        if (!delegateSecret) {
+            throw new Error('delegateSecret is required to set device delegate secret (E: 4a2b3c4d5e6f7890123456789a000104)');
+        }
+        const dbName = getGlobalDbName();
+        const storeName = getGlobalStoreName();
+        const key = getDeviceDelegateSecretKey({ primaryTjpAddr });
+        await storagePut({ dbName, storeName, key, value: delegateSecret });
+    }
+    catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+}
+/**
+ * Retrieves an existing device delegate secret from IndexedDB, or generates a high-entropy 512-bit
+ * secret, persists it, and returns it.
+ */
+export async function getOrCreateDeviceDelegateSecret({ primaryTjpAddr, deviceTag, }) {
+    const lc = `[${getOrCreateDeviceDelegateSecret.name}]`;
+    try {
+        if (!primaryTjpAddr) {
+            throw new Error('primaryTjpAddr is required to get or create device delegate secret (E: 5a2b3c4d5e6f7890123456789a000105)');
+        }
+        const existingSecret = await getDeviceDelegateSecret({ primaryTjpAddr });
+        if (existingSecret) {
+            return existingSecret;
+        }
+        const newSecret = await deriveDeviceDelegateSecret({ primaryTjpAddr, deviceTag });
+        await setDeviceDelegateSecret({ primaryTjpAddr, delegateSecret: newSecret });
+        return newSecret;
+    }
+    catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+}
+/**
+ * Removes the stored local device delegate secret from IndexedDB.
+ */
+export async function clearDeviceDelegateSecret({ primaryTjpAddr, }) {
+    const lc = `[${clearDeviceDelegateSecret.name}]`;
+    try {
+        if (!primaryTjpAddr) {
+            return;
+        }
+        const dbName = getGlobalDbName();
+        const storeName = getGlobalStoreName();
+        const key = getDeviceDelegateSecretKey({ primaryTjpAddr });
+        await storageDelete({ dbName, storeName, key });
+    }
+    catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+}
+/**
+ * Creates a Sovereign Password-based sync delegate for this device.
+ * Standardized format: `pwd-${safeUsername}-${defaultDeviceTag}`
+ */
+export async function createSovereignDeviceSyncDelegate({ username, primaryTjpAddr, masterSecret, metaspace, space, }) {
+    const delegateSecret = await deriveDelegateSecret({ masterSecret });
+    await setDeviceDelegateSecret({ primaryTjpAddr, delegateSecret });
+    const safeUser = getSaferSubstring({ text: username, length: 8, keepLiterals: ['-'] }) || 'user';
+    const defaultDeviceTag = generateDefaultDeviceTag();
+    const deviceTag = `pwd-${safeUser}-${defaultDeviceTag}`;
+    const sovereignSyncProfileName = process.env.KEYSTONE_PROFILE_SOVEREIGN_SYNC;
+    if (!sovereignSyncProfileName || !sovereignSyncProfileName.trim()) {
+        throw new Error('KEYSTONE_PROFILE_SOVEREIGN_SYNC environment variable is missing.');
+    }
+    const delegateKeystone = await createSyncDelegateKeystone({
+        profileName: sovereignSyncProfileName.trim(),
+        username,
+        deviceTag,
+        primaryTjpAddr,
+        delegateSecret,
+        additionalFrameDetails: { client: 'space-gib-web' },
+        metaspace,
+        space,
+    });
+    return { delegateKeystone, deviceTag, delegateSecret };
+}
+/**
+ * Creates an OAuth2 Custodial sync delegate for this device.
+ * Standardized format: `oauth2-${providerId}-${defaultDeviceTag}`
+ */
+export async function createOAuth2DeviceSyncDelegate({ providerId, username = 'user', primaryTjpAddr, custodianReqs, metaspace, space, }) {
+    const delegateSecret = await getOrCreateDeviceDelegateSecret({ primaryTjpAddr });
+    const defaultDeviceTag = generateDefaultDeviceTag();
+    const deviceTag = `oauth2-${providerId}-${defaultDeviceTag}`;
+    const custodianSyncProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_SYNC;
+    if (!custodianSyncProfileName || !custodianSyncProfileName.trim()) {
+        throw new Error('KEYSTONE_PROFILE_CUSTODIAN_SYNC environment variable is missing.');
+    }
+    const delegateKeystone = await createSyncDelegateKeystone({
+        profileName: custodianSyncProfileName.trim(),
+        username,
+        deviceTag,
+        primaryTjpAddr,
+        delegateSecret,
+        custodianReqs,
+        additionalFrameDetails: { client: 'space-gib-web' },
+        metaspace,
+        space,
+    });
+    return { delegateKeystone, deviceTag, delegateSecret };
+}
+/**
+ * Creates an Email Custodial sync delegate for this device.
+ * Standardized format: `email-${safeUser}@${safeDomain}-${defaultDeviceTag}`
+ */
+export async function createEmailDeviceSyncDelegate({ email, primaryTjpAddr, custodianReqs, metaspace, space, }) {
+    const delegateSecret = await getOrCreateDeviceDelegateSecret({ primaryTjpAddr });
+    const defaultDeviceTag = generateDefaultDeviceTag();
+    const [emailUser = '', emailDomain = ''] = (email || '').split('@');
+    const safeUser = getSaferSubstring({ text: emailUser, length: 8, keepLiterals: ['-'] }) || 'user';
+    const domainPart = emailDomain.split('.')[0] || '';
+    const safeDomain = domainPart ? getSaferSubstring({ text: domainPart, length: 8, keepLiterals: ['-'] }) : '';
+    const emailTag = safeDomain ? `${safeUser}@${safeDomain}` : safeUser;
+    const deviceTag = `email-${emailTag}-${defaultDeviceTag}`;
+    const username = safeUser;
+    const custodianSyncProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_SYNC;
+    if (!custodianSyncProfileName || !custodianSyncProfileName.trim()) {
+        throw new Error('KEYSTONE_PROFILE_CUSTODIAN_SYNC environment variable is missing.');
+    }
+    const delegateKeystone = await createSyncDelegateKeystone({
+        profileName: custodianSyncProfileName.trim(),
+        username,
+        deviceTag,
+        primaryTjpAddr,
+        delegateSecret,
+        custodianReqs,
+        additionalFrameDetails: { client: 'space-gib-web' },
+        metaspace,
+        space,
+    });
+    return { delegateKeystone, deviceTag, delegateSecret };
+}
+//# sourceMappingURL=device-delegate-helper.mjs.map

package/dist/identity/device-delegate-helper.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-delegate-helper.mjs","sourceRoot":"","sources":["../../src/identity/device-delegate-helper.mts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACrG,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAC3J,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAE7E;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAE,cAAc,EAA8B;IACrF,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,GAAG,6BAA6B,GAAG,cAAc,EAAE,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC1C,cAAc,GAGjB;IACG,MAAM,EAAE,GAAG,IAAI,uBAAuB,CAAC,IAAI,GAAG,CAAC;IAC/C,IAAI,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACtH,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,0BAA0B,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAE3D,OAAO,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC1C,cAAc,EACd,cAAc,GAIjB;IACG,MAAM,EAAE,GAAG,IAAI,uBAAuB,CAAC,IAAI,GAAG,CAAC;IAC/C,IAAI,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACtH,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,0BAA0B,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAE3D,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EAClD,cAAc,EACd,SAAS,GAIZ;IACG,MAAM,EAAE,GAAG,IAAI,+BAA+B,CAAC,IAAI,GAAG,CAAC;IACvD,IAAI,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;QAChI,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QACzE,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QAC1B,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,MAAM,uBAAuB,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAE7E,OAAO,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC5C,cAAc,GAGjB;IACG,MAAM,EAAE,GAAG,IAAI,yBAAyB,CAAC,IAAI,GAAG,CAAC;IACjD,IAAI,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,0BAA0B,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAE3D,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,EACpD,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,SAAS,EACT,KAAK,GAOR;IACG,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IACpE,MAAM,uBAAuB,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;IACjG,MAAM,gBAAgB,GAAG,wBAAwB,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,QAAQ,IAAI,gBAAgB,EAAE,CAAC;IACxD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAC7E,IAAI,CAAC,wBAAwB,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC;QACtD,WAAW,EAAE,wBAAwB,CAAC,IAAI,EAAS;QACnD,QAAQ;QACR,SAAS;QACT,cAAc;QACd,cAAc;QACd,sBAAsB,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;QACnD,SAAS;QACT,KAAK;KACR,CAAC,CAAC;IAEH,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACjD,UAAU,EACV,QAAQ,GAAG,MAAM,EACjB,cAAc,EACd,aAAa,EACb,SAAS,EACT,KAAK,GAQR;IACG,MAAM,cAAc,GAAG,MAAM,+BAA+B,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IACjF,MAAM,gBAAgB,GAAG,wBAAwB,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,UAAU,IAAI,gBAAgB,EAAE,CAAC;IAC7D,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAC7E,IAAI,CAAC,wBAAwB,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC;QACtD,WAAW,EAAE,wBAAwB,CAAC,IAAI,EAAS;QACnD,QAAQ;QACR,SAAS;QACT,cAAc;QACd,cAAc;QACd,aAAa;QACb,sBAAsB,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;QACnD,SAAS;QACT,KAAK;KACR,CAAC,CAAC;IAEH,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAChD,KAAK,EACL,cAAc,EACd,aAAa,EACb,SAAS,EACT,KAAK,GAOR;IACG,MAAM,cAAc,GAAG,MAAM,+BAA+B,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IACjF,MAAM,gBAAgB,GAAG,wBAAwB,EAAE,CAAC;IACpD,MAAM,CAAC,SAAS,GAAG,EAAE,EAAE,WAAW,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;IAClG,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7G,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,MAAM,SAAS,GAAG,SAAS,QAAQ,IAAI,gBAAgB,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC1B,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAC7E,IAAI,CAAC,wBAAwB,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC;QACtD,WAAW,EAAE,wBAAwB,CAAC,IAAI,EAAS;QACnD,QAAQ;QACR,SAAS;QACT,cAAc;QACd,cAAc;QACd,aAAa;QACb,sBAAsB,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;QACnD,SAAS;QACT,KAAK;KACR,CAAC,CAAC;IAEH,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAC3D,CAAC"}

package/dist/identity/device-delegate.respec.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-delegate.respec.d.mts.map

package/dist/identity/device-delegate.respec.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-delegate.respec.d.mts","sourceRoot":"","sources":["../../src/identity/device-delegate.respec.mts"],"names":[],"mappings":""}

package/dist/identity/device-delegate.respec.mjs

@@ -0,0 +1,106 @@
+import { respecfully, ifWe, iReckon } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+import { getIbGibGlobalThis_IbGib } from '../helpers.mjs';
+import { getDeviceDelegateSecretKey, getDeviceDelegateSecret, setDeviceDelegateSecret, getOrCreateDeviceDelegateSecret, clearDeviceDelegateSecret, DEVICE_DELEGATE_SECRET_PREFIX } from './device-delegate-helper.mjs';
+const sir = `[${import.meta.url}]`;
+// Initialize global db & store names for tests
+const globalThisIbGib = getIbGibGlobalThis_IbGib();
+globalThisIbGib.dbName_hack = 'space_gib_db';
+globalThisIbGib.storeName_hack = 'space_gib_store';
+// Mock storage substrate for Node test environment
+const inMemoryStore = new Map();
+if (typeof globalThis.indexedDB === 'undefined') {
+    globalThis.indexedDB = {
+        open: (dbName) => {
+            const req = {};
+            setTimeout(() => {
+                const db = {
+                    objectStoreNames: { contains: () => true },
+                    transaction: (storeName) => ({
+                        objectStore: (sName) => ({
+                            get: (key) => {
+                                const getReq = {};
+                                setTimeout(() => {
+                                    const val = inMemoryStore.get(key);
+                                    getReq.result = val !== undefined ? { value: val } : undefined;
+                                    if (getReq.onsuccess)
+                                        getReq.onsuccess({ target: getReq });
+                                }, 0);
+                                return getReq;
+                            },
+                            put: (datum) => {
+                                const putReq = {};
+                                setTimeout(() => {
+                                    inMemoryStore.set(datum.key, datum.value);
+                                    if (putReq.onsuccess)
+                                        putReq.onsuccess({ target: putReq });
+                                }, 0);
+                                return putReq;
+                            },
+                            delete: (key) => {
+                                const delReq = {};
+                                setTimeout(() => {
+                                    inMemoryStore.delete(key);
+                                    if (delReq.onsuccess)
+                                        delReq.onsuccess({ target: delReq });
+                                }, 0);
+                                return delReq;
+                            }
+                        })
+                    }),
+                    close: () => { }
+                };
+                req.result = db;
+                if (req.onsuccess)
+                    req.onsuccess({ target: req });
+            }, 0);
+            return req;
+        }
+    };
+}
+await respecfully(sir, 'Device Delegate Storage & Secret Lifecycle', async () => {
+    await ifWe(sir, 'getDeviceDelegateSecretKey constructs deterministic storage key', async () => {
+        const primaryTjpAddr = 'keystone^alice_tjp_12345';
+        const key = getDeviceDelegateSecretKey({ primaryTjpAddr });
+        iReckon(sir, key).willEqual(`${DEVICE_DELEGATE_SECRET_PREFIX}${primaryTjpAddr}`);
+    });
+    await ifWe(sir, 'setDeviceDelegateSecret and getDeviceDelegateSecret persist and retrieve secret', async () => {
+        const primaryTjpAddr = 'keystone^bob_tjp_999';
+        const secret = 'super-secret-512-token-abc';
+        await setDeviceDelegateSecret({ primaryTjpAddr, delegateSecret: secret });
+        const retrieved = await getDeviceDelegateSecret({ primaryTjpAddr });
+        iReckon(sir, retrieved).willEqual(secret);
+    });
+    await ifWe(sir, 'getOrCreateDeviceDelegateSecret generates high entropy token on first call and caches it', async () => {
+        const primaryTjpAddr = 'keystone^charlie_tjp_888';
+        const token1 = await getOrCreateDeviceDelegateSecret({ primaryTjpAddr, deviceTag: 'laptop' });
+        iReckon(sir, typeof token1 === 'string' && token1.length === 128).willEqual(true);
+        const token2 = await getOrCreateDeviceDelegateSecret({ primaryTjpAddr, deviceTag: 'laptop' });
+        iReckon(sir, token1).willEqual(token2);
+    });
+    await ifWe(sir, 'clearDeviceDelegateSecret removes stored secret', async () => {
+        const primaryTjpAddr = 'keystone^david_tjp_777';
+        await getOrCreateDeviceDelegateSecret({ primaryTjpAddr });
+        const beforeClear = await getDeviceDelegateSecret({ primaryTjpAddr });
+        iReckon(sir, !!beforeClear).willEqual(true);
+        await clearDeviceDelegateSecret({ primaryTjpAddr });
+        const afterClear = await getDeviceDelegateSecret({ primaryTjpAddr });
+        iReckon(sir, afterClear).willEqual(undefined);
+    });
+    await ifWe(sir, 'fails fast when global db or store name is uninitialized', async () => {
+        const primaryTjpAddr = 'keystone^failfast_tjp_000';
+        const savedDb = globalThisIbGib.dbName_hack;
+        globalThisIbGib.dbName_hack = undefined;
+        let threw = false;
+        try {
+            await getDeviceDelegateSecret({ primaryTjpAddr });
+        }
+        catch (error) {
+            threw = true;
+        }
+        finally {
+            globalThisIbGib.dbName_hack = savedDb;
+        }
+        iReckon(sir, threw).willEqual(true);
+    });
+});
+//# sourceMappingURL=device-delegate.respec.mjs.map

package/dist/identity/device-delegate.respec.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-delegate.respec.mjs","sourceRoot":"","sources":["../../src/identity/device-delegate.respec.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAa,OAAO,EAAE,MAAM,kDAAkD,CAAC;AACzG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACH,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,yBAAyB,EACzB,6BAA6B,EAChC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,GAAG,GAAG,IAAI,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC;AAEnC,+CAA+C;AAC/C,MAAM,eAAe,GAAG,wBAAwB,EAAE,CAAC;AACnD,eAAe,CAAC,WAAW,GAAG,cAAc,CAAC;AAC7C,eAAe,CAAC,cAAc,GAAG,iBAAiB,CAAC;AAEnD,mDAAmD;AACnD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;IAC7C,UAAkB,CAAC,SAAS,GAAG;QAC5B,IAAI,EAAE,CAAC,MAAc,EAAE,EAAE;YACrB,MAAM,GAAG,GAAQ,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,EAAE;gBACZ,MAAM,EAAE,GAAG;oBACP,gBAAgB,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;oBAC1C,WAAW,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC;wBACjC,WAAW,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC;4BAC7B,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE;gCACjB,MAAM,MAAM,GAAQ,EAAE,CAAC;gCACvB,UAAU,CAAC,GAAG,EAAE;oCACZ,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oCACnC,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;oCAC/D,IAAI,MAAM,CAAC,SAAS;wCAAE,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gCAC/D,CAAC,EAAE,CAAC,CAAC,CAAC;gCACN,OAAO,MAAM,CAAC;4BAClB,CAAC;4BACD,GAAG,EAAE,CAAC,KAAU,EAAE,EAAE;gCAChB,MAAM,MAAM,GAAQ,EAAE,CAAC;gCACvB,UAAU,CAAC,GAAG,EAAE;oCACZ,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;oCAC1C,IAAI,MAAM,CAAC,SAAS;wCAAE,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gCAC/D,CAAC,EAAE,CAAC,CAAC,CAAC;gCACN,OAAO,MAAM,CAAC;4BAClB,CAAC;4BACD,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;gCACpB,MAAM,MAAM,GAAQ,EAAE,CAAC;gCACvB,UAAU,CAAC,GAAG,EAAE;oCACZ,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oCAC1B,IAAI,MAAM,CAAC,SAAS;wCAAE,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gCAC/D,CAAC,EAAE,CAAC,CAAC,CAAC;gCACN,OAAO,MAAM,CAAC;4BAClB,CAAC;yBACJ,CAAC;qBACL,CAAC;oBACF,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;iBAClB,CAAC;gBACF,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,GAAG,CAAC,SAAS;oBAAE,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,OAAO,GAAG,CAAC;QACf,CAAC;KACJ,CAAC;AACN,CAAC;AAED,MAAM,WAAW,CAAC,GAAG,EAAE,4CAA4C,EAAE,KAAK,IAAI,EAAE;IAE5E,MAAM,IAAI,CAAC,GAAG,EAAE,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,cAAc,GAAG,0BAA0B,CAAC;QAClD,MAAM,GAAG,GAAG,0BAA0B,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAE3D,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,6BAA6B,GAAG,cAAc,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,GAAG,EAAE,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,cAAc,GAAG,sBAAsB,CAAC;QAC9C,MAAM,MAAM,GAAG,4BAA4B,CAAC;QAE5C,MAAM,uBAAuB,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAEpE,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,GAAG,EAAE,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACnH,MAAM,cAAc,GAAG,0BAA0B,CAAC;QAElD,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,GAAG,EAAE,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,cAAc,GAAG,wBAAwB,CAAC;QAEhD,MAAM,+BAA+B,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,yBAAyB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,GAAG,EAAE,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,cAAc,GAAG,2BAA2B,CAAC;QACnD,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC;QAC5C,eAAe,CAAC,WAAW,GAAG,SAAgB,CAAC;QAE/C,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACD,MAAM,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,KAAK,GAAG,IAAI,CAAC;QACjB,CAAC;gBAAS,CAAC;YACP,eAAe,CAAC,WAAW,GAAG,OAAO,CAAC;QAC1C,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/identity/keystone-sync-service.d.mts

@@ -15,6 +15,24 @@ export interface KeystoneUpdateCheckResult {
 export declare class KeystoneSyncService {
     protected lc: string;
     private dispatchUpdateAvailableEvent;
+    private dispatchRenewalRequiredEvent;
+    /**
+     * Retrieves the stored device delegate secret ($S_D$) for an active primary identity from IndexedDB.
+     */
+    getDeviceDelegateSecret({ primaryTjpAddr }: {
+        primaryTjpAddr: string;
+    }): Promise<string | undefined>;
+    /**
+     * Checks if the active identity has a valid, unexpired sync delegate on this device.
+     */
+    checkDelegateStatus({ activePrimaryAddr, metaspace, space }: {
+        activePrimaryAddr: string;
+        metaspace?: any;
+        space?: any;
+    }): Promise<{
+        isValid: boolean;
+        reason?: 'expired' | 'missing_secret';
+    }>;
     /**
      * Checks if a server update exists for the given active primary keystone address.
      */

package/dist/identity/keystone-sync-service.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-sync-service.d.mts","sourceRoot":"","sources":["../../src/identity/keystone-sync-service.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AAQpF,MAAM,WAAW,yBAAyB;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,EAAE,EAAE,MAAM,CAA2B;IAE/C,OAAO,CAAC,4BAA4B;IAUpC;;OAEG;IACU,sBAAsB,CAAC,EAChC,iBAAiB,EACjB,SAAS,EACT,KAAK,EACR,EAAE;QACC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,GAAG,CAAC;QAChB,KAAK,CAAC,EAAE,GAAG,CAAC;KACf,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAqHrC;IAED;;;OAGG;IACU,oBAAoB,CAAC,EAC9B,iBAAiB,EACjB,SAAS,EACT,KAAK,EACR,EAAE;QACC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,GAAG,CAAC;QAChB,KAAK,CAAC,EAAE,GAAG,CAAC;KACf,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAiExC;CACJ;AAID,wBAAgB,sBAAsB,IAAI,mBAAmB,CAK5D"}
+{"version":3,"file":"keystone-sync-service.d.mts","sourceRoot":"","sources":["../../src/identity/keystone-sync-service.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AAWpF,MAAM,WAAW,yBAAyB;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,qBAAa,mBAAmB;IAC5B,SAAS,CAAC,EAAE,EAAE,MAAM,CAA2B;IAE/C,OAAO,CAAC,4BAA4B;IAUpC,OAAO,CAAC,4BAA4B;IAUpC;;OAEG;IACU,uBAAuB,CAAC,EACjC,cAAc,EACjB,EAAE;QACC,cAAc,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE9B;IAED;;OAEG;IACU,mBAAmB,CAAC,EAC7B,iBAAiB,EACjB,SAAS,EACT,KAAK,EACR,EAAE;QACC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,GAAG,CAAC;QAChB,KAAK,CAAC,EAAE,GAAG,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAAA;KAAE,CAAC,CAwDvE;IAED;;OAEG;IACU,sBAAsB,CAAC,EAChC,iBAAiB,EACjB,SAAS,EACT,KAAK,EACR,EAAE;QACC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,GAAG,CAAC;QAChB,KAAK,CAAC,EAAE,GAAG,CAAC;KACf,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAqHrC;IAED;;;OAGG;IACU,oBAAoB,CAAC,EAC9B,iBAAiB,EACjB,SAAS,EACT,KAAK,EACR,EAAE;QACC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,GAAG,CAAC;QAChB,KAAK,CAAC,EAAE,GAAG,CAAC;KACf,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAiExC;CACJ;AAID,wBAAgB,sBAAsB,IAAI,mBAAmB,CAK5D"}

package/dist/identity/keystone-sync-service.mjs

@@ -7,11 +7,14 @@
 import { extractErrorMsg } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 import { getIbAndGib, getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
 import { getGibInfo } from "@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs";
+import { KeystoneService_V1 } from "@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs";
 import { getTimelinesGroupedByTjp, getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
+import { isDelegateExpired } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
 import { getApiBridge } from "../api/ibgib-api-bridge.mjs";
 import { getGlobalMetaspace_waitIfNeeded } from "../helpers.mjs";
-import { EVENT_IBGIB_IDENTITY_UPDATE_AVAILABLE } from "../ui/ui-constants.mjs";
+import { getDeviceDelegateSecret } from "./device-delegate-helper.mjs";
+import { EVENT_IBGIB_IDENTITY_UPDATE_AVAILABLE, EVENT_IBGIB_IDENTITY_RENEWAL_REQUIRED } from "../ui/ui-constants.mjs";
 export class KeystoneSyncService {
     lc = `[KeystoneSyncService]`;
     dispatchUpdateAvailableEvent(detail) {
@@ -23,6 +26,79 @@ export class KeystoneSyncService {
             }));
         }
     }
+    dispatchRenewalRequiredEvent(detail) {
+        if (typeof window !== 'undefined') {
+            window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_RENEWAL_REQUIRED, {
+                detail,
+                bubbles: true,
+                composed: true,
+            }));
+        }
+    }
+    /**
+     * Retrieves the stored device delegate secret ($S_D$) for an active primary identity from IndexedDB.
+     */
+    async getDeviceDelegateSecret({ primaryTjpAddr }) {
+        return getDeviceDelegateSecret({ primaryTjpAddr });
+    }
+    /**
+     * Checks if the active identity has a valid, unexpired sync delegate on this device.
+     */
+    async checkDelegateStatus({ activePrimaryAddr, metaspace, space }) {
+        const lc = `${this.lc}[${this.checkDelegateStatus.name}]`;
+        try {
+            if (!metaspace)
+                metaspace = await getGlobalMetaspace_waitIfNeeded();
+            if (!metaspace) {
+                throw new Error(`${lc} (UNEXPECTED) metaspace falsy? (E: a1b2c3d4e5f60718293a4b5c6d7e8f90)`);
+            }
+            if (!space)
+                space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) {
+                throw new Error(`${lc} (UNEXPECTED) space falsy? (E: b2c3d4e5f60718293a4b5c6d7e8f90a1)`);
+            }
+            const info = getGibInfo({ ibGibAddr: activePrimaryAddr });
+            const { ib } = getIbAndGib({ ibGibAddr: activePrimaryAddr });
+            const primaryTjpAddr = info.tjpGib ? `${ib}^${info.tjpGib}` : activePrimaryAddr;
+            // 1. Check if local secret exists in IndexedDB
+            const secret = await getDeviceDelegateSecret({ primaryTjpAddr });
+            if (!secret) {
+                this.dispatchRenewalRequiredEvent({
+                    activePrimaryAddr,
+                    primaryTjpAddr,
+                    reason: 'missing_secret'
+                });
+                return { isValid: false, reason: 'missing_secret' };
+            }
+            // 2. Check if primary keystone has registered delegates and if any are expired
+            const keystoneService = new KeystoneService_V1();
+            const keystone = await keystoneService.getLatestKeystone({
+                addr: activePrimaryAddr,
+                metaspace,
+                space
+            });
+            if (!keystone) {
+                throw new Error(`${lc} (UNEXPECTED) latest primary keystone not found for addr: ${activePrimaryAddr} (E: c3d4e5f60718293a4b5c6d7e8f90a1b2)`);
+            }
+            if (keystone?.data?.delegates) {
+                const delegates = Object.values(keystone.data.delegates);
+                const isAnyExpired = delegates.some(d => isDelegateExpired({ delegateInfo: d }));
+                if (isAnyExpired) {
+                    this.dispatchRenewalRequiredEvent({
+                        activePrimaryAddr,
+                        primaryTjpAddr,
+                        reason: 'expired'
+                    });
+                    return { isValid: false, reason: 'expired' };
+                }
+            }
+            return { isValid: true };
+        }
+        catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            return { isValid: false };
+        }
+    }
     /**
      * Checks if a server update exists for the given active primary keystone address.
      */

package/dist/identity/keystone-sync-service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"keystone-sync-service.mjs","sourceRoot":"","sources":["../../src/identity/keystone-sync-service.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,uDAAuD,CAAC;AAEnF,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,oDAAoD,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAW/E,MAAM,OAAO,mBAAmB;IAClB,EAAE,GAAW,uBAAuB,CAAC;IAEvC,4BAA4B,CAAC,MAA+C;QAChF,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,qCAAqC,EAAE;gBACxE,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI;aACjB,CAAC,CAAC,CAAC;QACR,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,EAChC,iBAAiB,EACjB,SAAS,EACT,KAAK,EAKR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,GAAG,CAAC;QAC7D,IAAI,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,SAAS,GAAG,MAAM,+BAA+B,EAAE,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvD,CAAC;YAED,yCAAyC;YACzC,MAAM,eAAe,GAAG,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACjH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClF,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAsB;gBAC1C,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAExC,0GAA0G;YAC1G,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC7E,MAAM,aAAa,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC;YAClG,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAEtE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACvC,MAAM,GAAG,GAA8B;oBACnC,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,MAAM;oBACf,MAAM;oBACN,gBAAgB,EAAE,eAAe;oBACjC,KAAK,EAAE,EAAE;iBACZ,CAAC;gBACF,IAAI,CAAC,4BAA4B,CAAC;oBAC9B,iBAAiB;oBACjB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;iBACzC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACf,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAyC,CAAC;YACjE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEzC,4DAA4D;YAC5D,MAAM,YAAY,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACvE,gFAAgF;YAChF,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE1I,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAA8B;oBACnC,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,MAAM;oBACf,MAAM;oBACN,gBAAgB,EAAE,eAAe;oBACjC,KAAK;iBACR,CAAC;gBACF,IAAI,CAAC,4BAA4B,CAAC;oBAC9B,iBAAiB;oBACjB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;iBACzC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACf,CAAC;YAED,wCAAwC;YACxC,MAAM,oBAAoB,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrG,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAqB,CAAC;YACpG,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,gBAAgB,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAEpE,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;YAEnC,MAAM,GAAG,GAA8B;gBACnC,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,gBAAgB;gBAChB,KAAK;aACR,CAAC;YACF,IAAI,CAAC,4BAA4B,CAAC;gBAC9B,iBAAiB;gBACjB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;aACzC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,GAAG,GAA8B;gBACnC,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,CAAC;gBACT,gBAAgB,EAAE,iBAAiB;gBACnC,KAAK,EAAE,EAAE;aACZ,CAAC;YACF,IAAI,CAAC,4BAA4B,CAAC;gBAC9B,iBAAiB;gBACjB,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,CAAC;gBACT,gBAAgB,EAAE,iBAAiB;aACtC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACf,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,oBAAoB,CAAC,EAC9B,iBAAiB,EACjB,SAAS,EACT,KAAK,EAKR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC;QAC3D,IAAI,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,SAAS,GAAG,MAAM,+BAA+B,EAAE,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAE9F,IAAI,UAAU,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACpD,kCAAkC;gBAClC,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEpD,sDAAsD;gBACtD,MAAM,YAAY,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACvE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;oBACtC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBACzB,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC9D,CAAC;gBACL,CAAC;gBAED,mCAAmC;gBACnC,MAAM,SAAS,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,IAAI,iBAAiB,CAAC;gBAC3F,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChI,MAAM,YAAY,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7F,MAAM,kBAAkB,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAqB,CAAC;gBAErF,IAAI,kBAAkB,EAAE,CAAC;oBACrB,+BAA+B;oBAC/B,MAAM,kBAAkB,CAAC;wBACrB,IAAI,EAAE,WAAW;wBACjB,UAAU,EAAE,CAAC;gCACT,SAAS,EAAE,UAAU;gCACrB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;6BACjD,CAAC;wBACF,SAAS;wBACT,KAAK;qBACR,CAAC,CAAC;oBACH,OAAO,kBAAkB,CAAC;gBAC9B,CAAC;YACL,CAAC;YAED,4DAA4D;YAC5D,MAAM,eAAe,GAAG,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACjH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAqB,CAAC;YAClD,CAAC;YACD,OAAO,SAAS,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,IAAI,gBAAiD,CAAC;AAEtD,MAAM,UAAU,sBAAsB;IAClC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,IAAI,mBAAmB,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"keystone-sync-service.mjs","sourceRoot":"","sources":["../../src/identity/keystone-sync-service.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,uDAAuD,CAAC;AAEnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,oDAAoD,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qCAAqC,EAAE,qCAAqC,EAAE,MAAM,wBAAwB,CAAC;AAWtH,MAAM,OAAO,mBAAmB;IAClB,EAAE,GAAW,uBAAuB,CAAC;IAEvC,4BAA4B,CAAC,MAA+C;QAChF,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,qCAAqC,EAAE;gBACxE,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI;aACjB,CAAC,CAAC,CAAC;QACR,CAAC;IACL,CAAC;IAEO,4BAA4B,CAAC,MAA+C;QAChF,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,qCAAqC,EAAE;gBACxE,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI;aACjB,CAAC,CAAC,CAAC;QACR,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,uBAAuB,CAAC,EACjC,cAAc,EAGjB;QACG,OAAO,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB,CAAC,EAC7B,iBAAiB,EACjB,SAAS,EACT,KAAK,EAKR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC;QAC1D,IAAI,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,SAAS,GAAG,MAAM,+BAA+B,EAAE,CAAC;YACpE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,sEAAsE,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,kEAAkE,CAAC,CAAC;YAC7F,CAAC;YAED,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC1D,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAEhF,+CAA+C;YAC/C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,IAAI,CAAC,4BAA4B,CAAC;oBAC9B,iBAAiB;oBACjB,cAAc;oBACd,MAAM,EAAE,gBAAgB;iBAC3B,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YACxD,CAAC;YAED,+EAA+E;YAC/E,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC;gBACrD,IAAI,EAAE,iBAAiB;gBACvB,SAAS;gBACT,KAAK;aACR,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,6DAA6D,iBAAiB,wCAAwC,CAAC,CAAC;YACjJ,CAAC;YAED,IAAI,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzD,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjF,IAAI,YAAY,EAAE,CAAC;oBACf,IAAI,CAAC,4BAA4B,CAAC;wBAC9B,iBAAiB;wBACjB,cAAc;wBACd,MAAM,EAAE,SAAS;qBACpB,CAAC,CAAC;oBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACjD,CAAC;YACL,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,EAChC,iBAAiB,EACjB,SAAS,EACT,KAAK,EAKR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,GAAG,CAAC;QAC7D,IAAI,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,SAAS,GAAG,MAAM,+BAA+B,EAAE,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvD,CAAC;YAED,yCAAyC;YACzC,MAAM,eAAe,GAAG,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACjH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClF,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAsB;gBAC1C,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAExC,0GAA0G;YAC1G,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC7E,MAAM,aAAa,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC;YAClG,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAEtE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACvC,MAAM,GAAG,GAA8B;oBACnC,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,MAAM;oBACf,MAAM;oBACN,gBAAgB,EAAE,eAAe;oBACjC,KAAK,EAAE,EAAE;iBACZ,CAAC;gBACF,IAAI,CAAC,4BAA4B,CAAC;oBAC9B,iBAAiB;oBACjB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;iBACzC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACf,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAyC,CAAC;YACjE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEzC,4DAA4D;YAC5D,MAAM,YAAY,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACvE,gFAAgF;YAChF,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE1I,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAA8B;oBACnC,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,MAAM;oBACf,MAAM;oBACN,gBAAgB,EAAE,eAAe;oBACjC,KAAK;iBACR,CAAC;gBACF,IAAI,CAAC,4BAA4B,CAAC;oBAC9B,iBAAiB;oBACjB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;iBACzC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACf,CAAC;YAED,wCAAwC;YACxC,MAAM,oBAAoB,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrG,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAqB,CAAC;YACpG,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,gBAAgB,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAEpE,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;YAEnC,MAAM,GAAG,GAA8B;gBACnC,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,gBAAgB;gBAChB,KAAK;aACR,CAAC;YACF,IAAI,CAAC,4BAA4B,CAAC;gBAC9B,iBAAiB;gBACjB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;aACzC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,GAAG,GAA8B;gBACnC,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,CAAC;gBACT,gBAAgB,EAAE,iBAAiB;gBACnC,KAAK,EAAE,EAAE;aACZ,CAAC;YACF,IAAI,CAAC,4BAA4B,CAAC;gBAC9B,iBAAiB;gBACjB,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,CAAC;gBACT,gBAAgB,EAAE,iBAAiB;aACtC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACf,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,oBAAoB,CAAC,EAC9B,iBAAiB,EACjB,SAAS,EACT,KAAK,EAKR;QACG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC;QAC3D,IAAI,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,SAAS,GAAG,MAAM,+BAA+B,EAAE,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAE9F,IAAI,UAAU,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACpD,kCAAkC;gBAClC,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEpD,sDAAsD;gBACtD,MAAM,YAAY,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACvE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;oBACtC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBACzB,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC9D,CAAC;gBACL,CAAC;gBAED,mCAAmC;gBACnC,MAAM,SAAS,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,IAAI,iBAAiB,CAAC;gBAC3F,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChI,MAAM,YAAY,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7F,MAAM,kBAAkB,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAqB,CAAC;gBAErF,IAAI,kBAAkB,EAAE,CAAC;oBACrB,+BAA+B;oBAC/B,MAAM,kBAAkB,CAAC;wBACrB,IAAI,EAAE,WAAW;wBACjB,UAAU,EAAE,CAAC;gCACT,SAAS,EAAE,UAAU;gCACrB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;6BACjD,CAAC;wBACF,SAAS;wBACT,KAAK;qBACR,CAAC,CAAC;oBACH,OAAO,kBAAkB,CAAC;gBAC9B,CAAC;YACL,CAAC;YAED,4DAA4D;YAC5D,MAAM,eAAe,GAAG,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,iBAAiB,CAAC;YACjH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAqB,CAAC;YAClD,CAAC;YACD,OAAO,SAAS,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,IAAI,gBAAiD,CAAC;AAEtD,MAAM,UAAU,sBAAsB;IAClC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,IAAI,mBAAmB,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC5B,CAAC"}

package/dist/identity/passkey-helper.d.mts

@@ -0,0 +1,72 @@
+/**
+ * @module identity/passkey-helper
+ *
+ * WebAuthn Level 3 PRF (Pseudo-Random Function) Passkey helper service.
+ * Derives deterministic 256-bit symmetric secrets from hardware biometrics
+ * (Touch ID, Windows Hello, Android Biometrics, YubiKey 5Ci) and creates
+ * passkey device sync delegates.
+ */
+import { AuthenticatorTransport } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+/**
+ * Checks if the browser and underlying platform authenticator support WebAuthn PRF.
+ */
+export declare function isPasskeyPrfSupported(): Promise<boolean>;
+/**
+ * Helper to convert an ArrayBuffer to a lowercase hex string.
+ */
+export declare function bufferToHex(buffer: ArrayBuffer | ArrayBufferLike): string;
+/**
+ * Helper to convert a hex string to a Uint8Array.
+ */
+export declare function hexToUint8Array(hex: string): Uint8Array;
+/**
+ * Helper to normalize a salt string or buffer into a 32-byte Uint8Array for PRF evaluation.
+ */
+export declare function normalizeSaltTo32Bytes(salt: string | Uint8Array): Uint8Array;
+/**
+ * Creates and registers a new WebAuthn resident passkey credential with PRF enabled.
+ */
+/**
+ * Creates and registers a new WebAuthn resident passkey credential with PRF enabled.
+ */
+export declare function registerPasskeyCredential({ username, displayName, rpName, rpId, salt, }: {
+    username: string;
+    displayName?: string;
+    rpName?: string;
+    rpId?: string;
+    salt?: string | Uint8Array;
+}): Promise<{
+    credentialId: string;
+    rawId: ArrayBuffer;
+    transports: AuthenticatorTransport[];
+    passkeySecret?: string;
+}>;
+/**
+ * Evaluates the PRF extension on a passkey assertion to derive a deterministic 256-bit symmetric secret.
+ */
+export declare function evaluatePasskeyPrf({ salt, credentialId, transports, rpId, }: {
+    salt: string | Uint8Array;
+    credentialId?: string;
+    transports?: AuthenticatorTransport[];
+    rpId?: string;
+}): Promise<{
+    passkeySecret: string;
+    credentialId: string;
+}>;
+/**
+ * Creates a Passkey sovereign sync delegate for this device.
+ * Standardized format: `passkey-${safeUsername}-${defaultDeviceTag}`
+ */
+export declare function createPasskeyDeviceSyncDelegate({ username, primaryTjpAddr, passkeySecret, transports, metaspace, space, }: {
+    username: string;
+    primaryTjpAddr: string;
+    passkeySecret: string;
+    transports?: AuthenticatorTransport[];
+    metaspace?: any;
+    space?: any;
+}): Promise<{
+    delegateKeystone: any;
+    deviceTag: string;
+    delegateSecret: string;
+}>;
+//# sourceMappingURL=passkey-helper.d.mts.map

package/dist/identity/passkey-helper.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-helper.d.mts","sourceRoot":"","sources":["../../src/identity/passkey-helper.mts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,sBAAsB,EAAwB,MAAM,kDAAkD,CAAC;AAGhH;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAoB9D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,MAAM,CAIzE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAOvD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAgB5E;AAED;;GAEG;AACH;;GAEG;AACH,wBAAsB,yBAAyB,CAAC,EAC5C,QAAQ,EACR,WAAsB,EACtB,MAAgB,EAChB,IAAI,EACJ,IAAI,GACP,EAAE;IACC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B,GAAG,OAAO,CAAC;IACR,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC,CAwED;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,EACrC,IAAI,EACJ,YAAY,EACZ,UAAU,EACV,IAAI,GACP,EAAE;IACC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC;IACR,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACxB,CAAC,CA6DD;AAED;;;GAGG;AACH,wBAAsB,+BAA+B,CAAC,EAClD,QAAQ,EACR,cAAc,EACd,aAAa,EACb,UAAU,EACV,SAAS,EACT,KAAK,GACR,EAAE;IACC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,KAAK,CAAC,EAAE,GAAG,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,gBAAgB,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BhF"}