@ibgib/core-gib 0.1.62 → 0.1.64

package/dist/keystone/keystone-service-v1.respec.mjs

@@ -4,12 +4,14 @@ import { clone, hash, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helpe
 import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { GLOBAL_LOG_A_LOT } from '../core-constants.mjs';
 import { KeystoneStrategyFactory } from './strategy/keystone-strategy-factory.mjs';
+import { KeystoneReplenishStrategy, KeystoneClaimType } from './keystone-types.mjs';
 import { createRevocationPoolConfig, createStandardPoolConfig } from './keystone-config-builder.mjs';
-import { POOL_ID_DEFAULT, POOL_ID_REVOKE, KEYSTONE_VERB_REVOKE, KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE } from './keystone-constants.mjs';
+import { POOL_ID_DEFAULT, POOL_ID_REVOKE, KEYSTONE_VERB_REVOKE, KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE, KEYSTONE_VERB_SYNC, POOL_ID_CUSTODIAN_MANAGE } from './keystone-constants.mjs';
 import { KeystoneService_V1, } from './keystone-service-v1.mjs';
-import { selectChallengeIds, validateChallengePool, validateKeystoneIb, validateKeystoneTransition, validateGenesisKeystone } from './keystone-helpers.mjs';
+import { selectChallengeIds, validateChallengePool, validateKeystoneIb, validateKeystoneTransition, validateGenesisKeystone, rotatePoolChallenges } from './keystone-helpers.mjs';
 import { KeystoneProfileBuilder } from './policy/keystone-profile-builder.mjs';
 import { getTjpAddr } from '../common/other/ibgib-helper.mjs';
+import { deriveDelegateSecret } from './strategy/hash-reveal-v1/hash-reveal-v1.mjs';
 const logalot = GLOBAL_LOG_A_LOT;
 /**
  * A simple in-memory map acting as a Space.
@@ -181,6 +183,14 @@ await respecfully(sir, 'Suite A: Strategy Vectors (HashRevealV1)', async () => {
             const secretB = await strategyB.derivePoolSecret({ masterSecret });
             iReckon(sir, secretA).asTo('salt affects secret').not.willEqual(secretB);
         });
+        await ifWeMight(sir, 'deriveDelegateSecret derives a consistent secret using KDF', async () => {
+            const secretA = await deriveDelegateSecret({ masterSecret });
+            const secretB = await deriveDelegateSecret({ masterSecret });
+            iReckon(sir, secretA).asTo('consistency').willEqual(secretB);
+            iReckon(sir, secretA).asTo('truthy').isGonnaBeTruthy();
+            const secretC = await deriveDelegateSecret({ masterSecret: masterSecret + '_other' });
+            iReckon(sir, secretA).asTo('differ').not.willEqual(secretC);
+        });
     });
     await respecfully(sir, 'Challenge/Solution Logic', async () => {
         await ifWeMight(sir, 'generateSolution -> generateChallenge -> validateSolution loop works', async () => {
@@ -460,6 +470,42 @@ await respecfully(sir, 'Suite D: Revocation', async () => {
             const remaining = Object.keys(revokePool.challenges);
             iReckon(sir, remaining.length).asTo('pool depleted').willEqual(0);
         });
+        await ifWeMight(sir, 'fails to sign any new claims after revocation', async () => {
+            let errorCaught = false;
+            try {
+                await service.sign({
+                    latestKeystone: revokedKeystone,
+                    masterSecret,
+                    claim: { verb: "post", target: "some_target" },
+                    metaspace: mockMetaspace,
+                    space: mockSpace,
+                });
+            }
+            catch (err) {
+                errorCaught = true;
+                iReckon(sir, err.message).includes("has been revoked");
+            }
+            iReckon(sir, errorCaught).asTo('signing blocked after revocation').isGonnaBeTrue();
+        });
+        await ifWeMight(sir, 'fails to evolve or add pools after revocation', async () => {
+            let errorCaught = false;
+            try {
+                const dummyConfig = createStandardPoolConfig({ id: "dummy", salt: "dummy" });
+                const dummyPool = { id: "dummy", config: dummyConfig, challenges: {} };
+                await service.addPools({
+                    latestKeystone: revokedKeystone,
+                    masterSecret,
+                    newPools: [dummyPool],
+                    metaspace: mockMetaspace,
+                    space: mockSpace,
+                });
+            }
+            catch (err) {
+                errorCaught = true;
+                iReckon(sir, err.message).includes("has been revoked");
+            }
+            iReckon(sir, errorCaught).asTo('adding pools blocked after revocation').isGonnaBeTrue();
+        });
     });
 });
 // ===========================================================================
@@ -925,6 +971,16 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
             iReckon(sir, details.description).asTo('description').willEqual('Alice test keystone');
             iReckon(sir, details.extraInfo).asTo('extraInfo').willEqual('abc');
         });
+        await ifWeMight(sir, 'compiles configs successfully with domain profile (omitting connect)', async () => {
+            const builder = KeystoneProfileBuilder.buildKeystone('domain')
+                .withUsername('alice')
+                .withEmail('alice@example.com')
+                .withDescription('Alice domain keystone');
+            const configs = await builder.compileConfigs();
+            iReckon(sir, configs.length).asTo('number of pools').willEqual(4);
+            const connectPool = configs.find(c => c.id === 'connect');
+            iReckon(sir, connectPool).asTo('connect pool omitted').isGonnaBeUndefined();
+        });
         await ifWeMight(sir, 'supports customized overrides', async () => {
             const builder = KeystoneProfileBuilder.buildKeystone('test')
                 .customizePool('sync', {
@@ -1046,6 +1102,7 @@ await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () =>
             masterSecret: parentSecret,
             metaspace: mockMetaspace,
             space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
         });
         iReckon(sir, evolvedParent).asTo('evolved parent exists').isGonnaBeTruthy();
         iReckon(sir, evolvedParent.data?.delegates).asTo('delegates map exists').isGonnaBeTruthy();
@@ -1081,6 +1138,7 @@ await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () =>
             masterSecret: parentSecret,
             metaspace: mockMetaspace,
             space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
         });
         // After registration
         const statusAfter = await service.getDelegateStatus({
@@ -1100,6 +1158,7 @@ await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () =>
             masterSecret: parentSecret,
             metaspace: mockMetaspace,
             space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
         });
         const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
         if (!delegateTjpAddr) {
@@ -1135,6 +1194,7 @@ await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () =>
                 masterSecret: parentSecret,
                 metaspace: mockMetaspace,
                 space: mockSpace,
+                allowedVerbs: [KEYSTONE_VERB_SYNC],
             });
         }
         catch (e) {
@@ -1198,6 +1258,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
             masterSecret: parentSecret,
             metaspace: mockMetaspace,
             space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
         });
         const errors = await validateKeystoneTransition({
             currentIbGib: evolvedParent,
@@ -1212,6 +1273,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
             masterSecret: parentSecret,
             metaspace: mockMetaspace,
             space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
         });
         const tamperedParent = JSON.parse(JSON.stringify(evolvedParent));
         // Remove the manage verb proof by converting it to sign
@@ -1234,6 +1296,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
             masterSecret: parentSecret,
             metaspace: mockMetaspace,
             space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
         });
         const tamperedParent = JSON.parse(JSON.stringify(evolvedParent));
         const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
@@ -1257,6 +1320,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
             masterSecret: parentSecret,
             metaspace: mockMetaspace,
             space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
         });
         const tamperedParent = JSON.parse(JSON.stringify(evolvedParent));
         const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
@@ -1278,6 +1342,7 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
             masterSecret: parentSecret,
             metaspace: mockMetaspace,
             space: mockSpace,
+            allowedVerbs: [KEYSTONE_VERB_SYNC],
         });
         const tamperedParent = JSON.parse(JSON.stringify(evolvedParent));
         const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
@@ -1293,4 +1358,384 @@ await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
         iReckon(sir, errors.some(e => e.includes('not a valid historical address in the parent keystone timeline'))).isGonnaBeTrue();
     });
 });
+// ===========================================================================
+// SUITE G: COMBINED POOLS & PASSWORD ROTATION
+// ===========================================================================
+await respecfully(sir, 'Suite G: Combined Pools & Password Rotation', async () => {
+    const service = new KeystoneService_V1();
+    const userSecret = "UserMasterSecret_123";
+    const custodianSecret = "CustodianSecret_456";
+    let mockSpace;
+    let mockMetaspace;
+    firstOfEach(sir, async () => {
+        mockSpace = new MockIbGibSpace();
+        mockMetaspace = new MockMetaspaceService(mockSpace);
+    });
+    await ifWeMight(sir, 'revokes a keystone using a separate revocation pool', async () => {
+        const stdSalt = "std_salt";
+        const revokeSalt = "revoke_salt";
+        const stdConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: stdSalt });
+        const revokeConfig = createStandardPoolConfig({ id: POOL_ID_REVOKE, salt: revokeSalt });
+        revokeConfig.allowedVerbs = [KEYSTONE_VERB_REVOKE];
+        revokeConfig.behavior.replenish = KeystoneReplenishStrategy.deleteAll;
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [stdConfig, revokeConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const revoked = await service.revoke({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, revoked.data?.revocationInfo).asTo('revocationInfo present').isGonnaBeTruthy();
+        const revokePool = revoked.data?.challengePools.find(p => p.id === POOL_ID_REVOKE);
+        iReckon(sir, Object.keys(revokePool.challenges).length).asTo('revoke pool depleted').willEqual(0);
+    });
+    await ifWeMight(sir, 'revokes a keystone using a combined manage/revoke pool and empties it', async () => {
+        const salt = "combined_salt";
+        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt });
+        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [manageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const revoked = await service.revoke({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, revoked.data?.revocationInfo).asTo('revocationInfo present').isGonnaBeTruthy();
+        const managePool = revoked.data?.challengePools.find(p => p.id === POOL_ID_MANAGE);
+        iReckon(sir, Object.keys(managePool.challenges).length).asTo('combined manage pool depleted').willEqual(0);
+    });
+    await ifWeMight(sir, 'rotates user password successfully when signed by the user manage pool', async () => {
+        const salt = "manage_salt";
+        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt });
+        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [manageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const newSecret = "NewUserSecret_999";
+        const rotated = await service.changePassword({
+            latestKeystone: keystone,
+            newMasterSecret: newSecret,
+            signingSecret: userSecret,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, rotated).isGonnaBeTruthy();
+        // 1. Try to sign using the new secret (should succeed)
+        const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
+        const signedNew = await service.sign({
+            latestKeystone: rotated,
+            masterSecret: newSecret,
+            claim,
+            poolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, signedNew).isGonnaBeTruthy();
+        // 2. Try to sign using the old secret (should fail)
+        let errorCaught = false;
+        try {
+            await service.sign({
+                latestKeystone: rotated,
+                masterSecret: userSecret,
+                claim,
+                poolId: POOL_ID_MANAGE,
+                metaspace: mockMetaspace,
+                space: mockSpace,
+            });
+        }
+        catch {
+            errorCaught = true;
+        }
+        iReckon(sir, errorCaught).asTo('old secret signing rejected').isGonnaBeTrue();
+    });
+    await ifWeMight(sir, 'recovers user password successfully when signed by the custodian manage pool', async () => {
+        const userSalt = "user_salt";
+        const custodianSalt = "custodian_salt";
+        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
+        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
+        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // We simulate constructing the custodian pool "offline" by the server
+        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+        const challenges = {};
+        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        }
+        const custodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: custodianManageConfig,
+            challenges,
+            isForeign: true
+        };
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [userManageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Add the custodian pool to the keystone
+        const keystoneWithCustodian = await service.addPools({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            newPools: [custodianPool],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // The user forgets their secret. Recover using custodianSecret!
+        const recoveredSecret = "RecoveredUserSecret_777";
+        const recoveredKeystone = await service.changePassword({
+            latestKeystone: keystoneWithCustodian,
+            newMasterSecret: recoveredSecret,
+            signingSecret: custodianSecret,
+            signingPoolId: POOL_ID_CUSTODIAN_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, recoveredKeystone).isGonnaBeTruthy();
+        // Verify we can sign with recovered secret
+        const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
+        const signedNew = await service.sign({
+            latestKeystone: recoveredKeystone,
+            masterSecret: recoveredSecret,
+            claim,
+            poolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, signedNew).isGonnaBeTruthy();
+    });
+    await ifWeMight(sir, 'rotates custodian manage pool successfully', async () => {
+        const userSalt = "user_salt";
+        const custodianSalt = "custodian_salt";
+        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
+        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
+        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // Custodian Pool genesis
+        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+        const challenges = {};
+        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        }
+        const custodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: custodianManageConfig,
+            challenges,
+            isForeign: true
+        };
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [userManageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const keystoneWithCustodian = await service.addPools({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            newPools: [custodianPool],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Rotate custodian credentials to new secret
+        const newCustodianSecret = "NewCustodianSecret_888";
+        const newCustodianConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: "new_custodian_salt" });
+        newCustodianConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const newStrategy = KeystoneStrategyFactory.create({ config: newCustodianConfig });
+        const newPoolSecret = await newStrategy.derivePoolSecret({ masterSecret: newCustodianSecret });
+        const newChallenges = {};
+        for (let i = 0; i < newCustodianConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${newCustodianConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await newStrategy.generateSolution({ poolSecret: newPoolSecret, poolId: newCustodianConfig.id, challengeId });
+            newChallenges[challengeId] = await newStrategy.generateChallenge({ solution });
+        }
+        const newCustodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: newCustodianConfig,
+            challenges: newChallenges,
+            isForeign: true
+        };
+        // Rotate signed by user manage pool
+        const rotated = await service.replacePool({
+            latestKeystone: keystoneWithCustodian,
+            newPool: newCustodianPool,
+            signingSecret: userSecret,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, rotated).isGonnaBeTruthy();
+        // Verify we can sign with new custodian secret
+        const claim = { verb: KEYSTONE_VERB_MANAGE, target: "test_target" };
+        const signedNew = await service.sign({
+            latestKeystone: rotated,
+            masterSecret: newCustodianSecret,
+            claim,
+            poolId: POOL_ID_CUSTODIAN_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, signedNew).isGonnaBeTruthy();
+    });
+    await ifWeMight(sir, 'rotates all non-foreign pools during changePassword by default', async () => {
+        const userSalt = "user_salt";
+        const custodianSalt = "custodian_salt";
+        const secondarySalt = "secondary_salt";
+        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: userSalt });
+        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // Another native/non-foreign pool
+        const secondaryNativeConfig = createStandardPoolConfig({ id: "secondary-native", salt: secondarySalt });
+        secondaryNativeConfig.allowedVerbs = [KEYSTONE_VERB_SYNC];
+        // A custodian/foreign pool
+        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: custodianSalt });
+        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // Custodian Pool genesis
+        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+        const challenges = {};
+        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        }
+        const custodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: custodianManageConfig,
+            challenges,
+            isForeign: true
+        };
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [userManageConfig, secondaryNativeConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const keystoneWithCustodian = await service.addPools({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            newPools: [custodianPool],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Rotate passphrase/password
+        const newPassphrase = "SuperNewSecretPassphrase_999";
+        const rotated = await service.changePassword({
+            latestKeystone: keystoneWithCustodian,
+            newMasterSecret: newPassphrase,
+            signingSecret: userSecret,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        iReckon(sir, rotated).isGonnaBeTruthy();
+        const data = rotated.data;
+        const rotatedManage = data.challengePools.find(p => p.id === POOL_ID_MANAGE);
+        const rotatedSecondary = data.challengePools.find(p => p.id === "secondary-native");
+        const rotatedCustodian = data.challengePools.find(p => p.id === POOL_ID_CUSTODIAN_MANAGE);
+        // Verify native pools rotated (salt changed)
+        iReckon(sir, rotatedManage.config.salt).not.willEqual(userSalt);
+        iReckon(sir, rotatedSecondary.config.salt).not.willEqual(secondarySalt);
+        // Verify foreign pool was not modified (salt identical)
+        iReckon(sir, rotatedCustodian.config.salt).willEqual(custodianSalt);
+        // Verify we can validate transition
+        const errors = await service.validate({
+            prevIbGib: keystoneWithCustodian,
+            currentIbGib: rotated
+        });
+        iReckon(sir, errors.length).willEqual(0);
+    });
+    await ifWeMight(sir, 'fails validation if password rotation details or constraints are violated', async () => {
+        // Construct invalid change-password transition
+        const userManageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: "salt1" });
+        userManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const custodianManageConfig = createStandardPoolConfig({ id: POOL_ID_CUSTODIAN_MANAGE, salt: "salt2" });
+        custodianManageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // Custodian Pool genesis
+        const strategy = KeystoneStrategyFactory.create({ config: custodianManageConfig });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+        const challenges = {};
+        for (let i = 0; i < custodianManageConfig.behavior.size; i++) {
+            const raw = await hash({ s: `${custodianManageConfig.salt}${Date.now()}${i}` });
+            const challengeId = raw.substring(0, 16);
+            const solution = await strategy.generateSolution({ poolSecret, poolId: custodianManageConfig.id, challengeId });
+            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        }
+        const custodianPool = {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config: custodianManageConfig,
+            challenges,
+            isForeign: true
+        };
+        const keystone = await service.genesis({
+            masterSecret: userSecret,
+            configs: [userManageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        const keystoneWithCustodian = await service.addPools({
+            latestKeystone: keystone,
+            masterSecret: userSecret,
+            newPools: [custodianPool],
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Create an invalid frame manually where a foreign pool is rotated during change-password
+        const badRotatedPool = await rotatePoolChallenges({
+            prevPool: custodianPool,
+            newMasterSecret: "bad_secret"
+        });
+        const evolved = await service.changePassword({
+            latestKeystone: keystoneWithCustodian,
+            newMasterSecret: "new_pass",
+            signingSecret: userSecret,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace: mockMetaspace,
+            space: mockSpace,
+        });
+        // Inject the foreign pool rotation manually to simulate an attacker
+        const attackerData = {
+            ...evolved.data,
+            challengePools: evolved.data.challengePools.map(p => p.id === POOL_ID_CUSTODIAN_MANAGE ? badRotatedPool : p)
+        };
+        // Update details claim to say we rotated custodian-manage
+        attackerData.proofs[0].claim.details = {
+            type: KeystoneClaimType.change_password,
+            info: { change: [POOL_ID_MANAGE, POOL_ID_CUSTODIAN_MANAGE] }
+        };
+        const attackerKeystone = {
+            ...evolved,
+            data: attackerData
+        };
+        const errors = await service.validate({
+            prevIbGib: keystoneWithCustodian,
+            currentIbGib: attackerKeystone
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        const hasForeignViolation = errors.some(e => e.includes("Security Violation") && e.includes("foreign pool"));
+        iReckon(sir, hasForeignViolation).isGonnaBeTrue();
+    });
+});
 //# sourceMappingURL=keystone-service-v1.respec.mjs.map