@ibgib/space-gib 0.0.7 → 0.0.9

package/src/client/components/keystone-details/keystone-details.mts

@@ -19,11 +19,13 @@ import {
 import { EVENT_IBGIB_IDENTITY_REQUEST_CHANGE, EVENT_IBGIB_IDENTITY_CHANGED } from "@ibgib/web-gib/dist/ui/ui-constants.mjs";
 import { spaceGibApiBridge } from "../../api/space-gib-api-bridge.mjs";
 import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
-import { toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
+import { getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 
 import { GLOBAL_LOG_A_LOT, APP_CONFIG, } from "../../constants.mjs";
 import { getComponentCtorArg, getIbGibGlobalThis_SpaceGib } from "../../helpers.web.mjs";
 import { devLog } from "../../dev-tools.mjs";
+import { promptForSecret } from "@ibgib/web-gib/dist/helpers.web.mjs";
+import { isSsoProviderLinked } from "@ibgib/web-gib/dist/identity/sso/sso-helpers.mjs";
 
 const logalot = GLOBAL_LOG_A_LOT || true;
 
@@ -84,9 +86,15 @@ interface KeystoneDetailsElements extends ElementsBase {
     historicalWarningBannerEl: HTMLDivElement;
     containerEl: HTMLDivElement;
     ssoLinkCardEl: HTMLDivElement;
-    btnLinkGoogleEl: HTMLButtonElement;
-    btnLinkGithubEl: HTMLButtonElement;
+    btnLinkGoogleEl: HTMLDivElement;
+    btnLinkGithubEl: HTMLDivElement;
     ssoStatusMsgEl: HTMLDivElement;
+    inputCurrentPassphraseEl: HTMLInputElement;
+    inputNewPassphraseEl: HTMLInputElement;
+    inputConfirmPassphraseEl: HTMLInputElement;
+    btnChangePassphraseEl: HTMLButtonElement;
+    changePassphraseStatusEl: HTMLDivElement;
+    changePassphraseCardEl: HTMLDivElement;
 }
 
 export class KeystoneDetailsComponentInstance
@@ -190,9 +198,15 @@ export class KeystoneDetailsComponentInstance
             this.elements.containerEl = shadow.getElementById('container') as HTMLDivElement;
             this.elements.historicalWarningBannerEl = shadow.getElementById('historical-warning-banner') as HTMLDivElement;
             this.elements.ssoLinkCardEl = shadow.getElementById('sso-link-card') as HTMLDivElement;
-            this.elements.btnLinkGoogleEl = shadow.getElementById('btn-link-google') as HTMLButtonElement;
-            this.elements.btnLinkGithubEl = shadow.getElementById('btn-link-github') as HTMLButtonElement;
+            this.elements.btnLinkGoogleEl = shadow.getElementById('btn-link-google') as HTMLDivElement;
+            this.elements.btnLinkGithubEl = shadow.getElementById('btn-link-github') as HTMLDivElement;
             this.elements.ssoStatusMsgEl = shadow.getElementById('sso-status-msg') as HTMLDivElement;
+            this.elements.inputCurrentPassphraseEl = shadow.getElementById('input-current-passphrase') as HTMLInputElement;
+            this.elements.inputNewPassphraseEl = shadow.getElementById('input-new-passphrase') as HTMLInputElement;
+            this.elements.inputConfirmPassphraseEl = shadow.getElementById('input-confirm-passphrase') as HTMLInputElement;
+            this.elements.btnChangePassphraseEl = shadow.getElementById('btn-change-passphrase') as HTMLButtonElement;
+            this.elements.changePassphraseStatusEl = shadow.getElementById('change-passphrase-status') as HTMLDivElement;
+            this.elements.changePassphraseCardEl = shadow.getElementById('change-passphrase-card') as HTMLDivElement;
 
             // ElementBase requires contentEl
             this.elements.contentEl = shadow.getElementById('identity-details-view') as HTMLDivElement;
@@ -229,8 +243,9 @@ export class KeystoneDetailsComponentInstance
         // Buttons
         this.elements!.btnVerifyChainEl.addEventListener('click', () => this.handleVerifyIdentityChain());
         this.elements!.btnSetActiveEl.addEventListener('click', () => this.handleSetActiveIdentity());
-        this.elements!.btnLinkGoogleEl.addEventListener('click', () => this.handleSSOLink('google'));
-        this.elements!.btnLinkGithubEl.addEventListener('click', () => this.handleSSOLink('github'));
+        this.elements!.btnLinkGoogleEl.addEventListener('click', () => this.handleSSOClick('google'));
+        this.elements!.btnLinkGithubEl.addEventListener('click', () => this.handleSSOClick('github'));
+        this.elements!.btnChangePassphraseEl.addEventListener('click', () => this.handleChangePassphrase());
     }
 
     private toggleAccordion() {
@@ -294,14 +309,23 @@ export class KeystoneDetailsComponentInstance
                 throw new Error(`(UNEXPECTED) space falsy and we couldn't get default local user space from metaspace? (E: fa298edcecbda889cfd7b228fbd57c26)`);
             }
 
-            const resGet = await metaspace.get({ addrs: [this.ibGibAddr], space });
+            let loadAddr = this.ibGibAddr;
+            if (opts?.getLatest) {
+                const latest = await metaspace.getLatestAddr({ addr: this.ibGibAddr, space });
+                if (latest) {
+                    loadAddr = latest;
+                    this.ibGibAddr = latest;
+                }
+            }
+
+            const resGet = await metaspace.get({ addrs: [loadAddr], space });
 
             if (resGet.success && resGet.ibGibs && resGet.ibGibs.length === 1) {
                 this.staticIbGib = resGet.ibGibs[0] as KeystoneIbGib_V1;
             } else {
                 const resIbGib = resGet.rawResultIbGib as any;
                 const addrsNotFound = resIbGib?.data?.addrsNotFound ?? 'unknown';
-                throw new Error(`couldn't find address ${this.ibGibAddr}. addrsNotFound: ${addrsNotFound}? resGet.errorMsg: ${resGet.errorMsg} (E: e0e5c9b7de2837bc902fa88390cd9f26)`);
+                throw new Error(`couldn't find address ${loadAddr}. addrsNotFound: ${addrsNotFound}? resGet.errorMsg: ${resGet.errorMsg} (E: e0e5c9b7de2837bc902fa88390cd9f26)`);
             }
 
             await this.updateFrameDetailsView();
@@ -348,9 +372,43 @@ export class KeystoneDetailsComponentInstance
         if (this.isHistoricalFrame) {
             this.elements.btnSetActiveEl.disabled = true;
             this.elements.btnVerifyChainEl.disabled = true;
+            this.elements.btnLinkGoogleEl.classList.add('disabled');
+            this.elements.btnLinkGithubEl.classList.add('disabled');
         } else {
             this.elements.btnVerifyChainEl.disabled = false;
             this.elements.btnSetActiveEl.disabled = isTimelineActive;
+            this.elements.btnLinkGoogleEl.classList.remove('disabled');
+            this.elements.btnLinkGithubEl.classList.remove('disabled');
+
+            // Check if already linked
+            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'google' });
+            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'github' });
+
+            // Google Card States
+            const googleCard = this.elements.btnLinkGoogleEl;
+            const googleLabel = googleCard.querySelector('.toggle-state-text')!;
+            if (isGoogleLinked) {
+                googleCard.classList.remove('unlinked');
+                googleCard.classList.add('linked');
+                googleLabel.textContent = "Google Linked ✅";
+            } else {
+                googleCard.classList.remove('linked');
+                googleCard.classList.add('unlinked');
+                googleLabel.textContent = "Unlinked";
+            }
+
+            // GitHub Card States
+            const githubCard = this.elements.btnLinkGithubEl;
+            const githubLabel = githubCard.querySelector('.toggle-state-text')!;
+            if (isGithubLinked) {
+                githubCard.classList.remove('unlinked');
+                githubCard.classList.add('linked');
+                githubLabel.textContent = "GitHub Linked ✅";
+            } else {
+                githubCard.classList.remove('linked');
+                githubCard.classList.add('unlinked');
+                githubLabel.textContent = "Unlinked";
+            }
         }
     }
 
@@ -459,15 +517,17 @@ export class KeystoneDetailsComponentInstance
             // Render Challenge Pools
             this.renderChallengePools(keystone.data?.challengePools || []);
 
-            // Render Delegates & SSO link card (only if this is a primary keystone, hide delegates table & SSO card for delegate/session keystones)
+            // Render Delegates, SSO link, and Passphrase Change cards (only if this is a primary keystone, hide them for delegate/session keystones)
             const details = await this.getKeystoneDetails(this.ibGibAddr);
             if (details.isPrimary) {
                 this.elements.delegatesCardEl.classList.remove('hidden');
                 await this.renderDelegates(keystone.data?.delegates);
                 this.elements.ssoLinkCardEl.classList.remove('hidden');
+                this.elements.changePassphraseCardEl.classList.remove('hidden');
             } else {
                 this.elements.delegatesCardEl.classList.add('hidden');
                 this.elements.ssoLinkCardEl.classList.add('hidden');
+                this.elements.changePassphraseCardEl.classList.add('hidden');
             }
 
             this.updateActiveButtonState();
@@ -597,10 +657,26 @@ export class KeystoneDetailsComponentInstance
             const btnView = document.createElement('button');
             btnView.className = 'action-btn secondary small';
             btnView.textContent = 'View Details';
-            btnView.addEventListener('click', () => {
+            btnView.addEventListener('click', async () => {
+                const lc = `${this.lc}[renderDelegates.click]`;
                 if (info.delegateAddr) {
+                    let addrToLoad = info.delegateAddr;
+                    const metaspace = getIbGibGlobalThis_SpaceGib(APP_CONFIG).metaspace;
+                    if (metaspace) {
+                        const space = await metaspace.getLocalUserSpace({ lock: false });
+                        if (space) {
+                            try {
+                                const latest = await metaspace.getLatestAddr({ addr: delegateTjpAddr, space });
+                                if (latest) {
+                                    addrToLoad = latest;
+                                }
+                            } catch (err) {
+                                console.warn(`${lc} Error resolving latest delegate address: ${extractErrorMsg(err)}`);
+                            }
+                        }
+                    }
                     this.dispatchEvent(new CustomEvent('ibgib-view-keystone-details', {
-                        detail: { addr: info.delegateAddr },
+                        detail: { addr: addrToLoad },
                         bubbles: true,
                         composed: true
                     }));
@@ -687,7 +763,7 @@ export class KeystoneDetailsComponentInstance
 
             // 2. Generate a secure, high-entropy user nonce
             const userNonce = (Math.random().toString(36).substring(2) + Math.random().toString(36).substring(2)).substring(0, 32);
-            
+
             // 3. Construct state payload
             const stateObj = {
                 providerId,
@@ -710,16 +786,30 @@ export class KeystoneDetailsComponentInstance
             }
 
             // 6. Listen for callback from pop-up
+            let checkClosedInterval: any;
             const messageListener = async (event: MessageEvent) => {
                 if (event.origin !== window.location.origin) return;
                 const callbackData = event.data;
                 if (callbackData && callbackData.type === 'sso-oauth-callback') {
                     window.removeEventListener('message', messageListener);
+                    clearInterval(checkClosedInterval);
                     await this.handleSSOLinkCallback(callbackData.code, stateObj, providerConfig.redirectUri);
                 }
             };
             window.addEventListener('message', messageListener);
 
+            // 7. Poll for manual closure of the popup window
+            checkClosedInterval = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(checkClosedInterval);
+                    window.removeEventListener('message', messageListener);
+                    const statusEl = this.elements!.ssoStatusMsgEl;
+                    if (statusEl.textContent && statusEl.textContent.startsWith('Linking')) {
+                        this.setSSOStatus('Linking cancelled (window closed).', 'error');
+                    }
+                }
+            }, 500);
+
         } catch (error) {
             console.error(`${lc} SSO link initiation failed: ${extractErrorMsg(error)}`);
             this.setSSOStatus(`Link failed: ${extractErrorMsg(error)}`, "error");
@@ -762,10 +852,47 @@ export class KeystoneDetailsComponentInstance
 
             const custodianPool = linkData.custodianPool;
 
-            // 2. Prompt user for master secret to evolve locally
-            const masterSecret = prompt("Link successful! Enter your local Master Secret (Passphrase) to sign and register the custodian pool:");
-            if (!masterSecret) {
-                this.setSSOStatus("Link cancelled by user.", "info");
+            // 2. Prompt user for master secret and verify it
+            const keystoneService = new KeystoneService_V1();
+            let masterSecret: string | undefined;
+            let isCorrect = false;
+            let tries = 0;
+            const maxTries = 8;
+
+            while (tries < maxTries && !isCorrect) {
+                try {
+                    const promptMsg = tries === 0
+                        ? "Link successful! Enter your local Master Secret (Passphrase) to sign and register the custodian pool"
+                        : `Incorrect passphrase. Please try again (${maxTries - tries} tries remaining):`;
+                    masterSecret = await promptForSecret({
+                        msg: promptMsg,
+                        confirm: false
+                    });
+                } catch (error) {
+                    // cancelled
+                    if (logalot) { console.log(`${lc}[promptForSecret] user cancelled (I: 911ff1fb0234949228481968e9087626)`); }
+                    masterSecret = undefined;
+                    break;
+                }
+
+                if (!masterSecret) {
+                    break;
+                }
+
+                // Verify secret using verifySigningSecret (requires manage poolId)
+                isCorrect = await keystoneService.verifySigningSecret({
+                    keystoneIbGib: this.ibGib!,
+                    signingSecret: masterSecret,
+                    poolId: 'manage'
+                });
+
+                if (!isCorrect) {
+                    tries++;
+                }
+            }
+
+            if (!isCorrect) {
+                this.setSSOStatus("Link cancelled or failed (incorrect passphrase).", "error");
                 return;
             }
 
@@ -774,13 +901,12 @@ export class KeystoneDetailsComponentInstance
             const metaspace = getIbGibGlobalThis_SpaceGib(APP_CONFIG).metaspace;
             if (!metaspace) throw new Error("Metaspace not found");
             const space = await metaspace.getLocalUserSpace({ lock: false });
-            if (!space) throw new Error("Local space not found");
+            if (!space) { throw new Error("Local space not found"); }
 
             // 3. Evolve parent keystone to include the custodian pool
-            const keystoneService = new KeystoneService_V1();
             const evolvedParent = await keystoneService.addPools({
                 latestKeystone: this.ibGib!,
-                masterSecret,
+                masterSecret: masterSecret!,
                 newPools: [custodianPool],
                 metaspace,
                 space
@@ -788,11 +914,11 @@ export class KeystoneDetailsComponentInstance
 
             // 4. Sync evolved parent keystone back to server
             this.setSSOStatus("Publishing evolved identity keystone to server...", "info");
-            const syncRes = await spaceGibApiBridge.putEvolveKeystone(
-                stateObj.parentTjpAddr,
-                evolvedParent,
-                [] // No outward delegate timelines
-            );
+            const syncRes = await spaceGibApiBridge.putEvolveKeystone({
+                domainAddr: stateObj.parentTjpAddr,
+                keystoneIbGib: evolvedParent,
+                relatedKeystoneIbGibs: [] // No outward delegate timelines
+            });
             if (!syncRes.success) {
                 throw new Error(`Server synchronization rejected: ${syncRes.message}`);
             }
@@ -818,4 +944,270 @@ export class KeystoneDetailsComponentInstance
             this.setSSOStatus(`Link failed: ${extractErrorMsg(error)}`, "error");
         }
     }
+
+    protected async handleSSOClick(providerId: 'google' | 'github') {
+        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId });
+        if (isLinked) {
+            await this.handleSSOUnlink(providerId);
+        } else {
+            await this.handleSSOLink(providerId);
+        }
+    }
+
+    protected async handleSSOUnlink(providerId: 'google' | 'github') {
+        const lc = `${this.lc}[${this.handleSSOUnlink.name}]`;
+        this.setSSOStatus(`Unlinking ${providerId}...`, "info");
+
+        try {
+            // 1. Prompt user for passphrase
+            const keystoneService = new KeystoneService_V1();
+            let masterSecret: string | undefined;
+            let isCorrect = false;
+            let tries = 0;
+            const maxTries = 8;
+
+            while (tries < maxTries && !isCorrect) {
+                try {
+                    const promptMsg = tries === 0
+                        ? `Are you sure you want to unlink your ${providerId} account? If so, enter your local Master Secret (Passphrase) to authorize. Otherwise, click Cancel.`
+                        : `Incorrect passphrase. Please try again (${maxTries - tries} tries remaining):`;
+                    masterSecret = await promptForSecret({
+                        msg: promptMsg,
+                        confirm: false
+                    });
+                } catch (error) {
+                    masterSecret = undefined;
+                    break;
+                }
+
+                if (!masterSecret) {
+                    break;
+                }
+
+                // Verify secret using verifySigningSecret (requires manage poolId)
+                isCorrect = await keystoneService.verifySigningSecret({
+                    keystoneIbGib: this.ibGib!,
+                    signingSecret: masterSecret,
+                    poolId: 'manage'
+                });
+
+                if (!isCorrect) {
+                    tries++;
+                }
+            }
+
+            if (!isCorrect) {
+                this.setSSOStatus("Unlink cancelled or failed (incorrect passphrase).", "error");
+                return;
+            }
+
+            this.setSSOStatus("Evolving identity locally and removing custodian pool...", "info");
+
+            const metaspace = getIbGibGlobalThis_SpaceGib(APP_CONFIG).metaspace;
+            if (!metaspace) throw new Error("Metaspace not found");
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) { throw new Error("Local space not found"); }
+
+            // 2. Evolve parent keystone to remove the custodian pool
+            const targetPoolId = `custodian-manage-${providerId}`;
+            const evolvedParent = await keystoneService.removePools({
+                latestKeystone: this.ibGib!,
+                masterSecret: masterSecret!,
+                poolIds: [targetPoolId],
+                metaspace,
+                space
+            });
+
+            // 3. Sync evolved parent keystone back to server
+            this.setSSOStatus("Publishing evolved identity keystone to server...", "info");
+            const syncRes = await spaceGibApiBridge.putEvolveKeystone({
+                domainAddr: getIbGibAddr({ ibGib: this.ibGib! }),
+                keystoneIbGib: evolvedParent,
+                relatedKeystoneIbGibs: [] // No outward delegate timelines
+            });
+            if (!syncRes.success) {
+                throw new Error(`Server synchronization rejected: ${syncRes.message}`);
+            }
+
+            // 4. Update index locally
+            await updateSpecialIndex({
+                type: "keystones",
+                rel8nInfos: [
+                    {
+                        rel8nName: "keystone",
+                        ibGibs: [toDto({ ibGib: evolvedParent })]
+                    }
+                ],
+                metaspace,
+                space
+            });
+
+            this.setSSOStatus(`Successfully unlinked ${providerId}!`, "success");
+            await this.loadIbGib({ getLatest: true });
+
+        } catch (error) {
+            console.error(`${lc} SSO unlink failed: ${extractErrorMsg(error)}`);
+            this.setSSOStatus(`Unlink failed: ${extractErrorMsg(error)}`, "error");
+        }
+    }
+
+    private setChangePassphraseStatus(msg: string, type: 'info' | 'success' | 'error') {
+        const el = this.elements!.changePassphraseStatusEl;
+        el.textContent = msg;
+        el.className = `status-msg ${type}`;
+        el.classList.remove('hidden');
+    }
+
+    protected async handleChangePassphrase(): Promise<void> {
+        const lc = `${this.lc}[${this.handleChangePassphrase.name}]`;
+        this.setChangePassphraseStatus("Validating entries...", "info");
+
+        try {
+            const currentPassphrase = this.elements!.inputCurrentPassphraseEl.value;
+            const newPassphrase = this.elements!.inputNewPassphraseEl.value;
+            const confirmPassphrase = this.elements!.inputConfirmPassphraseEl.value;
+
+            if (!currentPassphrase) {
+                this.setChangePassphraseStatus("Current passphrase is required.", "error");
+                return;
+            }
+            if (!newPassphrase) {
+                this.setChangePassphraseStatus("New passphrase is required.", "error");
+                return;
+            }
+            if (newPassphrase !== confirmPassphrase) {
+                this.setChangePassphraseStatus("New passphrase and confirmation do not match.", "error");
+                return;
+            }
+
+            const keystoneService = new KeystoneService_V1();
+
+            // 1. Verify current passphrase against parent manage pool
+            const isMatch = await keystoneService.verifySigningSecret({
+                keystoneIbGib: this.ibGib!,
+                signingSecret: currentPassphrase,
+                poolId: 'manage'
+            });
+            if (!isMatch) {
+                this.setChangePassphraseStatus("Incorrect current passphrase.", "error");
+                return;
+            }
+
+            this.setChangePassphraseStatus("Evolving primary identity keystone...", "info");
+
+            const metaspace = getIbGibGlobalThis_SpaceGib(APP_CONFIG).metaspace;
+            if (!metaspace) throw new Error("Metaspace not found");
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) { throw new Error("Local space not found"); }
+
+            // 2. Rotate parent identity
+            debugger; // walk through this...looking for delegate failure
+            const { newKeystone: evolvedParent, newDelegates: evolvedDelegates } = await keystoneService.changePassword({
+                keystoneIbGib: this.ibGib!,
+                newMasterSecret: newPassphrase,
+                signingSecret: currentPassphrase,
+                signingPoolId: 'manage',
+                metaspace,
+                space
+            });
+            debugger; // look at evolvedDelegates
+
+            this.setChangePassphraseStatus("Resolving and rotating delegate keystones...", "info");
+
+            // // 3. Evolve registered delegate keystones (preserving custodian/foreign delegate secrets)
+            // const delegates = this.ibGib!.data?.delegates || {};
+            // const evolvedDelegates: KeystoneIbGib_V1[] = [];
+
+            // for (const delegateInfo of Object.values(delegates)) {
+            //     const delegateAddr = delegateInfo.delegateAddr;
+            //     const delegateKeystone = await keystoneService.getLatestKeystone({
+            //         addr: delegateAddr,
+            //         metaspace,
+            //         space,
+            //     });
+
+            //     // Identify user-owned challenge pools in the delegate that match the old passphrase
+            //     const poolsToRotate: string[] = [];
+            //     for (const pool of delegateKeystone.data?.challengePools ?? []) {
+            //         if (!pool.isForeign) {
+            //             /**
+            //              * WARNING: There is an extreme edge case that if two pools
+            //              * happen to be owned by different parties but share the
+            //              * same secret, this will change the wrong pool's secret
+            //              * also. For V1, this shouldn't matter. But we need a
+            //              * better way of tracking pool ownership for V2 (or even
+            //              * V1 if we have multi-party support). (DO NOT REMOVE
+            //              * THIS COMMENT UNTIL THIS IS ADDRESSED)
+            //              */
+            //             const isPoolMatch = await keystoneService.verifySigningSecret({
+            //                 keystoneIbGib: delegateKeystone,
+            //                 signingSecret: currentPassphrase,
+            //                 poolId: pool.id
+            //             });
+            //             if (isPoolMatch) { poolsToRotate.push(pool.id); }
+            //         }
+            //     }
+
+            //     if (poolsToRotate.length > 0) {
+            //         console.log(`${lc} Rotating pools in delegate ${delegateInfo.delegateTjpAddr}: ${poolsToRotate.join(', ')}`);
+            //         const {newKeystone: evolvedDelegate} = await keystoneService.changePassword({
+            //             keystoneIbGib: delegateKeystone,
+            //             newMasterSecret: newPassphrase,
+            //             signingSecret: currentPassphrase,
+            //             signingPoolId: 'manage',
+            //             poolIds: poolsToRotate,
+            //             metaspace,
+            //             space
+            //         });
+            //         evolvedDelegates.push(evolvedDelegate);
+            //     }
+            // }
+
+            // 4. Sync evolved parent and all evolved delegate keystones atomically
+            this.setChangePassphraseStatus("Syncing evolved keystones to server...", "info");
+            const parentTjp = getIbGibAddr({ ibGib: this.ibGib! }); // is this.ibGib the tjp always? or is it the latest in the keystone line? Does it matter?
+
+            const syncRes = await spaceGibApiBridge.putEvolveKeystone({
+                domainAddr: parentTjp,
+                keystoneIbGib: evolvedParent,
+                relatedKeystoneIbGibs: evolvedDelegates,
+            });
+            if (!syncRes.success) {
+                throw new Error(`Server synchronization rejected: ${syncRes.message}`);
+            }
+
+            // 5. Update index locally
+            this.setChangePassphraseStatus("Updating local indexes...", "info");
+            const newKeystoneIbGibs = [toDto({ ibGib: evolvedParent })];
+            if (evolvedDelegates) {
+                evolvedDelegates.forEach(d => {
+                    newKeystoneIbGibs.push(toDto({ ibGib: d }));
+                });
+            }
+            const rel8nInfos = [
+                {
+                    rel8nName: "keystone",
+                    ibGibs: newKeystoneIbGibs,
+                }
+            ];
+            await updateSpecialIndex({
+                type: "keystones",
+                rel8nInfos,
+                metaspace,
+                space
+            });
+
+            // Clear inputs
+            this.elements!.inputCurrentPassphraseEl.value = "";
+            this.elements!.inputNewPassphraseEl.value = "";
+            this.elements!.inputConfirmPassphraseEl.value = "";
+
+            this.setChangePassphraseStatus("Passphrase updated successfully!", "success");
+            await this.loadIbGib({ getLatest: true });
+
+        } catch (error) {
+            console.error(`${lc} Passphrase rotation failed: ${extractErrorMsg(error)}`);
+            this.setChangePassphraseStatus(`Update failed: ${extractErrorMsg(error)}`, "error");
+        }
+    }
 }

package/src/client/dev-tools/common.mts

@@ -102,11 +102,11 @@ export async function createAndRegisterSyncDelegate({
     const domainAddr = getIbGibAddr({ ibGib: domainI });
 
     // 4. Sync evolved parent and delegate to server
-    const resEvolve = await apiBridge.putEvolveKeystone(
+    const resEvolve = await apiBridge.putEvolveKeystone({
         domainAddr,
-        evolvedDomainI,
-        [delegateKeystone]
-    );
+        keystoneIbGib: evolvedDomainI,
+        relatedKeystoneIbGibs: [delegateKeystone]
+    });
     if (!resEvolve.success) {
         throw new Error(`Server rejected delegate evolution: ${resEvolve.message}`);
     }

package/src/server/serve-gib/handlers/api/keystone/keystone-evolve.handler.mts

@@ -15,6 +15,8 @@ import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
 import { IbGib_V1 } from '@ibgib/ts-gib/dist/V1/types.mjs';
 import { validateAndRegisterEvolveKeystone } from '@ibgib/core-gib/dist/sync/sync-peer/sync-peer-websocket/sync-peer-websocket-receiver/sync-websocket-peer-helpers.mjs';
 import { KeystoneIbGib_V1 } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { loadSsoServerConfig } from '@ibgib/web-gib/dist/identity/sso/sso-config-helper.mjs';
+import { SsoCustodianService } from '@ibgib/web-gib/dist/identity/sso/sso-custodian-service.mjs';
 
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
 import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
@@ -27,9 +29,19 @@ interface EvolveParams extends ParamsWithDomain {
     domainAddr: string;
 }
 
+/**
+ * Body payload for the Keystone Evolve REST API request.
+ */
 interface EvolveBody {
+    /** The main evolved keystone frame. */
     keystoneIbGib: KeystoneIbGib_V1;
-    relatedIbGibs?: IbGib_V1[];
+    /**
+     * Array of other keystone frames related to this evolution.
+     * Ephemeral session keystones for sync, or persistent delegate keystones for manage.
+     */
+    relatedKeystoneIbGibs?: IbGib_V1[];
+    /** Optional map of providerId to token to revoke during unlinking. */
+    revokeTokens?: Record<string, string>;
 }
 
 export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase<EvolveParams, EvolveBody> {
@@ -75,7 +87,7 @@ export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase<Evol
                 return this.error(400, 'Invalid request JSON body: bodyStr does NOT parse. (E: 2f81c8c80a6884ff32b877671e92f326)');
             }
 
-            const { keystoneIbGib, relatedIbGibs = [] } = parsed;
+            const { keystoneIbGib, relatedKeystoneIbGibs = [] } = parsed;
             if (!keystoneIbGib) {
                 return this.error(400, 'Invalid request. Body must contain keystoneIbGib (E: e234647f79282982c8012fe8015f5826)');
             }
@@ -89,11 +101,41 @@ export class KeystoneEvolveHandler extends ServeGibHandlerWithMetaspaceBase<Evol
             await validateAndRegisterEvolveKeystone({
                 domainAddr,
                 keystoneIbGib,
-                relatedIbGibs,
+                relatedKeystoneIbGibs,
                 metaspace: reqCtx.metaspace,
                 space
             });
 
+            // Post-Evolution Hook: Handle SSO provider unlinking
+            const claim = keystoneIbGib.data?.proofs?.[0]?.claim;
+            if (claim?.details?.type === 'remove-pool') {
+                const removeInfo = claim.details.info;
+                if (removeInfo && Array.isArray(removeInfo.remove)) {
+                    // Lazy-load custodian service config
+                    const config = loadSsoServerConfig();
+                    const custodian = new SsoCustodianService(config);
+
+                    for (const poolId of removeInfo.remove) {
+                        if (poolId.startsWith('custodian-manage-')) {
+                            const providerId = poolId.replace('custodian-manage-', '');
+                            console.log(`${lc} Evolved keystone removed custodian pool: ${poolId}. Performing unlink cleanup for provider: ${providerId}`);
+
+                            // Revoke token if supplied by the client
+                            const token = parsed.revokeTokens?.[providerId];
+                            if (token) {
+                                try {
+                                    await custodian.revokeToken(providerId as any, token);
+                                } catch (e) {
+                                    console.warn(`${lc} Failed to revoke token for provider ${providerId}: ${extractErrorMsg(e)}`);
+                                }
+                            } else {
+                                console.log(`${lc} No OAuth token supplied by client for revocation of provider: ${providerId}`);
+                            }
+                        }
+                    }
+                }
+            }
+
             return this.ok({
                 message: `Successfully evolved domain keystone with session keystone`,
             });