@ibgib/web-gib 0.0.59 → 0.0.61

package/src/ui/component/identity/keystone-details/keystone-details.mts

@@ -23,10 +23,11 @@ import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.m
 import { getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { parseSpaceIb } from "@ibgib/core-gib/dist/witness/space/space-helper.mjs";
 import { executeSsoOAuthPopup } from "../../../../identity/sso-popup-helper.mjs";
-
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
 import { promptForSecret } from "../../../../helpers.web.mjs";
-import { isSsoProviderLinked } from "../../../../identity/sso/sso-helpers.mjs";
+import { isSsoProviderLinked, getKeystoneCapabilities, isDelegateExpired } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
+import { generatePoolChallenges } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
+import { POOL_ID_MANAGE } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
 import { getGlobalMetaspace_waitIfNeeded } from "../../../../helpers.mjs";
 
 const logalot = false;
@@ -94,12 +95,12 @@ interface KeystoneDetailsElements extends ElementsBase {
     btnLinkGoogleEl: HTMLDivElement;
     btnLinkGithubEl: HTMLDivElement;
     ssoStatusMsgEl: HTMLDivElement;
-    inputCurrentPassphraseEl: HTMLInputElement;
-    inputNewPassphraseEl: HTMLInputElement;
-    inputConfirmPassphraseEl: HTMLInputElement;
-    btnChangePassphraseEl: HTMLButtonElement;
-    changePassphraseStatusEl: HTMLDivElement;
-    changePassphraseCardEl: HTMLDivElement;
+    inputCurrentPasswordEl: HTMLInputElement;
+    inputNewPasswordEl: HTMLInputElement;
+    inputConfirmPasswordEl: HTMLInputElement;
+    btnChangePasswordEl: HTMLButtonElement;
+    changePasswordStatusEl: HTMLDivElement;
+    changePasswordCardEl: HTMLDivElement;
 }
 
 export class KeystoneDetailsComponentInstance
@@ -118,6 +119,7 @@ export class KeystoneDetailsComponentInstance
     private isHistoricalFrame: boolean = false;
     private _onIdentityChanged: ((e: any) => void) | null = null;
     private keystoneCache: Map<string, { username: string, description: string, isPrimary: boolean, n: number }> = new Map();
+    private aggregatedDetails?: any;
 
     constructor() {
         super();
@@ -212,12 +214,12 @@ export class KeystoneDetailsComponentInstance
             this.elements.btnLinkGoogleEl = shadow.getElementById('btn-link-google') as HTMLDivElement;
             this.elements.btnLinkGithubEl = shadow.getElementById('btn-link-github') as HTMLDivElement;
             this.elements.ssoStatusMsgEl = shadow.getElementById('sso-status-msg') as HTMLDivElement;
-            this.elements.inputCurrentPassphraseEl = shadow.getElementById('input-current-passphrase') as HTMLInputElement;
-            this.elements.inputNewPassphraseEl = shadow.getElementById('input-new-passphrase') as HTMLInputElement;
-            this.elements.inputConfirmPassphraseEl = shadow.getElementById('input-confirm-passphrase') as HTMLInputElement;
-            this.elements.btnChangePassphraseEl = shadow.getElementById('btn-change-passphrase') as HTMLButtonElement;
-            this.elements.changePassphraseStatusEl = shadow.getElementById('change-passphrase-status') as HTMLDivElement;
-            this.elements.changePassphraseCardEl = shadow.getElementById('change-passphrase-card') as HTMLDivElement;
+            this.elements.inputCurrentPasswordEl = shadow.getElementById('input-current-password') as HTMLInputElement;
+            this.elements.inputNewPasswordEl = shadow.getElementById('input-new-password') as HTMLInputElement;
+            this.elements.inputConfirmPasswordEl = shadow.getElementById('input-confirm-password') as HTMLInputElement;
+            this.elements.btnChangePasswordEl = shadow.getElementById('btn-change-password') as HTMLButtonElement;
+            this.elements.changePasswordStatusEl = shadow.getElementById('change-password-status') as HTMLDivElement;
+            this.elements.changePasswordCardEl = shadow.getElementById('change-password-card') as HTMLDivElement;
 
             // ElementBase requires contentEl
             this.elements.contentEl = shadow.getElementById('identity-details-view') as HTMLDivElement;
@@ -260,7 +262,7 @@ export class KeystoneDetailsComponentInstance
         this.elements!.btnUpdateIdentityEl.addEventListener('click', () => this.handleUpdateIdentity());
         this.elements!.btnLinkGoogleEl.addEventListener('click', () => this.handleSSOClick('google'));
         this.elements!.btnLinkGithubEl.addEventListener('click', () => this.handleSSOClick('github'));
-        this.elements!.btnChangePassphraseEl.addEventListener('click', () => this.handleChangePassphrase());
+        this.elements!.btnChangePasswordEl.addEventListener('click', () => this.handleChangePassword());
     }
 
     private toggleAccordion() {
@@ -454,9 +456,12 @@ export class KeystoneDetailsComponentInstance
             this.elements.btnLinkGoogleEl.classList.remove('disabled');
             this.elements.btnLinkGithubEl.classList.remove('disabled');
 
-            // Check if already linked
-            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'google' });
-            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'github' });
+            // Check if origin provider or linked
+            const originProvider = this.aggregatedDetails?.custodianProvider || this.ibGib?.data?.frameDetails?.custodianProvider;
+            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId: 'google' });
+            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId: 'github' });
+
+            const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
 
             // Google Card States
             const googleCard = this.elements.btnLinkGoogleEl;
@@ -464,11 +469,22 @@ export class KeystoneDetailsComponentInstance
             if (isGoogleLinked) {
                 googleCard.classList.remove('unlinked');
                 googleCard.classList.add('linked');
-                googleLabel.textContent = "Google Linked ✅";
+                const isOrigin = originProvider === 'google';
+                if (isOrigin && !caps.isSovereign) {
+                    googleLabel.textContent = "Google (Primary Account) 🔒";
+                    googleCard.title = "Cannot unlink primary account without first adding a Master Password below.";
+                } else if (isOrigin) {
+                    googleLabel.textContent = "Google (Primary Account) ✅";
+                    googleCard.title = "Click to unlink Google provider (requires Master Password).";
+                } else {
+                    googleLabel.textContent = "Google Linked ✅";
+                    googleCard.title = "Click to unlink Google provider.";
+                }
             } else {
                 googleCard.classList.remove('linked');
                 googleCard.classList.add('unlinked');
                 googleLabel.textContent = "Unlinked";
+                googleCard.title = "Click to link Google account.";
             }
 
             // GitHub Card States
@@ -477,15 +493,47 @@ export class KeystoneDetailsComponentInstance
             if (isGithubLinked) {
                 githubCard.classList.remove('unlinked');
                 githubCard.classList.add('linked');
-                githubLabel.textContent = "GitHub Linked ✅";
+                const isOrigin = originProvider === 'github';
+                if (isOrigin && !caps.isSovereign) {
+                    githubLabel.textContent = "GitHub (Primary Account) 🔒";
+                    githubCard.title = "Cannot unlink primary account without first adding a Master Password below.";
+                } else if (isOrigin) {
+                    githubLabel.textContent = "GitHub (Primary Account) ✅";
+                    githubCard.title = "Click to unlink GitHub provider (requires Master Password).";
+                } else {
+                    githubLabel.textContent = "GitHub Linked ✅";
+                    githubCard.title = "Click to unlink GitHub provider.";
+                }
             } else {
                 githubCard.classList.remove('linked');
                 githubCard.classList.add('unlinked');
                 githubLabel.textContent = "Unlinked";
+                githubCard.title = "Click to link GitHub account.";
             }
         }
     }
 
+    private updatePasswordCardView(): void {
+        const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+        const cardTitleEl = this.elements?.changePasswordCardEl?.querySelector('h3');
+        const cardDescEl = this.elements?.changePasswordCardEl?.querySelector('.description');
+        const currentPasswordGroup = this.elements?.inputCurrentPasswordEl?.closest('.form-group') as HTMLElement | null;
+        const btnChangePassword = this.elements?.btnChangePasswordEl;
+
+        const isCustodialOnly = caps.isCustodial && !caps.isSovereign;
+        if (isCustodialOnly) {
+            if (cardTitleEl) cardTitleEl.textContent = "Add Master Password";
+            if (cardDescEl) cardDescEl.textContent = "Establish sovereign ownership by adding a master password. This enables direct, independent cryptographic management without relying solely on custodian authentication.";
+            if (currentPasswordGroup) currentPasswordGroup.style.display = 'none';
+            if (btnChangePassword) btnChangePassword.textContent = "Add Master Password";
+        } else {
+            if (cardTitleEl) cardTitleEl.textContent = "Change Password";
+            if (cardDescEl) cardDescEl.textContent = "Rotate your local password that drives this identity. This will cryptographically evolve your primary identity and all registered user-owned delegate keystones to the new password.";
+            if (currentPasswordGroup) currentPasswordGroup.style.display = '';
+            if (btnChangePassword) btnChangePassword.textContent = "Update Password";
+        }
+    }
+
     private async updateFrameDetailsView(): Promise<void> {
         const lc = `${this.lc}[${this.updateFrameDetailsView.name}]`;
         try {
@@ -549,6 +597,7 @@ export class KeystoneDetailsComponentInstance
                             space
                         });
 
+                        this.aggregatedDetails = aggregated;
                         this.elements.identityAggrDetailsEl.textContent = aggregated ? pretty(aggregated) : '{}';
 
                         // Update Username and Description fields
@@ -556,16 +605,19 @@ export class KeystoneDetailsComponentInstance
                         this.elements.identityDescriptionEl.textContent = aggregated?.description || aggregated?.profile?.description || '-';
                     } catch (err) {
                         console.warn(`${lc} Error aggregating details: ${extractErrorMsg(err)}`);
+                        this.aggregatedDetails = undefined;
                         this.elements.identityAggrDetailsEl.textContent = '{}';
                         this.elements.identityNameEl.textContent = '-';
                         this.elements.identityDescriptionEl.textContent = '-';
                     }
                 } else {
+                    this.aggregatedDetails = undefined;
                     this.elements.identityAggrDetailsEl.textContent = '{}';
                     this.elements.identityNameEl.textContent = '-';
                     this.elements.identityDescriptionEl.textContent = '-';
                 }
             } else {
+                this.aggregatedDetails = undefined;
                 this.elements.identityAggrDetailsEl.textContent = '{}';
                 this.elements.identityNameEl.textContent = '-';
                 this.elements.identityDescriptionEl.textContent = '-';
@@ -591,17 +643,18 @@ export class KeystoneDetailsComponentInstance
             // Render Challenge Pools
             this.renderChallengePools(keystone.data?.challengePools || []);
 
-            // Render Delegates, SSO link, and Passphrase Change cards (only if this is a primary keystone, hide them for delegate/session keystones)
+            // Render Delegates, SSO link, and Password Change cards (only if this is a primary keystone, hide them for delegate/session keystones)
             const details = await this.getKeystoneDetails(this.ibGibAddr);
             if (details.isPrimary) {
                 this.elements.delegatesCardEl.classList.remove('hidden');
                 await this.renderDelegates(keystone.data?.delegates);
                 this.elements.ssoLinkCardEl.classList.remove('hidden');
-                this.elements.changePassphraseCardEl.classList.remove('hidden');
+                this.elements.changePasswordCardEl.classList.remove('hidden');
+                this.updatePasswordCardView();
             } else {
                 this.elements.delegatesCardEl.classList.add('hidden');
                 this.elements.ssoLinkCardEl.classList.add('hidden');
-                this.elements.changePassphraseCardEl.classList.add('hidden');
+                this.elements.changePasswordCardEl.classList.add('hidden');
             }
 
             this.updateActiveButtonState();
@@ -615,6 +668,7 @@ export class KeystoneDetailsComponentInstance
 
     private clearActiveDetails() {
         if (!this.elements) { return; }
+        this.aggregatedDetails = undefined;
         this.isHistoricalFrame = false;
         if (this.elements.historicalWarningBannerEl) {
             this.elements.historicalWarningBannerEl.classList.add('hidden');
@@ -804,43 +858,71 @@ export class KeystoneDetailsComponentInstance
         }
 
         const metaspace = await getGlobalMetaspace_waitIfNeeded();
-        let localSpaceId: string | undefined;
-        if (metaspace) {
-            const space = await metaspace.getLocalUserSpace({ lock: false });
-            if (space?.ib) {
-                localSpaceId = parseSpaceIb({ spaceIb: space.ib }).spaceId;
-            }
+        if (!metaspace) {
+            throw new Error(`(UNEXPECTED) metaspace falsy? (E: 8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3e)`);
+        }
+        const space = await metaspace.getLocalUserSpace({ lock: false });
+        if (!space) {
+            throw new Error(`(UNEXPECTED) space falsy? (E: 9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4f)`);
         }
+        const localSpaceId = space.ib ? parseSpaceIb({ spaceIb: space.ib }).spaceId : undefined;
 
         for (const [delegateTjpAddr, info] of Object.entries(delegates)) {
             const tr = document.createElement('tr');
 
-            const deviceName = info.deviceName || info.details?.deviceTag || info.details?.name || 'Device Delegate';
+            const deviceName = info.deviceName || (info as any).details?.deviceTag || (info as any).details?.name || 'Device Delegate';
             const tdName = document.createElement('td');
 
-            const delegateSpaceId = info.spaceId || info.details?.spaceId;
-            let badgeEl: HTMLSpanElement | null = null;
-
-            if (delegateSpaceId) {
-                badgeEl = document.createElement('span');
-                badgeEl.style.marginLeft = '0.5rem';
-                badgeEl.style.padding = '0.15rem 0.4rem';
-                badgeEl.style.borderRadius = '4px';
-                badgeEl.style.fontSize = '0.75rem';
-                badgeEl.style.fontWeight = 'bold';
-                if (localSpaceId && delegateSpaceId === localSpaceId) {
-                    badgeEl.textContent = 'This Device';
-                    badgeEl.className = 'badge badge-this-device';
-                    badgeEl.style.backgroundColor = '#1b5e20';
-                    badgeEl.style.color = '#a5d6a7';
-                } else {
-                    badgeEl.textContent = 'Remote Device';
-                    badgeEl.className = 'badge badge-remote-device';
-                    badgeEl.style.backgroundColor = '#0d47a1';
-                    badgeEl.style.color = '#90caf9';
+            const delegateSpaceId = info.spaceId || (info as any).details?.spaceId;
+
+            // Check if delegate is present in local space (via spaceId match or direct presence check)
+            let isThisDevice = false;
+            if (localSpaceId && delegateSpaceId === localSpaceId) {
+                isThisDevice = true;
+            } else {
+                try {
+                    const resGet = await metaspace.get({ addrs: [delegateTjpAddr], space });
+                    isThisDevice = !!(resGet.success && resGet.ibGibs && resGet.ibGibs.length > 0);
+                } catch {
+                    isThisDevice = false;
                 }
             }
 
+            const badgeEl = document.createElement('span');
+            badgeEl.style.marginLeft = '0.5rem';
+            badgeEl.style.padding = '0.15rem 0.4rem';
+            badgeEl.style.borderRadius = '4px';
+            badgeEl.style.fontSize = '0.75rem';
+            badgeEl.style.fontWeight = 'bold';
+
+            if (isThisDevice) {
+                badgeEl.textContent = 'This Device';
+                badgeEl.className = 'badge badge-this-device';
+                badgeEl.style.backgroundColor = '#1b5e20';
+                badgeEl.style.color = '#a5d6a7';
+            } else {
+                badgeEl.textContent = 'Remote Device';
+                badgeEl.className = 'badge badge-remote-device';
+                badgeEl.style.backgroundColor = '#0d47a1';
+                badgeEl.style.color = '#90caf9';
+            }
+
+            // Check expiration
+            const isExpired = isDelegateExpired({ delegateInfo: info });
+            let expiredBadgeEl: HTMLSpanElement | null = null;
+            if (isExpired) {
+                expiredBadgeEl = document.createElement('span');
+                expiredBadgeEl.textContent = 'Expired';
+                expiredBadgeEl.className = 'badge badge-expired';
+                expiredBadgeEl.style.marginLeft = '0.3rem';
+                expiredBadgeEl.style.padding = '0.15rem 0.4rem';
+                expiredBadgeEl.style.borderRadius = '4px';
+                expiredBadgeEl.style.fontSize = '0.75rem';
+                expiredBadgeEl.style.fontWeight = 'bold';
+                expiredBadgeEl.style.backgroundColor = '#b71c1c';
+                expiredBadgeEl.style.color = '#ef9a9a';
+            }
+
             const applyNameAndBadge = (displayName: string, hoverText?: string) => {
                 tdName.innerHTML = '';
                 const textSpan = document.createElement('span');
@@ -849,6 +931,9 @@ export class KeystoneDetailsComponentInstance
                 if (badgeEl) {
                     tdName.appendChild(badgeEl);
                 }
+                if (expiredBadgeEl) {
+                    tdName.appendChild(expiredBadgeEl);
+                }
                 tdName.title = hoverText || displayName;
             };
 
@@ -863,7 +948,7 @@ export class KeystoneDetailsComponentInstance
             tdVerbs.textContent = info.allowedVerbs ? info.allowedVerbs.join(', ') : '-';
             tdVerbs.title = tdVerbs.textContent;
 
-            const isRemote = !!(delegateSpaceId && localSpaceId && delegateSpaceId !== localSpaceId);
+            const isRemote = !isThisDevice;
 
             const tdActions = document.createElement('td');
             const btnView = document.createElement('button');
@@ -874,20 +959,20 @@ export class KeystoneDetailsComponentInstance
                 if (isRemote) {
                     this.showRemoteDelegateModal(info);
                 } else {
-                    if (info.delegateAddr) {
+                    if (info.delegateAddr || delegateTjpAddr) {
                         let addrToLoad = info.delegateAddr;
-                        if (metaspace) {
-                            const space = await metaspace.getLocalUserSpace({ lock: false });
-                            if (space) {
-                                try {
-                                    const latest = await metaspace.getLatestAddr({ addr: delegateTjpAddr, space });
-                                    if (latest) {
-                                        addrToLoad = latest;
-                                    }
-                                } catch (err) {
-                                    console.warn(`${lc} Error resolving latest delegate address: ${extractErrorMsg(err)}`);
-                                }
+                        try {
+                            const keystoneService = new KeystoneService_V1();
+                            const latestKeystone = await keystoneService.getLatestKeystone({
+                                addr: delegateTjpAddr,
+                                metaspace,
+                                space
+                            });
+                            if (latestKeystone) {
+                                addrToLoad = getIbGibAddr({ ibGib: latestKeystone });
                             }
+                        } catch (err) {
+                            console.warn(`${lc} Error resolving latest delegate keystone: ${extractErrorMsg(err)}`);
                         }
                         this.dispatchEvent(new CustomEvent('ibgib-view-keystone-details', {
                             detail: { addr: addrToLoad },
@@ -924,7 +1009,7 @@ export class KeystoneDetailsComponentInstance
             let masterSecret: string;
             try {
                 masterSecret = await promptForSecret({
-                    msg: `Enter Master Passphrase to revoke delegate '${deviceName}':`,
+                    msg: `Enter Master Password to revoke delegate '${deviceName}':`,
                     confirm: false
                 });
             } catch (err) {
@@ -1103,8 +1188,8 @@ export class KeystoneDetailsComponentInstance
             while (tries < maxTries && !isCorrect) {
                 try {
                     const promptMsg = tries === 0
-                        ? "Link successful! Enter your local Master Secret (Passphrase) to sign and register the custodian pool"
-                        : `Incorrect passphrase. Please try again (${maxTries - tries} tries remaining):`;
+                        ? "Link successful! Enter your local Master Secret (Password) to sign and register the custodian pool"
+                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
                     masterSecret = await promptForSecret({
                         msg: promptMsg,
                         confirm: false
@@ -1133,7 +1218,7 @@ export class KeystoneDetailsComponentInstance
             }
 
             if (!isCorrect) {
-                this.setSSOStatus("Link cancelled or failed (incorrect passphrase).", "error");
+                this.setSSOStatus("Link cancelled or failed (incorrect password).", "error");
                 return;
             }
 
@@ -1187,8 +1272,13 @@ export class KeystoneDetailsComponentInstance
     }
 
     protected async handleSSOClick(providerId: 'google' | 'github') {
-        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId });
+        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId });
         if (isLinked) {
+            const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+            if (!caps.isSovereign) {
+                this.setSSOStatus(`Cannot unlink ${providerId}: This is your only identity recovery and management method. Please add a Master Password first in the Password card below to enable sovereign ownership before unlinking.`, "error");
+                return;
+            }
             await this.handleSSOUnlink(providerId);
         } else {
             await this.handleSSOLink(providerId);
@@ -1200,7 +1290,7 @@ export class KeystoneDetailsComponentInstance
         this.setSSOStatus(`Unlinking ${providerId}...`, "info");
 
         try {
-            // 1. Prompt user for passphrase
+            // 1. Prompt user for password
             const keystoneService = new KeystoneService_V1();
             let masterSecret: string | undefined;
             let isCorrect = false;
@@ -1210,8 +1300,8 @@ export class KeystoneDetailsComponentInstance
             while (tries < maxTries && !isCorrect) {
                 try {
                     const promptMsg = tries === 0
-                        ? `Are you sure you want to unlink your ${providerId} account? If so, enter your local Master Secret (Passphrase) to authorize. Otherwise, click Cancel.`
-                        : `Incorrect passphrase. Please try again (${maxTries - tries} tries remaining):`;
+                        ? `Are you sure you want to unlink your ${providerId} account? If so, enter your local Master Secret (Password) to authorize. Otherwise, click Cancel.`
+                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
                     masterSecret = await promptForSecret({
                         msg: promptMsg,
                         confirm: false
@@ -1238,7 +1328,7 @@ export class KeystoneDetailsComponentInstance
             }
 
             if (!isCorrect) {
-                this.setSSOStatus("Unlink cancelled or failed (incorrect passphrase).", "error");
+                this.setSSOStatus("Unlink cancelled or failed (incorrect password).", "error");
                 return;
             }
 
@@ -1251,7 +1341,7 @@ export class KeystoneDetailsComponentInstance
 
             // 2. Evolve parent keystone to remove the custodian pool
             const targetPoolId = `custodian-manage-${providerId}`;
-            const evolvedParent = await keystoneService.removePools({
+            let evolvedParent = await keystoneService.removePools({
                 latestKeystone: this.ibGib!,
                 masterSecret: masterSecret!,
                 poolIds: [targetPoolId],
@@ -1259,6 +1349,22 @@ export class KeystoneDetailsComponentInstance
                 space
             });
 
+            // Unregister any corresponding outward delegate for this provider if present
+            const delegatesMap = this.ibGib?.data?.delegates;
+            if (delegatesMap) {
+                for (const [delegateTjpAddr, info] of Object.entries(delegatesMap)) {
+                    if (info.deviceName?.includes(providerId)) {
+                        evolvedParent = await keystoneService.unregisterDelegate({
+                            parentKeystone: evolvedParent,
+                            delegateTjpAddr,
+                            masterSecret: masterSecret!,
+                            metaspace,
+                            space,
+                        });
+                    }
+                }
+            }
+
             // 3. Sync evolved parent keystone back to server
             this.setSSOStatus("Publishing evolved identity keystone to server...", "info");
             const syncRes = await getApiBridge().putEvolveKeystone({
@@ -1292,49 +1398,211 @@ export class KeystoneDetailsComponentInstance
         }
     }
 
-    private setChangePassphraseStatus(msg: string, type: 'info' | 'success' | 'error') {
-        const el = this.elements!.changePassphraseStatusEl;
+    private setChangePasswordStatus(msg: string, type: 'info' | 'success' | 'error') {
+        const el = this.elements!.changePasswordStatusEl;
         el.textContent = msg;
         el.className = `status-msg ${type}`;
         el.classList.remove('hidden');
     }
 
-    protected async handleChangePassphrase(): Promise<void> {
-        const lc = `${this.lc}[${this.handleChangePassphrase.name}]`;
-        this.setChangePassphraseStatus("Validating entries...", "info");
+    protected async handleAddMasterPassword(): Promise<void> {
+        const lc = `${this.lc}[${this.handleAddMasterPassword.name}]`;
+        this.setChangePasswordStatus("Validating entries...", "info");
+
+        try {
+            const newPassword = this.elements!.inputNewPasswordEl.value;
+            const confirmPassword = this.elements!.inputConfirmPasswordEl.value;
+
+            if (!newPassword) {
+                this.setChangePasswordStatus("Master password is required.", "error");
+                return;
+            }
+            if (newPassword !== confirmPassword) {
+                this.setChangePasswordStatus("Master password and confirmation do not match.", "error");
+                return;
+            }
+
+            const initialManagePool = this.ibGib?.data?.challengePools?.find(p => p.id === POOL_ID_MANAGE);
+            if (!initialManagePool) {
+                this.setChangePasswordStatus("Primary keystone missing active manage challenge pool.", "error");
+                return;
+            }
+
+            this.showBusy({
+                isBusy: true,
+                title: 'Elevating Identity...',
+                msg: 'Generating cryptographic sovereign challenge pool...',
+                animationEmoji: '🔑'
+            });
+            this.setChangePasswordStatus("Generating sovereign challenge pool...", "info");
+            const newChallenges = await generatePoolChallenges({
+                config: initialManagePool.config,
+                masterSecret: newPassword,
+            });
+            const newManagePool = {
+                id: POOL_ID_MANAGE,
+                config: initialManagePool.config,
+                challenges: newChallenges,
+            };
+
+            const primaryTjpAddr = getTjpAddr({ ibGib: this.ibGib! }) || getIbGibAddr({ ibGib: this.ibGib! });
+            const custodianProvider = this.aggregatedDetails?.custodianProvider || 'google';
+
+            let requestBody: any = {
+                primaryTjpAddr,
+                newManagePool,
+            };
+
+            if (custodianProvider === 'google' || custodianProvider === 'github') {
+                this.showBusy({
+                    isBusy: true,
+                    title: 'Re-authenticating with Provider...',
+                    msg: `Please complete authentication in the ${custodianProvider} popup window...`,
+                    animationEmoji: '🔒'
+                });
+                this.setChangePasswordStatus(`Please authenticate in the popup with ${custodianProvider} to verify ownership...`, "info");
+                const resPopup = await executeSsoOAuthPopup({
+                    providerId: custodianProvider,
+                    parentTjpAddr: primaryTjpAddr,
+                });
+
+                if (!resPopup.success || !resPopup.code) {
+                    this.showBusy({ isBusy: false });
+                    this.setChangePasswordStatus(resPopup.message || "Re-authentication cancelled.", "error");
+                    return;
+                }
+
+                requestBody.providerId = custodianProvider;
+                requestBody.code = resPopup.code;
+                requestBody.redirectUri = resPopup.redirectUri;
+            } else {
+                this.showBusy({ isBusy: false });
+                // Email OTP fallback
+                const email = this.aggregatedDetails?.emails?.[0] || this.ibGib?.data?.emails?.[0];
+                const otpCode = await promptForSecret({
+                    msg: `Enter 6-digit verification code sent to ${email}:`,
+                    confirm: false,
+                });
+                if (!otpCode) {
+                    this.setChangePasswordStatus("Verification code required.", "error");
+                    return;
+                }
+                requestBody.email = email;
+                requestBody.code = otpCode;
+            }
+
+            this.showBusy({
+                isBusy: true,
+                title: 'Updating Keystone Timeline...',
+                msg: 'Publishing sovereign master password and evolving identity DAG...',
+                animationEmoji: '⏳'
+            });
+            this.setChangePasswordStatus("Elevating identity to sovereign master password on server...", "info");
+            const response = await fetch('/api/identity/custodian/add-master-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(requestBody),
+            });
+
+            const resJson = await response.json();
+            if (!response.ok || !resJson.success) {
+                throw new Error(resJson.error || resJson.message || `Server error (${response.status})`);
+            }
+
+            const evolvedParent = resJson.primaryKeystone;
+
+            // Save to local user space & metaspace
+            const metaspace = await getGlobalMetaspace_waitIfNeeded();
+            if (!metaspace) { throw new Error("Global metaspace not available"); }
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) { throw new Error("Local user space not available"); }
+
+            await metaspace.put({ ibGibs: [evolvedParent], space });
+            await metaspace.registerNewIbGib({ ibGib: evolvedParent, space });
+            await updateSpecialIndex({
+                type: "keystones",
+                rel8nInfos: [
+                    {
+                        rel8nName: "keystone",
+                        ibGibs: [toDto({ ibGib: evolvedParent })]
+                    }
+                ],
+                metaspace,
+                space
+            });
+
+            const evolvedAddr = getIbGibAddr({ ibGib: evolvedParent });
+
+            // Dispatch EVENT_IBGIB_IDENTITY_CHANGED
+            window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_CHANGED, {
+                detail: { activeIdentityAddr: evolvedAddr },
+                bubbles: true,
+                composed: true
+            }));
+
+            this.setChangePasswordStatus("Successfully added Master Password! Identity is now sovereign.", "success");
+
+            // Refresh the view
+            this.ibGibAddr = evolvedAddr;
+            this.staticIbGib = evolvedParent;
+            await this.loadIbGib({ getLatest: true });
+
+            // Clear inputs
+            this.elements!.inputNewPasswordEl.value = '';
+            this.elements!.inputConfirmPasswordEl.value = '';
+
+        } catch (error) {
+            console.error(`${lc} Elevation failed: ${extractErrorMsg(error)}`);
+            this.setChangePasswordStatus(`Failed to add master password: ${extractErrorMsg(error)}`, "error");
+        } finally {
+            this.showBusy({ isBusy: false });
+        }
+    }
+
+    protected async handleChangePassword(): Promise<void> {
+        const lc = `${this.lc}[${this.handleChangePassword.name}]`;
+
+        const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+        const isCustodialOnly = caps.isCustodial && !caps.isSovereign;
+        if (isCustodialOnly) {
+            await this.handleAddMasterPassword();
+            return;
+        }
+
+        this.setChangePasswordStatus("Validating entries...", "info");
 
         try {
-            const currentPassphrase = this.elements!.inputCurrentPassphraseEl.value;
-            const newPassphrase = this.elements!.inputNewPassphraseEl.value;
-            const confirmPassphrase = this.elements!.inputConfirmPassphraseEl.value;
+            const currentPassword = this.elements!.inputCurrentPasswordEl.value;
+            const newPassword = this.elements!.inputNewPasswordEl.value;
+            const confirmPassword = this.elements!.inputConfirmPasswordEl.value;
 
-            if (!currentPassphrase) {
-                this.setChangePassphraseStatus("Current passphrase is required.", "error");
+            if (!currentPassword) {
+                this.setChangePasswordStatus("Current password is required.", "error");
                 return;
             }
-            if (!newPassphrase) {
-                this.setChangePassphraseStatus("New passphrase is required.", "error");
+            if (!newPassword) {
+                this.setChangePasswordStatus("New password is required.", "error");
                 return;
             }
-            if (newPassphrase !== confirmPassphrase) {
-                this.setChangePassphraseStatus("New passphrase and confirmation do not match.", "error");
+            if (newPassword !== confirmPassword) {
+                this.setChangePasswordStatus("New password and confirmation do not match.", "error");
                 return;
             }
 
             const keystoneService = new KeystoneService_V1();
 
-            // 1. Verify current passphrase against parent manage pool
+            // 1. Verify current password against parent manage pool
             const isMatch = await keystoneService.verifySigningSecret({
                 keystoneIbGib: this.ibGib!,
-                signingSecret: currentPassphrase,
+                signingSecret: currentPassword,
                 poolId: 'manage'
             });
             if (!isMatch) {
-                this.setChangePassphraseStatus("Incorrect current passphrase.", "error");
+                this.setChangePasswordStatus("Incorrect current password.", "error");
                 return;
             }
 
-            this.setChangePassphraseStatus("Evolving primary identity keystone...", "info");
+            this.setChangePasswordStatus("Evolving primary identity keystone...", "info");
 
             const metaspace = await getGlobalMetaspace_waitIfNeeded();
             if (!metaspace) { throw new Error(`(UNEXPECTED) metaspace falsy? (E: 95e3c8374b0f088f339f5c5a8700f826)`); }
@@ -1346,15 +1614,15 @@ export class KeystoneDetailsComponentInstance
             const { newKeystone: evolvedParent, newDelegates: evolvedDelegates } =
                 await keystoneService.changePassword({
                     keystoneIbGib: this.ibGib!,
-                    newMasterSecret: newPassphrase,
-                    signingSecret: currentPassphrase,
+                    newMasterSecret: newPassword,
+                    signingSecret: currentPassword,
                     signingPoolId: 'manage',
                     metaspace,
                     space
                 });
             debugger; // look at evolvedDelegates
 
-            this.setChangePassphraseStatus("Resolving and rotating delegate keystones...", "info");
+            this.setChangePasswordStatus("Resolving and rotating delegate keystones...", "info");
 
             // // 3. Evolve registered delegate keystones (preserving custodian/foreign delegate secrets)
             // const delegates = this.ibGib!.data?.delegates || {};
@@ -1368,7 +1636,7 @@ export class KeystoneDetailsComponentInstance
             //         space,
             //     });
 
-            //     // Identify user-owned challenge pools in the delegate that match the old passphrase
+            //     // Identify user-owned challenge pools in the delegate that match the old password
             //     const poolsToRotate: string[] = [];
             //     for (const pool of delegateKeystone.data?.challengePools ?? []) {
             //         if (!pool.isForeign) {
@@ -1383,7 +1651,7 @@ export class KeystoneDetailsComponentInstance
             //              */
             //             const isPoolMatch = await keystoneService.verifySigningSecret({
             //                 keystoneIbGib: delegateKeystone,
-            //                 signingSecret: currentPassphrase,
+            //                 signingSecret: currentPassword,
             //                 poolId: pool.id
             //             });
             //             if (isPoolMatch) { poolsToRotate.push(pool.id); }
@@ -1394,8 +1662,8 @@ export class KeystoneDetailsComponentInstance
             //         console.log(`${lc} Rotating pools in delegate ${delegateInfo.delegateTjpAddr}: ${poolsToRotate.join(', ')}`);
             //         const {newKeystone: evolvedDelegate} = await keystoneService.changePassword({
             //             keystoneIbGib: delegateKeystone,
-            //             newMasterSecret: newPassphrase,
-            //             signingSecret: currentPassphrase,
+            //             newMasterSecret: newPassword,
+            //             signingSecret: currentPassword,
             //             signingPoolId: 'manage',
             //             poolIds: poolsToRotate,
             //             metaspace,
@@ -1406,7 +1674,7 @@ export class KeystoneDetailsComponentInstance
             // }
 
             // 4. Sync evolved parent and all evolved delegate keystones atomically
-            this.setChangePassphraseStatus("Syncing evolved keystones to server...", "info");
+            this.setChangePasswordStatus("Syncing evolved keystones to server...", "info");
             const parentTjpAddr = getIbGibAddr({ ibGib: this.ibGib! }); // is this.ibGib the tjp always? or is it the latest in the keystone line? Does it matter?
 
             const syncRes = await getApiBridge().putEvolveKeystone({
@@ -1419,7 +1687,7 @@ export class KeystoneDetailsComponentInstance
             }
 
             // 5. Update index locally
-            this.setChangePassphraseStatus("Updating local indexes...", "info");
+            this.setChangePasswordStatus("Updating local indexes...", "info");
             const newKeystoneIbGibs = [toDto({ ibGib: evolvedParent })];
             if (evolvedDelegates) {
                 evolvedDelegates.forEach(d => {
@@ -1440,16 +1708,16 @@ export class KeystoneDetailsComponentInstance
             });
 
             // Clear inputs
-            this.elements!.inputCurrentPassphraseEl.value = "";
-            this.elements!.inputNewPassphraseEl.value = "";
-            this.elements!.inputConfirmPassphraseEl.value = "";
+            this.elements!.inputCurrentPasswordEl.value = "";
+            this.elements!.inputNewPasswordEl.value = "";
+            this.elements!.inputConfirmPasswordEl.value = "";
 
-            this.setChangePassphraseStatus("Passphrase updated successfully!", "success");
+            this.setChangePasswordStatus("Password updated successfully!", "success");
             await this.loadIbGib({ getLatest: true });
 
         } catch (error) {
-            console.error(`${lc} Passphrase rotation failed: ${extractErrorMsg(error)}`);
-            this.setChangePassphraseStatus(`Update failed: ${extractErrorMsg(error)}`, "error");
+            console.error(`${lc} Password rotation failed: ${extractErrorMsg(error)}`);
+            this.setChangePasswordStatus(`Update failed: ${extractErrorMsg(error)}`, "error");
         }
     }
 }