@ibgib/web-gib 0.0.59 → 0.0.61

package/dist/ui/component/identity/keystone-details/keystone-details.mjs

@@ -15,7 +15,9 @@ import { parseSpaceIb } from "@ibgib/core-gib/dist/witness/space/space-helper.mj
 import { executeSsoOAuthPopup } from "../../../../identity/sso-popup-helper.mjs";
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
 import { promptForSecret } from "../../../../helpers.web.mjs";
-import { isSsoProviderLinked } from "../../../../identity/sso/sso-helpers.mjs";
+import { isSsoProviderLinked, getKeystoneCapabilities, isDelegateExpired } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
+import { generatePoolChallenges } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
+import { POOL_ID_MANAGE } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
 import { getGlobalMetaspace_waitIfNeeded } from "../../../../helpers.mjs";
 const logalot = false;
 export const KEYSTONE_DETAILS_COMPONENT_NAME = 'ibgib-keystone-details';
@@ -51,6 +53,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
     isHistoricalFrame = false;
     _onIdentityChanged = null;
     keystoneCache = new Map();
+    aggregatedDetails;
     constructor() {
         super();
     }
@@ -145,12 +148,12 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             this.elements.btnLinkGoogleEl = shadow.getElementById('btn-link-google');
             this.elements.btnLinkGithubEl = shadow.getElementById('btn-link-github');
             this.elements.ssoStatusMsgEl = shadow.getElementById('sso-status-msg');
-            this.elements.inputCurrentPassphraseEl = shadow.getElementById('input-current-passphrase');
-            this.elements.inputNewPassphraseEl = shadow.getElementById('input-new-passphrase');
-            this.elements.inputConfirmPassphraseEl = shadow.getElementById('input-confirm-passphrase');
-            this.elements.btnChangePassphraseEl = shadow.getElementById('btn-change-passphrase');
-            this.elements.changePassphraseStatusEl = shadow.getElementById('change-passphrase-status');
-            this.elements.changePassphraseCardEl = shadow.getElementById('change-passphrase-card');
+            this.elements.inputCurrentPasswordEl = shadow.getElementById('input-current-password');
+            this.elements.inputNewPasswordEl = shadow.getElementById('input-new-password');
+            this.elements.inputConfirmPasswordEl = shadow.getElementById('input-confirm-password');
+            this.elements.btnChangePasswordEl = shadow.getElementById('btn-change-password');
+            this.elements.changePasswordStatusEl = shadow.getElementById('change-password-status');
+            this.elements.changePasswordCardEl = shadow.getElementById('change-password-card');
             // ElementBase requires contentEl
             this.elements.contentEl = shadow.getElementById('identity-details-view');
             this.initHandlers();
@@ -190,7 +193,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         this.elements.btnUpdateIdentityEl.addEventListener('click', () => this.handleUpdateIdentity());
         this.elements.btnLinkGoogleEl.addEventListener('click', () => this.handleSSOClick('google'));
         this.elements.btnLinkGithubEl.addEventListener('click', () => this.handleSSOClick('github'));
-        this.elements.btnChangePassphraseEl.addEventListener('click', () => this.handleChangePassphrase());
+        this.elements.btnChangePasswordEl.addEventListener('click', () => this.handleChangePassword());
     }
     toggleAccordion() {
         const header = this.elements.rawAccordionHeaderEl;
@@ -394,21 +397,36 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             this.elements.btnSetActiveEl.disabled = isTimelineActive;
             this.elements.btnLinkGoogleEl.classList.remove('disabled');
             this.elements.btnLinkGithubEl.classList.remove('disabled');
-            // Check if already linked
-            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'google' });
-            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'github' });
+            // Check if origin provider or linked
+            const originProvider = this.aggregatedDetails?.custodianProvider || this.ibGib?.data?.frameDetails?.custodianProvider;
+            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId: 'google' });
+            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId: 'github' });
+            const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
             // Google Card States
             const googleCard = this.elements.btnLinkGoogleEl;
             const googleLabel = googleCard.querySelector('.toggle-state-text');
             if (isGoogleLinked) {
                 googleCard.classList.remove('unlinked');
                 googleCard.classList.add('linked');
-                googleLabel.textContent = "Google Linked ✅";
+                const isOrigin = originProvider === 'google';
+                if (isOrigin && !caps.isSovereign) {
+                    googleLabel.textContent = "Google (Primary Account) 🔒";
+                    googleCard.title = "Cannot unlink primary account without first adding a Master Password below.";
+                }
+                else if (isOrigin) {
+                    googleLabel.textContent = "Google (Primary Account) ✅";
+                    googleCard.title = "Click to unlink Google provider (requires Master Password).";
+                }
+                else {
+                    googleLabel.textContent = "Google Linked ✅";
+                    googleCard.title = "Click to unlink Google provider.";
+                }
             }
             else {
                 googleCard.classList.remove('linked');
                 googleCard.classList.add('unlinked');
                 googleLabel.textContent = "Unlinked";
+                googleCard.title = "Click to link Google account.";
             }
             // GitHub Card States
             const githubCard = this.elements.btnLinkGithubEl;
@@ -416,15 +434,56 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             if (isGithubLinked) {
                 githubCard.classList.remove('unlinked');
                 githubCard.classList.add('linked');
-                githubLabel.textContent = "GitHub Linked ✅";
+                const isOrigin = originProvider === 'github';
+                if (isOrigin && !caps.isSovereign) {
+                    githubLabel.textContent = "GitHub (Primary Account) 🔒";
+                    githubCard.title = "Cannot unlink primary account without first adding a Master Password below.";
+                }
+                else if (isOrigin) {
+                    githubLabel.textContent = "GitHub (Primary Account) ✅";
+                    githubCard.title = "Click to unlink GitHub provider (requires Master Password).";
+                }
+                else {
+                    githubLabel.textContent = "GitHub Linked ✅";
+                    githubCard.title = "Click to unlink GitHub provider.";
+                }
             }
             else {
                 githubCard.classList.remove('linked');
                 githubCard.classList.add('unlinked');
                 githubLabel.textContent = "Unlinked";
+                githubCard.title = "Click to link GitHub account.";
             }
         }
     }
+    updatePasswordCardView() {
+        const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+        const cardTitleEl = this.elements?.changePasswordCardEl?.querySelector('h3');
+        const cardDescEl = this.elements?.changePasswordCardEl?.querySelector('.description');
+        const currentPasswordGroup = this.elements?.inputCurrentPasswordEl?.closest('.form-group');
+        const btnChangePassword = this.elements?.btnChangePasswordEl;
+        const isCustodialOnly = caps.isCustodial && !caps.isSovereign;
+        if (isCustodialOnly) {
+            if (cardTitleEl)
+                cardTitleEl.textContent = "Add Master Password";
+            if (cardDescEl)
+                cardDescEl.textContent = "Establish sovereign ownership by adding a master password. This enables direct, independent cryptographic management without relying solely on custodian authentication.";
+            if (currentPasswordGroup)
+                currentPasswordGroup.style.display = 'none';
+            if (btnChangePassword)
+                btnChangePassword.textContent = "Add Master Password";
+        }
+        else {
+            if (cardTitleEl)
+                cardTitleEl.textContent = "Change Password";
+            if (cardDescEl)
+                cardDescEl.textContent = "Rotate your local password that drives this identity. This will cryptographically evolve your primary identity and all registered user-owned delegate keystones to the new password.";
+            if (currentPasswordGroup)
+                currentPasswordGroup.style.display = '';
+            if (btnChangePassword)
+                btnChangePassword.textContent = "Update Password";
+        }
+    }
     async updateFrameDetailsView() {
         const lc = `${this.lc}[${this.updateFrameDetailsView.name}]`;
         try {
@@ -484,6 +543,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                             metaspace,
                             space
                         });
+                        this.aggregatedDetails = aggregated;
                         this.elements.identityAggrDetailsEl.textContent = aggregated ? pretty(aggregated) : '{}';
                         // Update Username and Description fields
                         this.elements.identityNameEl.textContent = aggregated?.username || aggregated?.profile?.name || aggregated?.name || '-';
@@ -491,18 +551,21 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                     }
                     catch (err) {
                         console.warn(`${lc} Error aggregating details: ${extractErrorMsg(err)}`);
+                        this.aggregatedDetails = undefined;
                         this.elements.identityAggrDetailsEl.textContent = '{}';
                         this.elements.identityNameEl.textContent = '-';
                         this.elements.identityDescriptionEl.textContent = '-';
                     }
                 }
                 else {
+                    this.aggregatedDetails = undefined;
                     this.elements.identityAggrDetailsEl.textContent = '{}';
                     this.elements.identityNameEl.textContent = '-';
                     this.elements.identityDescriptionEl.textContent = '-';
                 }
             }
             else {
+                this.aggregatedDetails = undefined;
                 this.elements.identityAggrDetailsEl.textContent = '{}';
                 this.elements.identityNameEl.textContent = '-';
                 this.elements.identityDescriptionEl.textContent = '-';
@@ -525,18 +588,19 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             this.elements.rawKeystoneJsonEl.textContent = pretty(keystone);
             // Render Challenge Pools
             this.renderChallengePools(keystone.data?.challengePools || []);
-            // Render Delegates, SSO link, and Passphrase Change cards (only if this is a primary keystone, hide them for delegate/session keystones)
+            // Render Delegates, SSO link, and Password Change cards (only if this is a primary keystone, hide them for delegate/session keystones)
             const details = await this.getKeystoneDetails(this.ibGibAddr);
             if (details.isPrimary) {
                 this.elements.delegatesCardEl.classList.remove('hidden');
                 await this.renderDelegates(keystone.data?.delegates);
                 this.elements.ssoLinkCardEl.classList.remove('hidden');
-                this.elements.changePassphraseCardEl.classList.remove('hidden');
+                this.elements.changePasswordCardEl.classList.remove('hidden');
+                this.updatePasswordCardView();
             }
             else {
                 this.elements.delegatesCardEl.classList.add('hidden');
                 this.elements.ssoLinkCardEl.classList.add('hidden');
-                this.elements.changePassphraseCardEl.classList.add('hidden');
+                this.elements.changePasswordCardEl.classList.add('hidden');
             }
             this.updateActiveButtonState();
         }
@@ -554,6 +618,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         if (!this.elements) {
             return;
         }
+        this.aggregatedDetails = undefined;
         this.isHistoricalFrame = false;
         if (this.elements.historicalWarningBannerEl) {
             this.elements.historicalWarningBannerEl.classList.add('hidden');
@@ -730,39 +795,66 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             return;
         }
         const metaspace = await getGlobalMetaspace_waitIfNeeded();
-        let localSpaceId;
-        if (metaspace) {
-            const space = await metaspace.getLocalUserSpace({ lock: false });
-            if (space?.ib) {
-                localSpaceId = parseSpaceIb({ spaceIb: space.ib }).spaceId;
-            }
+        if (!metaspace) {
+            throw new Error(`(UNEXPECTED) metaspace falsy? (E: 8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3e)`);
+        }
+        const space = await metaspace.getLocalUserSpace({ lock: false });
+        if (!space) {
+            throw new Error(`(UNEXPECTED) space falsy? (E: 9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4f)`);
         }
+        const localSpaceId = space.ib ? parseSpaceIb({ spaceIb: space.ib }).spaceId : undefined;
         for (const [delegateTjpAddr, info] of Object.entries(delegates)) {
             const tr = document.createElement('tr');
             const deviceName = info.deviceName || info.details?.deviceTag || info.details?.name || 'Device Delegate';
             const tdName = document.createElement('td');
             const delegateSpaceId = info.spaceId || info.details?.spaceId;
-            let badgeEl = null;
-            if (delegateSpaceId) {
-                badgeEl = document.createElement('span');
-                badgeEl.style.marginLeft = '0.5rem';
-                badgeEl.style.padding = '0.15rem 0.4rem';
-                badgeEl.style.borderRadius = '4px';
-                badgeEl.style.fontSize = '0.75rem';
-                badgeEl.style.fontWeight = 'bold';
-                if (localSpaceId && delegateSpaceId === localSpaceId) {
-                    badgeEl.textContent = 'This Device';
-                    badgeEl.className = 'badge badge-this-device';
-                    badgeEl.style.backgroundColor = '#1b5e20';
-                    badgeEl.style.color = '#a5d6a7';
+            // Check if delegate is present in local space (via spaceId match or direct presence check)
+            let isThisDevice = false;
+            if (localSpaceId && delegateSpaceId === localSpaceId) {
+                isThisDevice = true;
+            }
+            else {
+                try {
+                    const resGet = await metaspace.get({ addrs: [delegateTjpAddr], space });
+                    isThisDevice = !!(resGet.success && resGet.ibGibs && resGet.ibGibs.length > 0);
                 }
-                else {
-                    badgeEl.textContent = 'Remote Device';
-                    badgeEl.className = 'badge badge-remote-device';
-                    badgeEl.style.backgroundColor = '#0d47a1';
-                    badgeEl.style.color = '#90caf9';
+                catch {
+                    isThisDevice = false;
                 }
             }
+            const badgeEl = document.createElement('span');
+            badgeEl.style.marginLeft = '0.5rem';
+            badgeEl.style.padding = '0.15rem 0.4rem';
+            badgeEl.style.borderRadius = '4px';
+            badgeEl.style.fontSize = '0.75rem';
+            badgeEl.style.fontWeight = 'bold';
+            if (isThisDevice) {
+                badgeEl.textContent = 'This Device';
+                badgeEl.className = 'badge badge-this-device';
+                badgeEl.style.backgroundColor = '#1b5e20';
+                badgeEl.style.color = '#a5d6a7';
+            }
+            else {
+                badgeEl.textContent = 'Remote Device';
+                badgeEl.className = 'badge badge-remote-device';
+                badgeEl.style.backgroundColor = '#0d47a1';
+                badgeEl.style.color = '#90caf9';
+            }
+            // Check expiration
+            const isExpired = isDelegateExpired({ delegateInfo: info });
+            let expiredBadgeEl = null;
+            if (isExpired) {
+                expiredBadgeEl = document.createElement('span');
+                expiredBadgeEl.textContent = 'Expired';
+                expiredBadgeEl.className = 'badge badge-expired';
+                expiredBadgeEl.style.marginLeft = '0.3rem';
+                expiredBadgeEl.style.padding = '0.15rem 0.4rem';
+                expiredBadgeEl.style.borderRadius = '4px';
+                expiredBadgeEl.style.fontSize = '0.75rem';
+                expiredBadgeEl.style.fontWeight = 'bold';
+                expiredBadgeEl.style.backgroundColor = '#b71c1c';
+                expiredBadgeEl.style.color = '#ef9a9a';
+            }
             const applyNameAndBadge = (displayName, hoverText) => {
                 tdName.innerHTML = '';
                 const textSpan = document.createElement('span');
@@ -771,6 +863,9 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 if (badgeEl) {
                     tdName.appendChild(badgeEl);
                 }
+                if (expiredBadgeEl) {
+                    tdName.appendChild(expiredBadgeEl);
+                }
                 tdName.title = hoverText || displayName;
             };
             const displayName = `💻 ${deviceName}`;
@@ -781,7 +876,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             const tdVerbs = document.createElement('td');
             tdVerbs.textContent = info.allowedVerbs ? info.allowedVerbs.join(', ') : '-';
             tdVerbs.title = tdVerbs.textContent;
-            const isRemote = !!(delegateSpaceId && localSpaceId && delegateSpaceId !== localSpaceId);
+            const isRemote = !isThisDevice;
             const tdActions = document.createElement('td');
             const btnView = document.createElement('button');
             btnView.className = 'action-btn secondary small';
@@ -792,22 +887,22 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                     this.showRemoteDelegateModal(info);
                 }
                 else {
-                    if (info.delegateAddr) {
+                    if (info.delegateAddr || delegateTjpAddr) {
                         let addrToLoad = info.delegateAddr;
-                        if (metaspace) {
-                            const space = await metaspace.getLocalUserSpace({ lock: false });
-                            if (space) {
-                                try {
-                                    const latest = await metaspace.getLatestAddr({ addr: delegateTjpAddr, space });
-                                    if (latest) {
-                                        addrToLoad = latest;
-                                    }
-                                }
-                                catch (err) {
-                                    console.warn(`${lc} Error resolving latest delegate address: ${extractErrorMsg(err)}`);
-                                }
+                        try {
+                            const keystoneService = new KeystoneService_V1();
+                            const latestKeystone = await keystoneService.getLatestKeystone({
+                                addr: delegateTjpAddr,
+                                metaspace,
+                                space
+                            });
+                            if (latestKeystone) {
+                                addrToLoad = getIbGibAddr({ ibGib: latestKeystone });
                             }
                         }
+                        catch (err) {
+                            console.warn(`${lc} Error resolving latest delegate keystone: ${extractErrorMsg(err)}`);
+                        }
                         this.dispatchEvent(new CustomEvent('ibgib-view-keystone-details', {
                             detail: { addr: addrToLoad },
                             bubbles: true,
@@ -841,7 +936,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             let masterSecret;
             try {
                 masterSecret = await promptForSecret({
-                    msg: `Enter Master Passphrase to revoke delegate '${deviceName}':`,
+                    msg: `Enter Master Password to revoke delegate '${deviceName}':`,
                     confirm: false
                 });
             }
@@ -1011,8 +1106,8 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             while (tries < maxTries && !isCorrect) {
                 try {
                     const promptMsg = tries === 0
-                        ? "Link successful! Enter your local Master Secret (Passphrase) to sign and register the custodian pool"
-                        : `Incorrect passphrase. Please try again (${maxTries - tries} tries remaining):`;
+                        ? "Link successful! Enter your local Master Secret (Password) to sign and register the custodian pool"
+                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
                     masterSecret = await promptForSecret({
                         msg: promptMsg,
                         confirm: false
@@ -1040,7 +1135,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 }
             }
             if (!isCorrect) {
-                this.setSSOStatus("Link cancelled or failed (incorrect passphrase).", "error");
+                this.setSSOStatus("Link cancelled or failed (incorrect password).", "error");
                 return;
             }
             this.setSSOStatus("Evolving identity locally and generating cryptographic signatures...", "info");
@@ -1090,8 +1185,13 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         }
     }
     async handleSSOClick(providerId) {
-        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId });
+        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId });
         if (isLinked) {
+            const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+            if (!caps.isSovereign) {
+                this.setSSOStatus(`Cannot unlink ${providerId}: This is your only identity recovery and management method. Please add a Master Password first in the Password card below to enable sovereign ownership before unlinking.`, "error");
+                return;
+            }
             await this.handleSSOUnlink(providerId);
         }
         else {
@@ -1102,7 +1202,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         const lc = `${this.lc}[${this.handleSSOUnlink.name}]`;
         this.setSSOStatus(`Unlinking ${providerId}...`, "info");
         try {
-            // 1. Prompt user for passphrase
+            // 1. Prompt user for password
             const keystoneService = new KeystoneService_V1();
             let masterSecret;
             let isCorrect = false;
@@ -1111,8 +1211,8 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             while (tries < maxTries && !isCorrect) {
                 try {
                     const promptMsg = tries === 0
-                        ? `Are you sure you want to unlink your ${providerId} account? If so, enter your local Master Secret (Passphrase) to authorize. Otherwise, click Cancel.`
-                        : `Incorrect passphrase. Please try again (${maxTries - tries} tries remaining):`;
+                        ? `Are you sure you want to unlink your ${providerId} account? If so, enter your local Master Secret (Password) to authorize. Otherwise, click Cancel.`
+                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
                     masterSecret = await promptForSecret({
                         msg: promptMsg,
                         confirm: false
@@ -1136,7 +1236,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 }
             }
             if (!isCorrect) {
-                this.setSSOStatus("Unlink cancelled or failed (incorrect passphrase).", "error");
+                this.setSSOStatus("Unlink cancelled or failed (incorrect password).", "error");
                 return;
             }
             this.setSSOStatus("Evolving identity locally and removing custodian pool...", "info");
@@ -1149,13 +1249,28 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             }
             // 2. Evolve parent keystone to remove the custodian pool
             const targetPoolId = `custodian-manage-${providerId}`;
-            const evolvedParent = await keystoneService.removePools({
+            let evolvedParent = await keystoneService.removePools({
                 latestKeystone: this.ibGib,
                 masterSecret: masterSecret,
                 poolIds: [targetPoolId],
                 metaspace,
                 space
             });
+            // Unregister any corresponding outward delegate for this provider if present
+            const delegatesMap = this.ibGib?.data?.delegates;
+            if (delegatesMap) {
+                for (const [delegateTjpAddr, info] of Object.entries(delegatesMap)) {
+                    if (info.deviceName?.includes(providerId)) {
+                        evolvedParent = await keystoneService.unregisterDelegate({
+                            parentKeystone: evolvedParent,
+                            delegateTjpAddr,
+                            masterSecret: masterSecret,
+                            metaspace,
+                            space,
+                        });
+                    }
+                }
+            }
             // 3. Sync evolved parent keystone back to server
             this.setSSOStatus("Publishing evolved identity keystone to server...", "info");
             const syncRes = await getApiBridge().putEvolveKeystone({
@@ -1186,43 +1301,189 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             this.setSSOStatus(`Unlink failed: ${extractErrorMsg(error)}`, "error");
         }
     }
-    setChangePassphraseStatus(msg, type) {
-        const el = this.elements.changePassphraseStatusEl;
+    setChangePasswordStatus(msg, type) {
+        const el = this.elements.changePasswordStatusEl;
         el.textContent = msg;
         el.className = `status-msg ${type}`;
         el.classList.remove('hidden');
     }
-    async handleChangePassphrase() {
-        const lc = `${this.lc}[${this.handleChangePassphrase.name}]`;
-        this.setChangePassphraseStatus("Validating entries...", "info");
+    async handleAddMasterPassword() {
+        const lc = `${this.lc}[${this.handleAddMasterPassword.name}]`;
+        this.setChangePasswordStatus("Validating entries...", "info");
+        try {
+            const newPassword = this.elements.inputNewPasswordEl.value;
+            const confirmPassword = this.elements.inputConfirmPasswordEl.value;
+            if (!newPassword) {
+                this.setChangePasswordStatus("Master password is required.", "error");
+                return;
+            }
+            if (newPassword !== confirmPassword) {
+                this.setChangePasswordStatus("Master password and confirmation do not match.", "error");
+                return;
+            }
+            const initialManagePool = this.ibGib?.data?.challengePools?.find(p => p.id === POOL_ID_MANAGE);
+            if (!initialManagePool) {
+                this.setChangePasswordStatus("Primary keystone missing active manage challenge pool.", "error");
+                return;
+            }
+            this.showBusy({
+                isBusy: true,
+                title: 'Elevating Identity...',
+                msg: 'Generating cryptographic sovereign challenge pool...',
+                animationEmoji: '🔑'
+            });
+            this.setChangePasswordStatus("Generating sovereign challenge pool...", "info");
+            const newChallenges = await generatePoolChallenges({
+                config: initialManagePool.config,
+                masterSecret: newPassword,
+            });
+            const newManagePool = {
+                id: POOL_ID_MANAGE,
+                config: initialManagePool.config,
+                challenges: newChallenges,
+            };
+            const primaryTjpAddr = getTjpAddr({ ibGib: this.ibGib }) || getIbGibAddr({ ibGib: this.ibGib });
+            const custodianProvider = this.aggregatedDetails?.custodianProvider || 'google';
+            let requestBody = {
+                primaryTjpAddr,
+                newManagePool,
+            };
+            if (custodianProvider === 'google' || custodianProvider === 'github') {
+                this.showBusy({
+                    isBusy: true,
+                    title: 'Re-authenticating with Provider...',
+                    msg: `Please complete authentication in the ${custodianProvider} popup window...`,
+                    animationEmoji: '🔒'
+                });
+                this.setChangePasswordStatus(`Please authenticate in the popup with ${custodianProvider} to verify ownership...`, "info");
+                const resPopup = await executeSsoOAuthPopup({
+                    providerId: custodianProvider,
+                    parentTjpAddr: primaryTjpAddr,
+                });
+                if (!resPopup.success || !resPopup.code) {
+                    this.showBusy({ isBusy: false });
+                    this.setChangePasswordStatus(resPopup.message || "Re-authentication cancelled.", "error");
+                    return;
+                }
+                requestBody.providerId = custodianProvider;
+                requestBody.code = resPopup.code;
+                requestBody.redirectUri = resPopup.redirectUri;
+            }
+            else {
+                this.showBusy({ isBusy: false });
+                // Email OTP fallback
+                const email = this.aggregatedDetails?.emails?.[0] || this.ibGib?.data?.emails?.[0];
+                const otpCode = await promptForSecret({
+                    msg: `Enter 6-digit verification code sent to ${email}:`,
+                    confirm: false,
+                });
+                if (!otpCode) {
+                    this.setChangePasswordStatus("Verification code required.", "error");
+                    return;
+                }
+                requestBody.email = email;
+                requestBody.code = otpCode;
+            }
+            this.showBusy({
+                isBusy: true,
+                title: 'Updating Keystone Timeline...',
+                msg: 'Publishing sovereign master password and evolving identity DAG...',
+                animationEmoji: '⏳'
+            });
+            this.setChangePasswordStatus("Elevating identity to sovereign master password on server...", "info");
+            const response = await fetch('/api/identity/custodian/add-master-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(requestBody),
+            });
+            const resJson = await response.json();
+            if (!response.ok || !resJson.success) {
+                throw new Error(resJson.error || resJson.message || `Server error (${response.status})`);
+            }
+            const evolvedParent = resJson.primaryKeystone;
+            // Save to local user space & metaspace
+            const metaspace = await getGlobalMetaspace_waitIfNeeded();
+            if (!metaspace) {
+                throw new Error("Global metaspace not available");
+            }
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) {
+                throw new Error("Local user space not available");
+            }
+            await metaspace.put({ ibGibs: [evolvedParent], space });
+            await metaspace.registerNewIbGib({ ibGib: evolvedParent, space });
+            await updateSpecialIndex({
+                type: "keystones",
+                rel8nInfos: [
+                    {
+                        rel8nName: "keystone",
+                        ibGibs: [toDto({ ibGib: evolvedParent })]
+                    }
+                ],
+                metaspace,
+                space
+            });
+            const evolvedAddr = getIbGibAddr({ ibGib: evolvedParent });
+            // Dispatch EVENT_IBGIB_IDENTITY_CHANGED
+            window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_CHANGED, {
+                detail: { activeIdentityAddr: evolvedAddr },
+                bubbles: true,
+                composed: true
+            }));
+            this.setChangePasswordStatus("Successfully added Master Password! Identity is now sovereign.", "success");
+            // Refresh the view
+            this.ibGibAddr = evolvedAddr;
+            this.staticIbGib = evolvedParent;
+            await this.loadIbGib({ getLatest: true });
+            // Clear inputs
+            this.elements.inputNewPasswordEl.value = '';
+            this.elements.inputConfirmPasswordEl.value = '';
+        }
+        catch (error) {
+            console.error(`${lc} Elevation failed: ${extractErrorMsg(error)}`);
+            this.setChangePasswordStatus(`Failed to add master password: ${extractErrorMsg(error)}`, "error");
+        }
+        finally {
+            this.showBusy({ isBusy: false });
+        }
+    }
+    async handleChangePassword() {
+        const lc = `${this.lc}[${this.handleChangePassword.name}]`;
+        const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+        const isCustodialOnly = caps.isCustodial && !caps.isSovereign;
+        if (isCustodialOnly) {
+            await this.handleAddMasterPassword();
+            return;
+        }
+        this.setChangePasswordStatus("Validating entries...", "info");
         try {
-            const currentPassphrase = this.elements.inputCurrentPassphraseEl.value;
-            const newPassphrase = this.elements.inputNewPassphraseEl.value;
-            const confirmPassphrase = this.elements.inputConfirmPassphraseEl.value;
-            if (!currentPassphrase) {
-                this.setChangePassphraseStatus("Current passphrase is required.", "error");
+            const currentPassword = this.elements.inputCurrentPasswordEl.value;
+            const newPassword = this.elements.inputNewPasswordEl.value;
+            const confirmPassword = this.elements.inputConfirmPasswordEl.value;
+            if (!currentPassword) {
+                this.setChangePasswordStatus("Current password is required.", "error");
                 return;
             }
-            if (!newPassphrase) {
-                this.setChangePassphraseStatus("New passphrase is required.", "error");
+            if (!newPassword) {
+                this.setChangePasswordStatus("New password is required.", "error");
                 return;
             }
-            if (newPassphrase !== confirmPassphrase) {
-                this.setChangePassphraseStatus("New passphrase and confirmation do not match.", "error");
+            if (newPassword !== confirmPassword) {
+                this.setChangePasswordStatus("New password and confirmation do not match.", "error");
                 return;
             }
             const keystoneService = new KeystoneService_V1();
-            // 1. Verify current passphrase against parent manage pool
+            // 1. Verify current password against parent manage pool
             const isMatch = await keystoneService.verifySigningSecret({
                 keystoneIbGib: this.ibGib,
-                signingSecret: currentPassphrase,
+                signingSecret: currentPassword,
                 poolId: 'manage'
             });
             if (!isMatch) {
-                this.setChangePassphraseStatus("Incorrect current passphrase.", "error");
+                this.setChangePasswordStatus("Incorrect current password.", "error");
                 return;
             }
-            this.setChangePassphraseStatus("Evolving primary identity keystone...", "info");
+            this.setChangePasswordStatus("Evolving primary identity keystone...", "info");
             const metaspace = await getGlobalMetaspace_waitIfNeeded();
             if (!metaspace) {
                 throw new Error(`(UNEXPECTED) metaspace falsy? (E: 95e3c8374b0f088f339f5c5a8700f826)`);
@@ -1235,14 +1496,14 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             debugger; // walk through this...looking for delegate failure // hmm...I thought we got change password going?
             const { newKeystone: evolvedParent, newDelegates: evolvedDelegates } = await keystoneService.changePassword({
                 keystoneIbGib: this.ibGib,
-                newMasterSecret: newPassphrase,
-                signingSecret: currentPassphrase,
+                newMasterSecret: newPassword,
+                signingSecret: currentPassword,
                 signingPoolId: 'manage',
                 metaspace,
                 space
             });
             debugger; // look at evolvedDelegates
-            this.setChangePassphraseStatus("Resolving and rotating delegate keystones...", "info");
+            this.setChangePasswordStatus("Resolving and rotating delegate keystones...", "info");
             // // 3. Evolve registered delegate keystones (preserving custodian/foreign delegate secrets)
             // const delegates = this.ibGib!.data?.delegates || {};
             // const evolvedDelegates: KeystoneIbGib_V1[] = [];
@@ -1253,7 +1514,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             //         metaspace,
             //         space,
             //     });
-            //     // Identify user-owned challenge pools in the delegate that match the old passphrase
+            //     // Identify user-owned challenge pools in the delegate that match the old password
             //     const poolsToRotate: string[] = [];
             //     for (const pool of delegateKeystone.data?.challengePools ?? []) {
             //         if (!pool.isForeign) {
@@ -1268,7 +1529,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             //              */
             //             const isPoolMatch = await keystoneService.verifySigningSecret({
             //                 keystoneIbGib: delegateKeystone,
-            //                 signingSecret: currentPassphrase,
+            //                 signingSecret: currentPassword,
             //                 poolId: pool.id
             //             });
             //             if (isPoolMatch) { poolsToRotate.push(pool.id); }
@@ -1278,8 +1539,8 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             //         console.log(`${lc} Rotating pools in delegate ${delegateInfo.delegateTjpAddr}: ${poolsToRotate.join(', ')}`);
             //         const {newKeystone: evolvedDelegate} = await keystoneService.changePassword({
             //             keystoneIbGib: delegateKeystone,
-            //             newMasterSecret: newPassphrase,
-            //             signingSecret: currentPassphrase,
+            //             newMasterSecret: newPassword,
+            //             signingSecret: currentPassword,
             //             signingPoolId: 'manage',
             //             poolIds: poolsToRotate,
             //             metaspace,
@@ -1289,7 +1550,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             //     }
             // }
             // 4. Sync evolved parent and all evolved delegate keystones atomically
-            this.setChangePassphraseStatus("Syncing evolved keystones to server...", "info");
+            this.setChangePasswordStatus("Syncing evolved keystones to server...", "info");
             const parentTjpAddr = getIbGibAddr({ ibGib: this.ibGib }); // is this.ibGib the tjp always? or is it the latest in the keystone line? Does it matter?
             const syncRes = await getApiBridge().putEvolveKeystone({
                 domainAddr: parentTjpAddr,
@@ -1300,7 +1561,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 throw new Error(`Server synchronization rejected: ${syncRes.message}`);
             }
             // 5. Update index locally
-            this.setChangePassphraseStatus("Updating local indexes...", "info");
+            this.setChangePasswordStatus("Updating local indexes...", "info");
             const newKeystoneIbGibs = [toDto({ ibGib: evolvedParent })];
             if (evolvedDelegates) {
                 evolvedDelegates.forEach(d => {
@@ -1320,15 +1581,15 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 space
             });
             // Clear inputs
-            this.elements.inputCurrentPassphraseEl.value = "";
-            this.elements.inputNewPassphraseEl.value = "";
-            this.elements.inputConfirmPassphraseEl.value = "";
-            this.setChangePassphraseStatus("Passphrase updated successfully!", "success");
+            this.elements.inputCurrentPasswordEl.value = "";
+            this.elements.inputNewPasswordEl.value = "";
+            this.elements.inputConfirmPasswordEl.value = "";
+            this.setChangePasswordStatus("Password updated successfully!", "success");
             await this.loadIbGib({ getLatest: true });
         }
         catch (error) {
-            console.error(`${lc} Passphrase rotation failed: ${extractErrorMsg(error)}`);
-            this.setChangePassphraseStatus(`Update failed: ${extractErrorMsg(error)}`, "error");
+            console.error(`${lc} Password rotation failed: ${extractErrorMsg(error)}`);
+            this.setChangePasswordStatus(`Update failed: ${extractErrorMsg(error)}`, "error");
         }
     }
 }