@ibgib/web-gib 0.0.60 → 0.0.61

package/src/ui/component/identity/keystone-details/keystone-details.mts

@@ -23,10 +23,11 @@ import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.m
 import { getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { parseSpaceIb } from "@ibgib/core-gib/dist/witness/space/space-helper.mjs";
 import { executeSsoOAuthPopup } from "../../../../identity/sso-popup-helper.mjs";
-
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
 import { promptForSecret } from "../../../../helpers.web.mjs";
-import { isSsoProviderLinked } from "../../../../identity/sso/sso-helpers.mjs";
+import { isSsoProviderLinked, getKeystoneCapabilities, isDelegateExpired } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
+import { generatePoolChallenges } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
+import { POOL_ID_MANAGE } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
 import { getGlobalMetaspace_waitIfNeeded } from "../../../../helpers.mjs";
 
 const logalot = false;
@@ -118,6 +119,7 @@ export class KeystoneDetailsComponentInstance
     private isHistoricalFrame: boolean = false;
     private _onIdentityChanged: ((e: any) => void) | null = null;
     private keystoneCache: Map<string, { username: string, description: string, isPrimary: boolean, n: number }> = new Map();
+    private aggregatedDetails?: any;
 
     constructor() {
         super();
@@ -454,9 +456,12 @@ export class KeystoneDetailsComponentInstance
             this.elements.btnLinkGoogleEl.classList.remove('disabled');
             this.elements.btnLinkGithubEl.classList.remove('disabled');
 
-            // Check if already linked
-            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'google' });
-            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'github' });
+            // Check if origin provider or linked
+            const originProvider = this.aggregatedDetails?.custodianProvider || this.ibGib?.data?.frameDetails?.custodianProvider;
+            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId: 'google' });
+            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId: 'github' });
+
+            const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
 
             // Google Card States
             const googleCard = this.elements.btnLinkGoogleEl;
@@ -464,11 +469,22 @@ export class KeystoneDetailsComponentInstance
             if (isGoogleLinked) {
                 googleCard.classList.remove('unlinked');
                 googleCard.classList.add('linked');
-                googleLabel.textContent = "Google Linked ✅";
+                const isOrigin = originProvider === 'google';
+                if (isOrigin && !caps.isSovereign) {
+                    googleLabel.textContent = "Google (Primary Account) 🔒";
+                    googleCard.title = "Cannot unlink primary account without first adding a Master Password below.";
+                } else if (isOrigin) {
+                    googleLabel.textContent = "Google (Primary Account) ✅";
+                    googleCard.title = "Click to unlink Google provider (requires Master Password).";
+                } else {
+                    googleLabel.textContent = "Google Linked ✅";
+                    googleCard.title = "Click to unlink Google provider.";
+                }
             } else {
                 googleCard.classList.remove('linked');
                 googleCard.classList.add('unlinked');
                 googleLabel.textContent = "Unlinked";
+                googleCard.title = "Click to link Google account.";
             }
 
             // GitHub Card States
@@ -477,15 +493,47 @@ export class KeystoneDetailsComponentInstance
             if (isGithubLinked) {
                 githubCard.classList.remove('unlinked');
                 githubCard.classList.add('linked');
-                githubLabel.textContent = "GitHub Linked ✅";
+                const isOrigin = originProvider === 'github';
+                if (isOrigin && !caps.isSovereign) {
+                    githubLabel.textContent = "GitHub (Primary Account) 🔒";
+                    githubCard.title = "Cannot unlink primary account without first adding a Master Password below.";
+                } else if (isOrigin) {
+                    githubLabel.textContent = "GitHub (Primary Account) ✅";
+                    githubCard.title = "Click to unlink GitHub provider (requires Master Password).";
+                } else {
+                    githubLabel.textContent = "GitHub Linked ✅";
+                    githubCard.title = "Click to unlink GitHub provider.";
+                }
             } else {
                 githubCard.classList.remove('linked');
                 githubCard.classList.add('unlinked');
                 githubLabel.textContent = "Unlinked";
+                githubCard.title = "Click to link GitHub account.";
             }
         }
     }
 
+    private updatePasswordCardView(): void {
+        const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+        const cardTitleEl = this.elements?.changePasswordCardEl?.querySelector('h3');
+        const cardDescEl = this.elements?.changePasswordCardEl?.querySelector('.description');
+        const currentPasswordGroup = this.elements?.inputCurrentPasswordEl?.closest('.form-group') as HTMLElement | null;
+        const btnChangePassword = this.elements?.btnChangePasswordEl;
+
+        const isCustodialOnly = caps.isCustodial && !caps.isSovereign;
+        if (isCustodialOnly) {
+            if (cardTitleEl) cardTitleEl.textContent = "Add Master Password";
+            if (cardDescEl) cardDescEl.textContent = "Establish sovereign ownership by adding a master password. This enables direct, independent cryptographic management without relying solely on custodian authentication.";
+            if (currentPasswordGroup) currentPasswordGroup.style.display = 'none';
+            if (btnChangePassword) btnChangePassword.textContent = "Add Master Password";
+        } else {
+            if (cardTitleEl) cardTitleEl.textContent = "Change Password";
+            if (cardDescEl) cardDescEl.textContent = "Rotate your local password that drives this identity. This will cryptographically evolve your primary identity and all registered user-owned delegate keystones to the new password.";
+            if (currentPasswordGroup) currentPasswordGroup.style.display = '';
+            if (btnChangePassword) btnChangePassword.textContent = "Update Password";
+        }
+    }
+
     private async updateFrameDetailsView(): Promise<void> {
         const lc = `${this.lc}[${this.updateFrameDetailsView.name}]`;
         try {
@@ -549,6 +597,7 @@ export class KeystoneDetailsComponentInstance
                             space
                         });
 
+                        this.aggregatedDetails = aggregated;
                         this.elements.identityAggrDetailsEl.textContent = aggregated ? pretty(aggregated) : '{}';
 
                         // Update Username and Description fields
@@ -556,16 +605,19 @@ export class KeystoneDetailsComponentInstance
                         this.elements.identityDescriptionEl.textContent = aggregated?.description || aggregated?.profile?.description || '-';
                     } catch (err) {
                         console.warn(`${lc} Error aggregating details: ${extractErrorMsg(err)}`);
+                        this.aggregatedDetails = undefined;
                         this.elements.identityAggrDetailsEl.textContent = '{}';
                         this.elements.identityNameEl.textContent = '-';
                         this.elements.identityDescriptionEl.textContent = '-';
                     }
                 } else {
+                    this.aggregatedDetails = undefined;
                     this.elements.identityAggrDetailsEl.textContent = '{}';
                     this.elements.identityNameEl.textContent = '-';
                     this.elements.identityDescriptionEl.textContent = '-';
                 }
             } else {
+                this.aggregatedDetails = undefined;
                 this.elements.identityAggrDetailsEl.textContent = '{}';
                 this.elements.identityNameEl.textContent = '-';
                 this.elements.identityDescriptionEl.textContent = '-';
@@ -598,6 +650,7 @@ export class KeystoneDetailsComponentInstance
                 await this.renderDelegates(keystone.data?.delegates);
                 this.elements.ssoLinkCardEl.classList.remove('hidden');
                 this.elements.changePasswordCardEl.classList.remove('hidden');
+                this.updatePasswordCardView();
             } else {
                 this.elements.delegatesCardEl.classList.add('hidden');
                 this.elements.ssoLinkCardEl.classList.add('hidden');
@@ -615,6 +668,7 @@ export class KeystoneDetailsComponentInstance
 
     private clearActiveDetails() {
         if (!this.elements) { return; }
+        this.aggregatedDetails = undefined;
         this.isHistoricalFrame = false;
         if (this.elements.historicalWarningBannerEl) {
             this.elements.historicalWarningBannerEl.classList.add('hidden');
@@ -804,43 +858,71 @@ export class KeystoneDetailsComponentInstance
         }
 
         const metaspace = await getGlobalMetaspace_waitIfNeeded();
-        let localSpaceId: string | undefined;
-        if (metaspace) {
-            const space = await metaspace.getLocalUserSpace({ lock: false });
-            if (space?.ib) {
-                localSpaceId = parseSpaceIb({ spaceIb: space.ib }).spaceId;
-            }
+        if (!metaspace) {
+            throw new Error(`(UNEXPECTED) metaspace falsy? (E: 8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3e)`);
         }
+        const space = await metaspace.getLocalUserSpace({ lock: false });
+        if (!space) {
+            throw new Error(`(UNEXPECTED) space falsy? (E: 9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4f)`);
+        }
+        const localSpaceId = space.ib ? parseSpaceIb({ spaceIb: space.ib }).spaceId : undefined;
 
         for (const [delegateTjpAddr, info] of Object.entries(delegates)) {
             const tr = document.createElement('tr');
 
-            const deviceName = info.deviceName || info.details?.deviceTag || info.details?.name || 'Device Delegate';
+            const deviceName = info.deviceName || (info as any).details?.deviceTag || (info as any).details?.name || 'Device Delegate';
             const tdName = document.createElement('td');
 
-            const delegateSpaceId = info.spaceId || info.details?.spaceId;
-            let badgeEl: HTMLSpanElement | null = null;
-
-            if (delegateSpaceId) {
-                badgeEl = document.createElement('span');
-                badgeEl.style.marginLeft = '0.5rem';
-                badgeEl.style.padding = '0.15rem 0.4rem';
-                badgeEl.style.borderRadius = '4px';
-                badgeEl.style.fontSize = '0.75rem';
-                badgeEl.style.fontWeight = 'bold';
-                if (localSpaceId && delegateSpaceId === localSpaceId) {
-                    badgeEl.textContent = 'This Device';
-                    badgeEl.className = 'badge badge-this-device';
-                    badgeEl.style.backgroundColor = '#1b5e20';
-                    badgeEl.style.color = '#a5d6a7';
-                } else {
-                    badgeEl.textContent = 'Remote Device';
-                    badgeEl.className = 'badge badge-remote-device';
-                    badgeEl.style.backgroundColor = '#0d47a1';
-                    badgeEl.style.color = '#90caf9';
+            const delegateSpaceId = info.spaceId || (info as any).details?.spaceId;
+
+            // Check if delegate is present in local space (via spaceId match or direct presence check)
+            let isThisDevice = false;
+            if (localSpaceId && delegateSpaceId === localSpaceId) {
+                isThisDevice = true;
+            } else {
+                try {
+                    const resGet = await metaspace.get({ addrs: [delegateTjpAddr], space });
+                    isThisDevice = !!(resGet.success && resGet.ibGibs && resGet.ibGibs.length > 0);
+                } catch {
+                    isThisDevice = false;
                 }
             }
 
+            const badgeEl = document.createElement('span');
+            badgeEl.style.marginLeft = '0.5rem';
+            badgeEl.style.padding = '0.15rem 0.4rem';
+            badgeEl.style.borderRadius = '4px';
+            badgeEl.style.fontSize = '0.75rem';
+            badgeEl.style.fontWeight = 'bold';
+
+            if (isThisDevice) {
+                badgeEl.textContent = 'This Device';
+                badgeEl.className = 'badge badge-this-device';
+                badgeEl.style.backgroundColor = '#1b5e20';
+                badgeEl.style.color = '#a5d6a7';
+            } else {
+                badgeEl.textContent = 'Remote Device';
+                badgeEl.className = 'badge badge-remote-device';
+                badgeEl.style.backgroundColor = '#0d47a1';
+                badgeEl.style.color = '#90caf9';
+            }
+
+            // Check expiration
+            const isExpired = isDelegateExpired({ delegateInfo: info });
+            let expiredBadgeEl: HTMLSpanElement | null = null;
+            if (isExpired) {
+                expiredBadgeEl = document.createElement('span');
+                expiredBadgeEl.textContent = 'Expired';
+                expiredBadgeEl.className = 'badge badge-expired';
+                expiredBadgeEl.style.marginLeft = '0.3rem';
+                expiredBadgeEl.style.padding = '0.15rem 0.4rem';
+                expiredBadgeEl.style.borderRadius = '4px';
+                expiredBadgeEl.style.fontSize = '0.75rem';
+                expiredBadgeEl.style.fontWeight = 'bold';
+                expiredBadgeEl.style.backgroundColor = '#b71c1c';
+                expiredBadgeEl.style.color = '#ef9a9a';
+            }
+
             const applyNameAndBadge = (displayName: string, hoverText?: string) => {
                 tdName.innerHTML = '';
                 const textSpan = document.createElement('span');
@@ -849,6 +931,9 @@ export class KeystoneDetailsComponentInstance
                 if (badgeEl) {
                     tdName.appendChild(badgeEl);
                 }
+                if (expiredBadgeEl) {
+                    tdName.appendChild(expiredBadgeEl);
+                }
                 tdName.title = hoverText || displayName;
             };
 
@@ -863,7 +948,7 @@ export class KeystoneDetailsComponentInstance
             tdVerbs.textContent = info.allowedVerbs ? info.allowedVerbs.join(', ') : '-';
             tdVerbs.title = tdVerbs.textContent;
 
-            const isRemote = !!(delegateSpaceId && localSpaceId && delegateSpaceId !== localSpaceId);
+            const isRemote = !isThisDevice;
 
             const tdActions = document.createElement('td');
             const btnView = document.createElement('button');
@@ -874,20 +959,20 @@ export class KeystoneDetailsComponentInstance
                 if (isRemote) {
                     this.showRemoteDelegateModal(info);
                 } else {
-                    if (info.delegateAddr) {
+                    if (info.delegateAddr || delegateTjpAddr) {
                         let addrToLoad = info.delegateAddr;
-                        if (metaspace) {
-                            const space = await metaspace.getLocalUserSpace({ lock: false });
-                            if (space) {
-                                try {
-                                    const latest = await metaspace.getLatestAddr({ addr: delegateTjpAddr, space });
-                                    if (latest) {
-                                        addrToLoad = latest;
-                                    }
-                                } catch (err) {
-                                    console.warn(`${lc} Error resolving latest delegate address: ${extractErrorMsg(err)}`);
-                                }
+                        try {
+                            const keystoneService = new KeystoneService_V1();
+                            const latestKeystone = await keystoneService.getLatestKeystone({
+                                addr: delegateTjpAddr,
+                                metaspace,
+                                space
+                            });
+                            if (latestKeystone) {
+                                addrToLoad = getIbGibAddr({ ibGib: latestKeystone });
                             }
+                        } catch (err) {
+                            console.warn(`${lc} Error resolving latest delegate keystone: ${extractErrorMsg(err)}`);
                         }
                         this.dispatchEvent(new CustomEvent('ibgib-view-keystone-details', {
                             detail: { addr: addrToLoad },
@@ -1187,8 +1272,13 @@ export class KeystoneDetailsComponentInstance
     }
 
     protected async handleSSOClick(providerId: 'google' | 'github') {
-        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId });
+        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId });
         if (isLinked) {
+            const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+            if (!caps.isSovereign) {
+                this.setSSOStatus(`Cannot unlink ${providerId}: This is your only identity recovery and management method. Please add a Master Password first in the Password card below to enable sovereign ownership before unlinking.`, "error");
+                return;
+            }
             await this.handleSSOUnlink(providerId);
         } else {
             await this.handleSSOLink(providerId);
@@ -1251,7 +1341,7 @@ export class KeystoneDetailsComponentInstance
 
             // 2. Evolve parent keystone to remove the custodian pool
             const targetPoolId = `custodian-manage-${providerId}`;
-            const evolvedParent = await keystoneService.removePools({
+            let evolvedParent = await keystoneService.removePools({
                 latestKeystone: this.ibGib!,
                 masterSecret: masterSecret!,
                 poolIds: [targetPoolId],
@@ -1259,6 +1349,22 @@ export class KeystoneDetailsComponentInstance
                 space
             });
 
+            // Unregister any corresponding outward delegate for this provider if present
+            const delegatesMap = this.ibGib?.data?.delegates;
+            if (delegatesMap) {
+                for (const [delegateTjpAddr, info] of Object.entries(delegatesMap)) {
+                    if (info.deviceName?.includes(providerId)) {
+                        evolvedParent = await keystoneService.unregisterDelegate({
+                            parentKeystone: evolvedParent,
+                            delegateTjpAddr,
+                            masterSecret: masterSecret!,
+                            metaspace,
+                            space,
+                        });
+                    }
+                }
+            }
+
             // 3. Sync evolved parent keystone back to server
             this.setSSOStatus("Publishing evolved identity keystone to server...", "info");
             const syncRes = await getApiBridge().putEvolveKeystone({
@@ -1299,8 +1405,170 @@ export class KeystoneDetailsComponentInstance
         el.classList.remove('hidden');
     }
 
+    protected async handleAddMasterPassword(): Promise<void> {
+        const lc = `${this.lc}[${this.handleAddMasterPassword.name}]`;
+        this.setChangePasswordStatus("Validating entries...", "info");
+
+        try {
+            const newPassword = this.elements!.inputNewPasswordEl.value;
+            const confirmPassword = this.elements!.inputConfirmPasswordEl.value;
+
+            if (!newPassword) {
+                this.setChangePasswordStatus("Master password is required.", "error");
+                return;
+            }
+            if (newPassword !== confirmPassword) {
+                this.setChangePasswordStatus("Master password and confirmation do not match.", "error");
+                return;
+            }
+
+            const initialManagePool = this.ibGib?.data?.challengePools?.find(p => p.id === POOL_ID_MANAGE);
+            if (!initialManagePool) {
+                this.setChangePasswordStatus("Primary keystone missing active manage challenge pool.", "error");
+                return;
+            }
+
+            this.showBusy({
+                isBusy: true,
+                title: 'Elevating Identity...',
+                msg: 'Generating cryptographic sovereign challenge pool...',
+                animationEmoji: '🔑'
+            });
+            this.setChangePasswordStatus("Generating sovereign challenge pool...", "info");
+            const newChallenges = await generatePoolChallenges({
+                config: initialManagePool.config,
+                masterSecret: newPassword,
+            });
+            const newManagePool = {
+                id: POOL_ID_MANAGE,
+                config: initialManagePool.config,
+                challenges: newChallenges,
+            };
+
+            const primaryTjpAddr = getTjpAddr({ ibGib: this.ibGib! }) || getIbGibAddr({ ibGib: this.ibGib! });
+            const custodianProvider = this.aggregatedDetails?.custodianProvider || 'google';
+
+            let requestBody: any = {
+                primaryTjpAddr,
+                newManagePool,
+            };
+
+            if (custodianProvider === 'google' || custodianProvider === 'github') {
+                this.showBusy({
+                    isBusy: true,
+                    title: 'Re-authenticating with Provider...',
+                    msg: `Please complete authentication in the ${custodianProvider} popup window...`,
+                    animationEmoji: '🔒'
+                });
+                this.setChangePasswordStatus(`Please authenticate in the popup with ${custodianProvider} to verify ownership...`, "info");
+                const resPopup = await executeSsoOAuthPopup({
+                    providerId: custodianProvider,
+                    parentTjpAddr: primaryTjpAddr,
+                });
+
+                if (!resPopup.success || !resPopup.code) {
+                    this.showBusy({ isBusy: false });
+                    this.setChangePasswordStatus(resPopup.message || "Re-authentication cancelled.", "error");
+                    return;
+                }
+
+                requestBody.providerId = custodianProvider;
+                requestBody.code = resPopup.code;
+                requestBody.redirectUri = resPopup.redirectUri;
+            } else {
+                this.showBusy({ isBusy: false });
+                // Email OTP fallback
+                const email = this.aggregatedDetails?.emails?.[0] || this.ibGib?.data?.emails?.[0];
+                const otpCode = await promptForSecret({
+                    msg: `Enter 6-digit verification code sent to ${email}:`,
+                    confirm: false,
+                });
+                if (!otpCode) {
+                    this.setChangePasswordStatus("Verification code required.", "error");
+                    return;
+                }
+                requestBody.email = email;
+                requestBody.code = otpCode;
+            }
+
+            this.showBusy({
+                isBusy: true,
+                title: 'Updating Keystone Timeline...',
+                msg: 'Publishing sovereign master password and evolving identity DAG...',
+                animationEmoji: '⏳'
+            });
+            this.setChangePasswordStatus("Elevating identity to sovereign master password on server...", "info");
+            const response = await fetch('/api/identity/custodian/add-master-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(requestBody),
+            });
+
+            const resJson = await response.json();
+            if (!response.ok || !resJson.success) {
+                throw new Error(resJson.error || resJson.message || `Server error (${response.status})`);
+            }
+
+            const evolvedParent = resJson.primaryKeystone;
+
+            // Save to local user space & metaspace
+            const metaspace = await getGlobalMetaspace_waitIfNeeded();
+            if (!metaspace) { throw new Error("Global metaspace not available"); }
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) { throw new Error("Local user space not available"); }
+
+            await metaspace.put({ ibGibs: [evolvedParent], space });
+            await metaspace.registerNewIbGib({ ibGib: evolvedParent, space });
+            await updateSpecialIndex({
+                type: "keystones",
+                rel8nInfos: [
+                    {
+                        rel8nName: "keystone",
+                        ibGibs: [toDto({ ibGib: evolvedParent })]
+                    }
+                ],
+                metaspace,
+                space
+            });
+
+            const evolvedAddr = getIbGibAddr({ ibGib: evolvedParent });
+
+            // Dispatch EVENT_IBGIB_IDENTITY_CHANGED
+            window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_CHANGED, {
+                detail: { activeIdentityAddr: evolvedAddr },
+                bubbles: true,
+                composed: true
+            }));
+
+            this.setChangePasswordStatus("Successfully added Master Password! Identity is now sovereign.", "success");
+
+            // Refresh the view
+            this.ibGibAddr = evolvedAddr;
+            this.staticIbGib = evolvedParent;
+            await this.loadIbGib({ getLatest: true });
+
+            // Clear inputs
+            this.elements!.inputNewPasswordEl.value = '';
+            this.elements!.inputConfirmPasswordEl.value = '';
+
+        } catch (error) {
+            console.error(`${lc} Elevation failed: ${extractErrorMsg(error)}`);
+            this.setChangePasswordStatus(`Failed to add master password: ${extractErrorMsg(error)}`, "error");
+        } finally {
+            this.showBusy({ isBusy: false });
+        }
+    }
+
     protected async handleChangePassword(): Promise<void> {
         const lc = `${this.lc}[${this.handleChangePassword.name}]`;
+
+        const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+        const isCustodialOnly = caps.isCustodial && !caps.isSovereign;
+        if (isCustodialOnly) {
+            await this.handleAddMasterPassword();
+            return;
+        }
+
         this.setChangePasswordStatus("Validating entries...", "info");
 
         try {

package/src/ui/ui-constants.mts

@@ -107,6 +107,7 @@ export const EVENT_IBGIB_UI_MESSAGE = 'ibgib-ui-message';
 export const EVENT_IBGIB_IDENTITY_REQUEST_CHANGE = 'ibgib-identity-request-change';
 export const EVENT_IBGIB_IDENTITY_CHANGED = 'ibgib-identity-changed';
 export const EVENT_IBGIB_IDENTITY_UPDATE_AVAILABLE = 'ibgib-identity-update-available';
+export const EVENT_IBGIB_IDENTITY_RENEWAL_REQUIRED = 'ibgib-identity-renewal-required';
 // #endregion Custom Events
 
 

package/src/ui/ui-types.mts

@@ -17,3 +17,9 @@ export interface EventIbGibIdentityUpdateAvailableDetail {
     localN: number;
     serverLatestAddr: string;
 }
+
+export interface EventIbGibIdentityRenewalRequiredDetail {
+    activePrimaryAddr: string;
+    primaryTjpAddr: string;
+    reason: 'expired' | 'missing_secret';
+}

package/dist/identity/custodian-delegate-helper.d.mts

@@ -1,22 +0,0 @@
-/**
- * @module identity/custodian-delegate-helper
- *
- * Client-side helper functions for deriving and storing local cryptographic delegate secrets
- * for full-custodian / passwordless identities.
- */
-/**
- * Retrieves or generates a high-entropy local delegate secret for a passwordless custodian identity.
- * Stored locally in `localStorage` keyed by `primaryTjpAddr`.
- *
- * @param primaryTjpAddr The primary identity keystone TJP address (`ib^gib`).
- */
-export declare function deriveLocalCustodianDelegateSecret({ primaryTjpAddr, }: {
-    primaryTjpAddr: string;
-}): Promise<string>;
-/**
- * Removes the stored local delegate secret for a custodian identity.
- */
-export declare function clearLocalCustodianDelegateSecret({ primaryTjpAddr, }: {
-    primaryTjpAddr: string;
-}): void;
-//# sourceMappingURL=custodian-delegate-helper.d.mts.map

package/dist/identity/custodian-delegate-helper.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"custodian-delegate-helper.d.mts","sourceRoot":"","sources":["../../src/identity/custodian-delegate-helper.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;;;;GAKG;AACH,wBAAsB,kCAAkC,CAAC,EACrD,cAAc,GACjB,EAAE;IACC,cAAc,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAiDlB;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,EAC9C,cAAc,GACjB,EAAE;IACC,cAAc,EAAE,MAAM,CAAC;CAC1B,GAAG,IAAI,CAIP"}

package/dist/identity/custodian-delegate-helper.mjs

@@ -1,67 +0,0 @@
-/**
- * @module identity/custodian-delegate-helper
- *
- * Client-side helper functions for deriving and storing local cryptographic delegate secrets
- * for full-custodian / passwordless identities.
- */
-import { getUUID, hash, HashAlgorithm, extractErrorMsg } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
-import { storageGet, storagePut } from "../storage/storage-helpers.web.mjs";
-import { getGlobalDbName, getGlobalStoreName } from "../helpers.web.mjs";
-const LOCAL_STORAGE_PREFIX = 'ibgib_custodian_delegate_secret_';
-/**
- * Retrieves or generates a high-entropy local delegate secret for a passwordless custodian identity.
- * Stored locally in `localStorage` keyed by `primaryTjpAddr`.
- *
- * @param primaryTjpAddr The primary identity keystone TJP address (`ib^gib`).
- */
-export async function deriveLocalCustodianDelegateSecret({ primaryTjpAddr, }) {
-    const lc = `[${deriveLocalCustodianDelegateSecret.name}]`;
-    try {
-        if (!primaryTjpAddr) {
-            throw new Error('primaryTjpAddr is required to derive local custodian delegate secret (E: a1b2c3d4e5f67890123456789a000101)');
-        }
-        const key = `${LOCAL_STORAGE_PREFIX}${primaryTjpAddr}`;
-        const dbName = getGlobalDbName();
-        const storeName = getGlobalStoreName();
-        // debugger; // what are the dbName and storeName?
-        const existingSecret = await storageGet({ dbName, storeName, key });
-        if (existingSecret) {
-            return existingSecret;
-        }
-        // Generate high-entropy 512-bit SHA hash secret from fresh UUIDs
-        const rawEntropy = await getUUID(32);
-        const newSecret = await hash({
-            s: rawEntropy,
-            algorithm: HashAlgorithm.sha_512
-        });
-        await storagePut({ dbName, storeName, key, value: newSecret });
-        return newSecret;
-        // const existingSecret = localStorage.getItem(key);
-        // if (existingSecret) {
-        //     return existingSecret;
-        // }
-        // // Generate high-entropy 512-bit SHA hash secret from fresh UUIDs
-        // const rawEntropy = `${await getUUID()}-${await getUUID()}-${await getUUID()}-${Date.now()}`;
-        // const newSecret = await hash({
-        //     s: rawEntropy,
-        //     algorithm: HashAlgorithm.sha_512
-        // });
-        // localStorage.setItem(key, newSecret);
-        // return newSecret;
-    }
-    catch (error) {
-        console.error(`${lc} ${extractErrorMsg(error)}`);
-        throw error;
-    }
-}
-/**
- * Removes the stored local delegate secret for a custodian identity.
- */
-export function clearLocalCustodianDelegateSecret({ primaryTjpAddr, }) {
-    if (!primaryTjpAddr) {
-        return;
-    }
-    const key = `${LOCAL_STORAGE_PREFIX}${primaryTjpAddr}`;
-    localStorage.removeItem(key);
-}
-//# sourceMappingURL=custodian-delegate-helper.mjs.map

package/dist/identity/custodian-delegate-helper.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"custodian-delegate-helper.mjs","sourceRoot":"","sources":["../../src/identity/custodian-delegate-helper.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,EACrD,cAAc,GAGjB;IACG,MAAM,EAAE,GAAG,IAAI,kCAAkC,CAAC,IAAI,GAAG,CAAC;IAC1D,IAAI,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,oBAAoB,GAAG,cAAc,EAAE,CAAC;QAEvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;QAEvC,kDAAkD;QAGlD,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QAC1B,CAAC;QAED,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC;YACzB,CAAC,EAAE,UAAU;YACb,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE/D,OAAO,SAAS,CAAC;QAGjB,oDAAoD;QACpD,wBAAwB;QACxB,6BAA6B;QAC7B,IAAI;QAEJ,oEAAoE;QACpE,+FAA+F;QAC/F,iCAAiC;QACjC,qBAAqB;QACrB,uCAAuC;QACvC,MAAM;QAEN,wCAAwC;QACxC,oBAAoB;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAAC,EAC9C,cAAc,GAGjB;IACG,IAAI,CAAC,cAAc,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,oBAAoB,GAAG,cAAc,EAAE,CAAC;IACvD,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}