@ibgib/web-gib 0.0.62 → 0.0.63

package/dist/ui/component/identity/keystone-details/keystone-details.mjs

@@ -1,7 +1,7 @@
 import thisCss from "./keystone-details.css";
 import thisHtml from "./keystone-details.html";
 import commonComponentStylesCss from "../../common-component-styles.css";
-import { extractErrorMsg, pretty, getSaferSubstring, HashAlgorithm } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { extractErrorMsg, pretty, getSaferSubstring, HashAlgorithm, delay } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 import { getIbAndGib, getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
 import { getGibInfo } from "@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs";
 import { KeystoneService_V1 } from "@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs";
@@ -14,14 +14,14 @@ import { getTjpAddr, toDto, getTimelinesGroupedByTjp } from "@ibgib/core-gib/dis
 import { parseSpaceIb } from "@ibgib/core-gib/dist/witness/space/space-helper.mjs";
 import { executeSsoOAuthPopup } from "../../../../identity/sso-popup-helper.mjs";
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
-import { promptForSecret } from "../../../../helpers.web.mjs";
+import { promptForAuthoritySecret } from "../../../../helpers.web.mjs";
 import { isSsoProviderLinked, getKeystoneCapabilities, isDelegateExpired, isCustodialDelegate } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
 import { generatePoolChallenges } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
 import { POOL_ID_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT, KEYSTONE_VERB_MANAGE } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
 import { generateDefaultDeviceTag } from "../../../../util/device-helper.mjs";
 import { getGlobalMetaspace_waitIfNeeded } from "../../../../helpers.mjs";
 import { createSovereignDeviceSyncDelegate, createOAuth2DeviceSyncDelegate } from "../../../../identity/device-delegate-helper.mjs";
-import { isPasskeyPrfSupported, registerPasskeyCredential, evaluatePasskeyPrf, bufferToHex } from "../../../../identity/passkey-helper.mjs";
+import { isPasskeyPrfSupported, registerPasskeyCredential, evaluatePasskeyPrf, createPasskeyDeviceSyncDelegate, bufferToHex } from "../../../../identity/passkey-helper.mjs";
 import { KeystoneChallengeType, KeystoneReplenishStrategy } from "@ibgib/core-gib/dist/keystone/keystone-types.mjs";
 const logalot = false;
 export const KEYSTONE_DETAILS_COMPONENT_NAME = 'ibgib-keystone-details';
@@ -183,6 +183,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             this.elements.passkeysCardEl = shadow.getElementById('passkeys-card');
             this.elements.passkeysListEl = shadow.getElementById('passkeys-list');
             this.elements.btnAddPasskeyEl = shadow.getElementById('btn-add-passkey');
+            this.elements.selectPasskeyAttachmentEl = shadow.getElementById('select-passkey-attachment');
             this.elements.passkeyStatusMsgEl = shadow.getElementById('passkey-status-msg');
             this.elements.containerEl = shadow.getElementById('container');
             this.elements.historicalWarningBannerEl = shadow.getElementById('historical-warning-banner');
@@ -514,19 +515,17 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
     updatePasswordCardView() {
         const caps = !!this.ibGib ?
             getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails }) :
-            false;
+            undefined;
         const cardTitleEl = this.elements?.changePasswordCardEl?.querySelector('h3');
         const cardDescEl = this.elements?.changePasswordCardEl?.querySelector('.description');
         const currentPasswordGroup = this.elements?.inputCurrentPasswordEl?.closest('.form-group');
         const btnChangePassword = this.elements?.btnChangePasswordEl;
-        const isCustodialOnly = !!caps ?
-            caps.isCustodial && !caps.isSovereign :
-            false;
-        if (isCustodialOnly) {
+        const hasPassword = !!caps?.hasPassword;
+        if (!hasPassword) {
             if (cardTitleEl)
                 cardTitleEl.textContent = "Add Master Password";
             if (cardDescEl)
-                cardDescEl.textContent = "Establish sovereign ownership by adding a master password. This enables direct, independent cryptographic management without relying solely on custodian authentication.";
+                cardDescEl.textContent = "Establish a master password for this identity. This enables sovereign password authentication alongside your passkeys and linked providers.";
             if (currentPasswordGroup)
                 currentPasswordGroup.style.display = 'none';
             if (btnChangePassword)
@@ -1011,12 +1010,17 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         const lc = `${this.lc}[${this.handleRevokeDelegate.name}]`;
         try {
             let masterSecret;
+            let matchedPoolId;
             try {
-                masterSecret = await promptForSecret({
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: 'Revoke Delegate',
                     msg: `Enter Master Password or touch security key to revoke delegate '${deviceName}':`,
-                    confirm: false,
-                    passkeys: this.aggregatedDetails?.passkeys,
+                    verb: KEYSTONE_VERB_MANAGE
                 });
+                masterSecret = authResult.secret;
+                matchedPoolId = authResult.poolId;
             }
             catch (err) {
                 // User cancelled prompt
@@ -1034,24 +1038,6 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 throw new Error("Local space not found");
             }
             const keystoneSvc = new KeystoneService_V1();
-            // Resolve which manage pool matches the provided masterSecret
-            let matchedPoolId;
-            const candidatePools = this.ibGib.data?.challengePools.filter(p => p.id === 'manage' || p.id.startsWith('passkey-manage-') || (p.config.allowedVerbs && p.config.allowedVerbs.includes(KEYSTONE_VERB_MANAGE))) || [];
-            for (const pool of candidatePools) {
-                const ok = await keystoneSvc.verifySigningSecret({
-                    keystoneIbGib: this.ibGib,
-                    signingSecret: masterSecret,
-                    poolId: pool.id
-                });
-                if (ok) {
-                    matchedPoolId = pool.id;
-                    break;
-                }
-            }
-            if (!matchedPoolId) {
-                this.setSyncStatus("Failed to authorize revocation (invalid secret/passkey).", "error");
-                return;
-            }
             // Unregister delegate from parent keystone
             const evolvedParent = await keystoneSvc.unregisterDelegate({
                 parentKeystone: this.ibGib,
@@ -1210,10 +1196,16 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             const username = this.aggregatedDetails?.username || this.ibGib.data?.frameDetails?.username || 'user';
             const rawSalt = crypto.getRandomValues(new Uint8Array(32));
             const saltHex = bufferToHex(rawSalt.buffer);
+            const attachmentVal = this.elements?.selectPasskeyAttachmentEl?.value;
+            const authenticatorAttachment = (attachmentVal === 'cross-platform' || attachmentVal === 'platform')
+                ? attachmentVal
+                : undefined;
             const regResult = await registerPasskeyCredential({
                 username,
                 displayName: username,
-                salt: saltHex
+                salt: saltHex,
+                userVerification: 'preferred',
+                authenticatorAttachment,
             });
             const { credentialId, transports } = regResult;
             let passkeySecret = regResult.passkeySecret;
@@ -1221,7 +1213,8 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 const prfResult = await evaluatePasskeyPrf({
                     credentialId,
                     salt: saltHex,
-                    transports
+                    transports,
+                    userVerification: 'preferred'
                 });
                 passkeySecret = prfResult.passkeySecret;
             }
@@ -1245,6 +1238,32 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 throw new Error("Local space not found");
             const keystoneService = new KeystoneService_V1();
             let evolvedKeystone;
+            const poolConfig = {
+                id: poolId,
+                type: KeystoneChallengeType.hash_reveal_v1,
+                salt: poolId,
+                algo: HashAlgorithm.sha_256,
+                rounds: 1,
+                allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+                behavior: {
+                    size: 10,
+                    replenish: KeystoneReplenishStrategy.topUp,
+                    selectSequentially: 1,
+                    selectRandomly: 0,
+                    targetBindingCount: 0,
+                }
+            };
+            const challenges = await generatePoolChallenges({
+                config: poolConfig,
+                masterSecret: passkeySecret
+            });
+            const newPool = {
+                id: poolId,
+                config: poolConfig,
+                challenges
+            };
+            let authSecret;
+            let signingPoolId;
             if (isCustodialOnly) {
                 // Elevate custodial account with sovereign passkey
                 this.showBusy({
@@ -1253,34 +1272,12 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                     msg: 'Establishing sovereign passkey pool on identity...',
                     animationEmoji: '⚡'
                 });
-                // Generate new manage pool configuration using passkeySecret
-                const poolConfig = {
-                    id: poolId,
-                    type: KeystoneChallengeType.hash_reveal_v1,
-                    salt: poolId,
-                    algo: HashAlgorithm.sha_256,
-                    rounds: 1,
-                    allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
-                    behavior: {
-                        size: 10,
-                        replenish: KeystoneReplenishStrategy.topUp,
-                        selectSequentially: 1,
-                        selectRandomly: 0,
-                        targetBindingCount: 0,
-                    }
-                };
-                const challenges = await generatePoolChallenges({
-                    config: poolConfig,
-                    masterSecret: passkeySecret
-                });
-                const newPool = {
-                    id: poolId,
-                    config: poolConfig,
-                    challenges
-                };
+                authSecret = passkeySecret;
+                signingPoolId = poolId;
                 evolvedKeystone = await keystoneService.addPools({
                     latestKeystone: this.ibGib,
-                    masterSecret: passkeySecret,
+                    masterSecret: authSecret,
+                    signingPoolId,
                     newPools: [newPool],
                     frameDetails: {
                         passkeys: {
@@ -1296,37 +1293,19 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             }
             else {
                 // Secondary passkey registration on existing sovereign identity:
-                // Prompt user to authorize with current master password
-                let authSecret;
-                let isCorrect = false;
-                let tries = 0;
-                const maxTries = 5;
-                while (tries < maxTries && !isCorrect) {
-                    try {
-                        const promptMsg = tries === 0
-                            ? 'Enter your current Master Secret (Password) or touch security key to authorize adding this passkey:'
-                            : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
-                        authSecret = await promptForSecret({
-                            msg: promptMsg,
-                            confirm: false,
-                            passkeys: this.aggregatedDetails?.passkeys,
-                        });
-                    }
-                    catch (err) {
-                        authSecret = undefined;
-                        break;
-                    }
-                    if (!authSecret)
-                        break;
-                    // Verify secret against manage/passkey pools
-                    isCorrect = await keystoneService.verifySigningSecret({
-                        keystoneIbGib: this.ibGib,
-                        signingSecret: authSecret
+                // Prompt user to authorize with current master password or passkey
+                try {
+                    const authResult = await promptForAuthoritySecret({
+                        keystone: this.ibGib,
+                        aggregatedDetails: this.aggregatedDetails,
+                        title: 'Authorize New Passkey',
+                        msg: 'Enter Master Password or touch security key to authorize adding this passkey:',
+                        verb: KEYSTONE_VERB_MANAGE
                     });
-                    if (!isCorrect)
-                        tries++;
+                    authSecret = authResult.secret;
+                    signingPoolId = authResult.poolId;
                 }
-                if (!isCorrect || !authSecret) {
+                catch (err) {
                     this.setPasskeyStatus("Registration cancelled (authorization required).", "error");
                     return;
                 }
@@ -1336,33 +1315,10 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                     msg: 'Adding cryptographic challenge pool and evolving identity...',
                     animationEmoji: '🛡️'
                 });
-                const poolConfig = {
-                    id: poolId,
-                    type: KeystoneChallengeType.hash_reveal_v1,
-                    salt: poolId,
-                    algo: HashAlgorithm.sha_256,
-                    rounds: 1,
-                    allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
-                    behavior: {
-                        size: 10,
-                        replenish: KeystoneReplenishStrategy.topUp,
-                        selectSequentially: 1,
-                        selectRandomly: 0,
-                        targetBindingCount: 0,
-                    }
-                };
-                const challenges = await generatePoolChallenges({
-                    config: poolConfig,
-                    masterSecret: passkeySecret
-                });
-                const newPool = {
-                    id: poolId,
-                    config: poolConfig,
-                    challenges
-                };
                 evolvedKeystone = await keystoneService.addPools({
                     latestKeystone: this.ibGib,
                     masterSecret: authSecret,
+                    signingPoolId,
                     newPools: [newPool],
                     frameDetails: {
                         passkeys: {
@@ -1375,22 +1331,66 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                     metaspace,
                     space
                 });
+                // Sync pool addition frame to server
+                const primaryTjpAddr = getTjpAddr({ ibGib: evolvedKeystone, defaultIfNone: 'incomingAddr' });
+                const resSyncPool = await getApiBridge().putEvolveKeystone({
+                    domainAddr: primaryTjpAddr,
+                    keystoneIbGib: evolvedKeystone,
+                    relatedKeystoneIbGibs: []
+                });
+                if (!resSyncPool.success) {
+                    throw new Error(`Server synchronization of passkey pool failed: ${resSyncPool.message}`);
+                }
             }
-            // Sync evolved keystone to server
+            // Construct outward device sync delegate for this passkey
+            this.showBusy({
+                isBusy: true,
+                title: 'Creating Sync Delegate...',
+                msg: 'Constructing outward passkey device sync delegate...',
+                animationEmoji: '📱'
+            });
+            const primaryTjpAddr = getTjpAddr({ ibGib: evolvedKeystone, defaultIfNone: 'incomingAddr' });
+            const { delegateKeystone, deviceTag } = await createPasskeyDeviceSyncDelegate({
+                username,
+                primaryTjpAddr,
+                passkeySecret,
+                transports,
+                metaspace,
+                space
+            });
+            // Register outward sync delegate on primary keystone
+            this.showBusy({
+                isBusy: true,
+                title: 'Registering Delegate...',
+                msg: 'Registering outward passkey delegate on primary identity...',
+                animationEmoji: '📝'
+            });
+            const delegateSigningPoolId = isCustodialOnly ? poolId : signingPoolId;
+            const delegateAuthSecret = isCustodialOnly ? passkeySecret : authSecret;
+            evolvedKeystone = await keystoneService.registerDelegate({
+                parentKeystone: evolvedKeystone,
+                delegateKeystone,
+                masterSecret: delegateAuthSecret,
+                signingPoolId: delegateSigningPoolId,
+                metaspace,
+                space,
+                allowedVerbs: [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+                deviceName: deviceTag
+            });
+            // Sync evolved keystone and delegate to server
             this.showBusy({
                 isBusy: true,
                 title: 'Syncing to Server...',
-                msg: 'Publishing evolved identity keystone to server...',
+                msg: 'Publishing evolved identity keystone and delegate to server...',
                 animationEmoji: '⚡'
             });
-            const primaryTjpAddr = getTjpAddr({ ibGib: evolvedKeystone, defaultIfNone: 'incomingAddr' });
             const resSync = await getApiBridge().putEvolveKeystone({
                 domainAddr: primaryTjpAddr,
                 keystoneIbGib: evolvedKeystone,
-                relatedKeystoneIbGibs: []
+                relatedKeystoneIbGibs: [delegateKeystone]
             });
             if (!resSync.success) {
-                console.warn(`${lc} Server sync note: ${resSync.message}`);
+                throw new Error(`Server synchronization of delegate failed: ${resSync.message}`);
             }
             // Update Special Index
             await updateSpecialIndex({
@@ -1398,7 +1398,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 rel8nInfos: [
                     {
                         rel8nName: "keystone",
-                        ibGibs: [toDto({ ibGib: evolvedKeystone })]
+                        ibGibs: [toDto({ ibGib: evolvedKeystone }), toDto({ ibGib: delegateKeystone })]
                     }
                 ],
                 metaspace,
@@ -1427,34 +1427,19 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         try {
             const keystoneService = new KeystoneService_V1();
             let masterSecret;
-            let isCorrect = false;
-            let tries = 0;
-            const maxTries = 5;
-            while (tries < maxTries && !isCorrect) {
-                try {
-                    const promptMsg = tries === 0
-                        ? `Are you sure you want to remove "${passkeyName}"? Enter your Master Secret (Password) or touch security key to authorize:`
-                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
-                    masterSecret = await promptForSecret({
-                        msg: promptMsg,
-                        confirm: false,
-                        passkeys: this.aggregatedDetails?.passkeys,
-                    });
-                }
-                catch (err) {
-                    masterSecret = undefined;
-                    break;
-                }
-                if (!masterSecret)
-                    break;
-                isCorrect = await keystoneService.verifySigningSecret({
-                    keystoneIbGib: this.ibGib,
-                    signingSecret: masterSecret
+            let signingPoolId;
+            try {
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: 'Authorize Removal',
+                    msg: `Are you sure you want to remove "${passkeyName}"? Enter your Master Secret (Password) or touch security key to authorize:`,
+                    verb: KEYSTONE_VERB_MANAGE
                 });
-                if (!isCorrect)
-                    tries++;
+                masterSecret = authResult.secret;
+                signingPoolId = authResult.poolId;
             }
-            if (!isCorrect || !masterSecret) {
+            catch (err) {
                 this.setPasskeyStatus("Removal cancelled or unauthorized.", "error");
                 return;
             }
@@ -1477,7 +1462,8 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             if (poolExists) {
                 evolvedKeystone = await keystoneService.removePools({
                     latestKeystone: this.ibGib,
-                    masterSecret,
+                    masterSecret: masterSecret,
+                    signingPoolId: signingPoolId,
                     poolIds: [poolIdToRemove],
                     frameDetails: {
                         passkeys: {
@@ -1492,11 +1478,12 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 });
             }
             else {
+                // If pool doesn't exist, just update frameDetails
                 evolvedKeystone = await keystoneService.sign({
                     latestKeystone: this.ibGib,
-                    masterSecret,
+                    masterSecret: masterSecret,
+                    poolId: signingPoolId,
                     claim: {
-                        verb: POOL_ID_MANAGE,
                         target: getIbGibAddr({ ibGib: this.ibGib })
                     },
                     frameDetails: {
@@ -1664,46 +1651,23 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 throw new Error(`Failed to retrieve custodian challenge pool: ${linkData.message || 'unknown error'}`);
             }
             const custodianPool = linkData.custodianPool;
-            // 2. Prompt user for master secret and verify it
-            this.showBusy({ isBusy: false });
+            // 2. Prompt user for authorization secret
             const keystoneService = new KeystoneService_V1();
             let masterSecret;
-            let isCorrect = false;
-            let tries = 0;
-            const maxTries = 8;
-            while (tries < maxTries && !isCorrect) {
-                try {
-                    const promptMsg = tries === 0
-                        ? "Link successful! Enter your local Master Secret (Password) to sign and register the custodian pool"
-                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
-                    masterSecret = await promptForSecret({
-                        msg: promptMsg,
-                        confirm: false
-                    });
-                }
-                catch (error) {
-                    // cancelled
-                    if (logalot) {
-                        console.log(`${lc}[promptForSecret] user cancelled (I: 911ff1fb0234949228481968e9087626)`);
-                    }
-                    masterSecret = undefined;
-                    break;
-                }
-                if (!masterSecret) {
-                    break;
-                }
-                // Verify secret using verifySigningSecret (requires manage poolId)
-                isCorrect = await keystoneService.verifySigningSecret({
-                    keystoneIbGib: this.ibGib,
-                    signingSecret: masterSecret,
-                    poolId: 'manage'
+            let signingPoolId;
+            try {
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: `Link ${providerName}`,
+                    msg: `Enter Master Password or touch security key to authorize linking ${providerName}:`,
+                    verb: KEYSTONE_VERB_MANAGE
                 });
-                if (!isCorrect) {
-                    tries++;
-                }
+                masterSecret = authResult.secret;
+                signingPoolId = authResult.poolId;
             }
-            if (!isCorrect) {
-                this.setSSOStatus("Link cancelled or failed (incorrect password).", "error");
+            catch (error) {
+                this.setSSOStatus("Link cancelled or failed.", "error");
                 return;
             }
             this.showBusy({
@@ -1724,6 +1688,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             const evolvedParent = await keystoneService.addPools({
                 latestKeystone: this.ibGib,
                 masterSecret: masterSecret,
+                signingPoolId: signingPoolId,
                 newPools: [custodianPool],
                 metaspace,
                 space
@@ -1751,7 +1716,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 parentKeystone: evolvedParent,
                 delegateKeystone,
                 masterSecret: masterSecret,
-                signingPoolId: 'manage',
+                signingPoolId: signingPoolId,
                 metaspace,
                 space,
                 allowedVerbs: [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
@@ -1820,41 +1785,23 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         const providerName = providerId === 'google' ? 'Google' : providerId === 'github' ? 'GitHub' : providerId;
         this.setSSOStatus(`Unlinking ${providerName}...`, "info");
         try {
-            // 1. Prompt user for password
+            // 1. Prompt user for authorization secret
             const keystoneService = new KeystoneService_V1();
             let masterSecret;
-            let isCorrect = false;
-            let tries = 0;
-            const maxTries = 8;
-            while (tries < maxTries && !isCorrect) {
-                try {
-                    const promptMsg = tries === 0
-                        ? `Are you sure you want to unlink your ${providerName} account? If so, enter your local Master Secret (Password) or touch security key to authorize. Otherwise, click Cancel.`
-                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
-                    masterSecret = await promptForSecret({
-                        msg: promptMsg,
-                        confirm: false,
-                        passkeys: this.aggregatedDetails?.passkeys,
-                    });
-                }
-                catch (error) {
-                    masterSecret = undefined;
-                    break;
-                }
-                if (!masterSecret) {
-                    break;
-                }
-                // Verify secret using verifySigningSecret
-                isCorrect = await keystoneService.verifySigningSecret({
-                    keystoneIbGib: this.ibGib,
-                    signingSecret: masterSecret
+            let signingPoolId;
+            try {
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: `Unlink ${providerName}`,
+                    msg: `Are you sure you want to unlink your ${providerName} account? If so, enter your Master Password or touch security key to authorize.`,
+                    verb: KEYSTONE_VERB_MANAGE
                 });
-                if (!isCorrect) {
-                    tries++;
-                }
+                masterSecret = authResult.secret;
+                signingPoolId = authResult.poolId;
             }
-            if (!isCorrect) {
-                this.setSSOStatus("Unlink cancelled or failed (incorrect password).", "error");
+            catch (error) {
+                this.setSSOStatus("Unlink cancelled or failed.", "error");
                 return;
             }
             this.showBusy({
@@ -1876,6 +1823,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             let evolvedParent = await keystoneService.removePools({
                 latestKeystone: this.ibGib,
                 masterSecret: masterSecret,
+                signingPoolId: signingPoolId,
                 poolIds: [targetPoolId],
                 metaspace,
                 space
@@ -2134,98 +2082,13 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 await metaspace.put({ ibGibs: [evolvedParent], space });
                 await metaspace.registerNewIbGib({ ibGib: evolvedParent, space });
             }
-            // 1. Create a password-based sync delegate for this device
-            this.showBusy({
-                isBusy: true,
-                title: 'Creating Sovereign Sync Delegate...',
-                msg: 'Deriving local device sync delegate keys from Master Password...',
-                animationEmoji: '🔑'
-            });
-            const rawUsername = this.aggregatedDetails?.username
-                || this.ibGib?.data?.username
-                || this.aggregatedDetails?.emails?.[0]?.split('@')[0]
-                || this.ibGib?.data?.emails?.[0]?.split('@')[0]
-                || 'user';
-            const { delegateKeystone: userSyncDelegate, deviceTag } = await createSovereignDeviceSyncDelegate({
-                username: rawUsername,
+            await this.registerAndSyncSovereignPasswordDelegate({
+                evolvedParent,
+                newPassword,
                 primaryTjpAddr,
-                masterSecret: newPassword,
-                metaspace,
-                space,
-            });
-            // 2. Register the new user sync delegate on the evolved parent keystone
-            this.showBusy({
-                isBusy: true,
-                title: 'Registering Sovereign Delegate...',
-                msg: 'Registering user sync delegate on primary keystone...',
-                animationEmoji: '📝'
-            });
-            const keystoneService = new KeystoneService_V1();
-            const parentWithUserDelegate = await keystoneService.registerDelegate({
-                parentKeystone: evolvedParent,
-                delegateKeystone: userSyncDelegate,
-                masterSecret: newPassword,
-                signingPoolId: 'manage',
-                metaspace,
-                space,
-                allowedVerbs: [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
-                deviceName: deviceTag
-            });
-            // 3. Post evolved keystone with new delegate to server
-            this.showBusy({
-                isBusy: true,
-                title: 'Syncing to Server...',
-                msg: 'Publishing updated domain identity and sovereign delegate to server...',
-                animationEmoji: '⚡'
-            });
-            const resSync = await getApiBridge().putEvolveKeystone({
-                domainAddr: primaryTjpAddr,
-                keystoneIbGib: parentWithUserDelegate,
-                relatedKeystoneIbGibs: [userSyncDelegate]
-            });
-            if (!resSync.success) {
-                console.warn(`${lc} Warning syncing user delegate to server: ${resSync.message}`);
-            }
-            // 4. Save parentWithUserDelegate and userSyncDelegate to local space & metaspace
-            await metaspace.put({ ibGibs: [parentWithUserDelegate, userSyncDelegate], space });
-            await metaspace.registerNewIbGib({ ibGib: parentWithUserDelegate, space });
-            await metaspace.registerNewIbGib({ ibGib: userSyncDelegate, space });
-            await updateSpecialIndex({
-                type: "keystones",
-                rel8nInfos: [
-                    {
-                        rel8nName: "keystone",
-                        ibGibs: [toDto({ ibGib: parentWithUserDelegate }), toDto({ ibGib: userSyncDelegate })]
-                    }
-                ],
                 metaspace,
                 space
             });
-            const evolvedAddr = getIbGibAddr({ ibGib: parentWithUserDelegate });
-            // Dispatch EVENT_IBGIB_IDENTITY_CHANGED
-            window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_CHANGED, {
-                detail: { activeIdentityAddr: evolvedAddr },
-                bubbles: true,
-                composed: true
-            }));
-            this.setChangePasswordStatus("Successfully added Master Password! Identity is now sovereign.", "success");
-            // Reset OTP section and button text
-            if (this.elements?.sectionAddPasswordOtpEl) {
-                this.elements.sectionAddPasswordOtpEl.classList.add('hidden');
-                if (this.elements.inputAddPasswordOtpEl) {
-                    this.elements.inputAddPasswordOtpEl.value = '';
-                }
-            }
-            if (this.elements?.btnChangePasswordEl) {
-                this.elements.btnChangePasswordEl.textContent = "Update Password";
-            }
-            // Refresh the view
-            this.ibGibAddr = evolvedAddr;
-            this.staticIbGib = parentWithUserDelegate;
-            await this.loadIbGib({ getLatest: true });
-            // Clear inputs
-            this.elements.inputNewPasswordEl.value = '';
-            this.elements.inputConfirmPasswordEl.value = '';
         }
         catch (error) {
             console.error(`${lc} Elevation failed: ${extractErrorMsg(error)}`);
@@ -2287,14 +2150,265 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             }
         }
     }
+    /**
+     * Common DRY post-elevation workflow: creates and registers the password-based
+     * device sync delegate, synchronizes the evolved identity with the delegate to the server,
+     * updates the local space and special index, and dispatches the identity change event.
+     */
+    async registerAndSyncSovereignPasswordDelegate({ evolvedParent, newPassword, primaryTjpAddr, metaspace, space, }) {
+        const lc = `${this.lc}[${this.registerAndSyncSovereignPasswordDelegate.name}]`;
+        // 1. Create a password-based sync delegate for this device
+        this.showBusy({
+            isBusy: true,
+            title: 'Creating Sovereign Sync Delegate...',
+            msg: 'Deriving local device sync delegate keys from Master Password...',
+            animationEmoji: '🔑'
+        });
+        await delay(50);
+        const rawUsername = this.aggregatedDetails?.username
+            || this.ibGib?.data?.username
+            || this.aggregatedDetails?.emails?.[0]?.split('@')[0]
+            || this.ibGib?.data?.emails?.[0]?.split('@')[0]
+            || 'user';
+        const { delegateKeystone: userSyncDelegate, deviceTag } = await createSovereignDeviceSyncDelegate({
+            username: rawUsername,
+            primaryTjpAddr,
+            masterSecret: newPassword,
+            metaspace,
+            space,
+        });
+        // 2. Register the new user sync delegate on the evolved parent keystone
+        this.showBusy({
+            isBusy: true,
+            title: 'Registering Sovereign Delegate...',
+            msg: 'Registering user sync delegate on primary keystone...',
+            animationEmoji: '📝'
+        });
+        await delay(50);
+        const keystoneService = new KeystoneService_V1();
+        const parentWithUserDelegate = await keystoneService.registerDelegate({
+            parentKeystone: evolvedParent,
+            delegateKeystone: userSyncDelegate,
+            masterSecret: newPassword,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace,
+            space,
+            allowedVerbs: [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+            deviceName: deviceTag
+        });
+        // 3. Post evolved keystone with new delegate to server
+        this.showBusy({
+            isBusy: true,
+            title: 'Syncing to Server...',
+            msg: 'Publishing updated domain identity and sovereign delegate to server...',
+            animationEmoji: '⚡'
+        });
+        const resSync = await getApiBridge().putEvolveKeystone({
+            domainAddr: primaryTjpAddr,
+            keystoneIbGib: parentWithUserDelegate,
+            relatedKeystoneIbGibs: [userSyncDelegate]
+        });
+        if (!resSync.success) {
+            throw new Error(`Server sync of password delegate failed: ${resSync.message}`);
+        }
+        // 4. Save parentWithUserDelegate and userSyncDelegate to local space & metaspace
+        await metaspace.put({ ibGibs: [parentWithUserDelegate, userSyncDelegate], space });
+        await metaspace.registerNewIbGib({ ibGib: parentWithUserDelegate, space });
+        await metaspace.registerNewIbGib({ ibGib: userSyncDelegate, space });
+        await updateSpecialIndex({
+            type: "keystones",
+            rel8nInfos: [
+                {
+                    rel8nName: "keystone",
+                    ibGibs: [toDto({ ibGib: parentWithUserDelegate }), toDto({ ibGib: userSyncDelegate })]
+                }
+            ],
+            metaspace,
+            space
+        });
+        const evolvedAddr = getIbGibAddr({ ibGib: parentWithUserDelegate });
+        // Dispatch EVENT_IBGIB_IDENTITY_CHANGED
+        window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_CHANGED, {
+            detail: { activeIdentityAddr: evolvedAddr },
+            bubbles: true,
+            composed: true
+        }));
+        this.setChangePasswordStatus("Successfully added Master Password! Identity is now sovereign.", "success");
+        // Reset OTP section and button text
+        if (this.elements?.sectionAddPasswordOtpEl) {
+            this.elements.sectionAddPasswordOtpEl.classList.add('hidden');
+            if (this.elements.inputAddPasswordOtpEl) {
+                this.elements.inputAddPasswordOtpEl.value = '';
+            }
+        }
+        if (this.elements?.btnChangePasswordEl) {
+            this.elements.btnChangePasswordEl.textContent = "Update Password";
+        }
+        // Refresh the view
+        this.ibGibAddr = evolvedAddr;
+        this.staticIbGib = parentWithUserDelegate;
+        await this.loadIbGib({ getLatest: true });
+        // Clear inputs
+        this.elements.inputNewPasswordEl.value = '';
+        this.elements.inputConfirmPasswordEl.value = '';
+        return parentWithUserDelegate;
+    }
+    /**
+     * Handles adding a master password to a sovereign identity that was created with passkeys only.
+     * Authorizes via passkey biometric/hardware assertion and cryptographically adds the manage pool.
+     */
+    async handleAddPasswordToPasskeyIdentity() {
+        const lc = `${this.lc}[${this.handleAddPasswordToPasskeyIdentity.name}]`;
+        this.setChangePasswordStatus("Validating entries...", "info");
+        try {
+            const newPassword = this.elements.inputNewPasswordEl.value;
+            const confirmPassword = this.elements.inputConfirmPasswordEl.value;
+            if (!newPassword) {
+                this.setChangePasswordStatus("Master password is required.", "error");
+                return;
+            }
+            if (newPassword !== confirmPassword) {
+                this.setChangePasswordStatus("Master password and confirmation do not match.", "error");
+                return;
+            }
+            const passkeysMap = this.aggregatedDetails?.passkeys
+                || this.ibGib?.data?.frameDetails?.passkeys
+                || this.ibGib?.data?.passkeys
+                || {};
+            const passkeysList = Array.isArray(passkeysMap)
+                ? passkeysMap
+                : Object.values(passkeysMap);
+            const passkeyPool = this.ibGib?.data?.challengePools?.find(p => p.id.startsWith('passkey-manage-'));
+            if (!passkeyPool) {
+                this.setChangePasswordStatus("No active passkey manage pool found on this identity.", "error");
+                return;
+            }
+            let passkeySecret;
+            let signingPoolId;
+            try {
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: 'Authorize Master Password',
+                    msg: 'Please touch your fingerprint sensor, Face ID, or security key to authorize adding a Master Password...',
+                    verb: KEYSTONE_VERB_MANAGE
+                });
+                passkeySecret = authResult.secret;
+                signingPoolId = authResult.poolId;
+            }
+            catch (err) {
+                this.setChangePasswordStatus("Authorization cancelled.", "error");
+                return;
+            }
+            this.showBusy({
+                isBusy: true,
+                title: 'Adding Master Password...',
+                msg: 'Compiling cryptographic master password pool and evolving identity...',
+                animationEmoji: '🔑'
+            });
+            await delay(50);
+            this.setChangePasswordStatus("Generating sovereign master password challenge pool...", "info");
+            const metaspace = await getGlobalMetaspace_waitIfNeeded();
+            if (!metaspace)
+                throw new Error("Global metaspace not available");
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space)
+                throw new Error("Local user space not available");
+            const poolConfig = {
+                id: POOL_ID_MANAGE,
+                type: KeystoneChallengeType.hash_reveal_v1,
+                salt: POOL_ID_MANAGE,
+                algo: HashAlgorithm.sha_256,
+                rounds: 1,
+                allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+                behavior: {
+                    size: 10,
+                    replenish: KeystoneReplenishStrategy.topUp,
+                    selectSequentially: 1,
+                    selectRandomly: 0,
+                    targetBindingCount: 0,
+                }
+            };
+            const newChallenges = await generatePoolChallenges({
+                config: poolConfig,
+                masterSecret: newPassword,
+            });
+            const newManagePool = {
+                id: POOL_ID_MANAGE,
+                config: poolConfig,
+                challenges: newChallenges,
+            };
+            const primaryTjpAddr = (this.ibGib ? getTjpAddr({ ibGib: this.ibGib }) : undefined)
+                || (this.ibGibAddr ? (() => {
+                    const { ib } = getIbAndGib({ ibGibAddr: this.ibGibAddr });
+                    const { tjpGib } = getGibInfo({ ibGibAddr: this.ibGibAddr });
+                    return tjpGib && ib ? `${ib}^${tjpGib}` : this.ibGibAddr;
+                })() : undefined)
+                || getIbGibAddr({ ibGib: this.ibGib });
+            const keystoneService = new KeystoneService_V1();
+            const evolvedParent = await keystoneService.sign({
+                latestKeystone: this.ibGib,
+                claim: {
+                    target: primaryTjpAddr,
+                    verb: KEYSTONE_VERB_MANAGE
+                },
+                masterSecret: passkeySecret,
+                poolId: signingPoolId,
+                dataToPatch: {
+                    challengePools: [...(this.ibGib.data.challengePools || []), newManagePool]
+                },
+                metaspace,
+                space
+            });
+            // Sync pool addition to server
+            this.showBusy({
+                isBusy: true,
+                title: 'Syncing to Server...',
+                msg: 'Publishing updated identity to server...',
+                animationEmoji: '⚡'
+            });
+            const resSync = await getApiBridge().putEvolveKeystone({
+                domainAddr: primaryTjpAddr,
+                keystoneIbGib: evolvedParent,
+                relatedKeystoneIbGibs: []
+            });
+            if (!resSync.success) {
+                throw new Error(`Server sync failed: ${resSync.message}`);
+            }
+            // Save locally
+            await metaspace.put({ ibGibs: [evolvedParent], space });
+            await metaspace.registerNewIbGib({ ibGib: evolvedParent, space });
+            // Delegate registration & final sync via DRY helper
+            await this.registerAndSyncSovereignPasswordDelegate({
+                evolvedParent,
+                newPassword,
+                primaryTjpAddr,
+                metaspace,
+                space
+            });
+        }
+        catch (error) {
+            console.error(`${lc} Failed to add password to passkey identity: ${extractErrorMsg(error)}`, error);
+            this.setChangePasswordStatus(`Failed to add master password: ${extractErrorMsg(error)}`, "error");
+        }
+        finally {
+            this.showBusy({ isBusy: false });
+        }
+    }
     async handleChangePassword() {
         const lc = `${this.lc}[${this.handleChangePassword.name}]`;
         const caps = !!this.ibGib ?
             getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails }) :
             undefined;
-        const isCustodialOnly = !!caps ? caps.isCustodial && !caps.isSovereign : false;
-        if (isCustodialOnly) {
-            await this.handleAddMasterPassword();
+        const hasPassword = !!caps?.hasPassword;
+        if (!hasPassword) {
+            const isCustodialOnly = !!caps ? caps.isCustodial && !caps.isSovereign : false;
+            if (isCustodialOnly) {
+                await this.handleAddMasterPassword();
+            }
+            else {
+                await this.handleAddPasswordToPasskeyIdentity();
+            }
             return;
         }
         this.setChangePasswordStatus("Validating entries...", "info");