@ibgib/web-gib 0.0.62 → 0.0.64

package/src/ui/component/identity/keystone-details/keystone-details.mts

@@ -2,7 +2,7 @@ import thisCss from "./keystone-details.css";
 import thisHtml from "./keystone-details.html";
 import commonComponentStylesCss from "../../common-component-styles.css";
 
-import { extractErrorMsg, pretty, getSaferSubstring, HashAlgorithm } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { extractErrorMsg, pretty, getSaferSubstring, HashAlgorithm, delay } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 import { IbGibAddr } from "@ibgib/ts-gib/dist/types.mjs";
 import { IbGib_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
 import { getIbAndGib, getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
@@ -24,7 +24,7 @@ import { getTjpAddr, toDto, getTimelinesGroupedByTjp } from "@ibgib/core-gib/dis
 import { parseSpaceIb } from "@ibgib/core-gib/dist/witness/space/space-helper.mjs";
 import { executeSsoOAuthPopup } from "../../../../identity/sso-popup-helper.mjs";
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
-import { promptForSecret } from "../../../../helpers.web.mjs";
+import { promptForSecret, promptForAuthoritySecret } from "../../../../helpers.web.mjs";
 import { isSsoProviderLinked, getKeystoneCapabilities, isDelegateExpired, deriveDelegateSecret, createSyncDelegateKeystone, isCustodialDelegate } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
 import { generatePoolChallenges } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
 import { POOL_ID_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT, KEYSTONE_VERB_MANAGE } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
@@ -99,6 +99,7 @@ interface KeystoneDetailsElements extends ElementsBase {
     passkeysCardEl: HTMLDivElement;
     passkeysListEl: HTMLTableSectionElement;
     btnAddPasskeyEl: HTMLButtonElement;
+    selectPasskeyAttachmentEl?: HTMLSelectElement;
     passkeyStatusMsgEl: HTMLDivElement;
     historicalWarningBannerEl: HTMLDivElement;
     containerEl: HTMLDivElement;
@@ -260,6 +261,7 @@ export class KeystoneDetailsComponentInstance
             this.elements.passkeysCardEl = shadow.getElementById('passkeys-card') as HTMLDivElement;
             this.elements.passkeysListEl = shadow.getElementById('passkeys-list') as HTMLTableSectionElement;
             this.elements.btnAddPasskeyEl = shadow.getElementById('btn-add-passkey') as HTMLButtonElement;
+            this.elements.selectPasskeyAttachmentEl = shadow.getElementById('select-passkey-attachment') as HTMLSelectElement;
             this.elements.passkeyStatusMsgEl = shadow.getElementById('passkey-status-msg') as HTMLDivElement;
             this.elements.containerEl = shadow.getElementById('container') as HTMLDivElement;
             this.elements.historicalWarningBannerEl = shadow.getElementById('historical-warning-banner') as HTMLDivElement;
@@ -577,18 +579,16 @@ export class KeystoneDetailsComponentInstance
     private updatePasswordCardView(): void {
         const caps = !!this.ibGib ?
             getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails }) :
-            false;
+            undefined;
         const cardTitleEl = this.elements?.changePasswordCardEl?.querySelector('h3');
         const cardDescEl = this.elements?.changePasswordCardEl?.querySelector('.description');
         const currentPasswordGroup = this.elements?.inputCurrentPasswordEl?.closest('.form-group') as HTMLElement | null;
         const btnChangePassword = this.elements?.btnChangePasswordEl;
 
-        const isCustodialOnly = !!caps ?
-            caps.isCustodial && !caps.isSovereign :
-            false;
-        if (isCustodialOnly) {
+        const hasPassword = !!caps?.hasPassword;
+        if (!hasPassword) {
             if (cardTitleEl) cardTitleEl.textContent = "Add Master Password";
-            if (cardDescEl) cardDescEl.textContent = "Establish sovereign ownership by adding a master password. This enables direct, independent cryptographic management without relying solely on custodian authentication.";
+            if (cardDescEl) cardDescEl.textContent = "Establish a master password for this identity. This enables sovereign password authentication alongside your passkeys and linked providers.";
             if (currentPasswordGroup) currentPasswordGroup.style.display = 'none';
             if (btnChangePassword) btnChangePassword.textContent = "Add Master Password";
         } else {
@@ -1091,12 +1091,17 @@ export class KeystoneDetailsComponentInstance
         const lc = `${this.lc}[${this.handleRevokeDelegate.name}]`;
         try {
             let masterSecret: string;
+            let matchedPoolId: string;
             try {
-                masterSecret = await promptForSecret({
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: 'Revoke Delegate',
                     msg: `Enter Master Password or touch security key to revoke delegate '${deviceName}':`,
-                    confirm: false,
-                    passkeys: this.aggregatedDetails?.passkeys,
+                    verb: KEYSTONE_VERB_MANAGE
                 });
+                masterSecret = authResult.secret;
+                matchedPoolId = authResult.poolId;
             } catch (err) {
                 // User cancelled prompt
                 return;
@@ -1112,29 +1117,6 @@ export class KeystoneDetailsComponentInstance
 
             const keystoneSvc = new KeystoneService_V1();
 
-            // Resolve which manage pool matches the provided masterSecret
-            let matchedPoolId: string | undefined;
-            const candidatePools = this.ibGib!.data?.challengePools.filter(p =>
-                p.id === 'manage' || p.id.startsWith('passkey-manage-') || (p.config.allowedVerbs && p.config.allowedVerbs.includes(KEYSTONE_VERB_MANAGE))
-            ) || [];
-
-            for (const pool of candidatePools) {
-                const ok = await keystoneSvc.verifySigningSecret({
-                    keystoneIbGib: this.ibGib!,
-                    signingSecret: masterSecret,
-                    poolId: pool.id
-                });
-                if (ok) {
-                    matchedPoolId = pool.id;
-                    break;
-                }
-            }
-
-            if (!matchedPoolId) {
-                this.setSyncStatus("Failed to authorize revocation (invalid secret/passkey).", "error");
-                return;
-            }
-
             // Unregister delegate from parent keystone
             const evolvedParent = await keystoneSvc.unregisterDelegate({
                 parentKeystone: this.ibGib!,
@@ -1299,10 +1281,18 @@ export class KeystoneDetailsComponentInstance
             const rawSalt = crypto.getRandomValues(new Uint8Array(32));
             const saltHex = bufferToHex(rawSalt.buffer as ArrayBuffer);
 
+            const attachmentVal = this.elements?.selectPasskeyAttachmentEl?.value;
+            const authenticatorAttachment: AuthenticatorAttachment | undefined =
+                (attachmentVal === 'cross-platform' || attachmentVal === 'platform')
+                    ? attachmentVal
+                    : undefined;
+
             const regResult = await registerPasskeyCredential({
                 username,
                 displayName: username,
-                salt: saltHex
+                salt: saltHex,
+                userVerification: 'preferred',
+                authenticatorAttachment,
             });
             const { credentialId, transports } = regResult;
 
@@ -1311,7 +1301,8 @@ export class KeystoneDetailsComponentInstance
                 const prfResult = await evaluatePasskeyPrf({
                     credentialId,
                     salt: saltHex,
-                    transports
+                    transports,
+                    userVerification: 'preferred'
                 });
                 passkeySecret = prfResult.passkeySecret;
             }
@@ -1338,6 +1329,36 @@ export class KeystoneDetailsComponentInstance
             const keystoneService = new KeystoneService_V1();
             let evolvedKeystone: KeystoneIbGib_V1;
 
+            const poolConfig: KeystonePoolConfig_HashV1 = {
+                id: poolId,
+                type: KeystoneChallengeType.hash_reveal_v1,
+                salt: poolId,
+                algo: HashAlgorithm.sha_256,
+                rounds: 1,
+                allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+                behavior: {
+                    size: 10,
+                    replenish: KeystoneReplenishStrategy.topUp,
+                    selectSequentially: 1,
+                    selectRandomly: 0,
+                    targetBindingCount: 0,
+                }
+            };
+
+            const challenges = await generatePoolChallenges({
+                config: poolConfig,
+                masterSecret: passkeySecret
+            });
+
+            const newPool: KeystoneChallengePool = {
+                id: poolId,
+                config: poolConfig,
+                challenges
+            };
+
+            let authSecret: string | undefined;
+            let signingPoolId: string | undefined;
+
             if (isCustodialOnly) {
                 // Elevate custodial account with sovereign passkey
                 this.showBusy({
@@ -1347,37 +1368,13 @@ export class KeystoneDetailsComponentInstance
                     animationEmoji: '⚡'
                 });
 
-                // Generate new manage pool configuration using passkeySecret
-                const poolConfig: KeystonePoolConfig_HashV1 = {
-                    id: poolId,
-                    type: KeystoneChallengeType.hash_reveal_v1,
-                    salt: poolId,
-                    algo: HashAlgorithm.sha_256,
-                    rounds: 1,
-                    allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
-                    behavior: {
-                        size: 10,
-                        replenish: KeystoneReplenishStrategy.topUp,
-                        selectSequentially: 1,
-                        selectRandomly: 0,
-                        targetBindingCount: 0,
-                    }
-                };
-
-                const challenges = await generatePoolChallenges({
-                    config: poolConfig,
-                    masterSecret: passkeySecret
-                });
-
-                const newPool: KeystoneChallengePool = {
-                    id: poolId,
-                    config: poolConfig,
-                    challenges
-                };
+                authSecret = passkeySecret;
+                signingPoolId = poolId;
 
                 evolvedKeystone = await keystoneService.addPools({
                     latestKeystone: this.ibGib,
-                    masterSecret: passkeySecret,
+                    masterSecret: authSecret,
+                    signingPoolId,
                     newPools: [newPool],
                     frameDetails: {
                         passkeys: {
@@ -1392,39 +1389,18 @@ export class KeystoneDetailsComponentInstance
                 });
             } else {
                 // Secondary passkey registration on existing sovereign identity:
-                // Prompt user to authorize with current master password
-                let authSecret: string | undefined;
-                let isCorrect = false;
-                let tries = 0;
-                const maxTries = 5;
-
-                while (tries < maxTries && !isCorrect) {
-                    try {
-                        const promptMsg = tries === 0
-                            ? 'Enter your current Master Secret (Password) or touch security key to authorize adding this passkey:'
-                            : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
-                        authSecret = await promptForSecret({
-                            msg: promptMsg,
-                            confirm: false,
-                            passkeys: this.aggregatedDetails?.passkeys,
-                        });
-                    } catch (err) {
-                        authSecret = undefined;
-                        break;
-                    }
-
-                    if (!authSecret) break;
-
-                    // Verify secret against manage/passkey pools
-                    isCorrect = await keystoneService.verifySigningSecret({
-                        keystoneIbGib: this.ibGib,
-                        signingSecret: authSecret
+                // Prompt user to authorize with current master password or passkey
+                try {
+                    const authResult = await promptForAuthoritySecret({
+                        keystone: this.ibGib,
+                        aggregatedDetails: this.aggregatedDetails,
+                        title: 'Authorize New Passkey',
+                        msg: 'Enter Master Password or touch security key to authorize adding this passkey:',
+                        verb: KEYSTONE_VERB_MANAGE
                     });
-
-                    if (!isCorrect) tries++;
-                }
-
-                if (!isCorrect || !authSecret) {
+                    authSecret = authResult.secret;
+                    signingPoolId = authResult.poolId;
+                } catch (err) {
                     this.setPasskeyStatus("Registration cancelled (authorization required).", "error");
                     return;
                 }
@@ -1436,36 +1412,10 @@ export class KeystoneDetailsComponentInstance
                     animationEmoji: '🛡️'
                 });
 
-                const poolConfig: KeystonePoolConfig_HashV1 = {
-                    id: poolId,
-                    type: KeystoneChallengeType.hash_reveal_v1,
-                    salt: poolId,
-                    algo: HashAlgorithm.sha_256,
-                    rounds: 1,
-                    allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
-                    behavior: {
-                        size: 10,
-                        replenish: KeystoneReplenishStrategy.topUp,
-                        selectSequentially: 1,
-                        selectRandomly: 0,
-                        targetBindingCount: 0,
-                    }
-                };
-
-                const challenges = await generatePoolChallenges({
-                    config: poolConfig,
-                    masterSecret: passkeySecret
-                });
-
-                const newPool: KeystoneChallengePool = {
-                    id: poolId,
-                    config: poolConfig,
-                    challenges
-                };
-
                 evolvedKeystone = await keystoneService.addPools({
                     latestKeystone: this.ibGib,
                     masterSecret: authSecret,
+                    signingPoolId,
                     newPools: [newPool],
                     frameDetails: {
                         passkeys: {
@@ -1478,25 +1428,75 @@ export class KeystoneDetailsComponentInstance
                     metaspace,
                     space
                 });
+
+                // Sync pool addition frame to server
+                const primaryTjpAddr = getTjpAddr({ ibGib: evolvedKeystone, defaultIfNone: 'incomingAddr' })!;
+                const resSyncPool = await getApiBridge().putEvolveKeystone({
+                    domainAddr: primaryTjpAddr,
+                    keystoneIbGib: evolvedKeystone,
+                    relatedKeystoneIbGibs: []
+                });
+                if (!resSyncPool.success) {
+                    throw new Error(`Server synchronization of passkey pool failed: ${resSyncPool.message}`);
+                }
             }
 
-            // Sync evolved keystone to server
+            // Construct outward device sync delegate for this passkey
+            this.showBusy({
+                isBusy: true,
+                title: 'Creating Sync Delegate...',
+                msg: 'Constructing outward passkey device sync delegate...',
+                animationEmoji: '📱'
+            });
+
+            const primaryTjpAddr = getTjpAddr({ ibGib: evolvedKeystone, defaultIfNone: 'incomingAddr' })!;
+            const { delegateKeystone, deviceTag } = await createPasskeyDeviceSyncDelegate({
+                username,
+                primaryTjpAddr,
+                passkeySecret,
+                transports,
+                metaspace,
+                space
+            });
+
+            // Register outward sync delegate on primary keystone
+            this.showBusy({
+                isBusy: true,
+                title: 'Registering Delegate...',
+                msg: 'Registering outward passkey delegate on primary identity...',
+                animationEmoji: '📝'
+            });
+
+            const delegateSigningPoolId = isCustodialOnly ? poolId : signingPoolId!;
+            const delegateAuthSecret = isCustodialOnly ? passkeySecret : authSecret!;
+
+            evolvedKeystone = await keystoneService.registerDelegate({
+                parentKeystone: evolvedKeystone,
+                delegateKeystone,
+                masterSecret: delegateAuthSecret,
+                signingPoolId: delegateSigningPoolId,
+                metaspace,
+                space,
+                allowedVerbs: [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+                deviceName: deviceTag
+            });
+
+            // Sync evolved keystone and delegate to server
             this.showBusy({
                 isBusy: true,
                 title: 'Syncing to Server...',
-                msg: 'Publishing evolved identity keystone to server...',
+                msg: 'Publishing evolved identity keystone and delegate to server...',
                 animationEmoji: '⚡'
             });
 
-            const primaryTjpAddr = getTjpAddr({ ibGib: evolvedKeystone, defaultIfNone: 'incomingAddr' })!;
             const resSync = await getApiBridge().putEvolveKeystone({
                 domainAddr: primaryTjpAddr,
                 keystoneIbGib: evolvedKeystone,
-                relatedKeystoneIbGibs: []
+                relatedKeystoneIbGibs: [delegateKeystone]
             });
 
             if (!resSync.success) {
-                console.warn(`${lc} Server sync note: ${resSync.message}`);
+                throw new Error(`Server synchronization of delegate failed: ${resSync.message}`);
             }
 
             // Update Special Index
@@ -1505,7 +1505,7 @@ export class KeystoneDetailsComponentInstance
                 rel8nInfos: [
                     {
                         rel8nName: "keystone",
-                        ibGibs: [toDto({ ibGib: evolvedKeystone })]
+                        ibGibs: [toDto({ ibGib: evolvedKeystone }), toDto({ ibGib: delegateKeystone })]
                     }
                 ],
                 metaspace,
@@ -1535,36 +1535,19 @@ export class KeystoneDetailsComponentInstance
         try {
             const keystoneService = new KeystoneService_V1();
             let masterSecret: string | undefined;
-            let isCorrect = false;
-            let tries = 0;
-            const maxTries = 5;
+            let signingPoolId: string | undefined;
 
-            while (tries < maxTries && !isCorrect) {
-                try {
-                    const promptMsg = tries === 0
-                        ? `Are you sure you want to remove "${passkeyName}"? Enter your Master Secret (Password) or touch security key to authorize:`
-                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
-                    masterSecret = await promptForSecret({
-                        msg: promptMsg,
-                        confirm: false,
-                        passkeys: this.aggregatedDetails?.passkeys,
-                    });
-                } catch (err) {
-                    masterSecret = undefined;
-                    break;
-                }
-
-                if (!masterSecret) break;
-
-                isCorrect = await keystoneService.verifySigningSecret({
-                    keystoneIbGib: this.ibGib,
-                    signingSecret: masterSecret
+            try {
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: 'Authorize Removal',
+                    msg: `Are you sure you want to remove "${passkeyName}"? Enter your Master Secret (Password) or touch security key to authorize:`,
+                    verb: KEYSTONE_VERB_MANAGE
                 });
-
-                if (!isCorrect) tries++;
-            }
-
-            if (!isCorrect || !masterSecret) {
+                masterSecret = authResult.secret;
+                signingPoolId = authResult.poolId;
+            } catch (err) {
                 this.setPasskeyStatus("Removal cancelled or unauthorized.", "error");
                 return;
             }
@@ -1590,7 +1573,8 @@ export class KeystoneDetailsComponentInstance
             if (poolExists) {
                 evolvedKeystone = await keystoneService.removePools({
                     latestKeystone: this.ibGib,
-                    masterSecret,
+                    masterSecret: masterSecret!,
+                    signingPoolId: signingPoolId!,
                     poolIds: [poolIdToRemove],
                     frameDetails: {
                         passkeys: {
@@ -1604,11 +1588,12 @@ export class KeystoneDetailsComponentInstance
                     space
                 });
             } else {
+                // If pool doesn't exist, just update frameDetails
                 evolvedKeystone = await keystoneService.sign({
                     latestKeystone: this.ibGib,
-                    masterSecret,
+                    masterSecret: masterSecret!,
+                    poolId: signingPoolId,
                     claim: {
-                        verb: POOL_ID_MANAGE,
                         target: getIbGibAddr({ ibGib: this.ibGib })
                     },
                     frameDetails: {
@@ -1783,48 +1768,23 @@ export class KeystoneDetailsComponentInstance
 
             const custodianPool = linkData.custodianPool;
 
-            // 2. Prompt user for master secret and verify it
-            this.showBusy({ isBusy: false });
+            // 2. Prompt user for authorization secret
             const keystoneService = new KeystoneService_V1();
             let masterSecret: string | undefined;
-            let isCorrect = false;
-            let tries = 0;
-            const maxTries = 8;
-
-            while (tries < maxTries && !isCorrect) {
-                try {
-                    const promptMsg = tries === 0
-                        ? "Link successful! Enter your local Master Secret (Password) to sign and register the custodian pool"
-                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
-                    masterSecret = await promptForSecret({
-                        msg: promptMsg,
-                        confirm: false
-                    });
-                } catch (error) {
-                    // cancelled
-                    if (logalot) { console.log(`${lc}[promptForSecret] user cancelled (I: 911ff1fb0234949228481968e9087626)`); }
-                    masterSecret = undefined;
-                    break;
-                }
-
-                if (!masterSecret) {
-                    break;
-                }
+            let signingPoolId: string | undefined;
 
-                // Verify secret using verifySigningSecret (requires manage poolId)
-                isCorrect = await keystoneService.verifySigningSecret({
-                    keystoneIbGib: this.ibGib!,
-                    signingSecret: masterSecret,
-                    poolId: 'manage'
+            try {
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: `Link ${providerName}`,
+                    msg: `Enter Master Password or touch security key to authorize linking ${providerName}:`,
+                    verb: KEYSTONE_VERB_MANAGE
                 });
-
-                if (!isCorrect) {
-                    tries++;
-                }
-            }
-
-            if (!isCorrect) {
-                this.setSSOStatus("Link cancelled or failed (incorrect password).", "error");
+                masterSecret = authResult.secret;
+                signingPoolId = authResult.poolId;
+            } catch (error) {
+                this.setSSOStatus("Link cancelled or failed.", "error");
                 return;
             }
 
@@ -1845,6 +1805,7 @@ export class KeystoneDetailsComponentInstance
             const evolvedParent = await keystoneService.addPools({
                 latestKeystone: this.ibGib!,
                 masterSecret: masterSecret!,
+                signingPoolId: signingPoolId!,
                 newPools: [custodianPool],
                 metaspace,
                 space
@@ -1875,7 +1836,7 @@ export class KeystoneDetailsComponentInstance
                 parentKeystone: evolvedParent,
                 delegateKeystone,
                 masterSecret: masterSecret!,
-                signingPoolId: 'manage',
+                signingPoolId: signingPoolId!,
                 metaspace,
                 space,
                 allowedVerbs: [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
@@ -1949,45 +1910,23 @@ export class KeystoneDetailsComponentInstance
         this.setSSOStatus(`Unlinking ${providerName}...`, "info");
 
         try {
-            // 1. Prompt user for password
+            // 1. Prompt user for authorization secret
             const keystoneService = new KeystoneService_V1();
             let masterSecret: string | undefined;
-            let isCorrect = false;
-            let tries = 0;
-            const maxTries = 8;
-
-            while (tries < maxTries && !isCorrect) {
-                try {
-                    const promptMsg = tries === 0
-                        ? `Are you sure you want to unlink your ${providerName} account? If so, enter your local Master Secret (Password) or touch security key to authorize. Otherwise, click Cancel.`
-                        : `Incorrect password. Please try again (${maxTries - tries} tries remaining):`;
-                    masterSecret = await promptForSecret({
-                        msg: promptMsg,
-                        confirm: false,
-                        passkeys: this.aggregatedDetails?.passkeys,
-                    });
-                } catch (error) {
-                    masterSecret = undefined;
-                    break;
-                }
-
-                if (!masterSecret) {
-                    break;
-                }
+            let signingPoolId: string | undefined;
 
-                // Verify secret using verifySigningSecret
-                isCorrect = await keystoneService.verifySigningSecret({
-                    keystoneIbGib: this.ibGib!,
-                    signingSecret: masterSecret
+            try {
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: `Unlink ${providerName}`,
+                    msg: `Are you sure you want to unlink your ${providerName} account? If so, enter your Master Password or touch security key to authorize.`,
+                    verb: KEYSTONE_VERB_MANAGE
                 });
-
-                if (!isCorrect) {
-                    tries++;
-                }
-            }
-
-            if (!isCorrect) {
-                this.setSSOStatus("Unlink cancelled or failed (incorrect password).", "error");
+                masterSecret = authResult.secret;
+                signingPoolId = authResult.poolId;
+            } catch (error) {
+                this.setSSOStatus("Unlink cancelled or failed.", "error");
                 return;
             }
 
@@ -2009,6 +1948,7 @@ export class KeystoneDetailsComponentInstance
             let evolvedParent = await keystoneService.removePools({
                 latestKeystone: this.ibGib!,
                 masterSecret: masterSecret!,
+                signingPoolId: signingPoolId!,
                 poolIds: [targetPoolId],
                 metaspace,
                 space
@@ -2293,113 +2233,14 @@ export class KeystoneDetailsComponentInstance
                 await metaspace.registerNewIbGib({ ibGib: evolvedParent, space });
             }
 
-            // 1. Create a password-based sync delegate for this device
-            this.showBusy({
-                isBusy: true,
-                title: 'Creating Sovereign Sync Delegate...',
-                msg: 'Deriving local device sync delegate keys from Master Password...',
-                animationEmoji: '🔑'
-            });
-
-            const rawUsername = this.aggregatedDetails?.username
-                || this.ibGib?.data?.username
-                || this.aggregatedDetails?.emails?.[0]?.split('@')[0]
-                || this.ibGib?.data?.emails?.[0]?.split('@')[0]
-                || 'user';
-
-            const { delegateKeystone: userSyncDelegate, deviceTag } = await createSovereignDeviceSyncDelegate({
-                username: rawUsername,
+            await this.registerAndSyncSovereignPasswordDelegate({
+                evolvedParent,
+                newPassword,
                 primaryTjpAddr,
-                masterSecret: newPassword,
-                metaspace,
-                space,
-            });
-
-            // 2. Register the new user sync delegate on the evolved parent keystone
-            this.showBusy({
-                isBusy: true,
-                title: 'Registering Sovereign Delegate...',
-                msg: 'Registering user sync delegate on primary keystone...',
-                animationEmoji: '📝'
-            });
-
-            const keystoneService = new KeystoneService_V1();
-            const parentWithUserDelegate = await keystoneService.registerDelegate({
-                parentKeystone: evolvedParent,
-                delegateKeystone: userSyncDelegate,
-                masterSecret: newPassword,
-                signingPoolId: 'manage',
-                metaspace,
-                space,
-                allowedVerbs: [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
-                deviceName: deviceTag
-            });
-
-            // 3. Post evolved keystone with new delegate to server
-            this.showBusy({
-                isBusy: true,
-                title: 'Syncing to Server...',
-                msg: 'Publishing updated domain identity and sovereign delegate to server...',
-                animationEmoji: '⚡'
-            });
-
-            const resSync = await getApiBridge().putEvolveKeystone({
-                domainAddr: primaryTjpAddr,
-                keystoneIbGib: parentWithUserDelegate,
-                relatedKeystoneIbGibs: [userSyncDelegate]
-            });
-            if (!resSync.success) {
-                console.warn(`${lc} Warning syncing user delegate to server: ${resSync.message}`);
-            }
-
-            // 4. Save parentWithUserDelegate and userSyncDelegate to local space & metaspace
-            await metaspace.put({ ibGibs: [parentWithUserDelegate, userSyncDelegate], space });
-            await metaspace.registerNewIbGib({ ibGib: parentWithUserDelegate, space });
-            await metaspace.registerNewIbGib({ ibGib: userSyncDelegate, space });
-
-            await updateSpecialIndex({
-                type: "keystones",
-                rel8nInfos: [
-                    {
-                        rel8nName: "keystone",
-                        ibGibs: [toDto({ ibGib: parentWithUserDelegate }), toDto({ ibGib: userSyncDelegate })]
-                    }
-                ],
                 metaspace,
                 space
             });
 
-            const evolvedAddr = getIbGibAddr({ ibGib: parentWithUserDelegate });
-
-            // Dispatch EVENT_IBGIB_IDENTITY_CHANGED
-            window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_CHANGED, {
-                detail: { activeIdentityAddr: evolvedAddr },
-                bubbles: true,
-                composed: true
-            }));
-
-            this.setChangePasswordStatus("Successfully added Master Password! Identity is now sovereign.", "success");
-
-            // Reset OTP section and button text
-            if (this.elements?.sectionAddPasswordOtpEl) {
-                this.elements.sectionAddPasswordOtpEl.classList.add('hidden');
-                if (this.elements.inputAddPasswordOtpEl) {
-                    this.elements.inputAddPasswordOtpEl.value = '';
-                }
-            }
-            if (this.elements?.btnChangePasswordEl) {
-                this.elements.btnChangePasswordEl.textContent = "Update Password";
-            }
-
-            // Refresh the view
-            this.ibGibAddr = evolvedAddr;
-            this.staticIbGib = parentWithUserDelegate;
-            await this.loadIbGib({ getLatest: true });
-
-            // Clear inputs
-            this.elements!.inputNewPasswordEl.value = '';
-            this.elements!.inputConfirmPasswordEl.value = '';
-
         } catch (error) {
             console.error(`${lc} Elevation failed: ${extractErrorMsg(error)}`);
             this.setChangePasswordStatus(`Failed to add master password: ${extractErrorMsg(error)}`, "error");
@@ -2460,6 +2301,295 @@ export class KeystoneDetailsComponentInstance
         }
     }
 
+    /**
+     * Common DRY post-elevation workflow: creates and registers the password-based
+     * device sync delegate, synchronizes the evolved identity with the delegate to the server,
+     * updates the local space and special index, and dispatches the identity change event.
+     */
+    private async registerAndSyncSovereignPasswordDelegate({
+        evolvedParent,
+        newPassword,
+        primaryTjpAddr,
+        metaspace,
+        space,
+    }: {
+        evolvedParent: KeystoneIbGib_V1;
+        newPassword: string;
+        primaryTjpAddr: string;
+        metaspace: any;
+        space: any;
+    }): Promise<KeystoneIbGib_V1> {
+        const lc = `${this.lc}[${this.registerAndSyncSovereignPasswordDelegate.name}]`;
+
+        // 1. Create a password-based sync delegate for this device
+        this.showBusy({
+            isBusy: true,
+            title: 'Creating Sovereign Sync Delegate...',
+            msg: 'Deriving local device sync delegate keys from Master Password...',
+            animationEmoji: '🔑'
+        });
+        await delay(50);
+
+        const rawUsername = this.aggregatedDetails?.username
+            || this.ibGib?.data?.username
+            || this.aggregatedDetails?.emails?.[0]?.split('@')[0]
+            || this.ibGib?.data?.emails?.[0]?.split('@')[0]
+            || 'user';
+
+        const { delegateKeystone: userSyncDelegate, deviceTag } = await createSovereignDeviceSyncDelegate({
+            username: rawUsername,
+            primaryTjpAddr,
+            masterSecret: newPassword,
+            metaspace,
+            space,
+        });
+
+        // 2. Register the new user sync delegate on the evolved parent keystone
+        this.showBusy({
+            isBusy: true,
+            title: 'Registering Sovereign Delegate...',
+            msg: 'Registering user sync delegate on primary keystone...',
+            animationEmoji: '📝'
+        });
+        await delay(50);
+
+        const keystoneService = new KeystoneService_V1();
+        const parentWithUserDelegate = await keystoneService.registerDelegate({
+            parentKeystone: evolvedParent,
+            delegateKeystone: userSyncDelegate,
+            masterSecret: newPassword,
+            signingPoolId: POOL_ID_MANAGE,
+            metaspace,
+            space,
+            allowedVerbs: [KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+            deviceName: deviceTag
+        });
+
+        // 3. Post evolved keystone with new delegate to server
+        this.showBusy({
+            isBusy: true,
+            title: 'Syncing to Server...',
+            msg: 'Publishing updated domain identity and sovereign delegate to server...',
+            animationEmoji: '⚡'
+        });
+
+        const resSync = await getApiBridge().putEvolveKeystone({
+            domainAddr: primaryTjpAddr,
+            keystoneIbGib: parentWithUserDelegate,
+            relatedKeystoneIbGibs: [userSyncDelegate]
+        });
+        if (!resSync.success) {
+            throw new Error(`Server sync of password delegate failed: ${resSync.message}`);
+        }
+
+        // 4. Save parentWithUserDelegate and userSyncDelegate to local space & metaspace
+        await metaspace.put({ ibGibs: [parentWithUserDelegate, userSyncDelegate], space });
+        await metaspace.registerNewIbGib({ ibGib: parentWithUserDelegate, space });
+        await metaspace.registerNewIbGib({ ibGib: userSyncDelegate, space });
+
+        await updateSpecialIndex({
+            type: "keystones",
+            rel8nInfos: [
+                {
+                    rel8nName: "keystone",
+                    ibGibs: [toDto({ ibGib: parentWithUserDelegate }), toDto({ ibGib: userSyncDelegate })]
+                }
+            ],
+            metaspace,
+            space
+        });
+
+        const evolvedAddr = getIbGibAddr({ ibGib: parentWithUserDelegate });
+
+        // Dispatch EVENT_IBGIB_IDENTITY_CHANGED
+        window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_CHANGED, {
+            detail: { activeIdentityAddr: evolvedAddr },
+            bubbles: true,
+            composed: true
+        }));
+
+        this.setChangePasswordStatus("Successfully added Master Password! Identity is now sovereign.", "success");
+
+        // Reset OTP section and button text
+        if (this.elements?.sectionAddPasswordOtpEl) {
+            this.elements.sectionAddPasswordOtpEl.classList.add('hidden');
+            if (this.elements.inputAddPasswordOtpEl) {
+                this.elements.inputAddPasswordOtpEl.value = '';
+            }
+        }
+        if (this.elements?.btnChangePasswordEl) {
+            this.elements.btnChangePasswordEl.textContent = "Update Password";
+        }
+
+        // Refresh the view
+        this.ibGibAddr = evolvedAddr;
+        this.staticIbGib = parentWithUserDelegate;
+        await this.loadIbGib({ getLatest: true });
+
+        // Clear inputs
+        this.elements!.inputNewPasswordEl.value = '';
+        this.elements!.inputConfirmPasswordEl.value = '';
+
+        return parentWithUserDelegate;
+    }
+
+    /**
+     * Handles adding a master password to a sovereign identity that was created with passkeys only.
+     * Authorizes via passkey biometric/hardware assertion and cryptographically adds the manage pool.
+     */
+    protected async handleAddPasswordToPasskeyIdentity(): Promise<void> {
+        const lc = `${this.lc}[${this.handleAddPasswordToPasskeyIdentity.name}]`;
+        this.setChangePasswordStatus("Validating entries...", "info");
+
+        try {
+            const newPassword = this.elements!.inputNewPasswordEl.value;
+            const confirmPassword = this.elements!.inputConfirmPasswordEl.value;
+
+            if (!newPassword) {
+                this.setChangePasswordStatus("Master password is required.", "error");
+                return;
+            }
+            if (newPassword !== confirmPassword) {
+                this.setChangePasswordStatus("Master password and confirmation do not match.", "error");
+                return;
+            }
+
+            const passkeysMap = this.aggregatedDetails?.passkeys
+                || (this.ibGib?.data as any)?.frameDetails?.passkeys
+                || (this.ibGib?.data as any)?.passkeys
+                || {};
+            const passkeysList: KeystonePasskeyEntry[] = Array.isArray(passkeysMap)
+                ? passkeysMap
+                : Object.values(passkeysMap);
+
+            const passkeyPool = this.ibGib?.data?.challengePools?.find(p => p.id.startsWith('passkey-manage-'));
+            if (!passkeyPool) {
+                this.setChangePasswordStatus("No active passkey manage pool found on this identity.", "error");
+                return;
+            }
+
+            let passkeySecret: string | undefined;
+            let signingPoolId: string | undefined;
+
+            try {
+                const authResult = await promptForAuthoritySecret({
+                    keystone: this.ibGib,
+                    aggregatedDetails: this.aggregatedDetails,
+                    title: 'Authorize Master Password',
+                    msg: 'Please touch your fingerprint sensor, Face ID, or security key to authorize adding a Master Password...',
+                    verb: KEYSTONE_VERB_MANAGE
+                });
+                passkeySecret = authResult.secret;
+                signingPoolId = authResult.poolId;
+            } catch (err) {
+                this.setChangePasswordStatus("Authorization cancelled.", "error");
+                return;
+            }
+
+            this.showBusy({
+                isBusy: true,
+                title: 'Adding Master Password...',
+                msg: 'Compiling cryptographic master password pool and evolving identity...',
+                animationEmoji: '🔑'
+            });
+            await delay(50);
+            this.setChangePasswordStatus("Generating sovereign master password challenge pool...", "info");
+
+            const metaspace = await getGlobalMetaspace_waitIfNeeded();
+            if (!metaspace) throw new Error("Global metaspace not available");
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) throw new Error("Local user space not available");
+
+            const poolConfig: KeystonePoolConfig_HashV1 = {
+                id: POOL_ID_MANAGE,
+                type: KeystoneChallengeType.hash_reveal_v1,
+                salt: POOL_ID_MANAGE,
+                algo: HashAlgorithm.sha_256,
+                rounds: 1,
+                allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT],
+                behavior: {
+                    size: 10,
+                    replenish: KeystoneReplenishStrategy.topUp,
+                    selectSequentially: 1,
+                    selectRandomly: 0,
+                    targetBindingCount: 0,
+                }
+            };
+
+            const newChallenges = await generatePoolChallenges({
+                config: poolConfig,
+                masterSecret: newPassword,
+            });
+
+            const newManagePool = {
+                id: POOL_ID_MANAGE,
+                config: poolConfig,
+                challenges: newChallenges,
+            };
+
+            const primaryTjpAddr = (this.ibGib ? getTjpAddr({ ibGib: this.ibGib }) : undefined)
+                || (this.ibGibAddr ? (() => {
+                    const { ib } = getIbAndGib({ ibGibAddr: this.ibGibAddr });
+                    const { tjpGib } = getGibInfo({ ibGibAddr: this.ibGibAddr });
+                    return tjpGib && ib ? `${ib}^${tjpGib}` : this.ibGibAddr;
+                })() : undefined)
+                || getIbGibAddr({ ibGib: this.ibGib! });
+
+            const keystoneService = new KeystoneService_V1();
+            const evolvedParent = await keystoneService.sign({
+                latestKeystone: this.ibGib!,
+                claim: {
+                    target: primaryTjpAddr,
+                    verb: KEYSTONE_VERB_MANAGE
+                },
+                masterSecret: passkeySecret,
+                poolId: signingPoolId,
+                dataToPatch: {
+                    challengePools: [...(this.ibGib!.data!.challengePools || []), newManagePool]
+                },
+                metaspace,
+                space
+            });
+
+            // Sync pool addition to server
+            this.showBusy({
+                isBusy: true,
+                title: 'Syncing to Server...',
+                msg: 'Publishing updated identity to server...',
+                animationEmoji: '⚡'
+            });
+
+            const resSync = await getApiBridge().putEvolveKeystone({
+                domainAddr: primaryTjpAddr,
+                keystoneIbGib: evolvedParent,
+                relatedKeystoneIbGibs: []
+            });
+
+            if (!resSync.success) {
+                throw new Error(`Server sync failed: ${resSync.message}`);
+            }
+
+            // Save locally
+            await metaspace.put({ ibGibs: [evolvedParent], space });
+            await metaspace.registerNewIbGib({ ibGib: evolvedParent, space });
+
+            // Delegate registration & final sync via DRY helper
+            await this.registerAndSyncSovereignPasswordDelegate({
+                evolvedParent,
+                newPassword,
+                primaryTjpAddr,
+                metaspace,
+                space
+            });
+
+        } catch (error) {
+            console.error(`${lc} Failed to add password to passkey identity: ${extractErrorMsg(error)}`, error);
+            this.setChangePasswordStatus(`Failed to add master password: ${extractErrorMsg(error)}`, "error");
+        } finally {
+            this.showBusy({ isBusy: false });
+        }
+    }
+
     protected async handleChangePassword(): Promise<void> {
         const lc = `${this.lc}[${this.handleChangePassword.name}]`;
 
@@ -2467,9 +2597,14 @@ export class KeystoneDetailsComponentInstance
             getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails }) :
             undefined;
 
-        const isCustodialOnly = !!caps ? caps.isCustodial && !caps.isSovereign : false;
-        if (isCustodialOnly) {
-            await this.handleAddMasterPassword();
+        const hasPassword = !!caps?.hasPassword;
+        if (!hasPassword) {
+            const isCustodialOnly = !!caps ? caps.isCustodial && !caps.isSovereign : false;
+            if (isCustodialOnly) {
+                await this.handleAddMasterPassword();
+            } else {
+                await this.handleAddPasswordToPasskeyIdentity();
+            }
             return;
         }