@ibgib/web-gib 0.0.60 → 0.0.61

package/src/identity/keystone-sync-service.mts

@@ -9,12 +9,15 @@ import { extractErrorMsg } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs
 import { getIbAndGib, getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
 import { getGibInfo } from "@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs";
 import { KeystoneIbGib_V1 } from "@ibgib/core-gib/dist/keystone/keystone-types.mjs";
+import { KeystoneService_V1 } from "@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs";
 import { getTimelinesGroupedByTjp, getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
+import { isDelegateExpired } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
 import { getApiBridge } from "../api/ibgib-api-bridge.mjs";
 import { getGlobalMetaspace_waitIfNeeded } from "../helpers.mjs";
-import { EVENT_IBGIB_IDENTITY_UPDATE_AVAILABLE } from "../ui/ui-constants.mjs";
-import { EventIbGibIdentityUpdateAvailableDetail } from "../ui/ui-types.mjs";
+import { getDeviceDelegateSecret } from "./device-delegate-helper.mjs";
+import { EVENT_IBGIB_IDENTITY_UPDATE_AVAILABLE, EVENT_IBGIB_IDENTITY_RENEWAL_REQUIRED } from "../ui/ui-constants.mjs";
+import { EventIbGibIdentityUpdateAvailableDetail, EventIbGibIdentityRenewalRequiredDetail } from "../ui/ui-types.mjs";
 
 export interface KeystoneUpdateCheckResult {
     hasUpdate: boolean;
@@ -37,6 +40,96 @@ export class KeystoneSyncService {
         }
     }
 
+    private dispatchRenewalRequiredEvent(detail: EventIbGibIdentityRenewalRequiredDetail): void {
+        if (typeof window !== 'undefined') {
+            window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_RENEWAL_REQUIRED, {
+                detail,
+                bubbles: true,
+                composed: true,
+            }));
+        }
+    }
+
+    /**
+     * Retrieves the stored device delegate secret ($S_D$) for an active primary identity from IndexedDB.
+     */
+    public async getDeviceDelegateSecret({
+        primaryTjpAddr
+    }: {
+        primaryTjpAddr: string;
+    }): Promise<string | undefined> {
+        return getDeviceDelegateSecret({ primaryTjpAddr });
+    }
+
+    /**
+     * Checks if the active identity has a valid, unexpired sync delegate on this device.
+     */
+    public async checkDelegateStatus({
+        activePrimaryAddr,
+        metaspace,
+        space
+    }: {
+        activePrimaryAddr: string;
+        metaspace?: any;
+        space?: any;
+    }): Promise<{ isValid: boolean; reason?: 'expired' | 'missing_secret' }> {
+        const lc = `${this.lc}[${this.checkDelegateStatus.name}]`;
+        try {
+            if (!metaspace) metaspace = await getGlobalMetaspace_waitIfNeeded();
+            if (!metaspace) {
+                throw new Error(`${lc} (UNEXPECTED) metaspace falsy? (E: a1b2c3d4e5f60718293a4b5c6d7e8f90)`);
+            }
+            if (!space) space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) {
+                throw new Error(`${lc} (UNEXPECTED) space falsy? (E: b2c3d4e5f60718293a4b5c6d7e8f90a1)`);
+            }
+
+            const info = getGibInfo({ ibGibAddr: activePrimaryAddr });
+            const { ib } = getIbAndGib({ ibGibAddr: activePrimaryAddr });
+            const primaryTjpAddr = info.tjpGib ? `${ib}^${info.tjpGib}` : activePrimaryAddr;
+
+            // 1. Check if local secret exists in IndexedDB
+            const secret = await getDeviceDelegateSecret({ primaryTjpAddr });
+            if (!secret) {
+                this.dispatchRenewalRequiredEvent({
+                    activePrimaryAddr,
+                    primaryTjpAddr,
+                    reason: 'missing_secret'
+                });
+                return { isValid: false, reason: 'missing_secret' };
+            }
+
+            // 2. Check if primary keystone has registered delegates and if any are expired
+            const keystoneService = new KeystoneService_V1();
+            const keystone = await keystoneService.getLatestKeystone({
+                addr: activePrimaryAddr,
+                metaspace,
+                space
+            });
+            if (!keystone) {
+                throw new Error(`${lc} (UNEXPECTED) latest primary keystone not found for addr: ${activePrimaryAddr} (E: c3d4e5f60718293a4b5c6d7e8f90a1b2)`);
+            }
+
+            if (keystone?.data?.delegates) {
+                const delegates = Object.values(keystone.data.delegates);
+                const isAnyExpired = delegates.some(d => isDelegateExpired({ delegateInfo: d }));
+                if (isAnyExpired) {
+                    this.dispatchRenewalRequiredEvent({
+                        activePrimaryAddr,
+                        primaryTjpAddr,
+                        reason: 'expired'
+                    });
+                    return { isValid: false, reason: 'expired' };
+                }
+            }
+
+            return { isValid: true };
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            return { isValid: false };
+        }
+    }
+
     /**
      * Checks if a server update exists for the given active primary keystone address.
      */

package/src/index.mts

@@ -18,8 +18,7 @@ export * from "./api/ibgib-api-bridge.mjs";
 
 // Identity & Sync services
 export * from "./identity/keystone-sync-service.mjs";
-export * from "./identity/custodian-delegate-helper.mjs";
-// export * from "./identity/sso-callback-helper.mjs";
+export * from "./identity/device-delegate-helper.mjs";
 export * from "./identity/sso-popup-helper.mjs";
 
 // Identity UI components

package/src/storage/storage-helpers.web.mts

@@ -726,3 +726,50 @@ export async function storageReaddir({
         }
     }
 }
+
+/**
+ * Deletes a single key from indexeddb storage.
+ */
+export async function storageDelete({
+    dbName,
+    storeName,
+    key,
+    logalot = false,
+}: {
+    dbName: string;
+    storeName: string;
+    key: string;
+    logalot?: boolean;
+}): Promise<void> {
+    const lc = `[${storageDelete.name}]`;
+    let db: IDBDatabase | undefined = undefined;
+    try {
+        if (logalot) { console.log(`${lc} starting... (I: 8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d)`); }
+        await new Promise<void>((resolve, reject) => {
+            const openDBRequest = indexedDB.open(dbName);
+            openDBRequest.onerror = () => {
+                reject(openDBRequest.error);
+            };
+            openDBRequest.onsuccess = () => {
+                db = openDBRequest.result;
+                const transaction = db.transaction(storeName, "readwrite");
+                const objectStore = transaction.objectStore(storeName);
+                const deleteRequest = objectStore.delete(key);
+                deleteRequest.onerror = () => {
+                    reject(deleteRequest.error);
+                };
+                deleteRequest.onsuccess = () => {
+                    resolve();
+                };
+            };
+        });
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    } finally {
+        if (db) {
+            (db as any).close();
+        }
+        if (logalot) { console.log(`${lc} complete.`); }
+    }
+}

package/src/ui/component/identity/add-device/add-device.mts

@@ -9,8 +9,8 @@ import { getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
 import { KeystoneService_V1 } from "@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs";
 import { KeystoneProfileBuilder } from "@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs";
 import { KeystoneIbGib_V1 } from "@ibgib/core-gib/dist/keystone/keystone-types.mjs";
-import { KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT, KEYSTONE_USERNAME_REGEXP } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
-import { deriveDelegateSecret } from "@ibgib/core-gib/dist/keystone/strategy/hash-reveal-v1/hash-reveal-v1.mjs";
+import { KEYSTONE_USERNAME_REGEXP, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
+import { deriveDelegateSecret, createSyncDelegateKeystone } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
 import { getTimelinesGroupedByTjp, getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
 import { validateEmail } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
@@ -29,7 +29,7 @@ import {
 } from "../../../ui-constants.mjs";
 import { generateDefaultDeviceTag } from "../../../../util/device-helper.mjs";
 import { executeSsoOAuthPopup } from "../../../../identity/sso-popup-helper.mjs";
-import { deriveLocalCustodianDelegateSecret } from "../../../../identity/custodian-delegate-helper.mjs";
+import { getOrCreateDeviceDelegateSecret, setDeviceDelegateSecret } from "../../../../identity/device-delegate-helper.mjs";
 
 export const ADD_DEVICE_COMPONENT_NAME = 'ibgib-add-device';
 
@@ -472,25 +472,6 @@ export class AddDeviceComponentInstance
             animationEmoji: '🔑'
         });
 
-        const delegateSecret = await deriveLocalCustodianDelegateSecret({ primaryTjpAddr });
-        const userAlias = username || (email ? email.split('@')[0] : 'user');
-        const custodianSyncProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_SYNC;
-        if (!custodianSyncProfileName || !custodianSyncProfileName.trim()) {
-            throw new Error('KEYSTONE_PROFILE_CUSTODIAN_SYNC environment variable is missing. Expected valid profile name like "sync-profile.dev" or "sync-profile.prod". (E: 4d5e6f7890123456789abcdef4)');
-        }
-
-        const delegateBuilder = KeystoneProfileBuilder.buildKeystone(custodianSyncProfileName.trim() as any)
-            .withUsername(`${userAlias}-sync-${deviceTag}`)
-            .withDescription(`Sync Delegate for ${userAlias} on ${deviceTag}`)
-            .withDetails({
-                client: 'space-gib-web',
-                role: 'sync-delegate',
-                deviceTag,
-                primaryTjpAddr,
-                custodianReqs,
-            });
-
-        const configs = await delegateBuilder.compileConfigs();
         const metaspace = await getGlobalMetaspace_waitIfNeeded();
         const space = await metaspace.getLocalUserSpace({ lock: false });
         if (!space) {
@@ -498,14 +479,23 @@ export class AddDeviceComponentInstance
             return;
         }
 
-        const keystoneService = new KeystoneService_V1();
-        const delegateKeystone = await keystoneService.genesis({
-            masterSecret: delegateSecret,
-            configs,
+        const delegateSecret = await getOrCreateDeviceDelegateSecret({ primaryTjpAddr, deviceTag });
+        const userAlias = username || (email ? email.split('@')[0] : 'user');
+        const custodianSyncProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_SYNC;
+        if (!custodianSyncProfileName || !custodianSyncProfileName.trim()) {
+            throw new Error('KEYSTONE_PROFILE_CUSTODIAN_SYNC environment variable is missing. Expected valid profile name like "sync-profile.dev" or "sync-profile.prod". (E: 4d5e6f7890123456789abcdef4)');
+        }
+
+        const delegateKeystone = await createSyncDelegateKeystone({
+            profileName: custodianSyncProfileName.trim() as any,
+            username: userAlias,
+            deviceTag,
+            primaryTjpAddr,
+            delegateSecret,
+            custodianReqs,
+            additionalFrameDetails: { client: 'space-gib-web' },
             metaspace,
             space,
-            frameDetails: delegateBuilder.getFrameDetails(),
-            isPrimary: false
         });
 
         this.setStatus('Registering device delegate with custodian server...', 'info');
@@ -590,34 +580,27 @@ export class AddDeviceComponentInstance
                 animationEmoji: '🔑'
             });
 
+            const metaspace = await getGlobalMetaspace_waitIfNeeded();
+            const space = await metaspace.getLocalUserSpace({});
+            if (!space) { throw new Error('No default space found in metaspace.'); }
+
             const delegateSecret = await deriveDelegateSecret({ masterSecret });
+            await setDeviceDelegateSecret({ primaryTjpAddr, delegateSecret });
+
             const sovereignSyncProfileName = process.env.KEYSTONE_PROFILE_SOVEREIGN_SYNC;
             if (!sovereignSyncProfileName || !sovereignSyncProfileName.trim()) {
                 throw new Error('KEYSTONE_PROFILE_SOVEREIGN_SYNC environment variable is missing. Expected valid profile name like "sync-profile.dev" or "sync-profile.prod". (E: 8f9e0a1b2c3d4e5f67890123456789ab)');
             }
 
-            const delegateBuilder = KeystoneProfileBuilder.buildKeystone(sovereignSyncProfileName.trim() as any)
-                .withUsername(`${primaryUsername}-sync-${deviceTag}`)
-                .withDescription(`Sync Delegate for ${primaryUsername} on ${deviceTag}`)
-                .withDetails({
-                    client: 'space-gib-web',
-                    role: 'sync-delegate',
-                    deviceTag,
-                    primaryTjpAddr,
-                });
-
-            const delegateConfigs = await delegateBuilder.compileConfigs();
-            const metaspace = await getGlobalMetaspace_waitIfNeeded();
-            const space = await metaspace.getLocalUserSpace({});
-            if (!space) { throw new Error('No default space found in metaspace.'); }
-
-            const delegateKeystone = await keystoneService.genesis({
-                masterSecret: delegateSecret,
-                configs: delegateConfigs,
+            const delegateKeystone = await createSyncDelegateKeystone({
+                profileName: sovereignSyncProfileName.trim() as any,
+                username: primaryUsername,
+                deviceTag,
+                primaryTjpAddr,
+                delegateSecret,
+                additionalFrameDetails: { client: 'space-gib-web' },
                 metaspace,
                 space,
-                frameDetails: delegateBuilder.getFrameDetails(),
-                isPrimary: false
             });
 
             this.setStatus('Evolving primary identity to register delegate...', 'info');
@@ -765,6 +748,11 @@ export class AddDeviceComponentInstance
 
         await delay(humanEyeDelay);
 
+        // 4.5 Sanitize password input fields from DOM
+        if (this.elements?.inputPassword) {
+            this.elements.inputPassword.value = '';
+        }
+
         // 5. Navigate to identity manager
         window.dispatchEvent(new CustomEvent(EVENT_IBGIB_UI_MESSAGE, {
             detail: { action: 'show-identity-manager', addr: primaryTjpAddr },

package/src/ui/component/identity/keystone-creator/keystone-creator.mts

@@ -14,7 +14,7 @@ import { toDto, getTjpAddr, getTimelinesGroupedByTjp } from "@ibgib/core-gib/dis
 import { FlatIbGibGraph } from "@ibgib/core-gib/dist/common/other/graph-types.mjs";
 import { validateEmail } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
 import { KEYSTONE_USERNAME_REGEXP, KEYSTONE_DESCRIPTION_REGEXP, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
-import { deriveDelegateSecret } from "@ibgib/core-gib/dist/keystone/strategy/hash-reveal-v1/hash-reveal-v1.mjs";
+import { deriveDelegateSecret, createSyncDelegateKeystone } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
 
 import { getGlobalMetaspace_waitIfNeeded, } from "../../../../helpers.mjs";
 import { IbGibDynamicComponentMetaBase, IbGibFormInstanceBase, } from "../../ibgib-dynamic-component-bases.mjs";
@@ -24,8 +24,9 @@ import {
 } from "../../component-types.mjs";
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
 import { getApiBridge } from "../../../../api/ibgib-api-bridge.mjs";
-import { deriveLocalCustodianDelegateSecret } from "../../../../identity/custodian-delegate-helper.mjs";
+import { getOrCreateDeviceDelegateSecret, setDeviceDelegateSecret } from "../../../../identity/device-delegate-helper.mjs";
 import { executeSsoOAuthPopup } from "../../../../identity/sso-popup-helper.mjs";
+import { generateDefaultDeviceTag } from "../../../../util/device-helper.mjs";
 import { EVENT_IBGIB_IDENTITY_REQUEST_CHANGE, EVENT_IBGIB_UI_MESSAGE } from "../../../ui-constants.mjs";
 import { alertUser, shadowRoot_getElementById } from "../../../../helpers.web.mjs";
 
@@ -307,25 +308,6 @@ export class KeystoneCreatorComponentInstance
                 animationEmoji: '🔑'
             });
 
-            const delegateSecret = await deriveLocalCustodianDelegateSecret({ primaryTjpAddr });
-            const email = resLogin.userInfo?.email || '';
-            const username = email ? email.split('@')[0] : 'user';
-            const custodianSyncProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_SYNC;
-            if (!custodianSyncProfileName || !custodianSyncProfileName.trim()) {
-                throw new Error('KEYSTONE_PROFILE_CUSTODIAN_SYNC environment variable is missing. Expected valid profile name like "sync-profile.dev" or "sync-profile.prod". (E: 4d5e6f7890123456789abcdef4)');
-            }
-
-            const delegateBuilder = KeystoneProfileBuilder.buildKeystone(custodianSyncProfileName.trim() as any)
-                .withUsername(`${username}-sync`)
-                .withDescription(`Sync Delegate for ${username}`)
-                .withDetails({
-                    client: 'space-gib-web',
-                    role: 'sync-delegate',
-                    primaryTjpAddr,
-                    custodianReqs,
-                });
-
-            const configs = await delegateBuilder.compileConfigs();
             const metaspace = await getGlobalMetaspace_waitIfNeeded();
             const space = await metaspace.getLocalUserSpace({ lock: false });
             if (!space) {
@@ -333,14 +315,24 @@ export class KeystoneCreatorComponentInstance
                 return;
             }
 
-            const keystoneService = new KeystoneService_V1();
-            const delegateKeystone = await keystoneService.genesis({
-                masterSecret: delegateSecret,
-                configs,
+            const delegateSecret = await getOrCreateDeviceDelegateSecret({ primaryTjpAddr });
+            const email = resLogin.userInfo?.email || '';
+            const username = email ? email.split('@')[0] : 'user';
+            const custodianSyncProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_SYNC;
+            if (!custodianSyncProfileName || !custodianSyncProfileName.trim()) {
+                throw new Error('KEYSTONE_PROFILE_CUSTODIAN_SYNC environment variable is missing. Expected valid profile name like "sync-profile.dev" or "sync-profile.prod". (E: 4d5e6f7890123456789abcdef4)');
+            }
+
+            const delegateKeystone = await createSyncDelegateKeystone({
+                profileName: custodianSyncProfileName.trim() as any,
+                username,
+                deviceTag: generateDefaultDeviceTag(),
+                primaryTjpAddr,
+                delegateSecret,
+                custodianReqs,
+                additionalFrameDetails: { client: 'space-gib-web' },
                 metaspace,
                 space,
-                frameDetails: delegateBuilder.getFrameDetails(),
-                isPrimary: false
             });
 
             this.setStatus('Registering device delegate with custodian server...', 'info');
@@ -467,24 +459,6 @@ export class KeystoneCreatorComponentInstance
                 animationEmoji: '🔑'
             });
 
-            const delegateSecret = await deriveLocalCustodianDelegateSecret({ primaryTjpAddr });
-            const username = email ? email.split('@')[0] : 'user';
-            const custodianSyncProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_SYNC;
-            if (!custodianSyncProfileName || !custodianSyncProfileName.trim()) {
-                throw new Error('KEYSTONE_PROFILE_CUSTODIAN_SYNC environment variable is missing. Expected valid profile name like "sync-profile.dev" or "sync-profile.prod". (E: 4d5e6f7890123456789abcdef4)');
-            }
-
-            const delegateBuilder = KeystoneProfileBuilder.buildKeystone(custodianSyncProfileName.trim() as any)
-                .withUsername(`${username}-sync`)
-                .withDescription(`Sync Delegate for ${username}`)
-                .withDetails({
-                    client: 'space-gib-web',
-                    role: 'sync-delegate',
-                    primaryTjpAddr,
-                    custodianReqs,
-                });
-
-            const configs = await delegateBuilder.compileConfigs();
             const metaspace = await getGlobalMetaspace_waitIfNeeded();
             const space = await metaspace.getLocalUserSpace({ lock: false });
             if (!space) {
@@ -492,14 +466,23 @@ export class KeystoneCreatorComponentInstance
                 return;
             }
 
-            const keystoneService = new KeystoneService_V1();
-            const delegateKeystone = await keystoneService.genesis({
-                masterSecret: delegateSecret,
-                configs,
+            const delegateSecret = await getOrCreateDeviceDelegateSecret({ primaryTjpAddr });
+            const username = email ? email.split('@')[0] : 'user';
+            const custodianSyncProfileName = process.env.KEYSTONE_PROFILE_CUSTODIAN_SYNC;
+            if (!custodianSyncProfileName || !custodianSyncProfileName.trim()) {
+                throw new Error('KEYSTONE_PROFILE_CUSTODIAN_SYNC environment variable is missing. Expected valid profile name like "sync-profile.dev" or "sync-profile.prod". (E: 4d5e6f7890123456789abcdef4)');
+            }
+
+            const delegateKeystone = await createSyncDelegateKeystone({
+                profileName: custodianSyncProfileName.trim() as any,
+                username,
+                deviceTag: generateDefaultDeviceTag(),
+                primaryTjpAddr,
+                delegateSecret,
+                custodianReqs,
+                additionalFrameDetails: { client: 'space-gib-web' },
                 metaspace,
                 space,
-                frameDetails: delegateBuilder.getFrameDetails(),
-                isPrimary: false
             });
 
             // Register delegate with server
@@ -684,27 +667,22 @@ export class KeystoneCreatorComponentInstance
             });
 
             const delegateSecret = await deriveDelegateSecret({ masterSecret });
+            await setDeviceDelegateSecret({ primaryTjpAddr, delegateSecret });
+
             const sovereignSyncProfileName = process.env.KEYSTONE_PROFILE_SOVEREIGN_SYNC;
             if (!sovereignSyncProfileName || !sovereignSyncProfileName.trim()) {
                 throw new Error('KEYSTONE_PROFILE_SOVEREIGN_SYNC environment variable is missing. Expected valid profile name like "sync-profile.dev" or "sync-profile.prod". (E: 5e6f7890123456789abcdef5)');
             }
 
-            const delegateBuilder = KeystoneProfileBuilder.buildKeystone(sovereignSyncProfileName.trim() as any)
-                .withUsername(`${username}-sync`)
-                .withDescription(`Sync Delegate for ${username}`)
-                .withDetails({
-                    client: 'space-gib-web',
-                    role: 'sync-delegate',
-                    primaryTjpAddr: primaryTjpAddr,
-                });
-            const delegateConfigs = await delegateBuilder.compileConfigs();
-
-            const delegateKeystoneIbGib = await keystoneService.genesis({
-                masterSecret: delegateSecret,
-                configs: delegateConfigs,
+            const delegateKeystoneIbGib = await createSyncDelegateKeystone({
+                profileName: sovereignSyncProfileName.trim() as any,
+                username,
+                deviceTag: generateDefaultDeviceTag(),
+                primaryTjpAddr,
+                delegateSecret,
+                additionalFrameDetails: { client: 'space-gib-web' },
                 metaspace,
                 space,
-                frameDetails: delegateBuilder.getFrameDetails()
             });
 
             const delegateAddr = getIbGibAddr({ ibGib: delegateKeystoneIbGib });
@@ -1009,6 +987,11 @@ export class KeystoneCreatorComponentInstance
         this.setStatus(successMsg, "success");
         console.log(`${lc} ✓ ${successMsg}`);
 
+        // 3.5 Sanitize secret input fields from DOM
+        if (this.elements?.inputSecret) {
+            this.elements.inputSecret.value = '';
+        }
+
         // 4. Dispatch UI navigation message to close creator and open identity manager
         window.dispatchEvent(new CustomEvent(EVENT_IBGIB_UI_MESSAGE, {
             detail: { action: 'show-identity-manager', addr: primaryTjpAddr },