@idleware/ringi 0.7.0 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idleware/ringi",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Distributed agent coordinator",
   "os": [
     "darwin",

package/target/dts/adapters/transport-git/index.d.ts

@@ -9,7 +9,7 @@ export declare class GitStore extends Marks implements Store {
         home: string;
         signing?: SigningContext;
     }, contract: Record<string, string>, text: string): GitStore;
-    static rootFor(hubDir: string, d: Descriptor, home: string, signing?: SigningContext): string;
+    static rootFor(hubDir: string, d: Descriptor, home: string, signing: SigningContext): string;
     logIds(room: StoredRoom): string[];
     logHead(room: StoredRoom, id: string): string | null;
     messages(room: StoredRoom, id: string, head: string): StoredMessage[];

package/target/dts/adapters/transport-git/remote/admit.d.ts

@@ -1,7 +1,7 @@
 import type { Handle, Room } from './types.ts';
-export declare const join: (H: Handle, R: Room, who: string, home: string) => {
+export declare const join: (H: Handle, R: Room, who: string) => {
     publicKey: string;
     fingerprint: string;
     admitted: boolean;
 };
-export declare const roomAdmit: (H: Handle, R: Room, who: string, publicKey: string, home: string) => string;
+export declare const roomAdmit: (H: Handle, R: Room, who: string, publicKey: string) => string;

package/target/dts/adapters/transport-git/remote/heartbeat.d.ts

@@ -3,5 +3,5 @@ export { checkHeartbeat, heartbeatObject } from './heartbeat-object.ts';
 export { heartbeatBody } from './heartbeat-facts.ts';
 export { HEARTBEAT_NAME, heartbeatName, heartbeatRef } from './heartbeat-name.ts';
 export declare const verifyHeartbeat: (H: Handle, R: Room, ref: string, sha: string) => string | null;
-type HeartbeatArgs = [H: Handle, R: Room, who: string, target: string, text: string, home: string];
-export declare const makeHeartbeat: (...[H, R, who, target, text, home]: HeartbeatArgs) => string;
+type HeartbeatArgs = [H: Handle, R: Room, who: string, target: string, text: string];
+export declare const makeHeartbeat: (...[H, R, who, target, text]: HeartbeatArgs) => string;

package/target/dts/adapters/transport-git/remote/keys.d.ts

@@ -3,11 +3,11 @@ export declare const parseKey: (value: unknown) => Key;
 export declare const keyInput: (value: string) => Key;
 export declare const rootKey: (H: Handle) => Key;
 export declare const signerLine: (who: string, key: Key) => string;
-export declare const identityKey: (H: Handle, who: string, home: string, create?: boolean) => Key;
-export declare const setupSigned: (H: Handle, home: string, url?: string) => {
+export declare const signingContext: (H: Pick<Handle, 'name' | 'signing'>) => import("../../../core/signing/index.ts").SigningContext;
+export declare const identityKey: (H: Handle, who: string, create?: boolean) => Key;
+export declare const setupSigned: (H: Handle, url?: string) => {
     root: string;
     allowedSigners: string;
 };
-export declare const sign: (H: Handle, who: string, home: string) => string[];
 export declare const rootRoster: (H: Handle) => string;
 export declare const checkUrl: (url: string) => void;

package/target/dts/adapters/transport-git/remote.d.ts

@@ -2,7 +2,7 @@ export type { Handle, Room, Branch } from './remote/types.ts';
 export { withVerification } from './remote/cache.ts';
 export { gitEnv, gitTimeout, checkGitTimeout } from './remote/process.ts';
 export { isRemote } from './remote/git.ts';
-export { parseKey, setupSigned, sign, rootRoster } from './remote/keys.ts';
+export { parseKey, setupSigned, rootRoster } from './remote/keys.ts';
 export { verifyHub } from './remote/main.ts';
 export { readCommits } from './remote/commits.ts';
 export { branch, verifyRoom, verify } from './remote/branch.ts';

package/target/dts/adapters/transport-git/signing.d.ts

@@ -1,4 +1,4 @@
 import type { Handle } from './remote/types.ts';
-export declare const signBytes: (H: Handle, who: string, payload: Buffer | string, home: string) => string;
-export declare const signCommit: (H: Handle, who: string, sha: string, home: string) => string;
-export declare const signedTag: (H: Handle, who: string, tag: string, target: string, home: string) => string;
+export declare const signBytes: (H: Handle, who: string, payload: Buffer | string) => string;
+export declare const signCommit: (H: Handle, who: string, sha: string) => string;
+export declare const signedTag: (H: Handle, who: string, tag: string, target: string) => string;

package/target/dts/core/hub/usecases/hubs.d.ts

@@ -17,6 +17,7 @@ export declare const create: (name: string, { signed, url }?: {
 }) => {
     H: Hub;
     rootKey: string | null;
+    remote: string | null;
     add: string | null;
 };
 export declare const use: (name: string) => void;

package/target/dts/lib/fail.d.ts

@@ -1,3 +1,4 @@
+export declare const withoutCredentials: (text: string) => string;
 export declare class Fail extends Error {
 }
 export declare const fail: (msg: string) => never;

package/target/esm/adapters/transport-git/index.js

@@ -22,10 +22,13 @@ import { CONTROL_FILES } from './branches.js';
 import { Marks } from './marks.js';
 export { runGit } from './run.js';
 import { TEXT_MAX, checkOutgoing } from '../../core/hub/protocol/index.js';
+import { signingContext } from './remote/keys.js';
 export class GitStore extends Marks {
     type = 'git';
     static create(hubDir, d, connection, contract, text) {
         const { home, signing } = typeof connection === 'string' ? { home: connection, signing: undefined } : connection;
+        if (d.trust === 'signed')
+            signingContext({ name: d.name, signing });
         const dir = path.join(hubDir, d.store.path, '.git');
         // A signed hub's repository already exists: rootFor made it with the root key.
         if (!fs.existsSync(dir)) {
@@ -43,10 +46,11 @@ export class GitStore extends Marks {
     }
     // A new signed hub: the root key is generated on this machine and pinned in the descriptor.
     static rootFor(hubDir, d, home, signing) {
+        signingContext({ name: d.name, signing });
         const dir = path.join(hubDir, d.store.path, '.git');
         mkdirIn(home, path.dirname(dir));
         init(dir, home);
-        return Remote.setupSigned({ name: d.name, dir, d, signing }, home, d.store.remote).root;
+        return Remote.setupSigned({ name: d.name, dir, d, signing }, d.store.remote).root;
     }
     logIds(room) { return [...new Set(this.live(room).map(e => e.author))]; }
     logHead(room, id) { return this.live(room).filter(e => e.author === id).at(-1)?.sha ?? null; }
@@ -114,8 +118,8 @@ export class GitStore extends Marks {
             .map(b => /^\d+ blob [0-9a-f]+ +(\d+)\t(.*)$/s.exec(b.toString('utf8'))).filter((x) => !!x)
             .filter(([, , p]) => wanted.has(p)).map(([, n, p]) => [p, Number(n)]));
     }
-    admit(room, who, key) { return Remote.roomAdmit(this.h, this.remote(room), who, key, this.home); }
-    joinKey(room, who) { return Remote.join(this.h, this.remote(room), who, this.home); }
+    admit(room, who, key) { return Remote.roomAdmit(this.h, this.remote(room), who, key); }
+    joinKey(room, who) { return Remote.join(this.h, this.remote(room), who); }
     // A room's transport alarm is the room's, whichever author the operator forgets.
     forgetLog(room, _id) { Remote.forget(this.h, this.remote(room)); }
     rootRoster() { return Remote.rootRoster(this.h); }

package/target/esm/adapters/transport-git/marks.js

@@ -2,7 +2,7 @@
 // one mutable tag `<agent>.heartbeat.<genesis12>` per agent and room, replaced on every beat.
 import * as Remote from './remote.js';
 import { signedTag } from './signing.js';
-import { ZERO, frames, ident, runGitRaw } from './run.js';
+import { ZERO, frames, runGitRaw } from './run.js';
 import { signalTags, tagObject } from './tags.js';
 import { Branches } from './branches.js';
 import { fail, note } from '../../lib/index.js';
@@ -15,7 +15,7 @@ export class Marks extends Branches {
     heartbeat(room, who, target, text) {
         const ref = Remote.heartbeatRef(who, room.genesis), name = ref.slice('refs/tags/'.length);
         const old = this.rev(`${ref}^{tag}`) ? this.git(['rev-parse', ref]).trim() : null;
-        const obj = this.trust === 'signed' ? Remote.makeHeartbeat(this.h, this.remote(room), who, target, text, this.home)
+        const obj = this.trust === 'signed' ? Remote.makeHeartbeat(this.h, this.remote(room), who, target, text)
             : this.git(['mktag'], { input: `object ${target}\ntype commit\ntag ${name}\ntagger ${who} <${who}@ringi> ${Math.floor(Date.now() / 1000)} +0000\n\n${text}` }).trim();
         if (this.gitOk(['update-ref', ref, obj, old ?? ZERO]).status !== 0)
             fail(`${name} moved meanwhile; the next beat writes it`);
@@ -45,13 +45,7 @@ export class Marks extends Branches {
             Remote.push(this.h, ref);
             return;
         }
-        if (this.h.signing)
-            this.git(['update-ref', ref, signedTag(this.h, who, tag, target, this.home), ZERO]);
-        else {
-            const sign = Remote.sign(this.h, who, this.home);
-            const key = sign[0]?.slice(2);
-            this.git([...(key ? ['-c', `user.signingkey=${key}`] : []), 'tag', key ? '-s' : '-a', '-F', '-', tag, target], { input: '', env: ident(who) });
-        }
+        this.git(['update-ref', ref, signedTag(this.h, who, tag, target), ZERO]);
         Remote.push(this.h, ref);
     }
     // The tags named `<actor>.<signal>.<message12>`, with the objects they name; a heartbeat is no signal (heartbeats()).

package/target/esm/adapters/transport-git/remote/admit.js

@@ -3,13 +3,13 @@ import * as C from '../../../lib/index.js';
 import * as P from '../../../core/hub/protocol/index.js';
 import { branch, verifyRoom } from './branch.js';
 import { git, id, ident, isRemote, locked, rev } from './git.js';
-import { keyInput, identityKey, sign, signerLine } from './keys.js';
+import { keyInput, identityKey, signerLine } from './keys.js';
 import { signCommit } from '../signing.js';
 import { push } from './push.js';
 import { CONTROL_FILES, ROOT } from './types.js';
-export const join = (H, R, who, home) => {
+export const join = (H, R, who) => {
     const room = verifyRoom(H, R);
-    const key = locked(H, () => identityKey(H, who, home, true));
+    const key = locked(H, () => identityKey(H, who, true));
     const admitted = !!room.entries.find(e => e.principal === who && e.key.line === key.line);
     return { publicKey: key.line, fingerprint: key.fp, admitted };
 };
@@ -30,14 +30,14 @@ const treeWith = (H, base, control, patches) => {
     return git(H, ['mktree'], { input: [...files].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, line]) => line).join('\n') + '\n' }).trim();
 };
 // The root's control record admitting a member, on top of the room's branch: the key and the member go in together.
-export const roomAdmit = (H, R, who, publicKey, home) => {
+export const roomAdmit = (H, R, who, publicKey) => {
     const key = admissionKey(H, R, who, publicKey);
     for (let attempt = 0; attempt < 8; attempt++) {
         const tip = rev(H, R.ref) ?? C.fail('room branch is missing');
         const room = branch(H, R, tip), head = room.control.at(-1);
         if (room.entries.some(e => e.principal === who || e.key.fp === key.fp))
             C.fail('principal or key is already admitted; key rotation is not implemented');
-        const { sha, members } = admissionCommit({ H, R, who, home, tip, head, room, key });
+        const { sha, members } = admissionCommit({ H, R, who, tip, head, room, key });
         if (git(H, ['update-ref', R.ref, sha, tip], { ok: true }).status !== 0)
             continue;
         if (!push(H, R.ref, { behind: true }))
@@ -48,14 +48,14 @@ export const roomAdmit = (H, R, who, publicKey, home) => {
     }
     return C.fail('room kept moving while admitting; retry');
 };
-const admissionCommit = ({ H, who, home, tip, head, room, key }) => {
+const admissionCommit = ({ H, who, tip, head, room, key }) => {
     const members = { ...room.members, [who]: { role: 'member', since: new Date().toISOString() } };
     const roster = [...room.entries.map(e => signerLine(e.principal, e.key)), signerLine(who, key)].join('');
     const tree = treeWith(H, tip, head, { 'members.json': JSON.stringify(members, null, 2) + '\n', allowed_signers: roster });
-    const sha = git(H, ['commit-tree', ...(H.signing ? [] : sign(H, ROOT, home)), tree, '-p', tip], {
+    const sha = git(H, ['commit-tree', tree, '-p', tip], {
         input: P.compose(`admit ${who}`, [['To', '*'], ['Kind', 'room'], ['Key', key.fp]]), env: ident(ROOT),
     }).trim();
-    return { sha: signCommit(H, ROOT, sha, home), members };
+    return { sha: signCommit(H, ROOT, sha), members };
 };
 const admissionKey = (H, R, who, publicKey) => {
     id(who);

package/target/esm/adapters/transport-git/remote/heartbeat.js

@@ -24,9 +24,9 @@ export const verifyHeartbeat = (H, R, ref, sha) => {
         return reason(e);
     }
 };
-// Keep the transport's existing call contract while object construction has one named input.
-export const makeHeartbeat = (...[H, R, who, target, text, home]) => createHeartbeat({ H, R, who, target, text, home });
-const createHeartbeat = ({ H, R, who, target, text, home }) => {
+// Object construction has one named input; signing needs no custody path.
+export const makeHeartbeat = (...[H, R, who, target, text]) => createHeartbeat({ H, R, who, target, text });
+const createHeartbeat = ({ H, R, who, target, text }) => {
     const ref = heartbeatRef(who, R.genesis);
     if (!SHA.test(target))
         C.fail('heartbeat target must be a full commit id');
@@ -35,7 +35,7 @@ const createHeartbeat = ({ H, R, who, target, text, home }) => {
     const body = `Room: ${R.genesis}\n${text.trimEnd()}\n`;
     heartbeatBody(body);
     const raw = `object ${target}\ntype commit\ntag ${ref.slice(TAGS.length)}\ntagger ${who} <${who}@ringi> ${Math.floor(Date.now() / 1000)} +0000\n\n${body}`;
-    const signature = signBytes(H, who, raw, home);
+    const signature = signBytes(H, who, raw);
     const sha = git(H, ['mktag'], { input: raw + signature }).trim();
     if (isRemote(H))
         checkHeartbeat(H, R, ref, sha);

package/target/esm/adapters/transport-git/remote/keys.js

@@ -1,10 +1,8 @@
 // keys: public keys as given and pinned, a signed hub's root and its signers, and which key signs for a principal.
 import crypto from 'node:crypto';
 import fs from 'node:fs';
-import path from 'node:path';
 import * as C from '../../../lib/index.js';
-import { config, id, isRemote, mkdir, rev } from './git.js';
-import { command } from './process.js';
+import { id, rev } from './git.js';
 import { ROOT } from './types.js';
 export const parseKey = (value) => {
     const text = String(value || '').trim();
@@ -20,47 +18,24 @@ export const parseKey = (value) => {
 export const keyInput = (value) => parseKey(fs.existsSync(value) && fs.statSync(value).isFile() ? fs.readFileSync(value, 'utf8') : value);
 export const rootKey = (H) => parseKey(H.d.root || C.fail(`hub ${H.name} has no out-of-band root pin; use hub add --root <public-key|file>`));
 export const signerLine = (who, key) => `${who} namespaces="git" ${key.line}\n`;
-const keyPath = (H, who, home) => path.join(home, 'keys', id(H.name), id(who));
-const localKey = (H, who, home, create = false) => {
-    const file = keyPath(H, who, home);
-    if (!fs.existsSync(file)) {
-        if (!create)
-            C.fail(`no private key for ${who} on this machine; ${who === ROOT ? 'root keys are never obtained from a hub' : 'join here to generate one, then ask the root to admit its public key'}`);
-        mkdir(path.dirname(file));
-        command('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', `${who}@ringi`, '-f', file]);
-    }
-    // Derive from the private key instead of trusting a mutable .pub sidecar.
-    const key = parseKey(command('ssh-keygen', ['-y', '-f', file]));
-    return { ...key, file };
+export const signingContext = (H) => H.signing ?? C.fail(`hub ${H.name}: signed writes require an injected Signer`);
+export const identityKey = (H, who, create = false) => {
+    const context = signingContext(H);
+    return parseKey(context.signer.publicIdentity(context.resolve(id(H.name), id(who), create)).key);
 };
-export const identityKey = (H, who, home, create = false) => H.signing
-    ? parseKey(H.signing.signer.publicIdentity(H.signing.resolve(id(H.name), id(who), create)).key)
-    : localKey(H, who, home, create);
-export const setupSigned = (H, home, url) => {
+export const setupSigned = (H, url) => {
     id(H.name);
     if (rev(H, 'refs/heads/main'))
         C.fail('setupSigned only initializes an empty hub; it cannot replace an existing trust anchor');
-    const key = identityKey(H, ROOT, home, true);
+    const key = identityKey(H, ROOT, true);
     H.d.trust = 'signed';
     H.d.root = key.line;
-    config(H, 'gpg.format', 'ssh');
-    config(H, 'gpg.ssh.program', 'ssh-keygen');
     if (url) {
         checkUrl(url);
         H.d.store.remote = url;
     }
     return { root: key.line, allowedSigners: signerLine(ROOT, key) };
 };
-export const sign = (H, who, home) => {
-    if (!isRemote(H))
-        return [];
-    const key = localKey(H, who, home);
-    if (who === ROOT && key.line !== rootKey(H).line)
-        C.fail('the local operator key does not match this hub\'s pinned root');
-    config(H, 'gpg.format', 'ssh');
-    config(H, 'gpg.ssh.program', 'ssh-keygen');
-    return [`-S${key.file}`];
-};
 export const rootRoster = (H) => signerLine(ROOT, rootKey(H));
 const supportedUrl = (url) => {
     const malformed = /[\r\n\0]/.test(url) || url.startsWith('-');

package/target/esm/adapters/transport-git/remote.js

@@ -1,7 +1,7 @@
 export { withVerification } from './remote/cache.js';
 export { gitEnv, gitTimeout, checkGitTimeout } from './remote/process.js';
 export { isRemote } from './remote/git.js';
-export { parseKey, setupSigned, sign, rootRoster } from './remote/keys.js';
+export { parseKey, setupSigned, rootRoster } from './remote/keys.js';
 export { verifyHub } from './remote/main.js';
 export { readCommits } from './remote/commits.js';
 export { branch, verifyRoom, verify } from './remote/branch.js';

package/target/esm/adapters/transport-git/repo.js

@@ -8,6 +8,7 @@ import { mkdirIn } from '../fs/index.js';
 import * as Remote from './remote.js';
 import { ZERO, ident, runGit, runGitOk } from './run.js';
 import { signCommit } from './signing.js';
+import { signingContext } from './remote/keys.js';
 // The store is a repository whose work tree holds the contract (`main`) as it is now, so Git clients (SourceTree, IDEs)
 // open `store/` without errors, on the contract, with every room's branch beside it; `git status` stays clean.
 export const init = (dir, home) => runGit(['init', '-q', '-b', 'main', path.dirname(dir)], { where: home });
@@ -24,6 +25,8 @@ export class Repo {
         this.trust = d.trust;
         this.dir = path.join(hubDir, d.store.path, '.git');
         this.h = { name: d.name, dir: this.dir, d, ...(d.trust === 'signed' && signing ? { signing } : {}) };
+        if (this.trust === 'signed')
+            signingContext(this.h);
         if (!fs.existsSync(this.dir))
             fail(`hub ${d.name}: no git store at ${this.dir}`);
         this.openable();
@@ -82,8 +85,8 @@ export class Repo {
     }
     // Every commit is made here: on a signed hub, signed by its author's key on this machine.
     commit(who, text, tree, parents) {
-        const sha = this.git(['commit-tree', ...(this.h.signing ? [] : Remote.sign(this.h, who, this.home)), tree, ...parents.flatMap(p => ['-p', p])], { input: text, env: ident(who) }).trim();
-        return signCommit(this.h, who, sha, this.home);
+        const sha = this.git(['commit-tree', tree, ...parents.flatMap(p => ['-p', p])], { input: text, env: ident(who) }).trim();
+        return signCommit(this.h, who, sha);
     }
     advance(ref, sha, old) {
         if (this.gitOk(['update-ref', ref, sha, old ?? ZERO]).status !== 0)

package/target/esm/adapters/transport-git/signing.js

@@ -1,18 +1,13 @@
 // GitSigningBridge: Signer signs the exact unsigned Git object. Tags append its SSH armor; commits fold it into
-// gpgsig. Custody is injected; only legacy direct entrypoints retain their previous file-key signing default.
+// gpgsig. All signing and public identity come from the injected Signer; custody stays outside the transport.
 import { fail } from '../../lib/index.js';
 import { git, id, ident, isRemote } from './remote/git.js';
-import { identityKey, parseKey, rootKey, sign } from './remote/keys.js';
-import { command } from './remote/process.js';
+import { identityKey, parseKey, rootKey, signingContext } from './remote/keys.js';
 import { checkSignature } from './remote/signature.js';
-export const signBytes = (H, who, payload, home) => {
+export const signBytes = (H, who, payload) => {
     if (!isRemote(H))
         return '';
-    if (!H.signing) {
-        const file = sign(H, who, home)[0].slice(2);
-        return command('ssh-keygen', ['-Y', 'sign', '-n', 'git', '-f', file], { input: payload });
-    }
-    const context = H.signing, key = context.resolve(id(H.name), id(who));
+    const context = signingContext(H), key = context.resolve(id(H.name), id(who));
     const identity = context.signer.publicIdentity(key), publicKey = parseKey(identity.key);
     if (who === 'operator' && publicKey.line !== rootKey(H).line)
         fail('the local operator key does not match this hub\'s pinned root');
@@ -21,24 +16,24 @@ export const signBytes = (H, who, payload, home) => {
         fail('the signer returned an incompatible signature identity or format');
     return Buffer.from(signature.bytes).toString('utf8');
 };
-// The legacy constructor path already asked Git to sign; only an injected provider uses the neutral byte bridge.
-export const signCommit = (H, who, sha, home) => {
-    if (!H.signing || !isRemote(H))
+export const signCommit = (H, who, sha) => {
+    if (!isRemote(H))
         return sha;
     const raw = git(H, ['cat-file', 'commit', sha], { raw: true }), end = raw.indexOf('\n\n');
     if (end < 0)
         fail('malformed unsigned commit');
-    const signature = signBytes(H, who, raw, home).trimEnd().replace(/\n/g, '\n ');
+    const signature = signBytes(H, who, raw).trimEnd().replace(/\n/g, '\n ');
     const body = Buffer.concat([raw.subarray(0, end), Buffer.from(`\ngpgsig ${signature}\n\n`), raw.subarray(end + 2)]);
     const signed = git(H, ['hash-object', '-t', 'commit', '-w', '--stdin'], { input: body }).trim();
-    checkSignature(H, signed, who, identityKey(H, who, home));
+    checkSignature(H, signed, who, identityKey(H, who));
     return signed;
 };
-export const signedTag = (H, who, tag, target, home) => {
+export const signedTag = (H, who, tag, target) => {
     const tagger = git(H, ['var', 'GIT_COMMITTER_IDENT'], { env: ident(who) }).trim();
     const raw = `object ${target}\ntype commit\ntag ${tag}\ntagger ${tagger}\n\n`;
-    const signed = git(H, ['mktag'], { input: raw + signBytes(H, who, raw, home) }).trim();
-    checkSignature(H, signed, who, identityKey(H, who, home), 'tag');
+    const signed = git(H, ['mktag'], { input: raw + signBytes(H, who, raw) }).trim();
+    if (isRemote(H))
+        checkSignature(H, signed, who, identityKey(H, who), 'tag');
     return signed;
 };
 //# sourceMappingURL=signing.js.map

package/target/esm/adapters/transport-git/transport.js

@@ -1,12 +1,12 @@
 // transport: the git store as a store type: a hub's repository is `store/.git` in the hub's directory; a signed hub's
-// root key is made here (remote/keys.ts) and a published hub is replicated by bootstrap (remote/bootstrap.ts).
-import path from 'node:path';
+// root identity comes from Signer and a published hub is replicated by bootstrap (remote/bootstrap.ts).
+import { fail } from '../../lib/index.js';
 import { GitStore } from './index.js';
 import * as Remote from './remote.js';
 const context = (d, opt) => d.trust === 'signed'
-    ? typeof opt.signer === 'function' ? opt.signer() : opt.signer
+    ? (typeof opt.signer === 'function' ? opt.signer() : opt.signer) ?? fail('signed hubs require an injected Signer')
     : undefined;
-// `home`: where this machine keeps its state; the git store keeps its keys and scratch indexes there.
+// `home`: where this machine keeps its state and scratch indexes; Signer owns key custody.
 export const gitTransport = (home, opt = {}) => ({
     // One branch per room with its messages and control records, signals as tags on them (hub-1, Layout).
     layout: 'git/2',
@@ -15,13 +15,13 @@ export const gitTransport = (home, opt = {}) => ({
     open: (at, d) => new GitStore(at, d, home, context(d, opt)),
     create: (at, d, genesis) => {
         const signing = context(d, opt);
-        if (d.trust === 'signed')
+        if (signing)
             d.root = GitStore.rootFor(at, d, home, signing);
         const g = genesis(d);
         const store = GitStore.create(at, d, { home, signing }, g.files, g.text);
         if (d.trust === 'signed')
             d.genesis = store.contractHead();
-        const custody = d.trust !== 'signed' ? null : signing ? signing.custody?.(d.name, 'operator') ?? null : path.join(home, 'keys', d.name, 'operator');
+        const custody = signing?.custody?.(d.name, 'operator') ?? null;
         return { store, custody };
     },
     attach: (name, url, pins) => { Remote.hubAdd({ home, name, url, ...pins }); },

package/target/esm/clients/cli/operator/hub-commands.js

@@ -14,7 +14,7 @@ export const createHub = (o) => {
     const r = Hubs.create(arg ?? '', { signed: flag(o, 'signed'), url: opt(o, 'url') });
     if (!r.add)
         return out(`created hub ${arg} (${r.H.dir})`);
-    return out(`created signed hub ${arg}${r.H.d.store.remote ? `, published to ${r.H.d.store.remote}` : ''}. Its root key stays on this machine (${r.rootKey}).
+    return out(`created signed hub ${arg}${r.remote ? `, published to ${r.remote}` : ''}. Its root key stays on this machine (${r.rootKey}).
 Give every machine that joins it, out of band:
   ${r.add}`);
 };

package/target/esm/core/hub/usecases/hubs.js

@@ -2,8 +2,10 @@
 import { DEFAULT_PROFILE, PROFILES_CAPABILITY, parseProfile } from '../work/index.js';
 import { OPERATOR, config, createHub, hubNames, openHub, roomNames, setConfig, transportOf } from '../rooms/index.js';
 import { hubPorts } from '../ports/index.js';
-import { fail, strictJson, words } from '../../../lib/index.js';
+import { fail, strictJson, withoutCredentials, words } from '../../../lib/index.js';
 import { ID_RE, compose } from '../protocol/index.js';
+// A remote as shown and handed to other machines: never with a password or token in it; each machine has its own.
+const shown = (url) => url ? withoutCredentials(url) : null;
 // The operator's terminal context picks the hub unless one is named.
 export const hubOf = (name) => openHub(name ?? config().hub);
 export const hubs = () => {
@@ -14,7 +16,7 @@ export const hubs = () => {
     return hubNames().map(n => {
         const H = openHub(n);
         return { name: H.name, current: H.name === cur, store: H.d.store.type, trust: H.contract.trust, contract: H.contract.version,
-            rooms: roomNames(H).length, remote: H.d.store.remote ?? null, dir: H.dir };
+            rooms: roomNames(H).length, remote: shown(H.d.store.remote), dir: H.dir };
     });
 };
 // A new hub; a signed one makes its root key here and returns what other machines need to pin it.
@@ -22,9 +24,9 @@ export const create = (name, { signed = false, url } = {}) => {
     if (!ID_RE.test(name))
         fail('usage: ringi hub create <name> [--signed [--url <git url>]]');
     const { custody } = createHub(name, { signed, url });
-    const H = openHub(name);
-    return { H, rootKey: custody,
-        add: H.signed ? `ringi hub add ${name} ${H.d.store.remote ?? '<url>'} --root '${H.d.root}' --genesis ${H.d.genesis}` : null };
+    const H = openHub(name), remote = shown(H.d.store.remote);
+    return { H, rootKey: custody, remote,
+        add: H.signed ? `ringi hub add ${name} ${remote ?? '<url>'} --root '${H.d.root}' --genesis ${H.d.genesis}` : null };
 };
 export const use = (name) => {
     openHub(name);

package/target/esm/lib/fail.js

@@ -1,7 +1,12 @@
 // fail: a refusal ringi explains (Fail, shown as its message), apart from a bug (any other error, shown with its stack).
+// A URL's credentials never shown, however git or a person wrote them: everything before its host goes, up to the last
+// `@` (a token may be the whole user, or hold an `@`), except an SSH login name, which is no secret.
+const USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/?#'"]*)@/gi;
+export const withoutCredentials = (text) => text.replace(USERINFO, (_, scheme, user) => /^ssh:/i.test(scheme) && !user.includes(':') ? `${scheme}${user}@` : scheme);
 export class Fail extends Error {
 }
-export const fail = (msg) => { throw new Fail(msg); };
+// Every refusal passes here, git's own diagnostics included, so none shows a URL's credentials.
+export const fail = (msg) => { throw new Fail(withoutCredentials(msg)); };
 export const errno = (e) => e?.code;
 // A write the host refused: what to do is the same for every host; a tool's own way (its sandbox settings) is added
 // by the interface that knows the tools (cli.ts).

package/target/esm/lib/index.js

@@ -1,7 +1,8 @@
 // lib: helpers that know nothing of ringi and touch no host: failing (fail.ts), notes, formatting, strict JSON
 // (json.ts). Files and locks are the adapters' (adapters/fs).
-// Notes and alarms go where the program sends them (composition/: stderr). Those written before it says where wait
-// for it, so none is lost to the order modules load in.
+import { withoutCredentials } from './fail.js';
+// Notes and alarms go where the program sends them (composition/: stderr), never with a URL's credentials. Those
+// written before it says where wait for it, so none is lost to the order modules load in.
 const notes = [];
 let sink = null;
 export const notesTo = (fn) => {
@@ -10,7 +11,7 @@ export const notesTo = (fn) => {
         fn(line);
 };
 export const note = (s) => {
-    const line = `ringi: ${s}\n`;
+    const line = `ringi: ${withoutCredentials(s)}\n`;
     if (sink)
         sink(line);
     else