| … | … | @@ -34,7 +34,7 @@ import { Service } from 'hyper-svc' |
| 34 | 34 | import { DeployServer } from 'hyper-deploy' |
| 35 | 35 | |
| 36 | 36 | import { TreeStore, DEFAULT_ROOT as PGH_STORE_ROOT } from 'pgh/store' |
| 37 | | import { loadOrCreateIdentity } from 'pgh/identity' |
| 37 | import { loadOrCreateIdentity, identityRootHex } from 'pgh/identity' |
| 38 | 38 | import { ReleaseRegistry } from 'pgh/release-registry' |
| 39 | 39 | import { NameRegistry } from 'pgh/name-registry' |
| 40 | 40 | import { readSubscriptions as readSubscriptionsFromDisk, readNameSubscriptions, addNameSubscription } from 'pgh/subscriptions' |
| … | … | @@ -1328,10 +1328,10 @@ export class Sidecar { |
| 1328 | 1328 | const id = this._identity || {} |
| 1329 | 1329 | const devicePubkey = id.publicKeyHex || |
| 1330 | 1330 | (id.publicKey ? id.publicKey.toString('hex') : null) |
| 1331 | | // masterPublicKey is populated by hyperident; raw fallback has none |
| 1332 | | const rootPubkey = id.masterPublicKey |
| 1333 | | ? (Buffer.isBuffer(id.masterPublicKey) ? id.masterPublicKey.toString('hex') : id.masterPublicKey) |
| 1334 | | : devicePubkey |
| 1331 | // The root, via the one accessor that reads rootPubkeyHex first. Reaching |
| 1332 | // for masterPublicKey alone reported the DEVICE key on a linked device |
| 1333 | // (org #142) — hyperident sets it, `pgh device join` does not. |
| 1334 | const rootPubkey = identityRootHex(id) |
| 1335 | 1335 | return { |
| 1336 | 1336 | devicePubkey, |
| 1337 | 1337 | rootPubkey, |
| … | … | @@ -1588,13 +1588,10 @@ export class Sidecar { |
| 1588 | 1588 | ? b4a.toString(this._registry._base.key, 'hex') |
| 1589 | 1589 | : null |
| 1590 | 1590 | const devicePubkey = this._identity && this._identity.publicKeyHex |
| 1591 | | const identityRoot = this._identity && ( |
| 1592 | | this._identity.masterPublicKey |
| 1593 | | ? (Buffer.isBuffer(this._identity.masterPublicKey) |
| 1594 | | ? this._identity.masterPublicKey.toString('hex') |
| 1595 | | : this._identity.masterPublicKey) |
| 1596 | | : devicePubkey |
| 1597 | | ) |
| 1591 | // The anchor a name is owned by, and what `update-name` will authorise |
| 1592 | // against — it MUST be the root, or rotating the device orphans the |
| 1593 | // claim (org #142). |
| 1594 | const identityRoot = identityRootHex(this._identity) |
| 1598 | 1595 | const publisher = { |
| 1599 | 1596 | devicePubkey, |
| 1600 | 1597 | registryKey: params.registryKey || registryKeyHex, |
| … | … | @@ -1611,12 +1608,9 @@ export class Sidecar { |
| 1611 | 1608 | |
| 1612 | 1609 | svc.handle('release-name', async (ctx, params) => { |
| 1613 | 1610 | if (!params || !params.name) throw new Error('release-name requires { name }') |
| 1614 | | const devicePubkey = this._identity && this._identity.publicKeyHex |
| 1615 | | const identityRoot = this._identity && this._identity.masterPublicKey |
| 1616 | | ? (Buffer.isBuffer(this._identity.masterPublicKey) |
| 1617 | | ? this._identity.masterPublicKey.toString('hex') |
| 1618 | | : this._identity.masterPublicKey) |
| 1619 | | : devicePubkey |
| 1611 | // Same anchor the claim was written with (org #142) — a release that |
| 1612 | // computes it differently from the claim can never match. |
| 1613 | const identityRoot = identityRootHex(this._identity) |
| 1620 | 1614 | await this._nameRegistry.release(params.name, identityRoot) |
| 1621 | 1615 | return { ok: true, released: params.name } |
| 1622 | 1616 | }) |