refactor(hub): the transport holds an identity, never a private key

Two public keys, sign() and shared(); the apps take transport.signFn. What
holds the keys (this page, or the desktop main process) is the identity's
business alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 3 insertions, 12 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/files-app.js b/packages/meshbay-hub/src/meshbay_hub/static/files-app.js
index cda34b5..38157b9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/files-app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/files-app.js
@@ -332,10 +332,7 @@ function FilesPanel({
     const transport = transportRef.current;
     if (!transport || !transport.connected) return;
     try {
-      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
-      const signFn = (sk && window.MeshBayKeys)
-        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
-        : null;
+      const signFn = transport.signFn;
       await transport.deleteDirectory(dir, signFn);
       applyIndex(await transport.fetchIndex());
     } catch (err) {
@@ -351,10 +348,7 @@ function FilesPanel({
       // the node — see MeshBayCrypto.adminTranscript and finding H5.
       // Signed with the identity this node pinned for us — the only one it
       // will accept, and the only one we hold here.
-      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
-      const signFn = (sk && window.MeshBayKeys)
-        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
-        : null;
+      const signFn = transport.signFn;
       await transport.deleteFile(entry.id, signFn);
       applyIndex(await transport.fetchIndex());
     } catch (err) {
@@ -845,10 +839,7 @@ function FilesPanel({
                   ev.stopPropagation();
                   const transport = transportRef.current;
                   if (!transport) return;
-                  const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
-                  const signFn = (sk && window.MeshBayKeys)
-                    ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
-                    : null;
+                  const signFn = transport.signFn;
                   const fn = isEjected
                     ? () => transport.plugRoot(groupId, d, signFn)
                     : () => transport.ejectRoot(groupId, d, signFn);