refactor(hub): the transport holds an identity, never a private key

Two public keys, sign() and shared(); the apps take transport.signFn. What
holds the keys (this page, or the desktop main process) is the identity's
business alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 8 insertions, 26 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js b/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js
index f16bdf8..bde218b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js
@@ -450,12 +450,9 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
   // every render is a new prop identity every render, and the callbacks that
   // close over it in the table below are memoised on it.
   const adminSignFn = useCallback((transcript) => {
-    const sk = transportRef.current && transportRef.current.sessionKeys
-      && transportRef.current.sessionKeys.skEdB64;
-    if (!sk || !window.MeshBayKeys) {
-      throw new Error(t('node.root_no_signing_key'));
-    }
-    return window.MeshBayKeys.signBytes(sk, transcript);
+    const sign = transportRef.current && transportRef.current.signFn;
+    if (!sign) throw new Error(t('node.root_no_signing_key'));
+    return sign(transcript);
   }, [transportRef]);
 
   const loadNodeInfo = useCallback(async () => {
@@ -608,10 +605,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
       if (!transport || !transport.connected) {
         throw new Error('Not connected to the node');
       }
-      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
-      const signFn = (sk && window.MeshBayKeys)
-        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
-        : null;
+      const signFn = transport.signFn;
       await transport.setAppsEnabled(next, signFn);
       if (onEnabledApps) onEnabledApps(next);
     } catch (err) {
@@ -648,10 +642,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
       if (!transport || !transport.connected) {
         throw new Error('Not connected to the node');
       }
-      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
-      const signFn = (sk && window.MeshBayKeys)
-        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
-        : null;
+      const signFn = transport.signFn;
       await transport.setScanSettings(reconcileMinutes * 60, debounceSeconds, signFn);
       const applied = {
         reconcile_interval_secs: reconcileMinutes * 60,
@@ -779,10 +770,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
           await platform.node.op('revokeMember', { userId: member.user_id, groupId });
         } catch { /* best effort — node may not host this group */ }
       } else if (transport && transport.connected && operatorPaired) {
-        const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
-        const signFn = (sk && window.MeshBayKeys)
-          ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
-          : null;
+        const signFn = transport.signFn;
         try {
           await transport.revokeMember(member.user_id, signFn);
         } catch (err) { nodeError = err.message; }
@@ -878,10 +866,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
 
       // Signed with the identity this node pinned for us — the only one it
       // will accept, and the only one we hold here.
-      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
-      const signFn = (sk && window.MeshBayKeys)
-        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
-        : null;
+      const signFn = transport.signFn;
       const result = await transport.createInvite(
         account.user_id, groupId, username, signFn);
 
@@ -939,10 +924,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef,
 
   const linkSignFn = useCallback(() => {
     const transport = transportRef && transportRef.current;
-    const sk = transport && transport.sessionKeys && transport.sessionKeys.skEdB64;
-    return (sk && window.MeshBayKeys)
-      ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
-      : null;
+    return (transport && transport.signFn) || null;
   }, [transportRef]);
 
   // A redeemed link is not shown: whoever used it is in the members list above,