mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-08-29 12:17:00 +00:00
Evan JarrettandClaude Opus 4.8
8a556a5893
The credential helper stored accounts keyed by handle, which broke on handle renames and let the Docker `store` path (username+secret, no DID) overwrite a good account with a DID-less one — how evan.jarrett.net on buoy.cr ended up active with a blank DID. Re-key everything by the stable DID, treating handle as a mutable display label. DID is recovered client-side via standard AT-proto handle resolution (DNS TXT _atproto.<handle> + HTTPS .well-known/atproto-did) — no server change, no JWT, no auth, and no indigo pulled into the helper. - resolve.go: stdlib handle->DID resolver - config.go: v3 DID-keyed schema; find/activeAccount/upsert/rekey helpers; upsert never blanks a known DID; migrateV2toV3 re-keys existing files in place (no login lost; DID-less accounts stay provisional and self-heal) - protocol.go: store resolves+preserves DID; get lazily backfills+re-keys; list reports the active account's handle (was arbitrary map iteration) - status/switch/logout: display handle, key/compare by DID - config_test.go: migration, upsert-never-blanks-DID, rekey, find, list, resolver parse helpers Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>