diff --git a/crates/auths-cli/src/commands/namespace.rs b/crates/auths-cli/src/commands/namespace.rs index e3a924819..88bbc9f72 100644 --- a/crates/auths-cli/src/commands/namespace.rs +++ b/crates/auths-cli/src/commands/namespace.rs @@ -60,7 +60,7 @@ pub enum NamespaceSubcommand { #[arg(long)] package_name: String, - /// Registry URL (defaults to the public registry) + /// Registry URL (no default) #[arg(long)] registry_url: Option, @@ -83,7 +83,7 @@ pub enum NamespaceSubcommand { #[arg(long)] delegate_did: String, - /// Registry URL (defaults to the public registry) + /// Registry URL (no default) #[arg(long)] registry_url: Option, @@ -106,7 +106,7 @@ pub enum NamespaceSubcommand { #[arg(long)] new_owner_did: String, - /// Registry URL (defaults to the public registry) + /// Registry URL (no default) #[arg(long)] registry_url: Option, @@ -125,7 +125,7 @@ pub enum NamespaceSubcommand { #[arg(long)] package_name: String, - /// Registry URL (defaults to the public registry) + /// Registry URL (no default) #[arg(long)] registry_url: Option, }, diff --git a/crates/auths-cli/src/commands/verify_helpers.rs b/crates/auths-cli/src/commands/verify_helpers.rs index 1bd43ad3a..927aaee14 100644 --- a/crates/auths-cli/src/commands/verify_helpers.rs +++ b/crates/auths-cli/src/commands/verify_helpers.rs @@ -88,11 +88,12 @@ pub fn parse_witness_keys(keys: &[String]) -> Result)>> { /// The registry URL to use, or an actionable error when none is configured. /// -/// There is no default registry: auths is offline-first, and the one that used to -/// be baked in (`https://registry.auths.dev`) returned HTTP 404 — a default that -/// looks configured and fails at the network. Registry-dependent verbs resolve -/// through here so the refusal is stated once, at the CLI boundary, in terms of -/// what the user can do about it. +/// There is no default registry: auths is offline-first, and defaulting to our +/// public one (`auths_sdk::PUBLIC_REGISTRY_URL`, `https://network.auths.dev`) +/// would quietly centralize a network meant to be federated. It stays opt-in — +/// pass `--registry ` (ours or your own) or set `AUTHS_REGISTRY_URL`. +/// Registry-dependent verbs resolve through here so the refusal is stated once, +/// at the CLI boundary, in terms of what the user can do about it. /// /// Args: /// * `configured`: The value of `--registry` / `AUTHS_REGISTRY_URL`, if any. @@ -104,8 +105,9 @@ pub fn parse_witness_keys(keys: &[String]) -> Result)>> { pub fn require_registry(configured: Option) -> Result { configured.ok_or_else(|| { anyhow!( - "{}", - auths_sdk::domains::identity::error::RegistrationError::NoRegistryConfigured + "{}\nOur public registry is {} — pass it, or point --registry at your own.", + auths_sdk::domains::identity::error::RegistrationError::NoRegistryConfigured, + auths_sdk::PUBLIC_REGISTRY_URL ) }) } diff --git a/crates/auths-sdk/README.md b/crates/auths-sdk/README.md index 3a2fe034c..b95b72bed 100644 --- a/crates/auths-sdk/README.md +++ b/crates/auths-sdk/README.md @@ -89,7 +89,7 @@ let config = DeveloperSetupConfig::builder("main".into()) .with_platform(PlatformVerification::GitHub { access_token: "ghp_abc123".into(), }) - .with_registration("https://registry.auths.dev") + .with_registration("https://network.auths.dev") .build(); let result = setup_developer(config, &ctx)?; diff --git a/crates/auths-sdk/src/domains/identity/registration.rs b/crates/auths-sdk/src/domains/identity/registration.rs index 5632b6342..46716df46 100644 --- a/crates/auths-sdk/src/domains/identity/registration.rs +++ b/crates/auths-sdk/src/domains/identity/registration.rs @@ -14,20 +14,22 @@ use crate::domains::identity::types::RegistrationOutcome; // There is deliberately no default registry URL. // -// There used to be one — `https://registry.auths.dev` — and it returned HTTP 404 -// (Vercel: DEPLOYMENT_NOT_FOUND). Every registry-touching command therefore shipped -// with a default pointing at a host that does not exist, which is the worst -// possible failure shape: it looks configured and fails at the network. +// We *do* run a first-party public registry — `crate::PUBLIC_REGISTRY_URL` +// (`https://network.auths.dev`) — but it is offered as one option, never baked +// in as the implicit fallback. A silent default would make our infrastructure +// everyone's default and centralize the very network the deploy charts +// (helm/terraform/compose) exist to let anyone federate — the opposite of the +// "no central server" headline claim. // -// Nothing needs it. Identity, signing, and verification are entirely local and -// git-native — a signer's KEL travels to a relying party inside the committed -// identity bundle (`auths id export-bundle` → `.auths/ci-bundle.json`). "No -// central server" is the product's headline claim, and a default that -// contradicts it is worse than no default. +// Nothing needs a registry anyway. Identity, signing, and verification are +// entirely local and git-native — a signer's KEL travels to a relying party +// inside the committed identity bundle (`auths id export-bundle` → +// `.auths/ci-bundle.json`). // -// A registry is now opt-in and explicit: pass `--registry ` or set -// `AUTHS_REGISTRY_URL`. Callers surface `RegistrationError::NoRegistryConfigured` -// when a registry-dependent verb is invoked without one. +// A registry is thus opt-in and explicit: pass `--registry ` (ours or your +// own) or set `AUTHS_REGISTRY_URL`. Callers surface +// `RegistrationError::NoRegistryConfigured` when a registry-dependent verb is +// invoked without one. #[derive(Serialize)] struct RegistryOnboardingPayload { @@ -56,7 +58,7 @@ struct RegistrationResponse { /// ```ignore /// let outcome = register_identity( /// identity_storage, registry, attestation_source, -/// "https://registry.auths.dev", None, &http_client, +/// "https://network.auths.dev", None, &http_client, /// ).await?; /// ``` pub async fn register_identity( diff --git a/crates/auths-sdk/src/domains/identity/types.rs b/crates/auths-sdk/src/domains/identity/types.rs index 6324c093e..ea2e79413 100644 --- a/crates/auths-sdk/src/domains/identity/types.rs +++ b/crates/auths-sdk/src/domains/identity/types.rs @@ -157,7 +157,7 @@ impl CreateDeveloperIdentityConfigBuilder { /// Usage: /// ```ignore /// let config = CreateDeveloperIdentityConfig::builder("my-key") - /// .with_registration("https://registry.auths.dev") + /// .with_registration("https://network.auths.dev") /// .build(); /// ``` pub fn with_registration(mut self, url: impl Into) -> Self { diff --git a/crates/auths-sdk/src/lib.rs b/crates/auths-sdk/src/lib.rs index 4f6499621..c358743be 100644 --- a/crates/auths-sdk/src/lib.rs +++ b/crates/auths-sdk/src/lib.rs @@ -20,6 +20,18 @@ //! SDK functions accept typed configs and return structured `Result` types. //! They never prompt for input, print to stdout, or call `process::exit()`. +/// The Auths-operated first-party public registry. +/// +/// This is the canonical home for the URL — reference it instead of re-typing +/// the literal, so the value lives in exactly one place. It is a *named +/// reference*, **not** an implicit default: registry-touching commands still +/// require an explicit `--registry`/`AUTHS_REGISTRY_URL`. Baking it in as a +/// silent fallback would make our infrastructure everyone's default and +/// centralize the very network the deploy charts exist to let anyone federate +/// (and the core verbs — identity, signing, verification — need no registry at +/// all). It is one option a party may opt into; running your own is another. +pub const PUBLIC_REGISTRY_URL: &str = "https://network.auths.dev"; + // ── Re-export modules: types from auths-core, auths-id, auths-storage ── // These allow CLI and API consumers to import through auths-sdk instead of // depending on lower-layer crates directly. diff --git a/crates/auths-sdk/src/pairing/mod.rs b/crates/auths-sdk/src/pairing/mod.rs index 6b60d4d9d..e3d087ef7 100644 --- a/crates/auths-sdk/src/pairing/mod.rs +++ b/crates/auths-sdk/src/pairing/mod.rs @@ -93,7 +93,7 @@ pub enum PairingError { /// ```ignore /// let params = PairingSessionParams { /// controller_did: "did:keri:abc123".into(), -/// registry: "https://registry.auths.dev".into(), +/// registry: "https://network.auths.dev".into(), /// capabilities: vec![Capability::sign_commit()], /// expiry_secs: 300, /// }; @@ -244,7 +244,7 @@ pub fn verify_device_did( /// ```ignore /// let req = build_pairing_session_request(PairingSessionParams { /// controller_did: "did:keri:abc123".into(), -/// registry: "https://registry.auths.dev".into(), +/// registry: "https://network.auths.dev".into(), /// capabilities: vec![Capability::sign_commit()], /// expiry_secs: 300, /// })?; diff --git a/crates/auths-sdk/src/workflows/transparency.rs b/crates/auths-sdk/src/workflows/transparency.rs index 82e4fed0c..f3da1ce92 100644 --- a/crates/auths-sdk/src/workflows/transparency.rs +++ b/crates/auths-sdk/src/workflows/transparency.rs @@ -105,7 +105,7 @@ fn operator_info_from_wire(w: &TrustRootWitnessResponse) -> Option` | — | Path to an existing .auths.json signature file. Defaults to .auths.json | | `--package ` | — | Package identifier for registry indexing (e.g., npm:react@18.3.0) | -| `--registry ` | `https://registry.auths.dev` | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] | +| `--registry ` | — | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] | | `-j, --json` | — | Emit machine-readable JSON | | `-q, --quiet` | — | Suppress non-essential output | | `--repo ` | — | Override the local storage directory (default: ~/.auths) | @@ -62,7 +62,7 @@ Sign and publish an artifact attestation to a registry |------|---------|-------------| | `--signature ` | — | Path to an existing .auths.json signature file. Defaults to .auths.json | | `--package ` | — | Package identifier for registry indexing (e.g., npm:react@18.3.0) | -| `--registry ` | `https://registry.auths.dev` | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] | +| `--registry ` | — | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] | | `--key ` | — | Local alias of the identity key. Omit for device-only CI signing | | `--device-key ` | — | Local alias of the device key. Auto-detected when only one key exists | | `--expires-in ` | — | Duration in seconds until expiration | @@ -259,7 +259,7 @@ Publish this identity to a public registry for discovery | Flag | Default | Description | |------|---------|-------------| -| `--registry ` | `https://registry.auths.dev` | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] | +| `--registry ` | — | Registry URL to publish to [env: AUTHS_REGISTRY_URL=] | | `-j, --json` | — | Emit machine-readable JSON | | `-q, --quiet` | — | Suppress non-essential output | | `--repo ` | — | Override the local storage directory (default: ~/.auths) | @@ -751,7 +751,7 @@ Claim a namespace in a package ecosystem |------|---------|-------------| | `--ecosystem ` | — | Package ecosystem (e.g. npm, crates.io, pypi) | | `--package-name ` | — | Package name to claim | -| `--registry-url ` | — | Registry URL (defaults to the public registry) | +| `--registry-url ` | — | Registry URL (no default) | | `--key ` | — | Alias of the signing key in keychain | | `-j, --json` | — | Emit machine-readable JSON | | `-q, --quiet` | — | Suppress non-essential output | @@ -772,7 +772,7 @@ Delegate namespace authority to another identity | `--ecosystem ` | — | Package ecosystem (e.g. npm, crates.io, pypi) | | `--package-name ` | — | Package name | | `--delegate-did ` | — | DID of the identity to delegate to | -| `--registry-url ` | — | Registry URL (defaults to the public registry) | +| `--registry-url ` | — | Registry URL (no default) | | `--key ` | — | Alias of the signing key in keychain | | `-j, --json` | — | Emit machine-readable JSON | | `-q, --quiet` | — | Suppress non-essential output | @@ -793,7 +793,7 @@ Transfer namespace ownership to another identity | `--ecosystem ` | — | Package ecosystem (e.g. npm, crates.io, pypi) | | `--package-name ` | — | Package name | | `--new-owner-did ` | — | DID of the new owner | -| `--registry-url ` | — | Registry URL (defaults to the public registry) | +| `--registry-url ` | — | Registry URL (no default) | | `--key ` | — | Alias of the signing key in keychain | | `-j, --json` | — | Emit machine-readable JSON | | `-q, --quiet` | — | Suppress non-essential output | @@ -813,7 +813,7 @@ Look up namespace information |------|---------|-------------| | `--ecosystem ` | — | Package ecosystem (e.g. npm, crates.io, pypi) | | `--package-name ` | — | Package name | -| `--registry-url ` | — | Registry URL (defaults to the public registry) | +| `--registry-url ` | — | Registry URL (no default) | | `-j, --json` | — | Emit machine-readable JSON | | `-q, --quiet` | — | Suppress non-essential output | | `--repo ` | — | Override the local storage directory (default: ~/.auths) | @@ -1034,7 +1034,7 @@ Join an organization using an invite code | Flag | Default | Description | |------|---------|-------------| | `--code ` | — | Invite code (e.g. from `auths org join --code C23BD59F`) | -| `--registry ` | `https://registry.auths.dev` | Registry URL to contact [env: AUTHS_REGISTRY_URL=] | +| `--registry ` | — | Registry URL to contact [env: AUTHS_REGISTRY_URL=] | | `-j, --json` | — | Emit machine-readable JSON | | `-q, --quiet` | — | Suppress non-essential output | | `--repo ` | — | Override the local storage directory (default: ~/.auths) | diff --git a/docs/cli/commands/primary.md b/docs/cli/commands/primary.md index 4756c566f..4a4cc6e88 100644 --- a/docs/cli/commands/primary.md +++ b/docs/cli/commands/primary.md @@ -19,7 +19,7 @@ Create your signing identity and configure Git | `--key-alias ` | `main` | Key alias for the identity key (default: main) | | `--force` | — | Force overwrite if identity already exists | | `--dry-run` | — | Preview agent configuration without creating files or identities | -| `--registry ` | `https://registry.auths.dev` | Registry URL for identity registration [env: AUTHS_REGISTRY_URL=] | +| `--registry ` | — | Registry URL for identity registration [env: AUTHS_REGISTRY_URL=] | | `--register` | — | Register identity with the Auths Registry after creation | | `--github-action` | — | Scaffold a GitHub Actions workflow using the auths attest-action | | `--device-count ` | `1` | Number of device slots for a multi-key KEL (default 1) | diff --git a/docs/getting-started/sharing-your-identity.md b/docs/getting-started/sharing-your-identity.md index 34ad752d0..f2803c6b2 100644 --- a/docs/getting-started/sharing-your-identity.md +++ b/docs/getting-started/sharing-your-identity.md @@ -74,9 +74,10 @@ with GitHub, and publishes a signed proof (a GitHub Gist). auths id register ``` -publishes your identity document to a registry so others can discover it by DID. The -default registry (`https://registry.auths.dev`) is not yet live — registration is -**opt-in** (`auths init --register`) and nothing is published during normal setup. +publishes your identity document to a registry so others can discover it by DID. +There is no default registry — registration is **opt-in** (`auths init --register`) +and nothing is published during normal setup. Point `--registry` at our public +registry (`https://network.auths.dev`) or one you run yourself. Until the registry ships, bundles and the committed `.auths/roots` file are the supported sharing mechanisms. diff --git a/docs/guides/identity/profiles.md b/docs/guides/identity/profiles.md index 2aace1b07..9aa239c9e 100644 --- a/docs/guides/identity/profiles.md +++ b/docs/guides/identity/profiles.md @@ -51,7 +51,7 @@ auths init --profile developer --non-interactive --key-alias my-key | `--key-alias` | `main` | Alias for the identity key | | `--force` | `false` | Overwrite existing identity | | `--non-interactive` | `false` | Skip all prompts, use defaults | -| `--registry` | `https://registry.auths.dev` | Registry URL for identity registration (registry not yet live) | +| `--registry` | `—` | Registry URL for identity registration (no default; e.g. `https://network.auths.dev`) | | `--register` | `false` | Register identity with the Auths Registry | ### CI profile diff --git a/docs/guides/platforms/github-claims.md b/docs/guides/platforms/github-claims.md index 70766d4d8..2ad1e16b7 100644 --- a/docs/guides/platforms/github-claims.md +++ b/docs/guides/platforms/github-claims.md @@ -39,7 +39,7 @@ Platform claim indexed: github @ -> did:keri:E... ### Custom registry URL -By default, claims are submitted to `https://registry.auths.dev` (the public registry is not yet live). To use a different registry: +Claims are submitted to the registry you pass with `--registry` — there is no default. Point it at our public registry (`https://network.auths.dev`) or one you run yourself: ```bash auths id claim github --registry https://your-registry.example.com diff --git a/docs/sdk/rust/identity-operations.md b/docs/sdk/rust/identity-operations.md index 3b037894a..3fc4f7af1 100644 --- a/docs/sdk/rust/identity-operations.md +++ b/docs/sdk/rust/identity-operations.md @@ -68,7 +68,7 @@ let config = DeveloperSetupConfig::builder(KeyAlias::new("work-laptop")?) }) .with_git_signing_scope(GitSigningScope::Global) .with_conflict_policy(IdentityConflictPolicy::ReuseExisting) - .with_registration("https://registry.auths.dev") + .with_registration("https://network.auths.dev") .with_witness_config(witness_cfg) .with_metadata(serde_json::json!({"team": "platform"})) .with_sign_binary_path(PathBuf::from("/usr/local/bin/auths-sign"))