fix: align DEVICE_PREFIX with CLI storage layout (refs/auths/keys)

The widget used a stale ref prefix (refs/auths/devices/nodes) that no
longer matches the CLI's StorageLayoutConfig::default(). This caused
widget verification to return an empty attestation chain.

Author: bordumb

src/resolvers/gitea.ts

@@ -13,7 +13,7 @@ import { didKeyToPublicKeyHex } from './did-utils';
 
 // Git ref constants — mirrors auths-id/src/storage/layout.rs
 const IDENTITY_REF = 'refs/auths/identity';
-const DEVICE_PREFIX = 'refs/auths/devices/nodes';
+const DEVICE_PREFIX = 'refs/auths/keys';
 const IDENTITY_BLOB = 'identity.json';
 const ATTESTATION_BLOB = 'attestation.json';
 

src/resolvers/github.ts

@@ -16,7 +16,7 @@ import { didKeyToPublicKeyHex, sanitizeDidForRef } from './did-utils';
 
 // Git ref constants — mirrors auths-id/src/storage/layout.rs
 const IDENTITY_REF = 'refs/auths/identity';
-const DEVICE_PREFIX = 'refs/auths/devices/nodes';
+const DEVICE_PREFIX = 'refs/auths/keys';
 const IDENTITY_BLOB = 'identity.json';
 const ATTESTATION_BLOB = 'attestation.json';
 
@@ -103,7 +103,7 @@ export const githubAdapter: ForgeAdapter = {
 
       for (const deviceRef of deviceRefs) {
         // Only process refs that end with a blob-bearing path
-        // Device ref pattern: refs/auths/devices/nodes/<sanitized_did>/signatures
+        // Device ref pattern: refs/auths/keys/<sanitized_did>/signatures
         try {
           const attestBlob = await resolveTreeBlob(
             config,

tests/resolvers/gitea.test.ts

@@ -74,7 +74,7 @@ describe('giteaAdapter', () => {
     global.fetch = mockFetch({
       'git/refs/auths': [
         { ref: 'refs/auths/identity', object: { sha: 'commit1' } },
-        { ref: 'refs/auths/devices/nodes/dev1/signatures', object: { sha: 'commit2' } },
+        { ref: 'refs/auths/keys/dev1/signatures', object: { sha: 'commit2' } },
       ],
       'git/commits/commit1': { tree: { sha: 'tree1' } },
       'git/trees/tree1': {

tests/resolvers/github.test.ts

@@ -39,7 +39,7 @@ describe('githubAdapter', () => {
     global.fetch = mockFetch({
       'matching-refs/auths/': [
         { ref: 'refs/auths/identity', object: { sha: 'abc123' } },
-        { ref: 'refs/auths/devices/nodes/dev1/signatures', object: { sha: 'def456' } },
+        { ref: 'refs/auths/keys/dev1/signatures', object: { sha: 'def456' } },
       ],
     });
 
@@ -72,7 +72,7 @@ describe('githubAdapter', () => {
     global.fetch = mockFetch({
       'matching-refs/auths/': [
         { ref: 'refs/auths/identity', object: { sha: 'commit1' } },
-        { ref: 'refs/auths/devices/nodes/dev1/signatures', object: { sha: 'commit2' } },
+        { ref: 'refs/auths/keys/dev1/signatures', object: { sha: 'commit2' } },
       ],
       'git/commits/commit1': { tree: { sha: 'tree1' } },
       'git/trees/tree1': {
@@ -106,7 +106,7 @@ describe('githubAdapter', () => {
   it('should return error when identity ref is missing', async () => {
     global.fetch = mockFetch({
       'matching-refs/auths/': [
-        { ref: 'refs/auths/devices/nodes/dev1', object: { sha: 'abc' } },
+        { ref: 'refs/auths/keys/dev1', object: { sha: 'abc' } },
       ],
     });