querysub 0.489.0 → 0.490.0

package/.claude/settings.local.json

@@ -25,7 +25,10 @@
       "mcp__node-debugger__removeBreakpoint",
       "mcp__hottest__runTest",
       "Bash(yarn test *)",
-      "Bash(yarn ssh-a-claude *)"
+      "Bash(yarn ssh-a-claude *)",
+      "WebSearch",
+      "WebFetch(domain:blog.cloudflare.com)",
+      "WebFetch(domain:developers.cloudflare.com)"
     ]
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "querysub",
-  "version": "0.489.0",
+  "version": "0.490.0",
   "main": "index.js",
   "license": "MIT",
   "note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",
@@ -67,6 +67,7 @@
     "node-forge": "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6",
     "pako": "^2.1.0",
     "peggy": "^5.0.6",
+    "sliftutils": "^1.5.6",
     "socket-function": "^1.1.43",
     "terser": "^5.31.0",
     "typesafecss": "^0.29.0",

package/src/-b-authorities/dnsAuthority.ts

@@ -19,6 +19,26 @@ const DNS_TTLSeconds = {
 
 const DNS_REFRESH_STALE_AFTER = timeInDay;
 
+// We stamp our own "last asserted" time into the record's comment, because Cloudflare's
+//  modified_on can only be moved by an actual content change - and re-asserting an already
+//  correct record has no content change to make (a create errors with 81058, a no-op edit
+//  doesn't bump the timestamp). Reading freshness from text we control sidesteps that entirely,
+//  and lets us refresh a stale-but-correct record in place instead of deleting and recreating it.
+const FRESHNESS_REGEX = /<set on:[^>]*>/;
+
+/** Strips any prior freshness tag and appends a new one, preserving other comment text. */
+function stampFreshness(comment?: string): string {
+    let base = (comment ?? "").replace(FRESHNESS_REGEX, "").trim();
+    let stamp = `<set on: ${new Date().toString()}>`;
+    return base ? `${base} ${stamp}` : stamp;
+}
+/** Parses our tag back out; 0 (i.e. always stale) when it's absent or unparseable. */
+export function freshnessTime(comment?: string): number {
+    let match = FRESHNESS_REGEX.exec(comment ?? "");
+    if (!match) return 0;
+    return new Date(match[0].replace("<set on:", "").replace(">", "").trim()).getTime() || 0;
+}
+
 export const hasDNSWritePermissions = lazy(async () => {
     if (!isNode()) return false;
     if (isClient()) return false;
@@ -56,8 +76,34 @@ export async function getRecordsRaw(type: string, key: string) {
         content: string;
         proxied: boolean;
         modified_on: string;
+        // Omitted by Cloudflare when the record has no comment.
+        comment?: string;
     }[]>(`/zones/${zoneId}/dns_records`);
-    return results.filter(x => x.type === type && x.name === key);
+    // DNS names are case-insensitive and Cloudflare returns them lowercased, so a mixed-case key
+    //  (e.g. a machine id subdomain) would never match an exact-case compare - match lowercased.
+    let keyLower = key.toLowerCase();
+    return results.filter(x => x.type === type && x.name.toLowerCase() === keyLower);
+}
+
+/** Cloudflare's batch endpoint applies deletes, then patches, then posts in a single database
+ *   transaction. We route edits (patches) through here because the standalone PATCH/PUT verbs
+ *   aren't usable in our setup, and because it lets "remove others + assert target" happen
+ *   without a window where the name resolves to nothing. */
+export async function batchRecords(zoneId: string, batch: {
+    deletes?: { id: string }[];
+    patches?: { id: string; comment?: string }[];
+    posts?: { type: string; name: string; content: string; ttl: number; proxied: boolean; comment?: string }[];
+}) {
+    let payload: { [key: string]: unknown } = {};
+    if (batch.deletes && batch.deletes.length > 0) payload.deletes = batch.deletes;
+    if (batch.patches && batch.patches.length > 0) payload.patches = batch.patches;
+    if (batch.posts && batch.posts.length > 0) payload.posts = batch.posts;
+    try {
+        await cloudflarePOSTCall(`/zones/${zoneId}/dns_records/batch`, payload);
+    } catch (error) {
+        console.error(`Error updating DNS records:`, { error: error, batch });
+        throw new Error(`Error updating DNS records. ${JSON.stringify(batch)}. Error: ${error}`);
+    }
 }
 export async function getRecords(type: string, key: string) {
     if (key.endsWith(".")) key = key.slice(0, -1);
@@ -81,35 +127,30 @@ export async function deleteRecord(type: string, key: string, value: string) {
         await cloudflareCall(`/zones/${zoneId}/dns_records/${value.id}`, Buffer.from([]), "DELETE");
     }
 }
-/** Removes all existing records (unless the record is already present) */
-export async function setRecord(type: string, key: string, value: string, proxied?: "proxied") {
-    let stack = new Error();
+/** Removes all existing records (unless the record is already present and fresh) */
+export async function setRecord(type: string, key: string, value: string, proxied?: "proxied", staleAfter = DNS_REFRESH_STALE_AFTER) {
     if (key.endsWith(".")) key = key.slice(0, -1);
     let zoneId = await getZoneId(getRootDomain(key));
     let prevValues = await getRecordsRaw(type, key);
-    // NOTE: Apparently if we try to update by just changing proxied, cloudflare complains and
-    //  says "an identical record already exists", even though it doesn't, we changed the proxied value...
-    let alreadyExisted = prevValues.some(x => x.content === value);
-    if (alreadyExisted && Date.now() - new Date(prevValues.find(x => x.content === value)!.modified_on).getTime() < DNS_REFRESH_STALE_AFTER) return;
+    let existing = prevValues.find(x => x.content === value);
+    let others = prevValues.filter(x => x.content !== value);
 
-    console.log(magenta(`Removing previous records of ${type} for ${key} ${JSON.stringify(prevValues.map(x => x.content))}`));
-    let didDeletions = false;
-    for (let value of prevValues) {
-        didDeletions = true;
-        await cloudflareCall(`/zones/${zoneId}/dns_records/${value.id}`, Buffer.from([]), "DELETE");
-    }
+    // Already correct and recently asserted - a prior run also cleaned up the other records,
+    //  so there is nothing left to do.
+    if (existing && Date.now() - freshnessTime(existing.comment) < staleAfter) return;
 
+    // A single atomic batch: drop the wrong records, and either refresh the existing record's
+    //  comment in place or create it - so the name is never left resolving to nothing.
+    let ttl = DNS_TTLSeconds[type as "A"] || 60;
+    let comment = stampFreshness(existing?.comment);
     console.log(magenta(`Setting ${type} record for ${key} to ${value} (previously had ${JSON.stringify(prevValues.map(x => x.content))})`));
-    const ttl = DNS_TTLSeconds[type as "A"] || 60;
-    await cloudflarePOSTCall(`/zones/${zoneId}/dns_records`, {
-        type: type,
-        name: key,
-        content: value,
-        ttl,
-        proxied: proxied === "proxied",
+    await batchRecords(zoneId, {
+        deletes: others.map(x => ({ id: x.id })),
+        patches: existing ? [{ id: existing.id, comment }] : [],
+        posts: existing ? [] : [{ type, name: key, content: value, ttl, proxied: proxied === "proxied", comment }],
     });
-    if (!alreadyExisted) {
-        // NOTE: Apparently... even if the record didn't exist, we still have to wait...
+    // Only a brand new record needs to propagate; an in-place comment refresh doesn't change the answer.
+    if (!existing) {
         console.log(`Waiting ${ttl} seconds for DNS to propagate...`);
         for (let ttlLeft = ttl; ttlLeft > 0; ttlLeft--) {
             await delay(1000);
@@ -119,29 +160,26 @@ export async function setRecord(type: string, key: string, value: string, proxie
     }
 }
 /** Keeps existing records */
-export async function addRecord(type: string, key: string, value: string, proxied?: "proxied") {
+export async function addRecord(type: string, key: string, value: string, proxied?: "proxied", staleAfter = DNS_REFRESH_STALE_AFTER) {
     if (key.endsWith(".")) key = key.slice(0, -1);
     let zoneId = await getZoneId(getRootDomain(key));
     let prevValues = await getRecordsRaw(type, key);
-    // NOTE: Apparently if we try to update by just changing proxied, cloudflare complains and
-    //  says "an identical record already exists", even though it doesn't, we changed the proxied value...
-    let alreadyExisted = prevValues.some(x => x.content === value);
-    if (alreadyExisted && Date.now() - new Date(prevValues.find(x => x.content === value)!.modified_on).getTime() < DNS_REFRESH_STALE_AFTER) return;
+    let existing = prevValues.find(x => x.content === value);
+    if (existing && Date.now() - freshnessTime(existing.comment) < staleAfter) return;
+
+    // Same single-batch flow as setRecord, minus the deletes (we keep sibling records here).
+    let ttl = DNS_TTLSeconds[type as "A"] || 60;
+    let comment = stampFreshness(existing?.comment);
     console.log(`Adding ${type} record for ${key} to ${value} (previously had ${JSON.stringify(prevValues.map(x => x.content))})`);
-    const ttl = DNS_TTLSeconds[type as "A"] || 60;
-    await cloudflarePOSTCall(`/zones/${zoneId}/dns_records`, {
-        type: type,
-        name: key,
-        content: value,
-        ttl,
-        proxied: proxied === "proxied",
+    await batchRecords(zoneId, {
+        patches: existing ? [{ id: existing.id, comment }] : [],
+        posts: existing ? [] : [{ type, name: key, content: value, ttl, proxied: proxied === "proxied", comment }],
     });
-    if (!alreadyExisted) {
-        console.log(`Waiting ${ttl} seconds for DNS to propagate...`);
-        for (let ttlLeft = ttl; ttlLeft > 0; ttlLeft--) {
-            await delay(1000);
-            console.log(`${ttlLeft} seconds left...`);
-        }
-        console.log(`Done waiting for DNS to update.`);
+    if (existing) return;
+    console.log(`Waiting ${ttl} seconds for DNS to propagate...`);
+    for (let ttlLeft = ttl; ttlLeft > 0; ttlLeft--) {
+        await delay(1000);
+        console.log(`${ttlLeft} seconds left...`);
     }
+    console.log(`Done waiting for DNS to update.`);
 }

package/src/-c-identity/IdentityController.ts

@@ -9,7 +9,7 @@ import { SocketFunction } from "socket-function/SocketFunction";
 import { CallerContext } from "socket-function/SocketFunctionTypes";
 import { cache, cacheWeak, lazy } from "socket-function/src/caching";
 import { getClientNodeId, getNodeId, getNodeIdDomain, getNodeIdIP, getNodeIdLocation, isClientNodeId } from "socket-function/src/nodeCache";
-import { decodeNodeId, getCommonName, getIdentityCA, getMachineId, getOwnMachineId, getPublicIdentifier, getThreadKeyCert, parseCert, sign, validateCertificate, verify } from "../-a-auth/certs";
+import { decodeNodeId, getCommonName, getIdentityCA, getMachineId, getOwnMachineId, getPublicIdentifier, getThreadKeyCert, parseCert, sign, validateCertificate, verify } from "sliftutils/misc/https/certs";
 import { getShortNumber } from "socket-function/src/bits";
 import { measureBlock, measureFnc, measureWrap } from "socket-function/src/profiling/measure";
 import { timeoutToError } from "../errors";
@@ -21,6 +21,7 @@ import { isNode } from "typesafecss";
 import { areNodeIdsEqual, getOwnNodeId, getOwnThreadId } from "../-f-node-discovery/NodeDiscovery";
 import { timeInMinute } from "socket-function/src/misc";
 import { isClient, isServer } from "../config2";
+import { getDomain } from "../config";
 
 // NOTE: This used to be small, but we cache this, so it would mean a node on startup would time out, and then we would refuse to talk to it ever again. So... this can't be small
 const MAX_CHANGE_IDENTITY_TIMEOUT = timeInMinute * 5;
@@ -81,7 +82,7 @@ export function debugNodeId(nodeId: string) {
 
 export function debugNodeThread(nodeId: string) {
     nodeId = debugNodeId(nodeId);
-    return decodeNodeId(nodeId)?.threadId || nodeId;
+    return decodeNodeId(nodeId, getDomain())?.threadId || nodeId;
 }
 
 /** Gets the nodeId of the machine, which should be consistent. When deciding to trust a node
@@ -91,7 +92,7 @@ export function debugNodeThread(nodeId: string) {
 export function IdentityController_getMachineId(callerContext: CallerContext, allowEmpty?: "allowEmpty"): string {
     let location = getNodeIdLocation(callerContext.nodeId);
     if (location) {
-        return getMachineId(location.address);
+        return getMachineId(location.address, getDomain());
     }
     let info = callerInfo.get(callerContext);
     if (!info) {
@@ -114,7 +115,7 @@ export function IdentityController_getPubKeyShort(callerContext: CallerContext):
     return info.pubKeyShort;
 }
 export const IdentityController_getOwnPubKeyShort = lazy((): number => {
-    let cert = getThreadKeyCert();
+    let cert = getThreadKeyCert(getDomain());
     let pubKey = getPublicIdentifier(cert.cert);
     return getShortNumber(pubKey);
 });
@@ -159,11 +160,11 @@ class IdentityControllerBase {
         }
         // If they're calling from the browser, then they're not going to be able to use our machine ID, etc. However, they should be calling an actual https node, so it should still be secure for them. 
         if (payload.clientIsNode) {
-            let calledMachineId = getMachineId(payload.serverId);
-            if (calledMachineId !== "127-0-0-1" && calledMachineId !== getOwnMachineId()) {
-                throw new Error(`Tried to call a different machine. We are ${getOwnMachineId()}, they called ${calledMachineId}`);
+            let calledMachineId = getMachineId(payload.serverId, getDomain());
+            if (calledMachineId !== "127-0-0-1" && calledMachineId !== getOwnMachineId(getDomain())) {
+                throw new Error(`Tried to call a different machine. We are ${getOwnMachineId(getDomain())}, they called ${calledMachineId}`);
             }
-            let calledThreadId = decodeNodeId(payload.serverId)?.threadId;
+            let calledThreadId = decodeNodeId(payload.serverId, getDomain())?.threadId;
             if (calledThreadId && calledThreadId !== "127-0-0-1" && calledThreadId !== getOwnThreadId()) {
                 throw new Error(`Tried to call a different thread. We are ${getOwnThreadId()}, they called ${calledThreadId}`);
             }
@@ -174,7 +175,7 @@ class IdentityControllerBase {
         verify(payload.cert, signature, payload);
 
         // Verify we even trust the issuer/cert pair
-        validateCertificate(payload.cert, payload.certIssuer);
+        validateCertificate(getDomain(), payload.cert, payload.certIssuer);
 
         let reconnectNodeId: string | undefined;
         if (payload.mountedPort) {
@@ -185,7 +186,7 @@ class IdentityControllerBase {
         }
 
         let pubKey = getPublicIdentifier(payload.cert);
-        let machineId = getMachineId(getCommonName(payload.certIssuer));
+        let machineId = getMachineId(getCommonName(payload.certIssuer), getDomain());
 
         callerInfo.set(caller, {
             cert: { certPEM: payload.cert, issuerPEM: payload.certIssuer },
@@ -232,8 +233,8 @@ const IdentityController = SocketFunction.register(
 // IMPORTANT! We need to cache per connection, not per nodeId, so caching based on connectionId is required!
 const changeIdentityOnce = cacheWeak(async function changeIdentityOnce(connectionId: { nodeId: string }) {
     let nodeId = connectionId.nodeId;
-    let threadKeyCert = getThreadKeyCert();
-    let issuer = getIdentityCA();
+    let threadKeyCert = getThreadKeyCert(getDomain());
+    let issuer = getIdentityCA(getDomain());
     let payload: ChangeIdentityPayload = {
         time: Date.now(),
         serverId: nodeId,

package/src/-d-trust/NetworkTrust2.ts

@@ -1,5 +1,5 @@
 import { measureWrap } from "socket-function/src/profiling/measure";
-import { getIdentityCA, getMachineId, getOwnMachineId } from "../-a-auth/certs";
+import { getIdentityCA, getMachineId, getOwnMachineId } from "sliftutils/misc/https/certs";
 import { getArchives } from "../-a-archives/archives";
 import { isNode, throttleFunction, timeInHour, timeInSecond } from "socket-function/src/misc";
 import { SocketFunctionHook } from "socket-function/SocketFunctionTypes";
@@ -93,7 +93,7 @@ let populateTrustedCache = lazy(async () => {
         trustedCache.add(trustedMachineId);
     }
     // Always trust ourself
-    trustedCache.add(getOwnMachineId());
+    trustedCache.add(getOwnMachineId(getDomain()));
 
     // NOTE: This only happens to servers that we connect to. Also we only allow the machine ID to be this special ID in the case it's on our domain. And because we use HTTPS when connecting to domains, it means that it must be implicitly trusted if it has a certificate for our domain.
     trustedCache.add("127-0-0-1");
@@ -107,7 +107,7 @@ let populateTrustedCache = lazy(async () => {
 export async function isNodeTrusted(nodeId: string) {
     let domainName = getNodeIdDomainMaybeUndefined(nodeId);
     if (!domainName) return false;
-    let machineId = getMachineId(domainName);
+    let machineId = getMachineId(domainName, getDomain());
     return await isTrusted(machineId);
 }
 
@@ -124,8 +124,8 @@ const loadServerCert = cache(async (machineId: string) => {
 });
 
 export const ensureWeAreTrusted = lazy(measureWrap(async () => {
-    let machineKeyCert = getIdentityCA();
-    let machineId = getOwnMachineId();
+    let machineKeyCert = getIdentityCA(getDomain());
+    let machineId = getOwnMachineId(getDomain());
     if (!await archives().get(machineId)) {
         await archives().set(machineId, machineKeyCert.cert);
     }
@@ -134,7 +134,7 @@ export const ensureWeAreTrusted = lazy(measureWrap(async () => {
 async function loadTrustCerts(nodeId: string) {
     let location = getNodeIdLocation(nodeId);
     if (location) {
-        let machineId = getMachineId(location.address);
+        let machineId = getMachineId(location.address, getDomain());
         let isTrustedBool = await isTrusted(machineId);
         if (isTrustedBool) {
             await loadServerCert(machineId);

package/src/-e-certs/EdgeCertController.ts

@@ -11,7 +11,7 @@
 
 import { SocketFunction } from "socket-function/SocketFunction";
 import { lazy } from "socket-function/src/caching";
-import { createX509, generateKeyPair, getMachineId, getOwnMachineId, getThreadKeyCert, parseCert } from "../-a-auth/certs";
+import { createX509, generateKeyPair, getMachineId, getOwnMachineId, getThreadKeyCert, parseCert } from "sliftutils/misc/https/certs";
 import { backoffRetryLoop, logErrors } from "../errors";
 import { getHTTPSKeyCert } from "./certAuthority";
 import { getControllerNodeId } from "../-g-core-values/NodeCapabilities";
@@ -57,8 +57,8 @@ export async function getSNICerts(config: {
         [getDomain()]: async (callback) => {
             await EdgeCertController_watchHTTPSKeyCert(callback);
         },
-        [getOwnMachineId() + "." + getDomain()]: async (callback) => {
-            let threadCert = await getThreadKeyCert();
+        [getOwnMachineId(getDomain()) + "." + getDomain()]: async (callback) => {
+            let threadCert = await getThreadKeyCert(getDomain());
             callback({
                 key: threadCert.key,
                 cert: threadCert.cert,
@@ -121,7 +121,7 @@ async function EdgeCertController_watchHTTPSKeyCert(
 export async function publishMachineARecords() {
     let ip = await getHostedIP();
 
-    let machineAddress = getOwnMachineId() + "." + getDomain();
+    let machineAddress = getOwnMachineId(getDomain()) + "." + getDomain();
 
     let prevMachineIP = await getRecords("A", machineAddress);
     let ipDomain = await getIPDomain();

package/src/-e-certs/certAuthority.ts

@@ -1,5 +1,5 @@
 import acme from "acme-client";
-import { generateRSAKeyPair, parseCert, privateKeyToPem } from "../-a-auth/certs";
+import { generateRSAKeyPair, parseCert, privateKeyToPem } from "sliftutils/misc/https/certs";
 import { cache, lazy } from "socket-function/src/caching";
 import { hasDNSWritePermissions, setRecord } from "../-b-authorities/dnsAuthority";
 import { magenta } from "socket-function/src/formatting/logColors";

package/src/-f-node-discovery/NodeDiscovery.ts

@@ -14,12 +14,12 @@ import { PromiseObj } from "../promise";
 import { formatDateTime } from "socket-function/src/formatting/format";
 import { isClient, isServer } from "../config2";
 import { waitForFirstTimeSync } from "socket-function/time/trueTimeShim";
-import { decodeNodeId, decodeNodeIdAssert } from "../-a-auth/certs";
+import { decodeNodeId, decodeNodeIdAssert } from "sliftutils/misc/https/certs";
 
 import { isDefined } from "../misc";
 import { getBootedEdgeNode } from "../-0-hooks/hooks";
 import { EdgeNodeConfig } from "../4-deploy/edgeNodes";
-import * as certs from "../-a-auth/certs";
+import * as certs from "sliftutils/misc/https/certs";
 import { logDisk } from "../diagnostics/logs/diskLogger";
 import { MaybePromise } from "socket-function/src/types";
 import { getPathStr2 } from "../path";
@@ -69,9 +69,9 @@ export function isNodeDiscoveryLogging() {
 
 function getAlternateNodeIds(nodeId: string): MaybePromise<string[] | undefined> {
     // IMPORTANT! NEVER allow for reconnection of client ids. A lot of code depends on the fact that clients will reconnect with a new client node id when they disconnect!
-    let machineId = certs.getMachineId(nodeId);
+    let machineId = certs.getMachineId(nodeId, getDomain());
     if (machineId === getOwnMachineId()) {
-        let decoded = decodeNodeId(nodeId);
+        let decoded = decodeNodeId(nodeId, getDomain());
         if (decoded) {
             return [
                 "127-0-0-1." + decoded.domain + ":" + decoded.port
@@ -105,10 +105,10 @@ export function getOwnNodeIdAssert(): string {
 }
 
 export const getOwnThreadId = lazy(() => {
-    return certs.getOwnThreadId();
+    return certs.getOwnThreadId(getDomain());
 });
 export const getOwnMachineId = lazy(() => {
-    return certs.getOwnMachineId();
+    return certs.getOwnMachineId(getDomain());
 });
 
 export function isOwnNodeId(nodeId: string): boolean {
@@ -119,8 +119,8 @@ export function isOwnNodeId(nodeId: string): boolean {
         return true;
     }
     // If it's 127.0.0.1, and on the same port as us, it is us.
-    let obj = decodeNodeId(nodeId);
-    if (obj && obj.domain === "127-0-0-1." + getDomain() && obj.port === decodeNodeId(getOwnNodeId())?.port) {
+    let obj = decodeNodeId(nodeId, getDomain());
+    if (obj && obj.domain === "127-0-0-1." + getDomain() && obj.port === decodeNodeId(getOwnNodeId(), getDomain())?.port) {
         return true;
     }
 
@@ -128,7 +128,7 @@ export function isOwnNodeId(nodeId: string): boolean {
 }
 
 export function isNodeIdOnOwnMachineId(nodeId: string): boolean {
-    return certs.getMachineId(nodeId) === getOwnMachineId() || decodeNodeId(nodeId)?.machineId === "127-0-0-1";
+    return certs.getMachineId(nodeId, getDomain()) === getOwnMachineId() || decodeNodeId(nodeId, getDomain())?.machineId === "127-0-0-1";
 }
 
 export function areNodeIdsEqual(lhs: string, rhs: string): boolean {
@@ -303,7 +303,7 @@ async function clearDeadThreadsFromArchives() {
     let nodes = await archives().find("");
 
     function getPortHash(nodeId: string) {
-        let obj = decodeNodeId(nodeId);
+        let obj = decodeNodeId(nodeId, getDomain());
         if (!obj) return undefined;
         return getPathStr2(obj.machineId, obj.port + "");
     }

package/src/-g-core-values/NodeCapabilities.ts

@@ -15,9 +15,10 @@ import type { DebugFunctionShardInfo } from "../3-path-functions/PathFunctionRun
 import type { AuthoritySpec } from "../0-path-value-core/PathRouter";
 import { requiresNetworkTrustHook } from "../-d-trust/NetworkTrust2";
 import { isNoNetwork } from "../config";
+import { getDomain } from "../config";
 import { getDebuggerUrl } from "../diagnostics/listenOnDebugger";
 import { hackDevtoolsWebsocketForward } from "./oneTimeForward";
-import { getOwnMachineId, decodeNodeId, decodeNodeIdAssert, getMachineId } from "../-a-auth/certs";
+import { getOwnMachineId, decodeNodeId, decodeNodeIdAssert, getMachineId } from "sliftutils/misc/https/certs";
 import { sort } from "socket-function/src/misc";
 import { getPathStr2 } from "../path";
 import { PromiseObj } from "../promise";
@@ -98,7 +99,7 @@ export async function getControllerNodeIdList(
         if (result) {
             let metadata = await NodeCapabilitiesController.nodes[nodeId].getMetadata();
             passedNodeIds.set(nodeId, {
-                machineId: getMachineId(nodeId),
+                machineId: getMachineId(nodeId, getDomain()),
                 entryPoint: metadata.entryPoint,
             });
         }
@@ -109,7 +110,7 @@ export async function getControllerNodeIdList(
     sort(results, (x) => isNodeIdOnOwnMachineId(x[0]) ? 0 : 1);
     let lookup = new Map<string, { nodeId: string; entryPoint: string }>();
     for (let x of results) {
-        let key = getPathStr2(x[1].machineId, decodeNodeIdAssert(x[0]).port.toString());
+        let key = getPathStr2(x[1].machineId, decodeNodeIdAssert(x[0], getDomain()).port.toString());
         if (key in lookup) continue;
         lookup.set(key, { nodeId: x[0], entryPoint: x[1].entryPoint });
     }

package/src/-h-path-value-serialize/PathValueSerializer.ts

@@ -12,7 +12,8 @@ import { setFlag } from "socket-function/require/compileFlags";
 
 import cbor from "cbor-x";
 import { atomicObjectWrite, atomicObjectWriteNoFreeze, doAtomicWrites } from "../2-proxy/PathValueProxyWatcher";
-import { getOwnThreadId } from "../-a-auth/certs";
+import { getOwnThreadId } from "sliftutils/misc/https/certs";
+import { getDomain } from "../config";
 
 const LAZY_INSTANCE_MARKER = Symbol("PathValueSerializer.lazyInstance");
 import { formatNumber, formatPercent, formatTime } from "socket-function/src/formatting/format";
@@ -997,7 +998,7 @@ class PathValueSerializer {
         let lazyInstance: { [k: string]: unknown } = {
             call_PathValueSerializer_getPathValue_toGetThisValue: true,
             lazyCreatedAt: Date.now(),
-            lazyCreatedByThreadId: getOwnThreadId(),
+            lazyCreatedByThreadId: getOwnThreadId(getDomain()),
         };
         lazyInstance[LAZY_INSTANCE_MARKER as unknown as string] = true;
         this.lazyValues.set(lazyInstance, buf);
@@ -1009,7 +1010,7 @@ class PathValueSerializer {
         let hasMarker = !!value && (value as { [k: symbol]: unknown })[LAZY_INSTANCE_MARKER] === true;
         let createdAt = value && value.lazyCreatedAt;
         let createdBy = value && value.lazyCreatedByThreadId;
-        return `Path: ${pathValue.path}, time: ${JSON.stringify(pathValue.time)}, currentThreadId: ${getOwnThreadId()}, hasSymbolMarker: ${hasMarker}, lazyCreatedAt: ${createdAt}, lazyCreatedByThreadId: ${createdBy}`;
+        return `Path: ${pathValue.path}, time: ${JSON.stringify(pathValue.time)}, currentThreadId: ${getOwnThreadId(getDomain())}, hasSymbolMarker: ${hasMarker}, lazyCreatedAt: ${createdAt}, lazyCreatedByThreadId: ${createdBy}`;
     }
 
     public getPathValue(pathValue: PathValue | undefined, noMutate?: "noMutate"): unknown {

package/src/0-path-value-core/PathValueCommitter.ts

@@ -17,7 +17,8 @@ import { isClient } from "../config2";
 import { auditLog, isDebugLogEnabled } from "./auditLogs";
 import { AuthorityEntry, authorityLookup } from "./AuthorityLookup";
 import { debugNodeId } from "../-c-identity/IdentityController";
-import { decodeNodeId } from "../-a-auth/certs";
+import { decodeNodeId } from "sliftutils/misc/https/certs";
+import { getDomain } from "../config";
 import { decodeParentFilter, encodeParentFilter } from "./hackedPackedPathParentFiltering";
 import { deepCloneCborx } from "../misc/cloneHelpers";
 import { removeRange } from "../rangeMath";
@@ -352,9 +353,9 @@ class PathValueCommitter {
                                         timeId: value?.time.time,
                                         source: value?.source,
                                         sourceNodeId: debugNodeId(batch.sourceNodeId),
-                                        sourceNodeThreadId: decodeNodeId(batch.sourceNodeId)?.threadId,
+                                        sourceNodeThreadId: decodeNodeId(batch.sourceNodeId, getDomain())?.threadId,
                                         watchingAuthorityId: debugNodeId(watchingAuthorityId),
-                                        watchingAuthorityNodeThreadId: decodeNodeId(watchingAuthorityId)?.threadId,
+                                        watchingAuthorityNodeThreadId: decodeNodeId(watchingAuthorityId, getDomain())?.threadId,
                                         isTransparent: value?.isTransparent,
                                     });
                                 }
@@ -390,7 +391,7 @@ class PathValueCommitter {
                             console.warn(`Ignoring parent path which we aren't watching. From ${debugNodeId(batch.sourceNodeId)}.`, {
                                 parentPath,
                                 sourceNodeId: debugNodeId(batch.sourceNodeId),
-                                sourceNodeThreadId: decodeNodeId(batch.sourceNodeId)?.threadId,
+                                sourceNodeThreadId: decodeNodeId(batch.sourceNodeId, getDomain())?.threadId,
                             });
                             batch.initialTriggers.parentPaths.delete(parentPath);
                         }

package/src/0-path-value-core/PathValueController.ts

@@ -9,8 +9,8 @@ import { pathValueSerializer } from "../-h-path-value-serialize/PathValueSeriali
 import { pathValueCommitter } from "./PathValueCommitter";
 import { auditLog, isDebugLogEnabled } from "./auditLogs";
 import { debugNodeId, debugNodeThread } from "../-c-identity/IdentityController";
-import { getSlowdown, isDiskAudit } from "../config";
-import { decodeNodeId } from "../-a-auth/certs";
+import { getSlowdown, isDiskAudit, getDomain } from "../config";
+import { decodeNodeId } from "sliftutils/misc/https/certs";
 import { areNodeIdsEqual, isOwnNodeId } from "../-f-node-discovery/NodeDiscovery";
 import { getNodeIdIP } from "socket-function/src/nodeCache";
 import { authorityLookup } from "./AuthorityLookup";
@@ -160,7 +160,7 @@ export class PathValueControllerBase {
                         path: value.path,
                         timeId: value.time.time,
                         sourceNodeId,
-                        sourceNodeThreadId: decodeNodeId(sourceNodeId)?.threadId,
+                        sourceNodeThreadId: decodeNodeId(sourceNodeId, getDomain())?.threadId,
                         totalValueCount: values.length,
                     });
                 }
@@ -179,7 +179,7 @@ export class PathValueControllerBase {
                     timeId: value.time.time,
                     timeIdVersion: value.time.version,
                     sourceNodeId,
-                    sourceNodeThreadId: decodeNodeId(sourceNodeId)?.threadId,
+                    sourceNodeThreadId: decodeNodeId(sourceNodeId, getDomain())?.threadId,
                     isValid: value.valid,
                 });
             }

package/src/0-path-value-core/archiveLocks/ArchiveLocks2.ts

@@ -1,6 +1,6 @@
 import { list, sort, timeInDay, timeInHour, timeInMinute, timeInSecond } from "socket-function/src/misc";
 import { MaybePromise } from "socket-function/src/types";
-import { decodeNodeId } from "../../-a-auth/certs";
+import { decodeNodeId } from "sliftutils/misc/https/certs";
 import { getOwnNodeId, getOwnNodeIdAssert } from "../../-f-node-discovery/NodeDiscovery";
 import { pathValueArchives } from "../pathValueArchives";
 import { ArchiveLocker, ArchiveTransaction } from "./ArchiveLocks";
@@ -8,7 +8,7 @@ import { Archives } from "../../-a-archives/archives";
 import debugbreak from "debugbreak";
 import { formatNumber, formatTime } from "socket-function/src/formatting/format";
 import { blue, green, magenta, red } from "socket-function/src/formatting/logColors";
-import { devDebugbreak } from "../../config";
+import { devDebugbreak, getDomain } from "../../config";
 import { logErrors } from "../../errors";
 import { saveSnapshot } from "./archiveSnapshots";
 import { getNodeId } from "socket-function/src/nodeCache";
@@ -395,7 +395,7 @@ class TransactionLocker {
             if (text.length <= length) return text;
             return text.slice(0, length - 3) + "...";
         }
-        let niceThreadId = decodeNodeId(getOwnNodeIdAssert())?.threadId.slice(0, 4) || "unknown";
+        let niceThreadId = decodeNodeId(getOwnNodeIdAssert(), getDomain())?.threadId.slice(0, 4) || "unknown";
         function debugFileInfo(file: string) {
             let obj = pathValueArchives.decodeDataPath(file);
             if (!obj.seqNum) {

package/src/0-path-value-core/pathValueArchives.ts

@@ -8,9 +8,9 @@ import { pathValueSerializer } from "../-h-path-value-serialize/PathValueSeriali
 import debugbreak from "debugbreak";
 import { formatNumber, formatTime } from "socket-function/src/formatting/format";
 import { list } from "socket-function/src/misc";
-import { NodeIdParts, decodeNodeId, decodeNodeIdAssert, encodeNodeId } from "../-a-auth/certs";
+import { NodeIdParts, decodeNodeId, decodeNodeIdAssert, encodeNodeId } from "sliftutils/misc/https/certs";
 import { createArchiveLocker2 } from "./archiveLocks/ArchiveLocks2";
-import { devDebugbreak, isNoNetwork } from "../config";
+import { devDebugbreak, isNoNetwork, getDomain } from "../config";
 import { wrapArchivesWithCache } from "../-a-archives/archiveCache";
 import { AuthoritySpec, PathRouter, debugSpec } from "./PathRouter";
 import { authorityLookup } from "./AuthorityLookup";
@@ -86,7 +86,7 @@ export class PathValueArchives {
         let parts = fileName.split("_");
         if (parts[0] !== "data") return defaultDecodedValuePath(dataPath);
         let nodeId = parts[1];
-        let decodedNodeId = decodeNodeId(nodeId);
+        let decodedNodeId = decodeNodeId(nodeId, getDomain());
         if (!decodedNodeId) return defaultDecodedValuePath(dataPath);
         let time = +parts[2] || 0;
         let seqNum = +parts[3] || 0;
@@ -111,7 +111,7 @@ export class PathValueArchives {
 
     public getDefaultValuePathInput(): DecodedValuePathInput {
         return {
-            ...decodeNodeIdAssert(getOwnNodeIdAssert()),
+            ...decodeNodeIdAssert(getOwnNodeIdAssert(), getDomain()),
             time: Date.now(),
             seqNum: this.nextWriteSeqNum++,
             valueCount: 0,

package/src/0-path-value-core/pathValueCore.ts

@@ -27,7 +27,9 @@ import { decodeParentFilter, filterChildPathsBase } from "./hackedPackedPathPare
 import { isDiskAudit } from "../config";
 import { removeRange } from "../rangeMath";
 import { remoteWatcher } from "../1-path-client/RemoteWatcher";
+import { setFlag } from "socket-function/require/compileFlags";
 import { sha256 } from "js-sha256";
+setFlag(require, "js-sha256", "allowclient", true);
 import { evaluateValidStates, isServer } from "../config2";
 
 setImmediate(async () => {