querysub 0.490.0 → 0.491.0

package/.claude/settings.local.json

@@ -28,7 +28,8 @@
       "Bash(yarn ssh-a-claude *)",
       "WebSearch",
       "WebFetch(domain:blog.cloudflare.com)",
-      "WebFetch(domain:developers.cloudflare.com)"
+      "WebFetch(domain:developers.cloudflare.com)",
+      "PowerShell(yarn type *)"
     ]
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "querysub",
-  "version": "0.490.0",
+  "version": "0.491.0",
   "main": "index.js",
   "license": "MIT",
   "note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",

package/src/-e-certs/certAuthority.ts

@@ -1,5 +1,6 @@
 import acme from "acme-client";
-import { generateRSAKeyPair, parseCert, privateKeyToPem } from "sliftutils/misc/https/certs";
+import crypto from "crypto";
+import { parseCert } from "sliftutils/misc/https/certs";
 import { cache, lazy } from "socket-function/src/caching";
 import { hasDNSWritePermissions, setRecord } from "../-b-authorities/dnsAuthority";
 import { magenta } from "socket-function/src/formatting/logColors";
@@ -13,6 +14,8 @@ import { timeInMinute } from "socket-function/src/misc";
 const archives = lazy(() => getArchives(`https_certs_3/`));
 // Expire EXPIRATION_THRESHOLD% of the way through the certificate's lifetime
 const EXPIRATION_THRESHOLD = 0.4;
+// Let's Encrypt only accepts RSA or ECDSA account keys (not Ed25519, which is all sliftutils/certs generates).
+const ACCOUNT_KEY_MODULUS_BITS = 2048;
 
 export const getHTTPSKeyCert = cache(async (domain: string): Promise<{ key: string; cert: string }> => {
     if (!await hasDNSWritePermissions()) {
@@ -112,13 +115,20 @@ let getAccountKey: () => string = lazy(() => {
     let keyCache = accountKeyCache.value;
     if (!keyCache) {
         console.log(`Generating new letsencrypt account key`);
-        const keyPair = generateRSAKeyPair();
-        keyCache = { key: privateKeyToPem(keyPair.privateKey) };
+        keyCache = { key: generateRSAPrivateKeyPem() };
         accountKeyCache.value = keyCache;
     }
     return keyCache.key;
 });
 
+function generateRSAPrivateKeyPem(): string {
+    return crypto.generateKeyPairSync("rsa", {
+        modulusLength: ACCOUNT_KEY_MODULUS_BITS,
+        publicKeyEncoding: { type: "spki", format: "pem" },
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    }).privateKey;
+}
+
 async function generateCert(config: {
     accountKey: string;
     domain: string;

package/src/4-querysub/Querysub.ts

@@ -906,7 +906,7 @@ export class Querysub {
             globalThis.remapImportRequestsClientside = globalThis.remapImportRequestsClientside || [];
             globalThis.remapImportRequestsClientside.push(async (args) => {
                 try {
-                    let key: typeof identityStorageKey = "machineCA_11";
+                    let key: typeof identityStorageKey = "machineCA_14";
                     let storageValueJSON = localStorage.getItem(key);
                     if (!storageValueJSON) return args;
                     let storageValue = JSON.parse(storageValueJSON) as IdentityStorageType;

package/tsconfig.json

@@ -18,10 +18,23 @@
         "types": [
             "node",
         ],
+        "paths": {
+            "socket-function": [
+                "./node_modules/socket-function"
+            ],
+            "socket-function/*": [
+                "./node_modules/socket-function/*"
+            ]
+        },
         "experimentalDecorators": true,
         "emitDecoratorMetadata": false,
         "skipLibCheck": true,
         "inlineSourceMap": true,
         "inlineSources": true,
-    }
+    },
+    "exclude": [
+        "node_modules",
+        "database-storage",
+        "sliftutils"
+    ]
 }