durt2 1.10.1

durt2: ^1.10.1 copied to clipboard

• call CryptoUtils.useMacosKeychainService('<bundle id>') before any secret is touched (default durt2), and never rename it afterwards: the login Keychain finds an item by (service, account);
• call CryptoUtils.migrateLegacySecretFiles([...]) once at startup on macOS, with the paths of the old files most recent location first. It moves every entry (the .tmp siblings included), reads each one back, destroys the files lowest priority first, and returns a LegacySecretFileReport; on a store failure it throws SecureStorageException and leaves every file where it was, so the next launch tries again. A file naming another master key than the one in use (the Keychain's, or the most recent file's) is a conflict: nothing of it is imported or destroyed, filesConflicting names it and report.unresolved is true, as it is for an unreadable file; read that flag and tell the user, the secrets are still on disk;
• CryptoUtils.setMacosSecureStoragePath and CryptoUtils.secureStorage are removed (the breaking part), and so is the biometric enrollment migration from the raw Keychain plugin to the file. A macOS install that enrolled biometrics with a build older than that migration re-enrols once with the PIN.
• CryptoUtils.masterKey() refuses to generate a key while a migration failed or left a file unresolved in the process (the files still hold the real one), and rejects a stored key that is not 32 bytes.

Runtime API calls are now capped and retried instead of being fired all at once. getBalances sent one state_call per address in a single Future.wait, so scanning 30 derivations meant 30 concurrent runtime API calls. Duniter nodes serve only 4 at a time and answer 4003 too many concurrent runtime API calls to the rest: measured on the public Ğ1 nodes, a burst of 30 lost 12 to 26 calls on g1.gyroi.de, g1.pini.fr and g1.1000i100.fr, while rpc.duniter.org and g1.axiom-team.fr answered all of them. A single rejection made the whole Future.wait fail, which is what broke Ğecko's derivation scan on restore. Every runtime API call now goes through one shared semaphore of 4, sized on that measurement, and a call rejected for overload is retried a couple of times with a short backoff. The semaphore is shared rather than per-call-site because the node's limit applies to the connection: a derivation scan and the balance streams of the open wallets hit the same node together. Errors other than overload, and an exhausted retry budget, still propagate.

Each call also gets a 15 s deadline, which the sharing makes necessary. polkadart's WsProvider.disconnect closes the socket without ever completing the calls still in flight, and durt2 replaces the provider on a node switch or a network change; such a call used to hang forever, penalising only its own caller. Holding a shared slot, four of them would have wedged every balance query in the app behind a semaphore that never frees up again, with no error and no log. The deadline releases the slot and surfaces a TimeoutException the callers already handle.

No query asks an indexer connection for more than it will serve. The combined history requested a thousand universal dividends at once. Dunipod refuses any connection page above 500 and rejects the whole query rather than serving part of it, so every account owning an identity got an HTTP 400 that callers read as "this account has nothing" (gecko#250). Squid was lenient about it, which is why the number went unnoticed until a second indexer implementation appeared. maxConnectionPageSize (500, measured against gtpod.elo.tf: first=500 answers, first=501 is refused) and connectionPageSize() are now applied where a number enters a query, so no call site can bring the default back by forgetting it; both are exported. A caller asking for more than 500 gets 500 instead of an error. Past 500 dividends, roughly sixteen months, the oldest ones fall out of the merged history: the real answer is cursor pagination, which needs the GraphQL bindings regenerated.

Contract change on CesiumPlusService.getProfileByAddress: it can now throw. It used to answer null for three different things, a 404, an unexpected HTTP status, and a network failure, swallowing the last two and only logging them. Callers that re-publish a profile read that null as "this user has no description, no city, no socials" and published those absences, which uploadProfile turns into an explicit erasure: a pod hiccup was enough to wipe a profile remotely, on every device at once. The read now answers three distinct things: the document, null on a 404 (the only case where "absent" is an answer from the pod), and the new CesiumPlusUnavailableException for everything else, including a 200 with no _source, a pod we failed to understand is not an empty profile. Writes inherit the guarantee without changing a line: their existing catch makes them return false without publishing anything. Callers that only want to display a profile must now handle the exception instead of showing "no profile" for an outage.

Squid indexers: SquidClientManager.testEndpoint takes an enforceMinimumVersion flag (default true, so automatic selection keeps the minimumSquidVersion floor). Callers testing an endpoint the user named themselves pass false: the floor no longer refuses a deliberate choice on a version number alone. The sync check (recent block hashes compared with the Duniter node) and the schema probe still run in both cases.

config/squid_endpoints.json: the gtest list carried indexer.duniter.org, which indexes the Ğ1 chain, so the hash check rightly refused it and the two remaining gtest entries answered 502. It is replaced by squid.gtest.bulma.sleoconnect.fr, which follows the ĞTest chain.

• RaceToFirstSuccess.raceWithMinWait gains a real early exit: it returns at first success + minWait (or when every operation settled) instead of waiting for the slowest operation or the global timeout. A dead bootstrap endpoint used to hold the Duniter connection to its own 3s+ timeout. The Duniter race additionally requires a quorum of 2 successful results (minResults) before the window may close, so freshness selection stays comparative: a fast but stale node cannot win unopposed while healthier nodes are still answering. Deliberate trade-off versus the legacy exhaustive wait: the ranking rule is identical (not-syncing, then highest block, then peers, then latency) but the compared sample is the endpoints that answered within the window, no longer every endpoint that answered before the 8s timeout.
• The winning RPC endpoint's test WebSocket is promoted to the real connection (TestResult.provider, kept alive on demand): the second handshake and its re-verification RPCs are gone from the critical path. Losing providers are always disconnected, including late finishers.
• Squid endpoints are validated by ONE combined GraphQL request (EndpointTester.probeSquidEndpoint: reachability + indexer version + schema probe + 5 recent blocks with hashes) instead of up to five sequential queries, and SquidClientManager.init now trusts a single pre-validated endpoint (skipSyncValidation + one endpoint) instead of re-validating the entire endpoint list behind a 15s wait bounded by the slowest endpoint, which could throw away a connection already won.
• SquidConnector is split into prepare() (probe race, needs nothing from Duniter) and finalize() (strict hash sync acceptance): the orchestrator runs the probes IN PARALLEL with the Duniter connection and accepts the best candidate against fresh Duniter blocks with zero extra requests in the nominal case. Strict sync validation, custom-endpoint precedence and the background peering discovery (the wide network view) are unchanged. Because prepare() can now run while the device is still offline, an unreachable user-configured endpoint is NOT cleared there: finalize(), which only runs once Duniter proved the network is up, re-tests it and either honors it or clears it (the decision the legacy flow made in the same network-proven context). Trusted endpoints (user-fixed, local dev) no longer overwrite the discovery fast cache with themselves, so returning to auto-discovery within the cache window cannot re-select the endpoint the user just removed.
• Also fixed on the way: the post-connect storage subscriptions are now awaited inside their guard, so a subscription error is logged instead of surfacing as an unhandled zone error; the fast-endpoint cache stores only endpoints that passed the test (winner first) instead of every tested endpoint including dead ones; the dead legacy ConnectionManager (pre-orchestrator, 1900 lines, imported by nothing) is removed.