edge-core-js 2.47.0 → 2.48.0

package/lib/util/nym.js

@@ -1,27 +1,37 @@
 import {
   createMixFetch,
-  disconnectMixTunnel,
+  disconnectMixFetch,
 
-} from '@nymproject/mix-fetch'
 
 
+} from '@nymproject/mix-fetch'
 
-/** The fetch-bound function `createMixFetch` resolves to. */
 
 
 /**
- * Configuration options for the NYM mixFetch tunnel.
+ * Configuration options for the NYM mixFetch client.
  */
 export const mixFetchOptions = {
   clientId: 'edge-core-js-2026-03-10',
+  preferredGateway: '5rXcNe2a44vXisK3uqLHCzpzvEwcnsijDMU7hg4fcYk8', // with WSS
+  preferredNetworkRequester:
+    '5x6q9UfVHs5AohKMUqeivj7a556kVVy7QwoKige8xHxh.6CFoB3kJaDbYz6oafPJxNxNjzahpT2NtgtytcSyN9EvF@5rXcNe2a44vXisK3uqLHCzpzvEwcnsijDMU7hg4fcYk8',
   forceTls: true, // force WSS
-  // Mixnet round trips are slow, so give the tunnel handshake plenty of time.
-  // v1 tuned a 5 min `requestTimeoutMs`; v2 exposes no per-request timeout, but
-  // the tunnel setup is where mixnet latency bites, so restore that 5 min
-  // budget here to avoid premature failures during the handshake.
-  connectTimeoutMs: 300000
+  mixFetchOverride: {
+    requestTimeoutMs: 300000
+  }
 }
 
+/**
+ * Budget for `createMixFetch` itself (client start + gateway handshake).
+ *
+ * A healthy setup with the pinned gateway completes in under 10s measured.
+ * Without a bound here the whole app blocks on the first mixnet request for
+ * as long as a dead gateway keeps us waiting, which reads to the user as a
+ * freeze.
+ */
+const SETUP_TIMEOUT_MS = 60000
+
 // MixFetch initialization state
 let mixFetchInitPromise = null
 
@@ -32,22 +42,44 @@ let mixFetchInitPromise = null
 export async function initMixFetch(log) {
   if (mixFetchInitPromise == null) {
     log('Initializing mixFetch...')
-    mixFetchInitPromise = createMixFetch(mixFetchOptions)
-      .then(mixFetch => {
+    const pending = createMixFetch(mixFetchOptions)
+    // The timeout below can abandon this setup while it is still in flight.
+    // Deliberately do NOT tear it down on late completion: `createMixFetch`
+    // resolves to a healthy global singleton, and disconnecting it (a
+    // process-wide operation) would race a newer init that has taken over.
+    // A late completion just repopulates `__mixFetchGlobal`, which the next
+    // init reuses. Swallow a late rejection so it is not unhandled.
+    pending.catch(() => {})
+    let timer
+    const timeout = new Promise((resolve, reject) => {
+      timer = setTimeout(() => {
+        reject(
+          new Error(`mixFetch setup timed out after ${SETUP_TIMEOUT_MS}ms`)
+        )
+      }, SETUP_TIMEOUT_MS)
+    })
+    mixFetchInitPromise = Promise.race([pending, timeout])
+      .then(mixFetchModule => {
         log('mixFetch initialized successfully')
-        return mixFetch
+        return mixFetchModule
       })
       .catch(async error => {
-        // Tear down any partially-established tunnel left by the failed init
-        // so the next createMixFetch call starts fresh instead of reusing a
+        // Clean up stale global state left by the failed init so the
+        // next createMixFetch call starts fresh instead of reusing a
         // broken singleton.
         try {
-          await disconnectMixTunnel()
+          await disconnectMixFetch()
         } catch (e) {}
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+        delete (window ).__mixFetchGlobal
         mixFetchInitPromise = null
         log.error('mixFetch initialization failed:', error)
         throw error
       })
+      .finally(() => {
+        clearTimeout(timer)
+      })
   }
-  return await mixFetchInitPromise
+  const mixFetchModule = await mixFetchInitPromise
+  return mixFetchModule.mixFetch
 }

package/lib/util/validateServer.js

@@ -1,11 +1,13 @@
 /**
- * We only accept *.edge.app or localhost as valid domain names.
+ * We only accept *.edge.app, localhost, or (for http/ws only) private LAN IPv4.
+ * https/wss still require localhost or *.edge(test)?.app; private IPs are not
+ * accepted on secure schemes.
  */
 export function validateServer(server) {
   const url = new URL(server)
 
   if (url.protocol === 'http:' || url.protocol === 'ws:') {
-    if (url.hostname === 'localhost') return
+    if (isPrivateHost(url.hostname)) return
   }
   if (url.protocol === 'https:' || url.protocol === 'wss:') {
     if (url.hostname === 'localhost') return
@@ -13,6 +15,34 @@ export function validateServer(server) {
   }
 
   throw new Error(
-    `Only *.edge.app or localhost are valid login domain names, not ${url.hostname}`
+    `Only *.edge.app, localhost, or private LAN addresses (http/ws) are valid login domain names, not ${url.hostname}`
   )
 }
+
+function isPrivateHost(hostname) {
+  if (hostname === 'localhost') return true
+  const octets = parseIpv4(hostname)
+  if (octets == null) return false
+  const [a, b] = octets
+  if (a === 127) return true
+  if (a === 10) return true
+  if (a === 192 && b === 168) return true
+  if (a === 172 && b >= 16 && b <= 31) return true
+  return false
+}
+
+function parseIpv4(hostname) {
+  const parts = hostname.split('.')
+  if (parts.length !== 4) return null
+  const octets = []
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null
+    const n = Number(part)
+    if (!Number.isInteger(n) || n < 0 || n > 255) return null
+    // Reject leading zeros like 010.0.0.1 which are not canonical dotted-quad
+    // when they reach this helper (URL parsing may already rewrite some forms).
+    if (part.length > 1 && part.startsWith('0')) return null
+    octets.push(n)
+  }
+  return octets 
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edge-core-js",
-  "version": "2.47.0",
+  "version": "2.48.0",
   "description": "Edge account & wallet management library",
   "keywords": [
     "bitcoin",
@@ -78,7 +78,7 @@
     "*.{js,jsx,ts,tsx}": "eslint"
   },
   "dependencies": {
-    "@nymproject/mix-fetch": "^2.0.0",
+    "@nymproject/mix-fetch": "^1.4.4",
     "aes-js": "^3.1.0",
     "base-x": "^4.0.1",
     "biggystring": "^4.2.3",

package/src/types/types.ts

@@ -2172,6 +2172,13 @@ export interface EdgeContext {
   readonly changeLogSettings: (
     settings: Partial<EdgeLogSettings>
   ) => Promise<void>
+
+  /**
+   * Supplies the latest device attestation token for login-server requests.
+   * Pass `undefined` or `''` to clear the header. Only subsequent login-server
+   * requests pick up the new value.
+   */
+  readonly setAttestationToken: (token: string | undefined) => Promise<void>
 }
 
 // ---------------------------------------------------------------------
@@ -2194,8 +2201,8 @@ export interface EdgeFakeContextOptions {
   logSettings?: Partial<EdgeLogSettings>
   plugins?: EdgeCorePluginsInit
 
-  // Allows core plugins to access the real network except for the
-  // login and sync servers, which remain emulated:
+  // Allows core plugins to access the real network except for login, info,
+  // and sync servers, which remain emulated:
   allowNetworkAccess?: boolean
 
   // Fake device options: