Repository navigation
refactor(widget): harden ids, values and type escape hatches - #612
Open
petar-omni wants to merge 8 commits into
Open
petar-omni wants to merge 8 commits into
petar-omni wants to merge 8 commits into
Conversation
Decoded ids, keys, hashes and amounts were widened back to string or number in helpers, feature state and service interfaces, so mixing id kinds or renaming a literal compiled silently. - Replace the ValidatorKey alias with EarnValidatorKey. This fixes subnet validators never showing as selected in the pending-action modal. - Carry BalanceDataKey from position routes and init params through the position-details flow and the positions resource. - Keep borrow ActionId, TransactionId, MarketId, IntegrationId and TokenAddress through API operations, flow state and activity lookups. - Classify borrow action and workflow transaction statuses exhaustively; decode init params pendingaction and validator to their domain types. - Type the dashboard page key and yield flow route group as tab | WidgetPath. - Add TransactionHash, WalletSignature, SignedTransactionPayload, DirectTransactionId and BorrowPositionActionKey brands, and remove the casts between them. - Decode confidential balance shares, fees, entry limits, TVL and price per share to exact values; a malformed field drops only itself.
Casts, non-null assertions and optional keys set to undefined let values bypass the branded types the previous change introduced. - Enable Biome noUnsafeTypeAssertion for widget src, noNonNullAssertion, exhaustive switches, promise misuse rules, and tsconfig noImplicitReturns and exactOptionalPropertyTypes. Remaining assertions are single-line suppressions at third-party library seams. - Add the no-unbranded-domain-identifier ast-grep rule: id-like domain fields must use a brand or literal union. - Type token helpers from Token, WalletScopeOwner.address as WalletAddress, yield-id predicates as YieldId, EVM RPC chain ids as EvmChainIds, and wallet routing ids honestly instead of strings disguised as numbers. - Add ContractAddress and WalletConnect topic, CAIP chain and account brands; the route registry alone mints WidgetPath. - Check tracking properties per event and page at compile time. - Host config: an unknown network key or malformed entry in validatorsConfig, preferredTokenYieldsPerNetwork, chainIconMapping or yieldProviderOrder drops only that entry with a warning. Public types for these settings are keyed by network.
Trans passes a link's URL to SKAnchor as an array of text children, so the string-only fallback added with the assertion ban produced href="" in the help modal and Terms links. Join the text children instead.
|
|
Important Review skippedToo many files! This PR contains 387 files, which is 237 over the limit of 150. To get a review, reduce the PR to 150 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to Team to raise the limit. Usage-priced reviews support at most 300 files.
 |
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
The non-null cleanup moved worker construction into a named arrow inside page.evaluate. tsx compiles named functions to `__name(...)`, which the browser page does not define, so the production consumer smoke failed.
cipher-base and hash-base, pulled in by the Solana and Cardano wallet
adapters through crypto-browserify, read require('stream').Transform at
load. Vite externalized stream, so dev logged a warning per package and
the hash classes lost their Transform base. Polyfill stream alongside
buffer and crypto.
Logging every tracked event and page view to the console is noise by default; enable it from the panel when needed.
Effect 4.0.7 (with the .repos/effect pin), @effect/tsgo 0.63, Biome 2.6.3, Angular build/cli 22.2.4, Vite 8.3.5, wagmi 3.7.9, viem 2.57.11, Next 16.4.3, react-router 8.5, motion 14.6, i18next, knip, dependency-cruiser, jscpd, ledger wallet API and Zama SDK patches; mise v2026.10.19 in CI. Biome 2.6 formats markdown and adds noComponentHookFactories: exclude the release-please CHANGELOG, and turn the rule off since Effect tag matchers read as nested components. Its React Compiler check ignores "use no memo", so the opted-out virtual lists carry a targeted suppression. The new tsgo build types the spied startViewTransition as callback-only; the test mock now declares both accepted forms. Held: cosmjs, cosmjs-types, chain-registry (cosmos-kit 2.18), universal-provider (appkit pin), oxc-transform-react (plugin-react peer), @solana/web3.js 3, TypeScript 7 (Angular peer), @meshsdk/wallet 2 beta, and Node 24 and pnpm 12.15 (newer releases are under the 3-day age gate).
petar-omni
force-pushed
the
refactor/type-hardening
branch
2 times, most recently
from
October 29, 2026 14:02
22ffd68 to
8f2cf78
Compare
Bump Effect to 4.1.0 (with the .repos/effect pin) and @tanstack/react-virtual to 3.14.23. Declare @types/node (^24.19.2, matching the Node 24 toolchain) in the widget and the Vite and Angular examples so peers no longer auto-install a different major. devEngines.packageManager made pnpm record a version in pnpm-lock.yaml (12.14.0) and switch to it, overriding the 12.15.0 mise pins locally and in CI. Drop devEngines and the stale package-manager lock document; the README and AGENTS.md already make mise the source of the pnpm version.
petar-omni
force-pushed
the
refactor/type-hardening
branch
from
October 29, 2026 14:32
8f2cf78 to
93cf2ee
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Decoded ids, keys, hashes and amounts no longer get widened back to
string/number, and the escape hatches that bypassed them (as,!,undefinedin optional keys) are now lint/compile errors.229
srccasts → 0, except 11 single-line suppressions, each naming the library constraint (wagmi ×4, Solana adapter ×2, cosmos-kit, viem, EffectAtom.transform, React lazy wrapper ×2).Evidence
SelectValidatorchecksselected.has(item.key); subnet validators (address:subnetId) never appeared selected.After:
position-details-action-model.test.ts› "selects subnet validators by key and submits their addresses" — red, then green.{ validatorsConfig: { etheruem: … } }silently never applied; a bad entry value rejected the whole host config.After:
widget-config-boundary.test.ts(9 new) — unknown key / malformed entry dropped with a warning, rest of config applies.balanceId,pendingactionand borrow position action key.After:
widget-routes.test.tsandparam-validation.dom.test.tsxreject values outside the grammar.After:
earn-models.test.ts(8 new) — only that field drops.Module "stream" has been externalized … Cannot access "stream.Transform"twice.After: same load, no warning; wallet connectors still initialise.
pnpm --versionin the repo → 12.14.0 (mise launched 12.15.0).After: 12.15.0;
pnpm install --frozen-lockfilepasses.pnpm check: lint, hygiene, 224 unit / 50 dom / 42 browser test files, builds — all pass.pnpm test:smoke: Vite package/bundle, Next.js, Angular hosts pass.Merge Danger
Door: two-way
Revertable; no persisted-data or API-contract migrations.
Blast Radius: host-config
validatorsConfig,preferredTokenYieldsPerNetwork,chainIconMappingare now network-keyed partial records; TypeScript hosts using arbitrary string keys get a compile error.SKTxMetaonly widened.schemaRawTransaction; non-hex direct-tx / permit / unwrap values.hash: nullinstead of showing the signed payload as a hash.tvlRaw(base units shown as token units).yieldLabelDtowas always null) and its EN/FR strings.streampolyfill in the wallet-connector chunks.npm installand non-mise pnpm are no longer blocked bydevEngines.