refactor: earn flow + remove xstate/store by petar-omni · Pull Request #551 · stakekit/widget

petar-omni · 2026-06-26T23:13:26Z

Note

High Risk
Large new DeFi borrow path with wallet signing, transaction submission, and LTV validation touches money-moving flows; earn routing/state refactor could regress staking if mis-wired.

Overview
Adds a feature-flagged borrow experience in the dashboard (form → review → steps → complete, plus borrow position management), backed by a new borrow module: Effect Schema domain models, OpenAPI-generated BorrowApi client, and @effect/atom-react atoms for markets/positions, form state, action execution (sign/submit/confirm), and post-tx cache refresh.

Earn flow cleanup: drops EarnPageStateUsageBoundaryProvider / @xstate/store, removes common/get-token-balances.ts and getInitialToken from stake types, and tightens validator handling via a composite Validator.key (address + optional subnet) used in select-validator and position balance keys.

Tooling/config: OpenAPI generator gains BorrowApi (full httpclient + spec prep), optional CLI spec selection, VITE_BORROW_API_URL / VITE_FORCE_BORROW, and root pnpm.patchedDependencies removed; adds skeleton line/circle loaders for borrow UI loading states.

^{Reviewed by Cursor Bugbot for commit 6cf3187. Configure here.}

changeset-bot · 2026-06-26T23:13:30Z

⚠️ No Changeset found

Latest commit: 2e4493d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-06-26T23:13:34Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f2d2a83c-e736-49e8-b48f-3041b4042c82

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/earn-effect-atom-poc

_{Comment @coderabbitai help to get the list of available commands.}

aws-amplify-eu-central-1 · 2026-06-26T23:15:52Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.d2ribjy8evqo6h.amplifyapp.com

aws-amplify-eu-central-1 · 2026-06-26T23:16:01Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.df4xyoi0xyeak.amplifyapp.com

Key validators by address and subnet so selection keeps distinct validator options. Scope balance and init token options to the selected dashboard category.

cursor

Stale comment

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, Cursor Security Agent left an unresolved medium-severity finding, and required checks did not finish on the latest commit (Bugbot cancelled; Security Agent still running). Assigned jdomingos and dnehl for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

dnehl

Played around with the flow - looks good.

no console errors
no "strange" multiple backend calls
duration looks good

Split earn intent and view atoms so route and wallet state changes update the resolved view. Keep dispatch separate from view reads and add wallet resolution handling. Cover dashboard tab selection and patch Effect parent tracking.

Use the native TypeScript 7 compiler across the widget and examples. Keep TypeScript 6 API compatibility for Next.js tooling.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Replace legacy context, query, and state-machine integrations with Effect services and atom-backed wallet, API, and workflow state. Split Vitest projects and add AST rules to validate the new architecture.

Use the active i18n locale via widget presentation so NumberInput accepts and displays decimal and grouping separators without guessing.

Prevent the catch-all handler from silently returning 204 for unknown external requests. Add explicit no-content responses for observed asset and telemetry endpoints. Make missing API mocks surface as diagnostic 500 responses.

Treat passive claimable and points balances as informational unless an actual pending action exists. Keep claim rewards distinct, preserve the actions pane, and redirect unavailable unstake routes.

Upgrade Effect to beta.102 and patch AtomRegistry so nodes invalidated while building still rebuild in the same batch. Normalize OpenAPI union objects during generation and reject empty Struct members that make Schema.Union ambiguous for transaction payloads.

Navigate Disabled fixed batches to Complete, project Activity complete views as nullable, and clear abandoned sessions only after navigation succeeds so failed abandons remain retryable.

Replace Borrow-specific flow outcomes with application-scoped WidgetDomainEvents. Started facts reset entry intents; Ended facts invalidate authoritative resources asynchronously.

Immediate invalidation alone can miss delayed indexer updates. Start owner-bound Post-Transaction Reconciliation that re-invalidates balances and positions at fixed intervals, canceling on disconnect or owner change.

…-poc

Project Yield API outputToken options into Earn models and enable receive-token selection for Sky Savings Rate exits. Forward the chosen token through the Exit Action Argument Contract and show it on classic Exit Review.

Narrow widget containers cramped activity rows when amounts stayed visible. Hide amounts under 400px and drop the unavailable yield via fallback so the list stays readable.

cursor

Stale comment

cursor · 2026-08-05T13:14:48Z

          npm publish "./$PACKAGE_DIR"
+
+  canary:
+    if: github.event_name == 'workflow_dispatch'


🔒 Agentic Security Review
Severity: HIGH

The canary release job is gated only by workflow_dispatch and publishes from ${{ github.sha }} without enforcing a trusted ref (for example main or a protected release tag). That means workflow-dispatch authority can publish branch-selected code to the official canary package channel.

Impact: A compromised or over-privileged dispatcher could publish unreviewed or malicious artifacts under @stakekit/widget, creating a supply-chain risk for canary consumers.

^{Reviewed by Cursor Security Reviewer for commit b4d2f9f. Configure here.}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Actions with empty, address-like, or missing token symbols no longer fall back to "Unknown token". Filter them from the activity list so users only see items with a usable token label.

cursor

Stale comment

cursor · 2026-08-05T13:53:49Z

+
+  return (url: string) => {
+    trackEvent("viewTxClicked");
+    window.open(url, "_blank");


🔒 Agentic Security Review
Severity: MEDIUM

window.open(url, "_blank") is called on a transaction URL without opener isolation or URL validation. If this URL is attacker-controlled (directly or via compromised upstream metadata), the opened page can retain window.opener access and redirect the original trusted tab.

Impact: This enables reverse-tabnabbing/phishing flow hijack during a wallet-sensitive user journey.

^{Reviewed by Cursor Security Reviewer for commit 73852cc. Configure here.}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Unstake USD previously reflected the full position balance. Scale it from the entered exit amount so partial exits show the correct value.

Tighten the form pane gap and increase spacing within amount and details sections for clearer visual hierarchy.

Proxy to the widget package so `pnpm dev` works from the monorepo root.

Raise pinned toolchain versions to Node 24.19.0, npm 11.19.0, and pnpm 11.19.0 so local and CI tooling stay on current releases.

The legacy price API serializes native tokens with an undefined address key, while local token identity uses an empty one. Fall back to the legacy key so USD amounts format correctly for native tokens.

Introduce a tabbed position-details hub and extract AmountTokenSection so stake and unstake share one amount card instead of drifting apart.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Hide the CTA for empty yield lists only when connected, so disconnected users can still connect instead of seeing no primary action.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). No new reviewers assigned; two reviewers are already requested for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Align classic and dashboard unstake on one shared section with a footer CTA, and select the receive token from the amount accessory like enter/stake instead of a separate dropdown.

Pending actions can require validator selection while the position has nothing to unstake, so rendering the modal inside the unstake section hid it. Render it alongside the whole surface on both classic and dashboard instead.

cursor

Risk: high. Not approving: Cursor Security Agent did not reach a terminal state within the polling window, and this large earn/borrow refactor exceeds the low-risk approval threshold. No new reviewers assigned; two reviewers are already requested for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

petar-omni added 2 commits June 27, 2026 01:10

feat(widget): add effect atom earn flow

8f6710c

refactor(widget): replace xstate stores with effect atoms

15d72af

fix(widget): stabilize earn option resolution

3127f0d

Key validators by address and subnet so selection keeps distinct validator options. Scope balance and init token options to the selected dashboard category.

petar-omni marked this pull request as ready for review July 7, 2026 12:22

Philippoes previously approved these changes Jul 7, 2026

View reviewed changes

cursor Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread packages/widget/src/features/borrow-transaction-flow/ui/complete.tsx

feat: borrow init

5dac944

petar-omni dismissed Philippoes’s stale review via 5dac944 July 7, 2026 12:27

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 6cf3187 to 5dac944 Compare July 7, 2026 12:27

petar-omni requested a review from Philippoes July 7, 2026 12:27

Philippoes previously approved these changes Jul 7, 2026

View reviewed changes

feat: temp

2110846

petar-omni dismissed Philippoes’s stale review via 2110846 July 7, 2026 12:31

cursor Bot requested a review from dnehl July 7, 2026 12:31

cursor Bot reviewed Jul 7, 2026

View reviewed changes

cursor Bot requested a review from jdomingos July 7, 2026 12:31

cursor Bot reviewed Jul 7, 2026

View reviewed changes

dnehl previously approved these changes Jul 7, 2026

View reviewed changes

dnehl self-requested a review July 7, 2026 14:11

petar-omni added 3 commits July 9, 2026 16:56

fix(widget): stabilize earn atom subscriptions

90a2b21

Split earn intent and view atoms so route and wallet state changes update the resolved view. Keep dispatch separate from view reads and add wallet resolution handling. Cover dashboard tab selection and patch Effect parent tracking.

feat: schema decoding, query to atoms migration

b2043f0

build(typescript): migrate to typescript 7

3c5bfdc

Use the native TypeScript 7 compiler across the widget and examples. Keep TypeScript 6 API compatibility for Next.js tooling.

petar-omni dismissed dnehl’s stale review via 16d2bb4 July 14, 2026 23:49

cursor Bot reviewed Jul 14, 2026

View reviewed changes

refactor(widget): migrate runtime state to effect atoms

67eb76f

Replace legacy context, query, and state-machine integrations with Effect services and atom-backed wallet, API, and workflow state. Split Vitest projects and add AST rules to validate the new architecture.

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 16d2bb4 to 67eb76f Compare July 15, 2026 08:42

petar-omni added 11 commits August 3, 2026 13:26

feat(widget): localize number input parsing and formatting

0020817

Use the active i18n locale via widget presentation so NumberInput accepts and displays decimal and grouping separators without guessing.

test(widget): tighten external request mocks

0f5bc15

Prevent the catch-all handler from silently returning 204 for unknown external requests. Add explicit no-content responses for observed asset and telemetry endpoints. Make missing API mocks surface as diagnostic 500 responses.

fix(widget): align position actions with pending state

32f2aec

Treat passive claimable and points balances as informational unless an actual pending action exists. Keep claim rewards distinct, preserve the actions pane, and redirect unavailable unstake routes.

fix(widget): harden classic activity completion and abandon

e06b9a0

Navigate Disabled fixed batches to Complete, project Activity complete views as nullable, and clear abandoned sessions only after navigation succeeds so failed abandons remain retryable.

feat(widget): project transaction workflow lifecycle via domain events

d514aab

Replace Borrow-specific flow outcomes with application-scoped WidgetDomainEvents. Started facts reset entry intents; Ended facts invalidate authoritative resources asynchronously.

feat(widget): reconcile balances after transaction workflow ends

82bf264

Immediate invalidation alone can miss delayed indexer updates. Start owner-bound Post-Transaction Reconciliation that re-invalidates balances and positions at fixed intervals, canceling on disconnect or owner change.

fix(widget): make unobserved atoms transient

c471693

Merge remote-tracking branch 'origin/main' into feat/earn-effect-atom…

1010b93

…-poc

feat(widget): let position details select exit receive token

891bfe0

Project Yield API outputToken options into Earn models and enable receive-token selection for Sky Savings Rate exits. Forward the chosen token through the Exit Action Argument Contract and show it on classic Exit Review.

fix(widget): hide activity amounts in narrow widget layout

b4d2f9f

Narrow widget containers cramped activity rows when amounts stayed visible. Hide amounts under 400px and drop the unavailable yield via fallback so the list stays readable.

cursor Bot reviewed Aug 5, 2026

View reviewed changes

fix(widget): hide activity actions without readable tokens

73852cc

Actions with empty, address-like, or missing token symbols no longer fall back to "Unknown token". Filter them from the activity list so users only see items with a usable token label.

cursor Bot reviewed Aug 5, 2026

View reviewed changes

petar-omni added 6 commits August 6, 2026 15:25

fix(widget): format partial exit USD from entered amount

fdce137

Unstake USD previously reflected the full position balance. Scale it from the entered exit amount so partial exits show the correct value.

style(borrow): adjust borrow entry form spacing

f5c3048

Tighten the form pane gap and increase spacing within amount and details sections for clearer visual hierarchy.

chore: add root pnpm dev script

c797aa9

Proxy to the widget package so `pnpm dev` works from the monorepo root.

chore: bump node, npm, and pnpm via mise

1905d40

Raise pinned toolchain versions to Node 24.19.0, npm 11.19.0, and pnpm 11.19.0 so local and CI tooling stay on current releases.

fix(widget): resolve native token prices from legacy API keys

3bf4b1e

The legacy price API serializes native tokens with an undefined address key, while local token identity uses an empty one. Fall back to the legacy key so USD amounts format correctly for native tokens.

feat(widget): unify position details stake and unstake amount UI

16be725

Introduce a tabbed position-details hub and extract AmountTokenSection so stake and unstake share one amount card instead of drifting apart.

cursor Bot reviewed Aug 6, 2026

View reviewed changes

feat: force dash + borrow

d106876

cursor Bot reviewed Aug 6, 2026

View reviewed changes

fix(yield-entry): show connect wallet when token has no yields

d2c633a

Hide the CTA for empty yield lists only when connected, so disconnected users can still connect instead of seeing no primary action.

cursor Bot reviewed Aug 6, 2026

View reviewed changes

petar-omni added 2 commits August 7, 2026 13:20

feat(position-details): move exit receive token into amount chip

9f6abbf

Align classic and dashboard unstake on one shared section with a footer CTA, and select the receive token from the amount accessory like enter/stake instead of a separate dropdown.

cursor Bot reviewed Aug 7, 2026

View reviewed changes

Uh oh!

Conversation

petar-omni commented Jun 26, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Jun 26, 2026

Review skipped

Uh oh!

aws-amplify-eu-central-1 Bot commented Jun 26, 2026

Uh oh!

aws-amplify-eu-central-1 Bot commented Jun 26, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dnehl left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

petar-omni commented Jun 26, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented Jun 26, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

dnehl left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading